theway

The Way The Way is a tool for unpacking, repacking, and creating malicious Cisco Adaptive Security Device Manager ASDM packages. ASDM is the Java-based administrative GUI for Adaptive Security Appliance ASA systems e.g. firewalls and VPNs. The ASDM package is hosted on the ASA and sub-components...

staystaystay

staystaystay staystaystay는 CVE-2021-1585에 대한 개념 증명 익스플로잇입니다. 이는 Cisco ASA Device ManagerASDM에 영향을 미치는 중간자 공격 또는 악의적 엔드포인트 RCE 문제입니다. 이 문제는 원래 Malcolm Lashley에 의해 발견되어 2021년 여름에 공개되었습니다. 하지만 제가 조사할 당시 최신 버전ASDM 7.171에서 패치되지 않았으며, 저는 이 문제를 독립적으로 발견했습니다. Cisco는 ASDM 7.181.152에서 이를 "수정"했습니다. 제가 "수정"이...

cisco_asa_research

Cisco ASA Research This repository contains slides and code presented at Black Hat USA 2022 and DEF CON 30. The following can be found: Slides DEF CON 30 and Black Hat slide decks. The DEF CON deck is slightly longer due to a longer time slot. theway - a tool for creating malicious/distributable...

EUVD-2014-2166

Malware in sbrugna...

EUVD-2022-25901

Malicious code in bioql PyPI...

CVE-2024-20494

A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition. This...

Cisco ASA ASDM Brute-force Login

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco ASA ASDM Brute-force Login', 'Description' = %q This module scans for the Cisco ASA ASDM landing page and performs login brute-force to...

CVE-2023-5553

CVE-2023-5553 affects Axis OS Secure Boot protection. The AXIS OS tampering-protection bypass is the underlying issue, enabling a sophisticated attack to bypass the device’s tamper protection. Public detail indicates affected AXIS OS ranges include versions 10.8–11.6 (per external summaries), wit...

Cisco ASA-X With FirePOWER Services Authenticated Command Injection Exploit

This Metasploit module exploits an authenticated command injection vulnerability affecting Cisco ASA-X with FirePOWER Services. This exploit is executed through the ASA's ASDM web server and lands in the FirePower Services SFR module's Linux virtual machine as the root user. Access to the virtual...

Cisco ASA-X With FirePOWER Services Authenticated Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco ASA-X with FirePOWER Services Authenticated Command Injection', 'Description' = %q This module exploits an authenticated command injection...

Cisco ASA ASDM Brute-force Login

This module scans for the Cisco ASA ASDM landing page and performs login brute-force to identify valid credentials. Module Options msf use auxiliary/scanner/http/ciscoasaasdmbruteforce msf auxiliaryciscoasaasdmbruteforce show actions ...actions... msf auxiliaryciscoasaasdmbruteforce set ACTION ms...

Metasploit Wrap-Up

Advantech iView NetworkServlet Command Injection This week Shelby Pace has developed a new exploit module for CVE-2022-2143. This module uses an unauthenticated command injection vulnerability to gain remote code execution against vulnerable versions of Advantech iView software below 5.7.04.6469...

Rapid7 Discovered Vulnerabilities in Cisco ASA, ASDM, and FirePOWER Services Software

Rapid7 discovered vulnerabilities and “non-security” issues affecting Cisco Adaptive Security Software ASA, Adaptive Security Device Manager ASDM, and FirePOWER Services Software for ASA. Rapid7 initially reported the issues to Cisco in separate disclosures in February and March 2022. Rapid7 and...

CVE-2022-20829

A vulnerability in the packaging of Cisco Adaptive Security Device Manager ASDM images and the validation of those images by Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious...

CVE-2022-20829 Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution Vulnerability

A vulnerability in the packaging of Cisco Adaptive Security Device Manager ASDM images and the validation of those images by Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious...

CVE-2022-20829

CVE-2022-20829 concerns Cisco ASA Software and ASDM packaging: an authenticated admin can upload a crafted ASDM image to a device running ASA, exploiting insufficient validation of ASDM image authenticity to execute arbitrary code on the target. Exploitation path involves the attacker delivering ...

CVE-2022-20651

A vulnerability in the logging component of Cisco Adaptive Security Device Manager ASDM could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited...

CVE-2022-20651 Cisco Adaptive Security Device Manager Information Disclosure Vulnerability

A vulnerability in the logging component of Cisco Adaptive Security Device Manager ASDM could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited...

CVE-2022-20651

CVE-2022-20651 describes an information-disclosure in the Cisco ASDM logging component. An authenticated, local attacker could access logs on a shared workstation and read unencrypted credentials stored there, leaking other users’ credentials. The issue is tied to how ASDM logs store sensitive da...

Cisco ASA-X with FirePOWER Services Authenticated Command Injection

This module exploits an authenticated command injection vulnerability affecting Cisco ASA-X with FirePOWER Services. This exploit is executed through the ASA's ASDM web server and lands in the FirePower Services SFR module's Linux virtual machine as the root user. Access to the virtual machine...