18 matches found
Curveball
Curveball A PoC for CVE-2020-0601. A detailed blog post can be found here. This exploit allows you to create a fake trusted certificate by abusing how CryptoAPI handles certain parameters on ECC based certificates. Setup Clone the repository and open it in Visual Studio 2019. Switch to Release an...
-CVE-2020-0601-ECC---EXPLOIT
CurveBall CVE-2020-0601 - ECC/Po2 EXPLOIT CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography ECC is not correctly verified. ECC relies on different parameters. Standardized parameters are used for many...
CVE-2020-0601
CVE-2020-0601 : CurveBall CVE exploitation This ruby script can be used to spoof a legit certificate authority and generat a certificate that will be considered valid for Windows computer affected by the CurveBall vulnerability. You need to get a certificate comming from the certificate authority...
curveball
curveball CVE-2020-0601 curveball - Calculadora de clave alternativa Compilación Windows Visual Studio 2012 o superior, luego compile la solución. Linux / Unix cc altkey.c -lcrypto -o altkey Uso Uso: altkey ecpubliccertificate.pem ecnewprivatekey.pem Ejemplo C:\security\curveball\Releasealtkey...
CurveBall
CurveBall CVE-2020-0601 - PoC CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography ECC is not correctly verified. ECC relies on different parameters. These parameters are standardized for many curves...
meetup-2-curveball
This repository does not have a README...
CurveBall
CurveBall CVE-2020-0601 - PoC CVE-2020-0601: Also known as CurveBall or ChainOffFools, is a vulnerability in the Microsoft CryptoApi specificly in Crypt32.dll where elliptic curve signatures ECDSA of certificates is not correctly verified. There is a very nice blog post here which explains the...
PoC_CurveBall
CVE-2020-0601 - CurveBall Highlights PoC for CVE-2020-0601 Trivial solution for private-key of 1 Non-trivial solution for 1 private-key curve-order Written in C, uses OpenSSL's libcrypto Requirements Linux of some variety apt install libssl libssl-dev Or whatever package mananger you use Compilin...
CVE-2020-0601_PoC
Basado en los POC de https://github.com/ly4k/CurveBall https://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc/ https://github.com/kudelskisecurity/chainoffools?tab=readme-ov-file REQUISITOS/SOFTWARE UTILIZADO python version 3.11 openssl version 3...
curveball-plus
curveball-plus simulation experiment of Curveball CVE-2020-0601 attacks under ECQV implicit certificates with Windows-like verifiers This file is constantly updated!...
Windows10_Cumulative_Updates_PowerShell
Just use this - https://github.com/aaronparker/LatestUpdate Updates everything if ENTERPRISE or EDU Win 10. If PRO only 1809 , 1903 & 1909 are patched. Windows10CumulativeUpdatesPowerShell This powershell script can be ran on a system and will identify if a system is patched for CVE-2020-0601...
CurveBallDetection
CurveBallDetection Resources related to CurveBall CVE-2020-0601 detection. See https://medium.com/zengo/hitting-a-curveball-like-a-pro-129c1dca427c...
Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft Windows CryptoAPI Crypt32.dll contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was fro...
Insecure Access Controls
@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...
Exploit for Improper Certificate Validation in Microsoft
CurveBall CVE-2020-0601 - PoC This vulnerability, known as...
CurveBall – An Unimaginative Pun but a Devastating Bug
ARCHIVED STORY CurveBall – An Unimaginative Pun but a Devastating Bug By Steve Povolny · June 17, 2020 Enterprise customers looking for information on defending against Curveball can find information here. 2020 came in with a bang this year, and it wasn’t from the record-setting number of firewor...
CurveBall – An Unimaginative Pun but a Devastating Bug
ARCHIVED STORY CurveBall – An Unimaginative Pun but a Devastating Bug By Steve Povolny · June 17, 2020 Enterprise customers looking for information on defending against Curveball can find information here. 2020 came in with a bang this year, and it wasn’t from the record-setting number of firewor...