18 matches found
CVE-2020-0601
CVE-2020-0601 : CurveBall CVE-Ausnutzung Dieses Ruby-Skript kann verwendet werden, um eine legitime Zertifizierungsstelle zu spoofen und ein Zertifikat zu generieren, das auf Windows-Computern, die von der CurveBall-Schwachstelle betroffen sind, als gültig angesehen wird. Sie benötigen ein...
PoC_CurveBall
CVE-2020-0601 - CurveBall Destaques PoC para CVE-2020-0601 Solução trivial para chave privada igual a 1 Solução não trivial para 1 chave-privada ordem-da-curva Escrito em C, usa a libcrypto do OpenSSL Requisitos Linux de alguma variedade apt install libssl libssl-dev Ou qualquer gerenciador de...
CurveBall
CurveBall CVE-2020-0601 - PoC CVE-2020-0601: Conosciuto anche come CurveBall o ChainOffFools, è una vulnerabilità nella Microsoft CryptoApi specificamente in Crypt32.dll in cui le firme a curva ellittica ECDSA dei certificati non vengono verificate correttamente. C'è un ottimo articolo sul blog q...
-CVE-2020-0601-ECC---EXPLOIT
CurveBall CVE-2020-0601 - ECC/Po2 EXPLOIT CVE-2020-0601, allgemein auch als CurveBall bezeichnet, ist eine Schwachstelle, bei der die Signatur von Zertifikaten, die Elliptic-Curve-Kryptografie ECC verwenden, nicht korrekt überprüft wird. ECC stützt sich auf verschiedene Parameter. Für viele Kurve...
CVE-2020-0601_PoC
Baseado no POC de https://github.com/ly4k/CurveBall https://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc/ https://github.com/kudelskisecurity/chainoffools?tab=readme-ov-file REQUISITOS/SOFTWARE UTILIZADO...
CurveBallDetection
CurveBallDetection موارد متعلقة بكشف CurveBall CVE-2020-0601. انظر https://medium.com/zengo/hitting-a-curveball-like-a-pro-129c1dca427c...
curveball
curveball CVE-2020-0601 curveball - Calcolatore di chiavi alternative Compilazione Windows Visual Studio 2012 o successivo, quindi compilare la soluzione. Linux / Unix cc altkey.c -lcrypto -o altkey Utilizzo Utilizzo: altkey ecpubliccertificate.pem ecnewprivatekey.pem Esempio root@kitploit:...
CurveBall
CurveBall CVE-2020-0601 - PoC CVE-2020-0601, o comunemente chiamata CurveBall, è una vulnerabilità in cui la firma dei certificati che utilizzano la crittografia a curva ellittica ECC non viene verificata correttamente. ECC si basa su diversi parametri. Questi parametri sono standardizzati per...
Curveball
Curveball Una PoC per CVE-2020-0601. Un post dettagliato del blog può essere trovato qui. Questo exploit permette di creare un certificato fidato falso sfruttando come CryptoAPI gestisce alcuni parametri sui certificati basati su ECC. Setup Clona il repository e aprilo in Visual Studio 2019. Pass...
meetup-2-curveball
Questo repository non contiene un README...
curveball-plus
curveball-plus esperimento di simulazione degli attacchi Curveball CVE-2020-0601 con certificati impliciti ECQV e verificatori in stile Windows Questo file viene aggiornato costantemente!...
Windows10_Cumulative_Updates_PowerShell
Einfach dies verwenden - https://github.com/aaronparker/LatestUpdate Aktualisiert alles, wenn Windows 10 ENTERPRISE oder EDU ist. Bei PRO werden nur 1809, 1903 & 1909 gepatcht. Windows10CumulativeUpdatesPowerShell Dieses PowerShell-Skript kann auf einem System ausgeführt werden und erkennt, ob ei...
Microsoft Windows CryptoAPI Spoofing Vulnerability
Microsoft Windows CryptoAPI Crypt32.dll contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography ECC certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was fro...
Insecure Access Controls
@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...
Exploit for Improper Certificate Validation in Microsoft
CurveBall CVE-2020-0601 - PoC This vulnerability, known as...
CurveBall – An Unimaginative Pun but a Devastating Bug
ARCHIVED STORY CurveBall – An Unimaginative Pun but a Devastating Bug By Steve Povolny · June 17, 2020 Enterprise customers looking for information on defending against Curveball can find information here. 2020 came in with a bang this year, and it wasn’t from the record-setting number of firewor...
CurveBall – An Unimaginative Pun but a Devastating Bug
ARCHIVED STORY CurveBall – An Unimaginative Pun but a Devastating Bug By Steve Povolny · June 17, 2020 Enterprise customers looking for information on defending against Curveball can find information here. 2020 came in with a bang this year, and it wasn’t from the record-setting number of firewor...