Mango Automation 2.6.0 User Enumeration

Mango Automation 2.6.0 User Enumeration Weakness Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to...

Mango Automation 2.6.0 CSRF Arbitrary Command Execution Exploit

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The POST parameter 'c0-param0...

Microsoft Windows Kernel - NtGdiBitBlt Buffer Overflow (MS15-097)

Microsoft Windows Kernel - NtGdiBitBlt Buffer Overflow MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=474 --- The attached PoC triggers a buffer overflow in the NtGdiBitBlt​ system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on...

Microsoft Windows Kernel - 'NtGdiBitBlt' Buffer Overflow (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=474 --- The attached PoC triggers a buffer overflow in the NtGdiBitBlt system call. It reproduces reliable on Win 7 32-bit with Special Pool enabled on win32k.sys --- Proof of Concept:...

Microsoft Windows Kernel - Use-After-Free with Printer Device Contexts (MS15-097)

Microsoft Windows Kernel - Use-After-Free with Printer Device Contexts MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=433 --- The attached PoC demonstrates a UAF condition with printer device contexts. The PoC will trigger on Win 7 32-bit with Special Pool...

Microsoft Windows Kernel - UserCommitDesktopMemory Use-After-Free (MS15-073)

Microsoft Windows Kernel - UserCommitDesktopMemory Use-After-Free MS15-073 Source: https://code.google.com/p/google-security-research/issues/detail?id=335 Freed memory is accessed after switching between two desktops of which one is closed. The testcase crashes with and without special pool...

Microsoft Windows Kernel - DeferWindowPos Use-After-Free (MS15-073)

Microsoft Windows Kernel - DeferWindowPos Use-After-Free MS15-073 Source: https://code.google.com/p/google-security-research/issues/detail?id=339 The attached PoC demonstrate a use-after-free condition that occurs when operating on a DeferWindowPos object from multiple threads. The DeferWindowPos...

Microsoft Windows Kernel - bGetRealizedBrush Use-After-Free (MS15-097)

Microsoft Windows Kernel - bGetRealizedBrush Use-After-Free MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=458 --- The attached testcase crashes Win 7 with Special Pool on win32k while accessing freed memory in bGetRealizedBrush​​. --- Proof of Concept:...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)

Microsoft Windows Kernel - Bitmap Handling Use-After-Free MS15-061 2 Source: https://code.google.com/p/google-security-research/issues/detail?id=311 Bitmap object Use-after-Free 2 The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however yo...

Microsoft Windows Kernel - 'NtGdiStretchBlt' Pool Buffer Overflow (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=415 --- Tested on Win 7 32-bit with Special Pool enabled. Multiple pool buffer overflows can be triggered through the NtGdiStretchBlt system call. The attached PoC demonstrates a write overflow and another read over flow...

Microsoft Windows Kernel - 'SURFOBJ' Null Pointer Dereference (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=312 This issue is very likely a null pointer issue affecting 32-bit Windows version. The offset is from add onto another offset which isn't quite zero, so not 100% convinced it is just a null pointer, however I wasn't abl...

Microsoft Windows Kernel - Brush Object Use-After-Free (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=304 Creating a device context with the flag DCXNORESETATTRS and selecting a brush object into the device context will result in the brush being freed on process exit without the reference to the object being cleared. The...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)

Source: https://code.google.com/p/google-security-research/issues/detail?id=293 Platform: Win7 32-bit. trigger.cpp should fire the issue, with two caveats: - PoC will NOT work if compiled as a debug build. - PoC will trigger the condition every time but the subsequent corruption might not cause a...

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=294 Platform: Win7 32-bit. trigger.cpp should fire the issue, with a caveat - PoC might NOT work if compiled as a debug build. windbg.txt is a sample crash log. Analysis from Nils: --- please find attached a C trigger,...

Microsoft Windows Kernel - Brush Object Use-After-Free (MS15-061)

Microsoft Windows Kernel - Brush Object Use-After-Free MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=304 Creating a device context with the flag DCXNORESETATTRS​ and selecting a brush object into the device context will result in the brush being freed on...

Microsoft Windows Kernel - HmgAllocateObjectAttr Use-After-Free (MS15-061)

Microsoft Windows Kernel - HmgAllocateObjectAttr Use-After-Free MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=320 The PoC bug checks reliably with Special Pool enabled on writing to freed memory. A reference to the freed memory is held at offset +0x10 of the...

Microsoft Windows Kernel - Use-After-Free with Cursor Object (MS15-097)

Microsoft Windows Kernel - Use-After-Free with Cursor Object MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=457 --- The attached testcase crashes Win 7 with Special Pool enabled while accessing the freed global cursor object gpqCursor​. See poc.cpp for...

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061)

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=294 Platform: Win7 32-bit. trigger.cpp should fire the issue, with a caveat - PoC might NOT work if compiled as a debug build...

Microsoft Windows Kernel - NtGdiStretchBlt Pool Buffer Overflow (MS15-097)

Microsoft Windows Kernel - NtGdiStretchBlt Pool Buffer Overflow MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=415 --- Tested on Win 7 32-bit with Special Pool enabled. Multiple pool buffer overflows can be triggered through the NtGdiStretchBlt system call. T...

Microsoft Windows Kernel - 'DeferWindowPos' Use-After-Free (MS15-073)

Source: https://code.google.com/p/google-security-research/issues/detail?id=339 The attached PoC demonstrate a use-after-free condition that occurs when operating on a DeferWindowPos object from multiple threads. The DeferWindowPos call will trigger and block on the execution of a window procedur...