How-to — Stealing Decryption Key from Air-Gapped Computer in Another Room

Air-gapped computers that are believed to be the most secure computers on the planet have become a regular target for researchers in recent years. Air-gap computers are one that are isolated from the Internet or any other computers that are connected to the Internet or external network, so hacker...

NTPd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow (PoC)

NTPd ntp-4.2.6p5 - ctlputdata Buffer Overflow PoC / Ntpd Based on: ntpq client from ntp package Provided for legal security research and testing purposes ONLY PoC DoS Denial of Service PoC. Will crash NTPd. You will need to know the KEY ID and MD5 password, for example put this in you ntp.conf...

Ntpd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow

Exploit for linux platform in category dos / poc / Ntpd Based on: ntpq client from ntp package Provided for legal security research and testing purposes ONLY PoC DoS Denial of Service PoC. Will crash NTPd. You will need to know the KEY ID and MD5 password, for example put this in you ntp.conf...

Morgan Stanley Research - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Morgan Stanley Research published at the 'play' market has multiple vulnerabilities...

WinREST Remote Privilege Escalation

So a year back I was massively scanning internet. This case ISPs IPs blocks where you can find easily at RIPE for example. Then I found some interesting hosts where SMB were open and the ACL is totally open to root file system with the same netbios name. All file system is writable. I was able to...

Samsung Galaxy S6 - android.media.process Face Recognition Memory Corruption (MdConvertLine)

Exploit for Android platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=616 The attached file causes memory corruption when iy is scanned by the face recognition library in android.media.process F/libc 4134: Fatal signal 11 SIGSEGV, code 1,...

Solr 3.5.0 - Arbitrary Data Deletion

Solr 3.5.0 - Arbitrary Data Deletion Exploit Title: All Solr Data Can Be Delete Google Dork: intext:Schema Config Analysis Schema Browser Statistics Info Distribution Ping Logging Date: 5/2/2016 Exploit Author: N37 Myanmar Vendor Homepage: http://lucene.apache.org/solr/ Software Link:...

Solr 3.5.0 - Arbitrary Data Deletion

Exploit for java platform in category web applications Exploit Title: All Solr Data Can Be Delete Google Dork: intext:Schema Config Analysis Schema Browser Statistics Info Distribution Ping Logging Date: 5/2/2016 Exploit Author: N37 Myanmar Vendor Homepage: http://lucene.apache.org/solr/ Software...

OpenDocMan 1.3.4 - Cross-Site Request Forgery

OpenDocMan 1.3.4 - Cross-Site Request Forgery Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: CSRF Remote...

Opendocman 1.3.4 HTML Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: HTML Injection Remote Exploitable: Yes Reported to vendor:...

Opendocman 1.3.4 Cross Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 11/21/2015...

pdfium - opj_t2_read_packet_header libopenjpeg Heap Use-After-Free

pdfium - opjt2readpacketheader libopenjpeg Heap Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=613 The following crash was encountered in pdfium the Chrome PDF renderer during PDF fuzzing: --- cut --- $ ./pdfiumtest...

VirusTotal Firmware Malware Implant Scanning

Successful attacks against firmware are rare but provide hackers with one thing they covet most: persistence. Advanced attack groups have already accelerated their capabilities in finding ways to burrow into the BIOS and EFI as noted by the Snowden leaks’ description of the NSA’s attempts to...

VideoLAN VLC Media Player 2.2.1 - .mp4 Heap Memory Corruption

VideoLAN VLC Media Player 2.2.1 - .mp4 Heap Memory Corruption Application: VLC media player Platforms: Windows Versions: Version 2.2.1 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC...

ACTi E31 surveillance Cameras 弱密码漏洞

Introduction The Perception Point Research team has identified a 0-day local privilege escalation vulnerability in the Linux kernel. While the vulnerability has existed since 2012, our team discovered the vulnerability only recently, disclosed the details to the Kernel security team, and later...

iOS Kernel - AppleOscarAccelerometer Use-After-Free

Exploit for iOS platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=607 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

iOS Kernel - AppleOscarCMA Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=605 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

iOS Kernel - AppleOscarGyro Use-After-Free

Exploit for iOS platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=608 Panic log attached OS X advisory: https://support.apple.com/en-us/HT205731 iOS advisory: https://support.apple.com/en-us/HT205732 Proof of Concept:...

VideoLAN VLC Media Player 2.2.1 - '.mp4' Heap Memory Corruption

Exploit for windows platform in category dos / poc Application: VLC media player Platforms: Windows Versions: Version 2.2.1 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1...

VideoLAN VLC Media Player 2.2.1 - '.mp4' Heap Memory Corruption

Application: VLC media player Platforms: Windows Versions: Version 2.2.1 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== VLC media player common...