4 X Security Team ::Undergr0und::

CVE-2011-1574 VideoLAN VLC ModPlug ReadS3M Stack Buffer Overflow

2011-06-18T05:29:00.000-07:00

This module exploits an input validation error in libmod_plugin as included with VideoLAN VLC 1.1.8. All versions prior to version 1.1.9 are affected. By creating a malicious S3M file, a remote attacker could execute arbitrary code. Although other products that bundle libmodplug may be vulnerable, this module was only tested against VLC. NOTE: As of July 1st, 2010, VLC now calls SetProcessDEPPoly to permanently enable NX support on machines that support it. As such, this module is capable of bypassing DEP, but not ASLR.

CVE-2011-1574 VideoLAN VLC ModPlug ReadS3M Stack Buffer Overflow from 4 X Security Team on Vimeo.

CVE-2011-0611-Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability

2011-04-18T01:49:00.000-07:00

Adobe warns of new Flash Player zero-day attack

Hackers are embedding malicious Flash Player files in Microsoft Word documents to launch targeted attacks against select businesses, according to a warning from Adobe.

This latest Flash Player zero-day attack comes just weeks after EMC’s RSA Division was hit with a malware attack that used a rigged Flash (.swf) file embedded in a Microsoft Excel document.

In both cases, the attacks are being used to steal corporate secrets.

Here’s the gist of the latest Flash Player zero-day:

A critical vulnerability exists in Flash Player 10.2.153.1 and earlier versions (Adobe Flash Player 10.2.154.25 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris, Adobe Flash Player 10.2.156.12 and earlier versions for Android, and the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.2) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems.

This vulnerability (CVE-2011-0611) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Word (.doc) file delivered as an email attachment, targeting the Windows platform. At this time, Adobe is not aware of any attacks via PDF targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

Adobe says it is in the process of finalizing a schedule for delivering patches for Flash Player 10.2.x and earlier versions for Windows, Macintosh, Linux, Solaris and Android, Adobe Acrobat X (10.0.2) and earlier 10.x and 9.x versions for Windows and Macintosh, Adobe Reader X (10.0.2) for Macintosh, and Adobe Reader 9.4.3 and earlier 9.x versions for Windows and Macintosh.

Because Adobe Reader X Protected Mode would prevent an exploit of this kind from executing, Adobe plans to fix this issue in Adobe Reader X for Windows with the next quarterly security update for Adobe Reader, currently scheduled for June 14, 2011.

AFFECTED SOFTWARE VERSIONS

Adobe Flash Player 10.2.153.1 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems
Adobe Flash Player 10.2.154.25 and earlier for Chrome users
Adobe Flash Player 10.2.156.12 and earlier for Android
The Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.2) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems

NOTE: Adobe Reader 9.x for UNIX, Adobe Reader for Android, and Adobe Reader and Acrobat 8.x are not affected by this issue.

[Source: zdnet]

CVE-2011-0611-Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability And Hacker Defender Rootkit Attack[metasploit] from 4 X Security Team on Vimeo.

Lab Scenario
--------------

CVE-2010-3275-VLC AMV Dangling Pointer Vulnerability

2011-04-15T22:26:00.000-07:00

This module exploits VLC media player when handling a .AMV file. By flipping the 0x41st
byte in the file format (video width/height), VLC crashes due to an invalid pointer, which
allows remote attackers to gain arbitrary code execution

CVE-2010-3275-VLC AMV Dangling Pointer Vulnerability from 4 X Security Team on Vimeo.

CVE-2011-0609 : Adobe Flash Player AVM Bytecode Verification Vulnerability

2011-04-15T02:44:00.000-07:00

Vulnerability discovered exploited in the wild This vulnerability was used to attack RSA First information about the 0day published the 2011-03-11 Security Advisory APSA11-01 posted by the vendor the 2011-03-14 First vulnerability analysis provided by villy the 2011-03-15 Metasploit PoC provided by bannedit the 2011-03-22

Affected version(s) :

Adobe Flash Player 10.2.152.33 and earlier versions for Windows, Macintosh, Linux and Solaris Adobe Flash Player 10.2.154.18 and earlier for Chrome users Adobe Flash Player 10.1.106.16 and earlier versions for Android Adobe Reader and Acrobat X (10.0.1) Earlier 10.x and 9.x versions of Reader and Acrobat for Windows and Macintosh

CVE-2011-0609 : Adobe Flash Player AVM Bytecode Verification Vulnerability from 4 X Security Team on Vimeo.

CVE-2010-3747 -RealNetworks RealPlayer CDDA URI Initialization Vulnerability

2011-04-15T02:17:00.000-07:00

Vulnerability discovered by CHkr_D591 Vulnerability transmitted to ZDI by CHkr_D591 Vulnerability reported to the vendor by ZDI the 2009-11-24 Coordinated public release of advisory the 2010-10-15 Saint PoC provided the 2010-10-22 Metasploit PoC provided the 2011-03-17

CVE-2010-3747 -RealNetworks RealPlayer CDDA URI Initialization Vulnerability from 4 X Security Team on Vimeo.

Trend Micro Internet Security Pro 2010 ActiveX extSetOwner() Remote Code Execution Exploit

2011-04-15T00:01:00.000-07:00

Trend MicroHere’s a Metasploit exploit module I wrote for the Trend Micro Internet Security Pro 2010 ActiveX extSetOwner() remote code execution vulnerability.

This vulnerability was originally discovered by Andrea Micalizzi aka rgod working with Zero Day Initiative. Abysssec Security Team published a binary analysis of this vulnerability as a part of MOAUB.

This module exploits a remote code execution vulnerability in Trend Micro Internet Security Pro 2010 UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll). The extSetOwner() function accepts a parameter and assumes it is an initialized pointer. When sending an invalid pointer to the extSetOwner() function of UfPBCtrl.dll an attacker may be able to execute arbitrary code.

Exploit successfully tested on the following platforms:
– Trend Micro Internet Security Pro 2010 on Internet Explorer 7, Windows XP SP3
– Trend Micro Internet Security Pro 2010 on Internet Explorer 7, Windows Vista SP2

CVE-2010-3189-Trend Micro Internet Security Pro 2010 ActiveX extSetOwner( from 4 X Security Team on Vimeo.

Metasploit_Kingview 6.53 SCADA

2011-03-18T23:30:00.000-07:00

This module exploits a buffer overflow in Kingview 6.53. By sending a specially crafted request to port 777 (HistorySvr.exe), a remote attacker may be able to gain arbitrary code execution without authentication.

Metasploit_Kingview 6.53 SCADA from 4xteam on Vimeo.

MS10-002

2010-03-16T00:57:00.000-07:00

Executive Summary

This security update resolves seven privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The more severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

ms10_002_aurora from 4xteam on Vimeo.

Microsoft Internet Explorer iepeers.dll use-after-free exploit

2010-03-16T00:55:00.000-07:00

New Microsoft Internet Explorer 0day exploit has been found circulating in-the-wild. According to Microsoft, there are targeted attacks attempting to use this vulnerability. Microsoft published a security advisory for this vulnerability here:
Microsoft Security Advisory (981374): Vulnerability in Internet Explorer Could Allow Remote Code Execution

The vulnerability is a use-after-free (invalid pointer reference) vulnerability within iepeers.dll and only Internet Explorer versions 6 and 7 are vulnerable. Internet Explorer 8 and 5 are not affected.

I’ve found this exploit in-the-wild on www.topix21century.com. The payload download and executes a binary file which connects back to notes.topix21century.com.
Here’s the exploit as it was found in-the-wild, a bit un-obfuscated and payload removed – ie_iepeers_wild.txt

And here’s a Metasploit exploit module for this vulnerability. Tested successfully on the following platforms:
– Microsoft Internet Explorer 7, Windows Vista SP2
– Microsoft Internet Explorer 7, Windows XP SP3
– Microsoft Internet Explorer 6, Windows XP SP3

As usual, this post will update with further references and updates when available.
Happy exploitation :-)

ie_iepeers Metasploit from 4xteam on Vimeo.

Metasploit_microsoft_ftpd_nlst

2009-09-13T22:22:00.000-07:00

This module exploits a stack overflow flaw in the Microsoft IIS FTP service. The flaw is triggered when a special NLST argument is passed while the session has changed into a long directory path. For this exploit to work, the FTP server must be configured to allow write access to the file system (either anonymously or in conjunction with a real account) This exploit module was written by Kingcope (kcope2@googlemail.com) and hdm (hdm@metasploit.com)

microsoft_ftpd_nlst from 4xteam on Vimeo.

smb2_negotiate_pidhigh_windows 7(dos)

2009-09-12T03:17:00.000-07:00

Exploit code for a remote reboot flaw in Microsoft’s implementation of the SMB2 protocol has been posted on the internet, exposing users of Windows 7 and Windows Vista to the teardrop attacks that used to be popular on Windows 3.1 and Windows 95.

Metasploit smb2_negotiate_pidhigh_windows 7(dos) from 4xteam on Vimeo.

SIDVault 2.0e

2009-09-11T02:40:00.000-07:00

This exploits a buffer overflow in the LDAP service that is part of the SIDVault product. This module was tested against version 2.0e.

SIDVault 2.0e from 4xteam on Vimeo.

Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption exploit

2009-07-17T07:56:00.000-07:00

The CSIS Security Group ~~found~~ (credit correction - see the update below) a 0day exploit in-the-wild that exploit a vulnerability within Microsoft DirectShow (msvidctl.dll) in the way it handles MPEG-2 files.

The exploit found is used to preform drive-by attacks via compromised Chinese web sites.
Original exploit (as it is in-the-wild) can be found here (shellcode changed to execute calc.exe) - aa.rar.
You can read the translated post here or read this post from ISC diary.

Here’s a Metasploit exploit module I wrote that exploit this vulnerability.
Tested successfully on the following platforms (fully patched 06/07/09):
- Internet Explorer 6, Windows XP SP2
- Internet Explorer 7, Windows XP SP3

Download msvidctl_mpeg2.rb.
Also on Metasploit.

Also, if you want to test this vulnerability manually, here’s a little Ruby script I wrote that build GIF files to trigger the vulnerability:
Download msvidctl_gif.rb.

This is the second exploit found in-the-wild in the past month that exploit a vulnerability in Microsoft DirectShow. In June, an exploit was found in-the-wild that exploit a vulnerability in DirectShow QuickTime Movie Parser Filter (quartz.dll). Liam O Murchu of Symantec wrote an analysis for this exploit here:
DirectShow Exploit In the Wild
DirectShow Exploit In the Wild, Part II

This post will update with additional updates about this vulnerability.

Metasploit msvidctl_mpeg2

msvidctl_mpeg2 from 4xteam on Vimeo.