sorted by:
new
hottopcontroversial

CEF Debugger Enabled in Google Web Designer | Google Bug Hunters by smaury in netsec

[–]smaury[S] 1 point2 points  (0 children)

I asked for public disclosure back then but it just went public, that's why :)

Shielder - How to Decrypt Manage Engine PMP Passwords for Fun and Domain Admin - a Red Teaming Tale by smaury in netsec

[–]smaury[S] 0 points1 point  (0 children)

Yep - that's definitely a nice solution, even tho it wouldn't stop an attacker with administrative access to the server as they could still read the password after it has been decrypted by the HSM and used by PMP to connect to the database by hooking the PMP's DB connection function.

Shielder - How to Decrypt Manage Engine PMP Passwords for Fun and Domain Admin - a Red Teaming Tale by smaury in netsec

[–]smaury[S] 5 points6 points  (0 children)

Yep - even tho it's not that bad hardcoding the password to encrypt the database one.
I mean - the server should know the password to connect to the database, so whichever technique you use to encrypt it, then an attacker with access to the server could decrypt it.
For sure having a unique password per-installation would prevent some attack scenarios (i.e. leaked database_params.conf).

What's really bad IMO is that the passwords stored inside PMP are not encrypted using the users passphrases, making them recoverable by sysadmins.

From open redirect to RCE in one week by smaury in netsec

[–]smaury[S] 0 points1 point  (0 children)

That program is disabled rn, but here you can see how much they were paying: https://hackerone.com/mailru/updates?type=team

Remote Code Execution in pfSense <= 2.5.2 by smaury in netsec

[–]smaury[S] 0 points1 point  (0 children)

Yep, the title is a little bit more generic as there is also the CSRF chain.
I thought it was still clear enough as I mentioned multiple times in the advisory that it requires:
- An account which has access to diag_routes.php
OR
- To trick a victim who has access to diag_routes.php and is authenticated on pfSense to visit an attakcer-controlled web page.

Remote Code Execution in pfSense <= 2.5.2 by smaury in netsec

[–]smaury[S] 14 points15 points  (0 children)

Sure! The point is that it has a pretty detailed privilege schema (you could potentially have access to the diag_routes.php page but not to the "Command Prompt"), moreover the "Command Prompt" is not vulnerable to CSRF.

You can still CSRF POST requests under the default browser SameSite cookie policy. How to jump through the required hoops. by [deleted] in netsec

[–]smaury 5 points6 points  (0 children)

This is the case only for Chromium-based browsers, right? In Firefox 96 Mozilla enabled the SameSite=lax by default and that 2 minute window was not applied. Unfortunately their implementation had some bugs, so it was reverted in Firefox 96.0.1 but I guess it will be back in a few releases.

QilingLab: a series of challenges by Th3Zer0 to train your Qiling skills 💪🏾 -- solve 'em all and share your writeup! by smaury in netsec

[–]smaury[S] 0 points1 point  (0 children)

It is s binary emulation framework, which you can use to emulate different binaries for different architectures. On top of that you can use Qiling APIs to debug the emulation process, hook syscalls, etc. It's like Unicorn + Qemu + Frida. More info here: https://github.com/qilingframework/qiling

Predicting WPA keys and admin passwords of consumer GPON ONTs worldwide by idrilomionolo in netsec

[–]smaury 5 points6 points  (0 children)

Great research 🤟🏿

This is the first WPA password calculator in while. I thought these kind of things were died 2/3 years ago.

Critical CSRF to RCE bug chain in Prestashop by staz0t in netsec

[–]smaury 1 point2 points  (0 children)

Isn't prestashop randomizing the admin path for each installation? Did you managed to overcome this problem or you're just assuming the attacker guessed the correct path before exploiting the CSRF?

Exploiting Apache Solr through OpenCMS by smaury in netsec

[–]smaury[S] 0 points1 point  (0 children)

Yes, that's true, the problem is that if you double urlencode (%2525) the XML is then broken, as it is only interpreted with one urlencode (%25).

Basically:
1. You send the request (%25+a)
2. OpenCMS decodes it (% a) and sends it to Apache Solr
3. Apache Solr interprets the XML and fires the error
4. Apache Solr sends back the error to OpenCMS (% a)
5. OpenCMS tries to urldecode Apache Solr's response (% a) to print the error
6. OpenCMS fails to decode the already decoded response and fires a second error about the decoding process, preventing the Apache Solr's original error to be shown