| Blog | https://rw.md |
| https://twitter.com/buffaloverflow | |
| GitHub | https://github.com/rxwx |
Here is the advisory:
The NSIS uninstaller package did not enforce appropriate permissions on the temporary directory used during the uninstall process. Furthermore, it did not ensure that the temporary directory was removed before running executable content from it. This could potentially result in privilege escalation under certain scenarios.
If you want to find vulnerable software, go onto GitHub or public sandboxes etc and look for software that has a service and (un)installs NSIS packages. Triggering an uninstall may be possible through RPC/COM methods or perhaps custom IPC. I’m sure you will find some 👀
Some example code to get started with a poc:
https://gist.github.com/rxwx/1717e95e5ec11bea12d33e93a3832508
Last week NSIS released a new version which addresses a privilege escalation issue I reported (CVE-2023-37378).
Its an interesting one which affects certain setups where you can trigger an uninstaller as SYSTEM. I found various software including endpoint management and security software where this is exploitable :)
I’ve not been using social media much recently, since I find it a mostly negative experience (and I have enough of that at $dayjob).
However, I do miss keeping up with the latest news and cool research and catching up with folks.
I’m going to give Threads a go, maybe the grass is greener, maybe not. If it stops me clicking the blue bird icon and immediately feeling depressed then it’s worth a try 🙂
Updated the #ProxyNotRelay blog with the impacket PoC.
I'm excited to share of my work that came out today! Specifically, a handful of vulnerabilities in #F5 #BIGIP devices that I worked on through the summer, and worked with the vendor to get patched (F5 was awesome to work with, btw!).
I wrote a super detailed #blog post, and also wrote a full PoC. #Metasploit modules (both for the exploits and some post-exploitation data-gathering) are incoming as well!
The most important of the issues is #RCE via a #CSRF vulnerability in the #SOAP interface (#CVE_2022_41622), which is pretty cool (though requires a confluence of conditions to actually matter). I also had to bypass #SELinux to actually exploit this on the path I chose, which is kinda cool.
The other is authenticated RCE, to which they assigned #CVE_2022_41800, though even I, the person who found it, doesn't really think it's a big deal. It's a nice way to get a #Meterpreter session on your test box, at least?
I also published a bunch of my #tools for analyzing F5, including scripts to build, parse, and #MitM requests to their proprietary (I think?) database protocol (these require a valid login to use, but there's no user separation so there's a bit of #LPE).
I'll also be speaking about this research in much more detail (as much as I can in 45 minutes :) ) in my #HushCon talk on Dec 2!
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately
Ron Bowes
Trend Zero Day Initiative