All posts by noam

SSD Advisory – BusyBox (local) cmdline stack buffer overwrite

Vulnerability Description
BusyBox provides an arp applet which is missing an array bounds check for command-line parameter IFNAME. It is therefore vulnerable to a command-line based local stack buffer overwrite effectively allowing local users to write past a 16 bytes fixed stack buffer. This leads to two scenarios, one (A) where an IOCTL for GET_HW_ADDRESS (SIOCGIFHWADDR) fails and results in a corrupted va_list being passed to *printf() and one (B) where an attacker might provide valid params for the IOCTL and trick the program to proceed and result in a RET eip overwrite eventually gaining code execution.

Continue reading SSD Advisory – BusyBox (local) cmdline stack buffer overwrite

Hack2Win 2016 – a CodeBlue Conference Event

Hi everyone,

This year again, our Code Blue event will let you win prizes and show your skills in hacking network based devices.

We have selected 9 devices so far for you to try and hack.

We looked wide and far for different devices, all around the 200$ USD range, so that they won’t be expensive for you to buy and try out before the event
Continue reading Hack2Win 2016 – a CodeBlue Conference Event

SSD Advisory – Untangle NG Firewall Remote Command Execution

Vulnerability Description
The Untangle NG Firewall appliance includes a free module called “Captive Portal”. This module is installed by default with several other recommended modules. This module works as 2FA authentication system, which enables multi user login (in VPN or LAN environment for example) and custom firewall rules for each one. It forces all traffic to be authenticated before giving access to the network, and redirects all HTTP/HTTPS request to a login/disclaimer URL (“/capture/handler.py”).

The component URI is not restricted to local users, so it can be accessed also from the administrative interface, which is enabled by default on WAN interfaces to remote users, through HTTPS (443).

There is an administrative functionality in this module to upload custom python scripts or HTML pages, packed as ZIP file. The component does not check if the user is authenticated before processing the upload. It results in an arbitrary file upload vulnerability, which allows remote unauthenticated users to write custom python/HTML files to a known folder.

All Untangle plugins has its own application id, by default the captive portal id is “16”. The uploaded files (if packed correctly) will be extracted and copied to:
“/capture/custom_16/”

The id is consistent, but in older versions may change. Anyway, it is always between 1-35, which is short enough to identify it in a few tries (in the worst case).

The content of the ZIP file must be a “custom.py” or “custom.html” file.

As result, there is a RCE vulnerability, because when the module is installed, the web server configuration is modified to execute CGI files (as python) from “/capture/” folder. So if a custom python is uploaded, accessing the file through the web will execute the content:
“/capture/custom_16/custom.py”

In a few words:

  1. Upload ZIP file with a file called “custom.py” with the desired Python payload inside.
  2. Access “/capture/custom_16/custom.py” to execute its content

Continue reading SSD Advisory – Untangle NG Firewall Remote Command Execution