THE KNOWLEDGE IS THE WORK.
Resources(82)
The Known Beacons Attack (34th Chaos Communication Congress)
George Chatzisofroniou
The recent key reinstallation attacks (KRACK) against the WPA2 protocol revealed how an adversary can easily eavesdrop, and in some cases tamper, a Wi-Fi connection secured by the WPA2 protocol. At the same time, Wi-Fi automatic association attacks achieve a similar result (man-in-the-middle position) not by attacking...
Shadow v2 public release
Patroklos Argyroudis
About four months ago (April 2017), Vasilis Tsaousoglou and myself presented our work on exploiting Android's libc allocator at the 2017 INFILTRATE conference (Miami, Florida). Since version 5.0, Android has adopted the jemalloc allocator as its default libc malloc(3) implementation. For our talk we extended our...
Lure10: Exploiting Windows Automatic Association Algorithm
George Chatzisofroniou
Lure10 is a novel technique presented at the Hack-in-the-Box 2017 conference in Amsterdam that enables an attacker to automatically achieve a man-in-the-middle position against wireless devices running the Windows operating system. The attack requires no user interaction and exploits the "Wi-Fi Sense" feature found in...
GDCM buffer overflow in ImageRegionReader :: ReadIntoBuffer
Stelios Tsampas
A flaw in GDCM versions before 2.6.2 allows an integer overflow in the ImageRegionReader::ReadIntoBuffer function, causing a buffer overflow that attackers can trigger using specially crafted DICOM image dimensions. Because the overflow bypasses internal size checks, it can lead to memory corruption, denial of...
libpurple OTR information leakage
CENSUS
A design flaw in libpurple causes the plaintext of OTR messages to be broadcast over DBus, exposing private conversations to any process running under the same user account. Because libpurple does not propagate "no‑log" or privacy flags to third‑party listeners, applications such as widgets or notification systems may...
FreeBSD kernel NFS client local vulnerabilities
Patroklos Argyroudis
.3‑RELEASE, and 8.0Short description:** Two improper input‑validation flaws in the FreeBSD NFS client (versions 7.2‑RELEASE, 7.3‑RELEASE, and 8.0‑RELEASE) allow local unprivileged users to trigger kernel stack and kernel heap overflows through crafted arguments to the mount(2) and nmount(2) system calls when...
FreeBSD kernel exploitation mitigations
Patroklos Argyroudis
In my recent Black Hat Europe 2010 talk I gave an overview of the kernel exploitation prevention mechanisms that exist on FreeBSD. A few people at the conference have subsequently asked me to elaborate on the subject. In this post I will collect all the information from my talk and the various discussions I had in the...
Monkey HTTPd improper input validation vulnerability
Patroklos Argyroudis
A flaw in Monkey HTTPd versions 0.9.2 and earlier allows remote attackers to crash worker threads by sending HTTP requests with malformed Connection headers. Due to improper input validation and incorrect buffer‑end calculations in Request_Find_Variable(), certain crafted request bodies trigger signedness and...
CoreHTTP web server off-by-one buffer overflow vulnerability
Patroklos Argyroudis
A flaw in the CoreHTTP web server (versions 0.5.3.1 and earlier) allows remote attackers to trigger an off‑by‑one stack buffer overflow during parsing of malformed HTTP method names or URIs. Because the server's sscanf() call writes a full 256 bytes into 256‑byte buffers without ensuring NULL‑termination, crafted...
Linux kernel SUNRPC off-by-two buffer overflow
Patroklos Argyroudis
An off‑by‑two stack buffer overflow in the Linux SUNRPC subsystem (kernel versions 2.6.32 through 2.6.32‑rc7) allows out‑of‑bounds writes in the function rpc_uaddr2sockaddr() when processing universal address strings of maximum length. Because the function writes two bytes past the end of a fixed‑size stack buffer, a...
gif2png command line buffer overflow
Patroklos Argyroudis
A stack‑based buffer overflow in gif2png (versions 2.5.1 and earlier) allows attackers to overwrite memory by supplying an overly long filename on the command line. Because the program uses an unsafe strcpy() into a fixed‑size buffer, crafted input can cause a crash or potentially enable remote code execution when...
CVE-2008-3531: FreeBSD kernel stack overflow exploit development
Patroklos Argyroudis
About four months ago I developed a reliable exploit for vulnerability CVE-2008-3531, which is also addressed in the advisory FreeBSD-SA-08:08.nmount. In this post I will use this vulnerability to provide an overview of the development process for FreeBSD kernel stack exploits.
Rasterbar libtorrent arbitrary file overwrite vulnerability
CENSUS
A path‑sanitization flaw in Rasterbar libtorrent (versions 0.14.3 and earlier) allows attackers to craft malicious multi‑file .torrent metadata that includes directory components containing embedded relative paths (e.g., "../../"). Because libtorrent only checks for exact ".." matches, these malformed elements bypass...
Static SSP canary in Debian libc6
CENSUS
A vulnerability in older Debian GNU libc (libc6 ≤ 2.7) caused stack protection (SSP / -fstack-protector) to use a fixed, predictable canary value (0xff0a0000) instead of a random one. Normally, stack canaries are randomized at runtime to prevent attackers from guessing them during buffer overflow attacks. However,...