|
|
|
Faked Adobe PDF.SWF exploit on milw0rm |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Faked Adobe PDF.SWF exploit on milw0rm Par Security ShellLe [2009-07-27] à 19:29:56
Présentation : on July-23, milw0rm uploaded Adobe Flash Embedded in PDF LIVE VIRUS MALWARE Exploit written by hdmoore who states that it s I quote live exploit sample for the new Flash bug embedded in PDF , which is far from the truth. the truth is - it s the old getIcon exploit having nothing to do with the new vulnerability in ActiveScript Virtual Machine. the real worms described here uses PDF with two embedded SWF files, one - triggers the bug, another performs heap-spraying and generates the shell-code on the fly yeah it uses Active Script byte-code which is not plain text like JavaScript, it s more like Java byte-code to generate the shell-code, so there is no unescape strings, so my shell-detector fails to find it of course it fails, it does not support Active Script byte code, at least not yet . I will write about the real SWF exploit tomorrow. today we re going talk about that faked exploit. it s pretty interested as well. the first thing we have to do is to decompress all streams. it s easy. zlib support that format, we just should write PDF parser should we oh, not really according to RFC-1950 a zlib stream has the following structure CMF_FLG more . so, we can just look for CMF_FLG header, trying to decompress every stream we meet - very useful universal decompressor, supporting now only PDF, but much more HTTP streams for example . FLG filed has 4 bits FCHECK checksum and the header itself is quite predicable, so it s easy to find a potential ZLIB header inside a byte stream. how to defeat false positives 2byte header is too short to be reliable enough . well, no problem guys if we found something looks like CMF_FLG just try to unpack the first 512 bytes by zlib inflate function. if it fails it means - false positive, otherwise we have to call it again to unpack the rest. Check KPNC blog for More Info
Les mots clés de la revue de presse pour cet article : adobe exploit milw0rm
Les videos sur SecuObs pour les mots clés : exploit
Les mots clés pour les articles publiés sur SecuObs : exploit
Les éléments de la revue Twitter pour les mots clé : adobe exploit
Les derniers articles du site "Security Shell" :
- A Secure Cookie Protocol
- OWASP JBroFuzz v 2.3 released
- Cain Abel 4.9.36 Released
- Live CD for Secure Remote Incident Handling in the Enterprise
- Websecurify 0.6 Final Released
- Norton Update Center XSS Defacement
- THC IPV6 ATTACK TOOLKIT v1.1
- iScanner 0.6
- Update Websecurify and Skipfish tools
- Maltego version 3 Released
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.191.75.173 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.191.75.173 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
