Dec 31, 2009

8 years hacking Microsoft stuff, +50 vulnerabilities found

2009 is ending and I thought it would be nice to write down my personal record on Microsoft vulnerabilities. I started finding vulns in MS products in 2002 and these are most of them:

-Microsoft Biztalk Server ISAPI HTTP Receive function buffer overflow
-Microsoft Biztalk Server DTA vulnerable to SQL injection

-Microsoft Commerce Server 2002 Weak Registry Key Permissions Weakness

-Microsoft Active Server Pages Cookie Retrieval Issue

-Microsoft Windows LPC heap overflow

-Microsoft Windows Utility Manager Local Elevation of Privileges

-Microsoft Windows Utility Manager Local Elevation of Privileges II

-Microsoft Windows Improper Token Validation

-Microsoft Windows GDI Kernel Local Privilege Escalation Vulnerability

-Microsoft MSDTC COM+ Remote Code Execution Vulnerability

-Microsoft Windows 2000 TroubleShooter ActiveX Control Buffer Overflow Vulnerability

-Microsoft Windows COM Structured Storage Local Privilege Escalation Vulnerability

-Microsoft Windows Thread Pool ACL Local Privilege Escalation Vulnerability
-Microsoft Windows RPCSS Service Isolation Local Privilege Escalation Vulnerability
-Microsoft Windows MSDTC Service Isolation Vulnerability
-Microsoft Windows WMI Service Isolation Local Privilege Escalation Vulnerability

-Microsoft Windows Shell Could Allow Remote Code Execution (2 vulns)

-Microsoft SQL Server Heterogenous Queries Buffer Overflow

-Microsoft SQL Server xp_dirtree Buffer Overflow

-Microsoft SQL Server Buffer Overflows in numerous extended stored procedures (17 vulns)

-Microsoft SQL Server encoded password written by service pack

-Microsoft SQL Server BULK INSERT buffer overflow

-Microsoft SQL Server multiple buffer overflows in DBCC and SQL Injections (6 vulns)

-Microsoft SQL Server multiple vulnerabilities (5 vulns)


If you count them, they are 50 vulnerabilities in total, 14 are Microsoft Windows specific. Actually the real count should be +50, few not mentioned vulnerabilities were patched in service packs, new versions, not acknoledged by MS as vulnerabilities, etc.
Of course I'm not mentioning there the 0days I have, with them the count is >50, reaching 20 specific to MS Windows.

Microsoft should give me a prize someday ;)

Oct 27, 2009

Token Kidnapping's Revenge

Finally I got some free time to take a look at Windows for security issues, I was initialy amazed with Windows 7 and Windows 2008 R2 they looked really solid but after some time I started to find some issues.
These issues are not really dangerous (depending on the scenario) but allow to continue exploiting Windows using a new attack vector to perform Token Kidnapping ( .
Don't get me wrong MS properly fixed the issues ( detailed in Token Kidnapping presentation but they didn't find/fix all the attack vectors.
With this new attack vector it's still possible to elevate privileges to Local System account from almost any process that has impersonation rights bypassing new Windows services protections such as Per service SID, Write restricted token, etc
Probably I will be presenting the findings at Hackers to Hackers Conference in Brazil ( in a couple of weeks.

Apr 7, 2009

Opening Intranets to attacks by using Internet Explorer

I just released a whitepaper titled: Opening Intranets to attacks by using Internet Explorer, I hope you find it interesting, you can find it here


Mar 16, 2009

Antivirus, antivirus, antivirus...

My last post was about a bug in an antivirus product, not big deal, all software has bugs.
I was kindly pointed to this article by Ryan Naraine, it's about an incident were one of my token kidnapping exploits was used, it's a weird feeling to know that some tool of yours was used in an attack but in the end it's not about the tools it's about the user, the intention, etc. anyways, what really surprized me was that no antivirus is detecting the exploits!!! we all know that antivirus suck but not being able to detect a very old exploit with signature analysis that really sucks.