Exploit Collector
wolfSSL WOLFSSL_CALLBACKS Heap Buffer Over-Read

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
wolfSSL versions prior to 5.5.2 suffer from a heap buffer over-read with WOLFSSL_CALLBACKS and can be triggered with a single Client Hello message.

SHA-256 | 22c8bd75668677a45f903b9289dfd4de5cffd44e8f21af11820559278a985e59

Download
# wolfSSL before 5.5.2: Heap-buffer over-read with WOLFSSL_CALLBACKS
====================================================================

## INFO
=======

The CVE project has assigned the id CVE-2022-42905 to this issue.

Severity: 9.1 CRITICAL
Affected version: before 5.5.2
End of embargo: Ended October 28, 2022
Blog Post: https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/

## SUMMARY
==========

If wolfSSL callback functions are enabled (i.e., the flag `WOLFSSL_CALLBACKS` is
enabled), then a malicious client or network attacker can send a Client Hello
message to a server that when parsed by the server will trigger a buffer
over-read on the heap of at least 5 bytes. Similarly, a malicious server or a
network attacker can send a Hello Retry Request message to a client that when
parsed by the client will trigger a buffer over-read on the heap of at least 15
bytes.

The `AddPacketInfo` is given a buffer that should be the input buffer and that
actually is shifted by 5 bytes on the left, i.e., instead of reading
`input[0]..input[length]`, the function will read `input[-5]..input[length]` and
store it in a buffer that is exposed through the wolfSSL API. Note that `input`
is stored on the heap and `input[-5]` to `input[-1]` might store sensitive data
that should not be given to `AddPacketInfo`, for example when callback functions
are used as logging facility (through the API functions `wolfSSL_accept_ex` and
`wolfSSL_connect_ex`).

This buffer over-read can be triggered at a server with a single Client Hello
message. We have confirmed this with a proof-of-concept test case given below on
wolfSSL 5.5.0, on the version from the master branch, and on version 5.4.0. A
similar buffer over-read can be triggered at a client with the same wolfSSL
versions.

## DETAILS
==========

(Note: All code snippets and line numbers are with respect to the git hash
`#43715d1bb5b8c5b8b18cba4be3171fd1dd7eb046` on remote
`git@github.com:wolfssl/wolfssl.git`.)

When executing the first proof of concept test case given below, we reach a call
to `DoTls13HandShakeMsgType` from `tls13.c:DoTls13HandShakeMsg:10443` when the
server parses the Client Hello message, with the following values:

```c
size = 16520;
totalSz = 16524;
*inOutIdx = 4;
type = 1;
input; // buffer containing the input to be processed, before input,
there seems to be another input stored
```

`*inOutIdx=4` because of the call to `GetHandshakeHeader` at line
`tls13.c:10411`.

We enter the function `tls13.c:DoTls13HandShakeMsgType` and because
`WOLFSSL_CALLBACKS` flag is defined, we enter this snippet:

```c
#if defined(WOLFSSL_CALLBACKS)
/* add name later, add on record and handshake header part back on */
if (ssl->toInfoOn) {
int add = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
AddPacketInfo(ssl, 0, handshake, input + *inOutIdx - add,
size + add, READ_PROTO, ssl->heap);
AddLateRecordHeader(&ssl->curRL, &ssl->timeoutInfo);
}

Exploit Collector
TOR Virtual Network Tunneling Tool 0.4.7.13

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

SHA-256 | 2079172cce034556f110048e26083ce9bea751f3154b0ad2809751815b11ea9d

Download
Source:packetstormsecurity.com

hacking: security in practice
Using my living address

I don’t know if this is the correct sub but I don’t know what to do. Some spammer has gotten my home address and is texting and calling a random person in my hometown about my home’s equity. Only reason I know about it is because they contacted me on fb. What should I do or more importantly what can I tell her to do because she has blocked it before and it doesn’t stop.

submitted by /u/SneakyRobot6131
[link] [comments]

hacking: security in practice
Best Messaging software?

I would like to use a software that doesn’t keep track of my Ip or selling my info, I wanna talk to a friend but I don’t want to use discord or telegram

submitted by /u/FamousResponse2726
[link] [comments]

hacking: security in practice
T-Mobile Says Hacker Stole Data From 37 Million Accounts

https://external-preview.redd.it/db_wZzdStGCnv2Gk8t-YhVhmr4C5De3RoNt0g4WPoik.jpg?width=216&crop=smart&auto=webp&s=efbc3a7bf88de8583d15f1dff0ec8b4db8e122de submitted by /u/trumpfamily2020
[link] [comments]

Hacking on Medium
Networking in Cybersecurity: Concepts, Challenges & Solutions

https://cdn-images-1.medium.com/max/640/1*XnYzoxFg-d8v1I8sracJ8A.jpeg
Learn about the various concepts, challenges & solutions to multiple areas of networking in relation to the cybersecurity industry.

Continue reading on Medium »

Hacking on Medium
Hawk (htb) writeup

https://cdn-images-1.medium.com/max/695/1*Zi0OriRyLUathKCGMY4ivw.png
Running nmapAutomator.sh shows us a couple of different things to look at.

Continue reading on Medium »

Hacking on Medium
Home Grown Red Team: Bypassing Applocker, UAC and Getting Administrative Persistence

https://cdn-images-1.medium.com/max/643/1*4jR-qOHQ3hZkJi-s6dnpmQ.png
Welcome back! In my previous post, I showed how we can bypass default Applocker rules using LNK files to get a Havoc beacon.

Continue reading on Medium »

Hacking on Medium
Windows Isolation & Compartmentalization

https://cdn-images-1.medium.com/max/640/1*PSg5wipY3UA039dTlhWypQ.jpeg
Securing Your Windows: A Step-by-Step Guide to Isolation and Compartmentalization Techniques

Continue reading on Medium »

Hacking on Medium
Top five Cyber Threat Intel stories of the week: 01/16 to 01/20/2023

https://cdn-images-1.medium.com/max/1000/0*iRxNeY3RbpYSIJJZ
Top 5 general threat intelligence stories of the week. This is from TLP white/open-source websites, so please feel free to share with…

Continue reading on Hunter Strategy »