Bypassing Symantec Endpoint Protection for Fun & Profit!
🗣input0
This is fun, but missing some details.
1. Version of Symantec Endpoint Protection tested is not listed. SEP14.3 came out a couple weeks ago and adds new capabilities including AMSI (finally).
1. Test was conducted on Windows 2012R2. Yes, Windows 2012R2 is still widespread in production and under support, however Windows 10/2016 have enhancements that make dumping credentials much more difficult (LSAS virtualization in Virtualization Bases Security).
Without this information, this blog really is "I walked through an intentionally vulnerable pen testing lab scenario", vs. "here is a demonstration that you should do something and actionable guidance on what you should do". (IE, you should upgrade your fleet to 2016/10, etc).
👤R-EDDIT
🎖@malwr
🗣input0
This is fun, but missing some details.
1. Version of Symantec Endpoint Protection tested is not listed. SEP14.3 came out a couple weeks ago and adds new capabilities including AMSI (finally).
1. Test was conducted on Windows 2012R2. Yes, Windows 2012R2 is still widespread in production and under support, however Windows 10/2016 have enhancements that make dumping credentials much more difficult (LSAS virtualization in Virtualization Bases Security).
Without this information, this blog really is "I walked through an intentionally vulnerable pen testing lab scenario", vs. "here is a demonstration that you should do something and actionable guidance on what you should do". (IE, you should upgrade your fleet to 2016/10, etc).
👤R-EDDIT
🎖@malwr
House of Io – Bypassing Safe-Linking and attacking Glibc's tcache
🗣eyalitki
Very interesting! I remember noticing the same thing about the first chunk but didn’t think much about. Good work getting a new exploit type out of the mitigation’s.
👤mdulin2
In a classic "Thank you /r/netsec" /u/awarau888 and I were able to develop their initial attack variant that was posted here a few days ago, into a working bypass.
👤eyalitki
🎖@malwr
🗣eyalitki
Very interesting! I remember noticing the same thing about the first chunk but didn’t think much about. Good work getting a new exploit type out of the mitigation’s.
👤mdulin2
In a classic "Thank you /r/netsec" /u/awarau888 and I were able to develop their initial attack variant that was posted here a few days ago, into a working bypass.
👤eyalitki
🎖@malwr
awarau
House of Io – Remastered
A few days ago, I (Awarau) published a blog post (link) with my analysis of the new heap mitigation, Safe-Linking, that will be introduced in GLibc 2.32. The blog post describes the mechanism, alon…
Abusing Java Remote Protocols in IBM WebSphere: Details on two bugs - one RCE and one Info Disclosure - in the WebSphere application server
🗣RedmondSecGnome
🎖@malwr
🗣RedmondSecGnome
🎖@malwr
Zero Day Initiative
Zero Day Initiative — Abusing Java Remote Protocols in IBM WebSphere
Back in April of this year, a researcher named tint0 submitted two bugs in IBM WebSphere to the ZDI program. One was an information disclosure vulnerability while the other could lead to remote code execution (RCE). This blog covers ZDI-20-689 /CVE-2020…
Sophos XG - A Tale of the Unfortunate Re-engineering of an N-Day and the Lucky Find of a 0-Day
🗣0xniph
🎖@malwr
🗣0xniph
🎖@malwr
Blogspot
CODE WHITE | Blog: Sophos XG - A Tale of the Unfortunate Re-engineering of an N-Day and the Lucky Find of a 0-Day
On April 25, 2020, Sophos published a knowledge base article (KBA) 135412 which warned about a pre-authenticated SQL injection (SQLi) vulne...