Wednesday, September 24, 2014

Bash Vulnearbility: CVE-2014-6271

Test if you are vulnerable

Nothing really to add here. It makes me just thinking.... those things still happens (thxG). More here, here, here, here and here

UPDATE (click to enlarge):
From PasteBin (here)
  No Way... Wondering of many triggering vector would be out there

UPDATE 2

After some days from the original 6271, more than 5 vulnerabilities have been found on the same "way".  My favorite place to stay up-to-date on this topic is that Repository.
If you are still wondering what are the real risks for your company, here some simple examples from (here).

Find out your vulnerable cgi. Get it, and learn from the results...

As simple is a curl, remove everything you want (this is freaking scary).


And then be sure everything went as you whished.


Are you wondering.... if I could....  , ... , yes you can !


And, yes.. this vulnerability is "wormable", it might be used for spreading worms.

Wednesday, September 10, 2014

Nice Way To Evade Dynamic Analysis

One of the most important rules in building dynamic analysis environments is to avoid internet connection by the "potential malicious code". Indeed the "potential malicious code" would try to exploit the analysis system per se if an internet connection is available. To respect this basic rule, when a sandboxed code tries to open an internet page, the sandbox environment sends back a static 200 code, letting the "potential malicious code" compare the received page to the needed one. At such point the analysis system might try to "taint" and/or to apply its own detection mechanisms. 

A smart way to detect if a code is sandboxed or not is to try to reach out an unreachable internet site. If the code reads back 200 means the malicious code has been sandboxed since the malicious code is trying to reach an unreachable page. Following a simple python example.

Python2.7 Example

Following a simple JavaExample of the aforementioned technique.

A Java Example
Another tipycal example written in C

C esample
That trick has been known since 2012. Have a nice evasion.