leesh3288

Sandbox Escape in vm2@3.9.16

Summary

There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context.

Proof of Concept

jakeajames

#include <stdlib.h>
#include <stdio.h>
#include <pthread/pthread.h>
#include <mach/mach.h>

struct ool_msg  {
    mach_msg_header_t hdr;
    mach_msg_body_t body;
    mach_msg_ool_ports_descriptor_t ool_ports[];
};

bet4it

Java.perform(function () {
   var act = Java.use("android.app.Activity");
   act.getIntent.overload().implementation = function () {
     var intent = this.getIntent()
     var cp = intent.getComponent()
     console.log("Starting " + cp.getPackageName() + "/" + cp.getClassName())
     var ext = intent.getExtras();
     if (ext) {
       var keys = ext.keySet()
       var iterator = keys.iterator()

andripwn

app.alert("XSS")

williballenthin

//------------------------------------------------
//--- 010 Editor v8.0.1 Binary Template
//
//      File: Transactional Registry Transaction Logs (.TxR)
//   Authors: Willi Ballenthin <william.ballenthin@fireeye.com>
//   Version: 0.1
// Reference: https://www.fireeye.com/blog/threat-research/2019/01/digging-up-the-past-windows-registry-forensics-revisited.html
//------------------------------------------------

LittleEndian();

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

pexcn

#!/sbin/sh
#
# Copyright (C) 2018 Unlegacy Android Project
# Copyright (C) 2018 Svyatoslav Ryhel
# Copyright (C) 2019 Nick80835
# Copyright (C) 2019 z3dd3r
#
# Made for Hammerhead
#

pe3zx

rem USE AT OWN RISK AS IS WITHOUT WARRANTY OF ANY KIND !!!!!
rem https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference
rem To also disable Windows Defender Security Center include this
rem reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
rem 1 - Disable Real-time protection
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

burinov

#Example on how to use adb to start an Activity,
#BroadcastReceiver or Service from adb and include intent extras too.

#for Activity: 

adb shell am start  -n "com.peirr.test/com.peirr.test.MyActivity" --es name "John" --ei age 30

#for BroadcastReceiver 

adb shell am broadcast  -n "com.peirr.test/com.peirr.test.MyReceiver" --es name "John" --ei age 30

feix

var CryptoJS = require('crypto-js')
var request = require('request-promise')

/*
 * npm install crypto-js request-promise request
 * node wx_t1t_hack.js
 */

// export function testEncription(msg, fullKey) {
//   var fullKey = fullKey.slice(0, 16)