mirchr/security-research

Security Research

Security Research

A collection of files related to my personal security research. Additional content will be posted on my blog https://blog.mirch.io.

Tools

Tool	Description
openssldir_check	Windows utility to check for potential insecure paths used by the OPENSSLDIR build parameter in OpenSSL libraries
ssscache2john	Convert SSSD LDAP cache files to John The Ripper format
DumpTompcatSessions	Dump Tomcat sessions using JMX

Vulnerabilities

• CVE-2020-3950 - VMware Fusion Elevation of Privilege Vulnerability. PoC: CVE-2020-3950.sh.

• CVE-2019-19954 - Signal Desktop Windows Elevation of Privilege Vulnerability. Detailed write-up: https://blog.mirch.io/signal-desktop-windows-lpe

• CVE-2019-3466 - Debian / Ubuntu PostgreSQL Privilege Escalation via pg_ctlcluster. CVE-2019-3466-stage1.sh CVE-2019-3466-stage2.sh. Detailed write-up: https://blog.mirch.io/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation. Debian Advisory: DSA-4568. Ubuntu Advisory: 4194-1

• CVE-2019-12571 - PIA macOS Arbitrary File Overwrite. CVE-2019-12571.txt.

• CVE-2019-12572 - PIA Windows Privilege Escalation: Malicious OpenSSL engine. CVE-2019-12572.txt. Walk through https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/

• CVE-2019-12573 - PIA Linux, macOS Arbitrary File Overwrite. CVE-2019-12573.txt.

• CVE-2019-12574 - PIA Windows Privilege Escalation: DLL Injection. Detailed write-up: CVE-2019-12574.txt.

• CVE-2019-12575 - PIA Linux, macOS Privilege Escalation: Shared Object Injection. CVE-2019-12575.txt.

• CVE-2019-12576 - PIA macOS Privilege Escalation: Untrusted Search Path. CVE-2019-12576.txt.

• CVE-2019-12577 - PIA macOS Privilege Escalation: Insecure umask. CVE-2019-12577.txt.

• CVE-2019-12578 - PIA Linux Privilege Escalation: Argument Injection. CVE-2019-12578.txt.

• CVE-2019-12579 - PIA Linux, macOS Privilege Escalation: Command Injection. CVE-2019-12579.txt.

• CVE-2019-6617 - F5 BIG-IP Resource Administrator Privilege Escalation. CVE-2019-6617.txt. F5 Advisory: https://support.f5.com/csp/article/K38941195

• CVE-2019-6724 - Barracuda VPN Client Privilege Escalation on Linux and macOS. PoC: CVE-2019-6724.sh. Detailed write-up: CVE-2019-6724: Barracuda VPN Client Privilege Escalation on Linux and macOS. Barracuda VPN Client Release Notes

• CVE-2018-1792.sh - IBM MQ can allow an attacker to execute a privilege escalation attack on a local machine. PoC: CVE-2018-1792.sh. Detailed write-up: CVE-2018-1792 – IBM MQ Privilege Escalation: Fun with RUNPATH. IBM Advisory: ibm10734447

• CVE-2018-15332 - F5 BIG-IP APM client for Linux and macOS arbitrary file takeover vulnerability. Detailed write-up: CVE-2018-15332.txt. F5 Advisory: K12130880

• CVE-2018-5529, CVE-2018-5546 - F5 BIG-IP APM client for Linux and macOS vulnerability. Detailed write-up: CVE-2018-5529.txt. F5 Advisories: K52171282, K54431371

• CVE-2018-18629 - Privilege Escalation on Linux via keybase-redirector . PoC: CVE-2018-18629.sh. Detailed write-up: CVE-2018-18629: Keybase Linux privilege escalation. Keybase Advisory: Local Privilege Escalation on Linux via keybase-redirector (KB002)

• CVE-2018-19788 - PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command. PoC: CVE-2018-19788.sh. Detailed write-up: CVE-2018-19788 PoC – polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass. The Hacker News article: Warning! Unprivileged Linux Users With UID > INT_MAX Can Execute Any Command

• CVE-2018-18556 - VyOS Privilege escalation via sudo pppd for operator users. PoC: CVE-2018-18556.sh. Detailed write-up: CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users. Advisory: The "operator" level is proved insecure and will be removed in the next releases