pedrib/poc

Advisories, proof of concept files and exploits that have been made public by @pedrib.

Pedro Ribeiro (@pedrib) Exploit Dumping Grounds

This repository contains information, exploits, scripts, etc, that I have made public and it is located at https://github.com/pedrib/PoC.

• advisories: all my public advisories, research notes, etc
  • Pwn2Own: advisories related to my Pwn2Own participations
• exploits: all my public exploits
  • metasploit: Metasploit modules created by myself and integrated into the Metasploit framework
    • Pwn2Own: Metasploit modules created for / used in Pwn2Own competitions I have participated in
• fuzzing: proof of concept or fuzzing testcases that have an assigned CVE identifier but weren't exploitable (or I just didn't have time to dig further and make them exploitable)
• tools: a few of my tools which might be useful for other hackers
• pedigree.csv: a CSV file containing all my trophies, aka CVE and ZDI identifiers assigned to my vulnerabilities, my Metasploit modules that have been integrated into the framework, etc (basically my vulnerability CV)
• pedrib-gmail-pgp.asc: my current PGP key for pedrib_at_gmail_dot_com

All information, code and binary data in this repository is released to the public under the GNU General Public License, version 3 (GPLv3). For information, code or binary data obtained from other sources that has a license which is incompatible with GPLv3, the original license prevails. For more information check https://www.gnu.org/licenses/gpl-3.0.en.html or the LICENSE file in the root of this repository.

Please note that Agile Information Security Limited (Agile InfoSec) relies on information provided by the vendor / product manufacturer when listing fixed versions, products or releases. Agile InfoSec does not verify this information, except when specifically mentioned in the advisory text and requested or contracted by the vendor to do so.

Unconfirmed vendor fixes might be ineffective, incomplete or easy to bypass and it is the vendor's responsibility to ensure all the vulnerabilities found by Agile InfoSec are resolved properly. Agile InfoSec usually provides the information in its advisories free of charge to the vendor, as well as a minimum of six months for the vendor to resolve the vulnerabilities identified in its advisories before they are made public.

Agile InfoSec does not accept any responsibility, financial or otherwise, from any material losses, loss of life or reputational loss as a result of misuse of the information or code contained or mentioned in its advisories. It is the vendor's responsibility to ensure their products' security before, during and after release to market.

Pedro Ribeiro (pedrib_at_gmail_dot_com)
Founder & Director of Research at Agile Information Security
Twitter: @pedrib1337

Feel free to send me questions / comments / criticism.

poc's Issues

You can check the list of all vulnerabilities and Metasploit modules I publicly disclosed here.

Link is not working
https://github.com/pedrib/PoC/blob/master/tracking.csv

Issue about Address Space Layout Randomization of cisco router

"From our observation it seems stack addresses are very lightly randomized due to the use of threads being used. Strangely, it seems that our buffer address remains constant, as part of the stack is not always randomised, while some other parts are. Although this is fantastic for exploitation, we're baffled by this and have no idea why it happens. Any comments on this are welcome!"

Hi Pedrib, I encountered Similar issue long time ago. I was baffled by this too. After I tried to modify the value of randomize_va_space, the address was still not randomised，I guess it's probably for efficiency, The function of Address Space Layout Randomization of the kernel is removed, or the current platform does not support this function at all.

ISEpwn have a problem

[+] Picked port 32801 to receive the shell
[+] Creating AMF payload...
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Exception in thread "main" java.lang.IllegalAccessError: class uk.co.agileinfosec.acsflex.ACSFlex (in unnamed module @0x6b162892) cannot access class sun.rmi.transport.tcp.TCPEndpoint (in module java.rmi) because module java.rmi does not export sun.rmi.transport.tcp to unnamed module @0x6b162892
at uk.co.agileinfosec.acsflex.ACSFlex.generateUnicastRef(ACSFlex.java:26)
at uk.co.agileinfosec.acsflex.ACSFlex.main(ACSFlex.java:11)
ISEpwn.rb:141:in binread': No such file or directory @ rb_sysopen - /tmp/d20231212-361622-oix3mk/payload.ser (Errno::ENOENT) from ISEpwn.rb:141:in block in

'
from /usr/lib/ruby/3.1.0/tmpdir.rb:96:in mktmpdir' from ISEpwn.rb:130:in '

Great research, just wanted to say I liked it.

IBM have always been pretty scummy with regards to how they handle bug findings. Since there's no "comment section" to your guide, I just wanted to tell you I enjoyed the writeup and the code. Don't let vendor responses annoy you. I find that at least 1 in 4 vendors respond pathetically with regards to being presented bug findings. Doesn't make what you've found any less interesting or your research any less meaningful. Good stuff man.

ISEpwn.rb connection failed

The connection failed. What's wrong with this script? Or is my configuration problem. Can you answer it?

Could I share your on Youtube?

Hi Pedrib, I have created channel for CVE videos where I explain latest CVE and upload PoC.
I would like to upload your new vulnerability CVE video Micro Focus Operations Bridge Manager. I will mention credit in video and description box. Could I share your video on YouTube channel?

I have shared your tibco data virtualization vulnerability video on our channel.

Youtube channel Link : @Rapidsafeguard

Thank you.

Could I share your video on Youtube?

Hi Pedrib, I have created channel for CVE videos where I explain latest CVE and upload PoC. I will mention your name/github in video and description box. Could I share your video on my youtube channel?

Youtube channel Link : @Rapidsafeguard

Thank you.

lcms1.19 PoC

dear sir,
I am a fresh man and i want to know more about cve-2013-4276. i have read your patch but i don't know how to make a Poc. do you have a more specify article about lcm1.19 or can you send me a poc.
thans very much