Posts

Unquoted Service Path: How a Missing Pair of Quotes Can Hand Over SYSTEM Privileges

  Introduction Not every critical vulnerability lives inside an application's source code. Some of the most reliable local privilege escalation paths on Windows come from a single misconfigured line in the registry — no buffer overflow, no malicious input, no clever exploit chain. The Unquoted Service Path vulnerability is one of these: a decades-old, still-common misconfiguration that turns a missing pair of double quotes into a way for a standard user to run code as SYSTEM. This post walks through what's actually vulnerable, how Windows' path-parsing behavior creates the opening, how to find and reproduce the issue, and how to fix it for good. What's Actually Vulnerable — It's Not the Application's Code The first thing to understand is what isn't the problem. The application's executable — say, target.exe — is not buggy, not modified, and not touched in any way by this vulnerability. It sits safely on disk, completely unchanged, before, during...
Post a Comment
Read more

DirtyCred : CVE-2022-2588

Image
  A vulnerability in the Linux kernel that allows data to be overwritten in arbitrary read-only files. Since unprivileged processes can inject code into parent processes, this vulnerability can lead to privilege escalation.  DirtyCred is a kernel exploit concept that exploits the heap memory reuse mechanism to obtain high privilege. This vulnerability is similar to the DirtyPipe  vulnerability ( CVE-2022-0847 ) impacting Linux kernel versions 5.8 and later. The attack includes 3 steps: 1.  Free an in-use unprivileged credential 2. Allocate privileged credentials in the free memory slot by triggering a privileged userspace process such as su, mount, or sshd 3. Operate as a privileged user Exploit in action: 1.      Login to the vulnerable machine and check the kernel version “ uname -a ” {The exploit works on most Centos 8 kernels higher than linux-4.18.0-305.el8 and most ubuntu 20 kernels higher than 5.4.0-87.98 and 5.11.0-37.41} 2. ...
Post a Comment
Read more

Unrestricted File Uploads

Image
Uploading is the transmission of a file from one computer system to another, usually a larger computer system. For instance, a job portal would allow a user to upload a resume and certificates whereas a banking website would allow a user to upload supporting documentation such as identity, address, and income proof. What is  Unrestricted File Upload ? If the File Upload functionality is not properly designed, this might bring up the danger. An attacker can take advantage of this functionality and upload executable codes in file formats such as PHP file, JavaScript, and exe, which could attack client machines or the network by uploading viruses, worms, or trojan horses.  This is what is known as file upload vulnerability. Types of File Upload Vulnerability : Local file upload vulnerability - A local file upload vulnerability is a vulnerability where an application allows a user to upload a malicious file directly which is then executed. Remote file upload vulnerability - A rem...
1 comment
Read more

XML Injection

Image
  XML injection is an attack technique used to manipulate or compromise the logic of an XML application or service.It allows an attacker to inject malicious and/or unexpected input that can break XML logic. Depending on the functionality and XML usage of an application, a successful XML injection may cause unauthorized access to resources and sensitive data disclosure. What is XML? ✔ XML stands for eXtensible Markup Language.  ✔ It is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. It is  designed to store and transport data. XML is  extensible and hence can be tailored according to the application. ✔ XML uses a tree-like structure (XML Tree structure) of tags and data where tags can be user defined. To interpret XML data, an application needs XML parser, also known as the XML processor. Example : An XML document is always descriptive and can be referred as XML tree structure. XML Ent...
Post a Comment
Read more