Suite à la parution de commentaires sur /r/jailbreak concernant un malware ciblant iOS, je me suis dis qu’une analyse serait intéressante vu que cette plateforme est encore peu ciblée par ce type de menaces du à son architecture.
Continue reading Analyse d’un malware iOS : Unflod.dylibMonth: April 2014
NeDi Remote Code Execution
During a recent intrusion test, we discovered that NeDi was used in our target infrastructure. Since this application’s source code is freely available on the developer’s website (www.nedi.ch) I thought I’d have a look and see whether it would be possible to take control of a server through it.
Continue reading NeDi Remote Code ExecutionRemote Command Execution in HP TippingPoint Security Management System
During a recent security audit, SCRT discovered a TippingPoint SMS server that exposed a famously exploitable JBoss invoker to any unauthenticated user. By using this invoker, it is possible to upload new applications on the server that are then run with the permissions of the JBoss application server (which happens to be running as root in this case). The server can then be compromised entirely by uploading new files into the SMS application’s folder and then accessing them through a Web browser. This could be done with the help of a very practical tool called jimmix which makes it possible to invoke commands on a JBoss server from the command line.
Continue reading Remote Command Execution in HP TippingPoint Security Management System