SCRT Team Blog

Area 41

Après une année d’absence, les Hashdays reviennent avec un nouveau nom, une nouvelle localisation et des nouvelles dates.

La conférence se passait les 2 et 3 juin 2014 au Komplex 457 de Zurich.

PHDays Finals 2014 Homepage + Breadcrumbs Tasks Writeup

We’re going to look at two of the tasks of the PHDays finals, namely breadcrumbs which we solved and homepage, which unfortunately we were not able to solve during the CTF, though the solution seems to be correct. If you have any additional information on this particular task, I’d love to have your comments : @plopz0r.

Finales PHDays 2014

S’étant qualifiés en ligne pour les finales, quelques ingénieurs de SCRT se sont rendus à Moscou pour participer avec l’équipe “w3stormz” à la finale du concours de piratage éthique PHDays.

Neo4j – “Enter the GraphDB”

Following interest for NoSQL (see MongoDB exploit :D), this time I wanted to check Neo4j, the famous Graph Database. As you can see on their blog http://blog.neo4j.org/, Neo4j is really active and updates come really often ! The v1 was released in 2010 and v2 in 2013 and I didn’t find any specific paper about security so it may be interesting… Don’t hesitate to correct me if I say something wrong !

Analyse d’un malware iOS : Unflod.dylib

Suite à la parution de commentaires sur /r/jailbreak concernant un malware ciblant iOS, je me suis dis qu’une analyse serait intéressante vu que cette plateforme est encore peu ciblée par ce type de menaces du à son architecture.

NeDi Remote Code Execution

During a recent intrusion test, we discovered that NeDi was used in our target infrastructure. Since this application’s source code is freely available on the developer’s website (www.nedi.ch) I thought I’d have a look and see whether it would be possible to take control of a server through it.

Remote Command Execution in HP TippingPoint Security Management System

During a recent security audit, SCRT discovered a TippingPoint SMS server that exposed a famously exploitable JBoss invoker to any unauthenticated user. By using this invoker, it is possible to upload new applications on the server that are then run with the permissions of the JBoss application server (which happens to be running as root in this case). The server can then be compromised entirely by uploading new files into the SMS application’s folder and then accessing them through a Web browser. This could be done with the help of a very practical tool called jimmix which makes it possible to invoke commands on a JBoss server from the command line.