lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <AANLkTi=fp6kAB8FfC_c3p_zOCjVom=gu4+EqUFdTkGfz@mail.gmail.com>
Date: Mon, 22 Nov 2010 23:39:37 +0100
From: niekt0 <niekt0@...teria.sk>
To: bugtraq@...urityfocus.com
Subject: Juniper VPN client rdesktop clickhack

Juniper VPN client rdesktop clickhack
================================
discovered by niekt0@...teria.sk

PRODUCT: Juniper VPN client + Windows remote desktop (or console access)

VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)

EXPOSURE: Remote code execution (SYSTEM privileges)

SYNOPSIS
========
By simple clicking it is possible to spawn a
Internet Explorer instance on rdesktop session
before authentication.
Account on target server is not required.

PROOF OF CONCEPT
================
If small blue icon "network logon" is available in right down corner,
system may be vulnerable (windows vista & 7).
Click on the icon and keep clicking like a real power user until
you get your explorer.
Probably at least one VPN or Dial-UP connection must be defined.
Illustrated guide is available at
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/

WORKAROUND
==========
None known.

VENDOR RESPONSE
===============
Not contacted. (try calling "helpdesk")

NOTICE
======
It is not really clear, if this is only juniper issue.
After third click, ale spawned screens are legitimate windows menu.
According to some guides it should be possible to create
"network logon" icon just by setting Windows. However,
I was not able to do so, at least not in Windows 7 ultimate.

Thanks to #brmlab, biiter

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ