Changes for page Application_Webkit

Last modified by Nicolas Gregoire on 2012/01/14 17:48

From version Icon 7.1 Icon
edited by Nicolas Gregoire
on 2012/01/13 23:57
Change comment: Upload new attachment webos-root-backdoor.xml
To version Icon 9.1 Icon
edited by Nicolas Gregoire
on 2012/01/14 00:30
Change comment: Upload new image ipad-tmp-owned.png

Summary

Details

Icon Page properties
Content
... ... @@ -28,7 +28,7 @@
28 28  
29 29  PoC included on the [[libxslt>>Engine_libxslt]] page demonstrate the vulnerability.
30 30  
31 -== Exploits ==
31 +== Meatsploit ==
32 32  
33 33  Two modules are included in Metasploit :
34 34  
... ... @@ -35,7 +35,9 @@
35 35  * a [[auxiliary>>http://www.metasploit.com/modules/auxiliary/server/webkit_xslt_dropper||rel="__blank"]] working on any non-sandboxed non-patched Webkit device
36 36  * an [[exploit>>http://www.metasploit.com/modules/exploit/windows/browser/safari_xslt_output||rel="__blank"]] plugin targeting Safari users with Admin privileges (because of the MOF trick)
37 37  
38 -An exploit for HP webOS is attached. This exploit drops a backdoor executed with root privileges at boot time :
38 +== HP webOS 3.x ==
39 39  
40 -* XML contains the payload : destination file name + file content. A reverse-shell based on netcat is added to the script
41 -* XSL reads the XML file and create the requested file on disk
40 +An exploit for HP webOS 3.x was developed. This exploit drops a backdoor which is later executed with root privileges at boot time. The exploit is composed of two files :
41 +
42 +* [[webos-root-backdoor.xml>>attach:webos-root-backdoor.xml]] contains the configurable data (name and content of the destination file) and a processing instruction trigger the XSLT code
43 +* [[webos-root-backdoor.xsl>>attach:webos-root-backdoor.xsl]] reads the XML file and create the requested file on disk. This version overwrites a script located in /etc/default/ with a version including a reverse-shell based on netcat
Icon ipad-tmp-owned.png
Author
... ... @@ -1,0 +1,1 @@
1 +xwiki:XWiki.NicolasGregoire
Size
... ... @@ -1,0 +1,1 @@
1 +11.9 KB
Content Icon