Changes for page Application_Webkit

Last modified by Nicolas Gregoire on 2012/01/14 17:48
From version Icon 9.1 Icon
edited by Nicolas Gregoire
on 2012/01/14 00:30
Change comment: Upload new image ipad-tmp-owned.png
To version Icon 12.1 Icon
edited by Nicolas Gregoire
on 2012/01/14 00:33
Change comment: There is no comment for this version

Summary

Details

Icon Page properties
Content
... ... @@ -26,8 +26,14 @@
26 26  Webkit uses [[libxslt>>Engine_libxslt]] as its XSLT engine. Old versions were not restricting __write__ access by the engine to the file system, leading to a remotely exploitable vulnerability ([[CVE-2011-1774>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1774||rel="__blank"]]). This was patched in [[Changeset 79159>>http://trac.webkit.org/changeset/79159||rel="__blank"]] by adding appropriate calls to xsltSetSecurityPrefs().
27 27  
28 28  
29 -PoC included on the [[libxslt>>Engine_libxslt]] page demonstrate the vulnerability.
29 +PoC included on the [[libxslt>>Engine_libxslt]] page demonstrate the vulnerability :
30 30  
31 +[[image:macos-tmp-owned.png||style="display: block; margin-left: auto; margin-right: auto"]]
32 +
33 +
34 +
35 +[[image:ipad-tmp-owned.png||style="display: block; margin-left: auto; margin-right: auto"]]
36 +
31 31  == Meatsploit ==
32 32  
33 33  Two modules are included in Metasploit :
... ... @@ -39,5 +39,5 @@
39 39  
40 40  An exploit for HP webOS 3.x was developed. This exploit drops a backdoor which is later executed with root privileges at boot time. The exploit is composed of two files :
41 41  
42 -* [[webos-root-backdoor.xml>>attach:webos-root-backdoor.xml]] contains the configurable data (name and content of the destination file) and a processing instruction trigger the XSLT code
48 +* [[webos-root-backdoor.xml>>attach:webos-root-backdoor.xml]] contains the configurable data (name and content of the destination file) and a processing instruction triggering the XSLT code
43 43  * [[webos-root-backdoor.xsl>>attach:webos-root-backdoor.xsl]] reads the XML file and create the requested file on disk. This version overwrites a script located in /etc/default/ with a version including a reverse-shell based on netcat
Icon macos-tmp-owned.png
Author
... ... @@ -1,0 +1,1 @@
1 +xwiki:XWiki.NicolasGregoire
Size
... ... @@ -1,0 +1,1 @@
1 +12.4 KB
Content Icon