Exploit the possiblities

Juniper VPN Client rdesktop Click Hack

Juniper VPN Client rdesktop Click Hack
Posted Nov 22, 2010
Authored by niekt0

Juniper VPN client with remote desktop lets an attacking spawn Internet Explorer prior to authentication.

tags | exploit, remote
systems | juniper
MD5 | 0333e86622746f8572e53c7115b95635

Juniper VPN Client rdesktop Click Hack

Change Mirror Download
Juniper VPN client rdesktop clickhack
================================
discovered by niekt0@hysteria.sk

PRODUCT: Juniper VPN client + Windows remote desktop (or console access)

VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)

EXPOSURE: Remote code execution (SYSTEM privileges)

SYNOPSIS
========
By simple clicking it is possible to spawn a
Internet Explorer instance on rdesktop session
before authentication.
Account on target server is not required.

PROOF OF CONCEPT
================
If small blue icon "network logon" is available in right down corner,
system may be vulnerable (windows vista & 7).
Click on the icon and keep clicking like a real power user until
you get your explorer.
Probably at least one VPN or Dial-UP connection must be defined.
Illustrated guide is available at
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/

WORKAROUND
==========
None known.

VENDOR RESPONSE
===============
Not contacted. (try calling "helpdesk")

NOTICE
======
It is not really clear, if this is only juniper issue.
After third click, ale spawned screens are legitimate windows menu.
According to some guides it should be possible to create
"network logon" icon just by setting Windows. However,
I was not able to do so, at least not in Windows 7 ultimate.

Thanks to #brmlab, biiter

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close