Showing 1 - 2 of 2

Files from Jihui Lu

First Active	2015-08-19
Last Active	2015-08-19

Flash Broker-Based Sandbox Escape Via Timing Attack Against File Moving: Posted Aug 19, 2015; Authored by Jihui Lu; FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions. There is a race condition in FlashBroker BrokerMoveFileEx method. This race can be won by using an oplock to wait for the point where the BrokerMoveFileEx method opens the original file and then making destination to be a junction.; tags | exploit, arbitrary; systems | linux; advisories | CVE-2015-3081; SHA-256 | 4a8cd33a5f101e483a330b62c04d5e4cf5d733d46fdcb20efda5eb7f32e33f84; Download | Favorite | View

Flash Broker-Based Sandbox Escape Via Unexpected Directory Lock: Posted Aug 19, 2015; Authored by Jietao Yang, Jihui Lu; FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions. There is a bad check in FlashBroker BrokerCreateFile method and BrokerMoveFileEx method. FlashBroker uses CreateFile to open the destination folder for check. If CreateFile fails, the destination will be considered as a valid path. However, FlashBroker uses dwShareMode as 0 in CreateFile, which make CreateFile always fail if handle of the destination folder is held by other.; tags | exploit, arbitrary; systems | linux; advisories | CVE-2015-3083; SHA-256 | 1833e423f195e8f2809219e0689a0b518a6badd8204abdb35e1d3ceaabc57452; Download | Favorite | View