exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 76 - 100 of 113 RSS Feed

Files from Matthias Deeg

First Active2014-09-01
Last Active2023-08-16
CHERRY B.UNLIMITED AES JD-0400EU-2/01 Keystroke Injection
Posted Jul 29, 2016
Authored by Matthias Deeg, Gerhard Klostermeier | Site syss.de

CHERRY B.UNLIMITED AES version JD-0400EU-2/01 suffers from cryptographic issues and keystroke injection vulnerabilities.

tags | advisory, vulnerability
SHA-256 | 8d783cf17d0aeb744bc415fcc3f5209b17a3b0f1fec084fd4a66af59968c352f
CHERRY B.UNLIMITED AES JD-0400EU-2/01 Insufficient Protections
Posted Jul 29, 2016
Authored by Matthias Deeg, Gerhard Klostermeier | Site syss.de

CHERRY B.UNLIMITED AES version JD-0400EU-2/01 suffers from insufficient protection of code (firmware) and data (cryptographic key).

tags | exploit
SHA-256 | f1ff00bde501a530edae9d601cb3986ee2e1274ad3e4408f7af68bf525e7d5f6
perfact::mpa Persistent Cross Site Scripting
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that different functions of the web application perfact::mpa are prone to persistent cross-site scripting attacks due to insufficient user input validation.

tags | exploit, web, xss
SHA-256 | 3de9ebd0a6d7d71bc98db0dbfca47d2036e6cb55c8c5730f0710bc34b796c3d7
perfact::mpa Insecure Direct Object Reference
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that different resources of the web application perfact::mpa can be directly accessed by the correct URL due to improper user authorization checks. That is, unauthorized users can access different functions of the perfact::mpa web application.

tags | exploit, web
SHA-256 | 9ddb061b9a0b9ab1cc362d42499ce13c2180721efde797ef3793f8df0246c9b2
perfact::mpa Open Redirect
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that the web application perfact:mpa accepts user-controlled input via the URL parameter "redir" that can be used to redirect victims to an arbitrary site which simplifies so-called phishing attacks.

tags | exploit, web, arbitrary
SHA-256 | 1240006c91f037df38cbcd2cbcc641d8f0ac32f2445fa4d65f159730f692deb7
perfact::mpa Insecure Direct Object Reference
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that any logged in user is able to download valid VPN configuration files of arbitrary existing remote sessions. All an intruder needs to know is the URL with the dynamic parameter "brsessid". Due to the modification of this incremental increasing integer value, it is possible to enumerate and download a valid VPN configuration file for every existing remote session.

tags | exploit, remote, arbitrary
SHA-256 | 0395cba8a67f491b8450abca96173ea16da49abe7cd6b3f2d88cf3e02d04710c
perfact::mpa Cross Site Request Forgery
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

The tested web application perfact::mpa offers no protection against cross-site request forgery (CSRF) attacks. This kind of attack forces end users respectively their web browsers to perform unwanted actions in a web application context in which they are currently authenticated.

tags | exploit, web, csrf
SHA-256 | 2b1425b7f0db4e14f7b33d9778f0a59b7e1c1b93b42771c51ac1b69ae8116af3
perfact::mpa Insecure Direct Object Reference
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

SySS GmbH found out that unauthorized users are able to download arbitrary files of other users that have been uploaded via the file upload functionality. As the file names of uploaded files are incremental integer values, it is possible to enumerate and download all uploaded files without any authorization.

tags | exploit, arbitrary, file upload
SHA-256 | b599bdab77ad574016e3a7c31c5ca968b8a2daac827a37f269eb26e143e5fe99
perfact::mpa Reflected Cross Site Scripting
Posted Mar 1, 2016
Authored by Matthias Deeg, Sven Freund | Site syss.de

SySS GmbH found out that the request new user and translation functionalities of the web application perfact::mpa are prone to reflected cross-site scripting attacks.

tags | exploit, web, xss
SHA-256 | c41cae5aadb2813a38940d61e582bbde74c6eac30c32083652ec5ccf789a03e0
Password Safe And Repository Enterprise 7.4.4 Build 2247 SQL Injection
Posted Oct 12, 2015
Authored by Matthias Deeg | Site syss.de

Password Safe and Repository Enterprise version 7.4.4 Build 2247 suffers from remote SQL injection and authentication bypass vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 912329f72ad8b3fa3e4c5025c1548e060893d43692df38044806d8bed8cc8a2b
Password Safe And Repository Enterprise 7.4.4 Build 2247 Crypto Issues
Posted Oct 12, 2015
Authored by Matthias Deeg | Site syss.de

Password Safe and Repository Enterprise version 7.4.4 Build 2247 suffers from insufficiently protecting credentials by using an unsalted MD5 hash for protection.

tags | exploit
SHA-256 | aa3f253285227ed11f229a3e22241cb871c5accd91980275c406e839bee0740f
Kaspersky Small Office Security 13.0.4.233 Authentication Bypass
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

By analyzing the password-based authentication for unloading the Kaspersky Small Office Security protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe (actually within the module avpmain.dll), which runs or can be run in the context of the current Windows user, who can also be a standard, limited user. This fact allows a further analysis and the manipulation of the password comparison during runtime without administrative privileges, as every user is able to debug and manipulate the processes running with her user privileges. In order to bypass the password-based authentication to deactivate the protection of Kaspersky Small Office Security in an unauthorized manner, an attacker only has to patch this password comparison, so that it always returns true, for example by comparing the correct unload password with itself or by modifying the program control flow.

tags | advisory
systems | windows
SHA-256 | f56f7f4ad60158ad733a4f73ea4635638de505c45f25ef6e8047b7a8a8e5a7ce
Kaspersky Endpoint Security For Windows 8.1.0.1042 / 10.2.1.23 Unsalted Hash
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that the admin password for protecting different functions of the Kaspersky Endpoint Security software, like managing backups or stopping protection services, is stored as raw, unsalted MD5 hash value in the Windows registry.

tags | exploit, registry
systems | windows
SHA-256 | 8a7c74b5cbb75ec15cb0f9a3938c69c29a10c97069f7ba7e4871500310fbc21c
Kaspersky Endpoint Security For Windows 8.1.0.1042 / 10.2.1.23 Authentication Bypass
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

By analyzing the password-based authentication for unloading the Kaspersky Endpoint Security for Windows protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe, which runs or can be run in the context of the current Windows user, who can also be a standard, limited user. This fact allows a further analysis and the manipulation of the password comparison during runtime without administrative privileges, as every user is able to debug and manipulate the processes running with her user privileges. In order to bypass the password-based authentication to deactivate the protection of Kaspersky Endpoint Security for Windows in an unauthorized manner, an attacker only has to patch this password comparison, so that it always returns true, for example by comparing the correct unload password with itself or by modifying the program control flow.

tags | advisory
systems | windows
SHA-256 | 2d0462fc09a2607d7ee16b44834d6ec901e61cace833e168b9102654473f32bc
Kaspersky Anti-Virus 15.0.1.415 Unsalted Hash
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that the administrator password for protecting different functions of the Kaspersky Anti-Virus software, like managing backups or stopping protection services, is stored as raw, unsalted MD5 hash value in the Windows registry.

tags | exploit, registry, virus
systems | windows
SHA-256 | ea3ba68c2445280d74bd945ec27706a66dc51e94a333bf175519fd2093dc8a5e
Kaspersky Anti-Virus 15.0.1.415 Authentication Bypass
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

By analyzing the password-based authentication for unloading the Kaspersky Anti-Virus protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe (actually within the used module shell_service.dll), which runs or can be run in the context of the current Windows user, who can also be a standard, limited user. This fact allows a further analysis and the manipulation of the password comparison during runtime without administrative privileges, as every user is able to debug and manipulate the processes running with her user privileges. In order to bypass the password-based authentication to deactivate the protection of Kaspersky Anti-Virus in an unauthorized manner, an attacker only has to patch this password comparison, so that it always returns true, for example by comparing the correct unload password with itself or by modifying the program control flow.

tags | advisory, virus
systems | windows
SHA-256 | 554441351ca1092de802550ffa43352381d6c7482cd5373295ac4d9310a088aa
Kaspersky Internet Security 15.0.2.361 Unsalted Hash
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that the administrator password for protecting different functions of the Kaspersky Internet Security software, like managing backups or stopping protection services, is stored as raw, unsalted MD5 hash value in the Windows registry.

tags | exploit, registry
systems | windows
SHA-256 | 1de91bfb49d3f0e7cd83b46395378df631ea2882433f6e879dd0b109e920970e
Kaspersky Internet Security 15.0.2.361 Authentication Bypass
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

By analyzing the password-based authentication for unloading the Kaspersky Internet Security protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe (actually within the used module shell_service.dll), which runs or can be run in the context of the current Windows user, who can also be a standard, limited user. This fact allows a further analysis and the manipulation of the password comparison during runtime without administrative privileges, as every user is able to debug and manipulate the processes running with her user privileges. In order to bypass the password-based authentication to deactivate the protection of Kaspersky Internet Security in an unauthorized manner, an attacker only has to patch this password comparison, so that it always returns true, for example by comparing the correct unload password with itself or by modifying the program control flow.

tags | advisory
systems | windows
SHA-256 | 15965bde1ae5e842c07d11a1778e4a501e0cade94ff4d28bf4c19ef058f87c30
Kaspersky Total Security 15.0.1.415 Unsalted Hash
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that the administrator password for protecting different functions of the Kaspersky Total Security software, like managing backups or stopping protection services, is stored as raw, unsalted MD5 hash value in the Windows registry.

tags | exploit, registry
systems | windows
SHA-256 | bb0133dfea19da32e1adc63779e910d52d60547b085a50a1b291be2d89764758
Kaspersky Total Security 15.0.1.415 Authentication Bypass
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

By analyzing the password-based authentication for unloading the Kaspersky Total Security protection, the SySS GmbH found out, that the password comparison is done within the process avp.exe (actually within the used module shell_service.dll), which runs or can be run in the context of the current Windows user, who can also be a standard, limited user. This fact allows a further analysis and the manipulation of the password comparison during runtime without administrative privileges, as every user is able to debug and manipulate the processes running with her user privileges. In order to bypass the password-based authentication to deactivate the protection of Kaspersky Total Security in an unauthorized manner, an attacker only has to patch this password comparison, so that it always returns true, for example by comparing the correct unload password with itself or by modifying the program control flow.

tags | advisory
systems | windows
SHA-256 | b12d3e03fd22c3e9658d41432c039d1d5f73a44ea1032e75289b6f1261bafbdf
Kaspersky Small Office Security 13.0.4.233 Unsalted Hash
Posted Oct 1, 2015
Authored by Matthias Deeg, Sven Freund | Site syss.de

The SySS GmbH found out that the administrator password for protecting different functions of the Kaspersky Small Office Security software, like managing backups or stopping protection services, is stored as raw, unsalted MD5 hash value in the Windows registry.

tags | exploit, registry
systems | windows
SHA-256 | f9313aec301a7c3586f846924c4e87db8f5ea73a5ca80b220b990f5e9dca66c1
Netop Remote Control 11.52 / 12.11 Credential Issue
Posted Aug 25, 2015
Authored by Matthias Deeg | Site syss.de

Netop Remote Control versions 11.52 and 12.11 suffer from hard-coded cryptographic key and insufficiently protected credential issues.

tags | exploit, remote
SHA-256 | bd92784b38a1c301a6674b12b72e327934aa4b895b78f8ea87bbefcaaebfb4a3
Privilege Escalation Via Client Management Software Part 2
Posted Jul 14, 2015
Authored by Matthias Deeg

This whitepaper deals with local privilege escalation attacks via exploiting vulnerabilities in the client management software Empirum.

tags | paper, local, vulnerability
SHA-256 | 976d9cf9503cd3beaddb146f9507ee3529d1b82a6712b2cdc7b7ce1b67ac583a
Privilege Escalation Via Client Management Software Part 1
Posted Jul 14, 2015
Authored by Matthias Deeg

This whitepaper deals with local privilege escalation attacks via exploiting vulnerabilities in the client management software FrontRange DSM.

tags | paper, local, vulnerability
SHA-256 | 08ece3edf3aa93e1fde88c8522d035bcfa58b66f09c695d34999e853118ef852
BullGuard Antivirus 15.0.297 Authentication Bypass
Posted May 7, 2015
Authored by Matthias Deeg | Site syss.de

BullGuard Antivirus version 15.0.297 suffers from an authentication bypass vulnerability.

tags | advisory, bypass
SHA-256 | 5112dee77c43095b3a49dcb2330e479154fb9f8936b7496f27a233d75f4262a3
Page 4 of 5
Back12345Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close