what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Flash Broker-Based Sandbox Escape Via Timing Attack Against File Moving

Posted Aug 19, 2015

Authored by Jihui Lu

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions. There is a race condition in FlashBroker BrokerMoveFileEx method. This race can be won by using an oplock to wait for the point where the BrokerMoveFileEx method opens the original file and then making destination to be a junction.

tags | exploit, arbitrary

systems | linux

advisories | CVE-2015-3081

SHA-256 | 4a8cd33a5f101e483a330b62c04d5e4cf5d733d46fdcb20efda5eb7f32e33f84

Download | Favorite | View

Related Files

No related files