Detecting CVE-2018-16983 (NoScript Bypass)

MORE INFO: https://nvd.nist.gov/vuln/detail/CVE-2018-16983

 

The following post is regarding information which is obviously quite old.


As a long time NoScript user, I was quite alarmed to see a tweet put out by Zerodium detailing an extremely simple exploit that tricks NoScript into allowing Javascript to be executed.

I consider NoScript necessary for a safe browsing experience. However, the real concern is for those whose physical safety relies on the security and privacy provided by the Tor Browser, which is by extension affected by this critical flaw.
 

Unfortunately, I was unable to locate a version of NoScript (prior to version 5.1.8.7) that is vulnerable.

In any case, I am releasing the following Snort rule in hopes that someone may benefit from it.

 

alert tcp any any -> any any (msg:"EXTERNAL_NET CVE-2018-16938 NoScript Content-Type Bypass"; content:"text/html\;/json"; sid:1; rev:1;)


Fortunately, we may still the efficacy of this rule using netcat.


A stripped-down Snort configuration file was written for this exampe, as shown above.



Tcpdump is listening on the loopback interface, dumping traffic to a file named 'noscript.pcap'.


 

We created a simple text file as a proof of concept to demonstrate the exploit. The contents of the file are piped to a netcat listener on port 4444. Netcat is then reused to connect to port 4444, causing the exploit to be sent over the loopback interface.



Snort is then directed to log to the current directory, load the configuration file from the current directory, and read noscript.pcap from the current directory.



When the generated alert file is opened, we see that Snort was successfully able to detect the exploit.





Comments

Post a Comment

Popular posts from this blog

Vulnhub Matrix: 1 Walkthrough

Image
Starting with a ping scan we find Matrix at 192.168.19.192 A service scan reveals 3 open ports A base64 encoded string can be found in the source of the web root on port 31337 Decoding this string reveals a command that redirects a quote to a file named 'Cypher.matrix' The server's response to http://matrix:31337/Cypher.matrix is a brainfuck sample I then used https://copy.sh/brainfuck to interpret the code This reveals a set of credentials, where the last 2 characters of the password are unknown I then used crunch to create a list of suffixes to use in combination with 'k1ll0r' Awk was then used to prepend 'k1ll0r' to the wordlist The list is now ready to be used in a dictionary attack against ssh using ncrack ncrack found the credentials to be 'guest:k1ll0r7n' We are now able to login to ssh using these credentials! Attempts to execute commands reveal that we are stuck in a restricted s
Read more

Hack the Box - Sauna

Image
Sauna is a Windows machine at 10.10.10.175 using nmap to scan for open ports shows that Sauna's domain is EGOTISTICALBANK.LOCAL Sauna is running an IIS web server on port 80 the web root links to /about.html, this page reveals employee names we can now create a wordlist based on common enterprise naming conventions and these names this list can now be used with kerbrute to enumerate valid domain users the only user found was 'fsmith' as stated https://www.tarlogic.com/en/blog/how-to-attack-kerberos/ , GetNPUsers.py is used to harvest non-preauth AS-REP responses. This may reveal hashes for users with this attribute. we now have fsmith's hash in Kerberos 5 AS-REP format johntheripper can be used to crack this hash with the rockyou.txt wordlist johntheripper determined fsmith's password to be 'Thestrokes23' evil-winrm is a tool which takes advantage of the windows remote management service we can use it to start a ses
Read more