Security Research

A collection of files related to my personal security research. Additional content will be posted on my blog https://blog.mirch.io.

Tools

Vulnerabilities

• CVE-2020-3950 - VMware Fusion Elevation of Privilege Vulnerability. PoC: CVE-2020-3950.sh.

• CVE-2019-19954 - Signal Desktop Windows Elevation of Privilege Vulnerability. Detailed write-up: https://blog.mirch.io/signal-desktop-windows-lpe

• CVE-2019-3466 - Debian / Ubuntu PostgreSQL Privilege Escalation via pg_ctlcluster. CVE-2019-3466-stage1.sh CVE-2019-3466-stage2.sh. Detailed write-up: https://blog.mirch.io/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation. Debian Advisory: DSA-4568. Ubuntu Advisory: 4194-1

• CVE-2019-12571 - PIA macOS Arbitrary File Overwrite. CVE-2019-12571.txt.

• CVE-2019-12572 - PIA Windows Privilege Escalation: Malicious OpenSSL engine. CVE-2019-12572.txt. Walk through https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/

• CVE-2019-12573 - PIA Linux, macOS Arbitrary File Overwrite. CVE-2019-12573.txt.

• CVE-2019-12574 - PIA Windows Privilege Escalation: DLL Injection. Detailed write-up: CVE-2019-12574.txt.

• CVE-2019-12575 - PIA Linux, macOS Privilege Escalation: Shared Object Injection. CVE-2019-12575.txt.

• CVE-2019-12576 - PIA macOS Privilege Escalation: Untrusted Search Path. CVE-2019-12576.txt.

• CVE-2019-12577 - PIA macOS Privilege Escalation: Insecure umask. CVE-2019-12577.txt.

• CVE-2019-12578 - PIA Linux Privilege Escalation: Argument Injection. CVE-2019-12578.txt.

• CVE-2019-12579 - PIA Linux, macOS Privilege Escalation: Command Injection. CVE-2019-12579.txt.

• CVE-2019-6617 - F5 BIG-IP Resource Administrator Privilege Escalation. CVE-2019-6617.txt. F5 Advisory: https://support.f5.com/csp/article/K38941195

• CVE-2019-6724 - Barracuda VPN Client Privilege Escalation on Linux and macOS. PoC: CVE-2019-6724.sh. Detailed write-up: CVE-2019-6724: Barracuda VPN Client Privilege Escalation on Linux and macOS. Barracuda VPN Client Release Notes

• CVE-2018-1792.sh - IBM MQ can allow an attacker to execute a privilege escalation attack on a local machine. PoC: CVE-2018-1792.sh. Detailed write-up: CVE-2018-1792 – IBM MQ Privilege Escalation: Fun with RUNPATH. IBM Advisory: ibm10734447

• CVE-2018-15332 - F5 BIG-IP APM client for Linux and macOS arbitrary file takeover vulnerability. Detailed write-up: CVE-2018-15332.txt. F5 Advisory: K12130880

• CVE-2018-5529, CVE-2018-5546 - F5 BIG-IP APM client for Linux and macOS vulnerability. Detailed write-up: CVE-2018-5529.txt. F5 Advisories: K52171282, K54431371

• CVE-2018-18629 - Privilege Escalation on Linux via keybase-redirector . PoC: CVE-2018-18629.sh. Detailed write-up: CVE-2018-18629: Keybase Linux privilege escalation. Keybase Advisory: Local Privilege Escalation on Linux via keybase-redirector (KB002)

• CVE-2018-19788 - PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command. PoC: CVE-2018-19788.sh. Detailed write-up: CVE-2018-19788 PoC – polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass. The Hacker News article: Warning! Unprivileged Linux Users With UID > INT_MAX Can Execute Any Command

• CVE-2018-18556 - VyOS Privilege escalation via sudo pppd for operator users. PoC: CVE-2018-18556.sh. Detailed write-up: CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users. Advisory: The "operator" level is proved insecure and will be removed in the next releases