Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
summary
Claims exploit chains deliver pre-auth RCE against major SSL VPNs (FortiGate and Pulse/Pearl Secure), affecting millions; techniques include VM memory forensics and live patching to jailbreak appliances, a WebVPN JavaScript heap overflow that overwrites an SSL connection structure and handshake pointer, and a readable web session cache with plaintext passwords plus a magic reset key backdoor. Chain on Pulse uses an HTML5 file-read to leak private keys and cached credentials then a Perl/PSF bypass via tcpdump stderr injection to achieve RCE. Demonstrations include reliable reverse shells (minutes per attempt), client-side persistence via local login scripts, and successful disclosure/patch timelines (vendors patched; Twitter took ~30 days).
AI-written summary · about
chapters (9)
- 0:00Introduction and logistics
- 1:30SSL VPN security landscape
- 3:37Research methodology and targets
- 8:55Jailbreaking virtual appliances
- 12:06Attack vectors in SSL VPNs
- 16:49FortiGate case study
- 29:37Pulse Secure case study
- 37:29Twitter security analysis
- 41:33Weaponization and defense
related talks
29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
50mPwnie Awards 2016
39mDiving into Windows Remote Access Service for Pre-Auth Bugs
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
45mOutside the box: pwning IoT devices through their applications
39mSeasCoASA: Exploiting A Small Leak In A Great Ship
56mModern Web Vulnerabilities 2020
55m2024 Security BSides // John Hammond