SeasCoASA: Exploiting A Small Leak In A Great Ship

on YouTube ↗39m

" summary

A new 0day in Cisco ASA’s WebVPN AnyConnect (embedded Lua 5.0.2) uses an forprep OOB to gain arbitrary PC in the Lua VM, then builds arbitrary read/write by faking Lua objects and constants, and stabilizes exploitation with heap fengshui >90% despite ASA’s custom heap metadata. The exploit leaks heap, libc and stack, locates a pthread_cond_timedwait return, pivots stack to heap, ROPs to call socks_proc_init and shell_execute, and spawns a root shell in demo; mitigation: disable loadstring.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 1:30What is Cisco ASA
3. 6:46Web VPN Lua vulnerabilities
4. 10:40Lua bytecode basics
5. 16:00Arbitrary PC control
6. 20:26Arbitrary address read
7. 26:49Arbitrary address write
8. 30:51Ubuntu exploitation
9. 31:13Cisco ASA heap differences
10. 34:02Bypassing Linux monitor
11. 36:52ROP and reverse shell
12. 38:41Patching the vulnerability

" related talks

• 46mInfiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNsOrange Tsai, Meh Chang · Black Hat USA 2019
• 37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-DaysBen Seri, Barak Hadad · Black Hat Asia 2020
• 50mPwnie Awards 2016Black Hat USA 2016
• 39mDiving into Windows Remote Access Service for Pre-Auth BugsYuki Chen · Black Hat USA 2023
• 29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS LibraryNiels Buchmann, Thomas Kemmer · Black Hat Asia 2022
• 51mNew Exploit Technique In Java Deserialization AttackYongtao Wang, Lucas Zhang, Kunzhe Chai · Black Hat Europe 2019
• 46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OTJos Wetzels · Black Hat Asia 2023
• 47mBLEEDINGBIT: Your APs Belong to UsBen Seri, Dor Zusman · Black Hat Europe 2018