Re: [FD] Cisco ASA VPN - Zero Day Exploit

2016-02-22 Thread Joey Maresca
For folks who want code that runs, I did you all a favor, fixed the ident issues, removed unused libraries, fixed SSL certificate validation checks causing failures, fixed typos that prevent running, killed dead code, made sure it actually used the Port input. All while stripping out the unnecessar

Re: [FD] Cisco ASA VPN - Zero Day Exploit

2016-02-25 Thread Joey Maresca
According to Cisco it is CVE-2014-2120, which indicates that much like the code sort of gave away, it is a bad attempt by a 1337 hax0r to push their crappy 'exploitpack.com' instead of you know, finding anything useful. Indeed it is a damn XSS with minimal utility. The crappy code is just the icin

Re: [FD] RCE by abusing NAC to gain Domain Persistence.

2016-07-15 Thread Joey Maresca
Congratulations...2013 called and they want their attack back: https://pen-testing.sans.org/blog/2013/04/25/smb-relay-demystified-and-ntlmv2-pwnage-with-python/ On Sat, Jul 9, 2016 at 7:45 AM, Alexander Korznikov wrote: > link: > http://www.korznikov.com/2016/07/rce-by-abusing-nac-to-gain-doma