GoSecure Blog
WSUS Attacks Part 2: CVE-2020-1013 a Windows 10 Local Privilege Escalation 1-Day
This is the second blog post in a series discussing attacks leveraging Windows Server Update Services (WSUS).
After having revived the classic 2015 WSUS attack in part 1 of the series by creating a tool, PyWSUS, that works on Windows 10, we started to wonder if the module could be used for other purposes.
We often see deployments using WSUS where users can set the local proxy for their session. If the WSUSpect-proxy module is nothing more than a MITM proxy that modifies some parts of the traffic and we also have the power to proxy our local traffic, we therefore have the power to run WSUSpect-proxy locally to run code as System on our asset.
WSUS Attacks Part 1: Introducing PyWSUS
At GoSecure, we work hard to illustrate the impact of our pentest findings on our clients’ security posture. In the past few years, we found numerous organizations with vulnerable Windows Server Update Services (WSUS) deployments. However, no tool (reliable enough to use during engagements) was available to show to clients the risks associated with this critical vulnerability. For these reasons, in the next series of blog posts, we will describe the vulnerability, explore its attack vectors and release new tools to weaponize the vulnerability, and subsequently, demonstrate its impact.
Slipups in Cybersecurity: Defenders’ and Attackers’ Perceptions on Security Measures
As part of our research on Cybersecurity Perceptions Versus Reality, we developed a survey in collaboration with Serene-risc, a knowledge mobilization network in cybersecurity based in Canada, on the perceptions and practices of cybersecurity professionals. The survey aimed at understanding how defenders perceive specific security measures and whether these measures were implemented in their respective organizations. We then combined the survey results with our penetration testing experience to confront two perspectives: the defenders’ and the pentesters’, the latter standing as proxies for real attackers. After finding incongruities in the survey results and the penetration testers’ experience, summarized in a series of blogposts, we then compared perceived organizational security maturity versus implemented security measures. We also compiled the top 10 vulnerabilities/missing controls found in 65 penetration testing reports. This blog post summarizes the findings of these two analyses, which uncover potential biases in the defenders’ mindset and important information gaps. It also provides a list of pro-tips to overcome the most common attack vectors found during penetration tests.
Forget Your Perimeter:
RCE in Pulse Connect Secure (CVE-2020-8218)
A vulnerability discovered by GoSecure on Pulse Secure Connect, an SSL VPN, allows an authenticated user to run arbitrary code remotely (RCE). The RCE requires to have admin privileges but can also be triggered by an unsuspecting victim simply clicking on a malicious link. Several other vulnerabilities of varying severities were also found and disclosed, however only the RCE was fixed as of version 9.1R8 and will therefore be the focus of this blog post. We will release the details of the remaining vulnerabilities in a later blog post.
Endpoint Visibility: Discrepancies in Defenders’ Perception and Pentesters’ Experience
As part of our research on Cybersecurity Perceptions Versus Reality, we developed a survey in collaboration with Serene-risc, a knowledge mobilization network in cybersecurity based in Canada, on the perceptions and practices of cybersecurity professionals. The survey aimed at understanding how defenders perceive specific security measures and whether these measures were implemented in their respective organizations. We then combined the survey results with our penetration testing experience to confront two perspectives: the defenders’ and the pentesters’, the latter standing as proxies for real attackers. This blog post summarizes the results related to endpoint visibility.
