środa, 7 stycznia 2015

yammer.com - Same Origin Method Execution

SOME ;-) time ago@BenHayak talked about Same-Origin Method Execution on BlackHat EU. At the time of posting this article, there's no public whitepaper yet (only leaked slides) - that's why I'd love to share one of first posts that show this attack in action.

Yammer.com is part of Microsoft Bug Bounty for Online Services. During some research in used Flash files I found this one: video-js.swf (source).

Take a look to this piece of code:



As far as you probably know - the ExternalInterface is ActionScript class that allows (for example) to communicate Flash object with browser’s Javascript. First parameter is function name, that we want to call. As you can see - it’s readyFunction parameter (from GET), but it’s also sanitized with cleanEIString which looks like this:


So - only chars we are able to use is alphanumeric, underscore and a dot - to prevent Cross-Site Scripting. For example - if we’ll provide readyFunction=alert - our flash file will execute alert function, but we have no control over arguments (because we can't use brackets), so it’s useless for XSS purposes.

...and here is the place where we can start talking about Same-Origin Method Execution :-) Let take evil.com, that have hyperlink to vulnerable videoplayer. After clicking to this link, it opens the flash file in new tab, and next - redirect evil.com to yammer.com (in the same tab). From now on - newly opened tab have access to previous tab by window.opener (because they are both in Same Origin - yammer.com), and it’s also able to access DOM and execute functions in context of opened yammer.com page. 

The goal is to authorize user to some malicious application without his knowledge. Attack scenario will look this way:

1. User is visiting evil PoC site
2. He/she clicks on link which -in the end - redirect user to video player with readyFunction param described later
3. We’re redirecting Poc site to our yammer.com application - all we need to know is client_id - link example here: 


4. We need to wait few seconds to be 100% sure that redirect from point 3 happend (that's why I used proxy.php that sleeps and then returns 30x).
5. Flash Video Player will execute this readyFunction:

window.opener.new_message_popup.nextElementSibling.lastElementChild.firstChild.nextElementSibling.click()

...which is simply the “Allow” button + click() function :->

As you can imagine - this will cause clicking on the button and authorizing application to victim’s account, which is dangerous. :)

Proof of Concept goes here: http://ropchain.org/poc/yammer-some.html

...and demo:


183 komentarze:

  1. Nice! Just saw the BlackHat talk. A minor correction, readyFunction=alert isn't completely useless. @garethheyes have some interesting payloads that work without paranetsis, document.domain=name might pass forexample.

    OdpowiedzUsuń
  2. GBWhatsApp - It will help you to get rid of most of those restrictions that the official version imposes on you. In simple words, the gbwa is a modded application which has some extra features that you won’t be able to find in the stock version. Some of the most noteworthy and popular features of the gbwa mod are hiding blue tick, online status, last seen, theme customizations and the brand new auto-reply.

    Lucky Patcher app is an android tool to change permission on android apps, block ads, get free in app purchases from android apps and games. Lucky patcher can be used on android and also on PC or windows with the help of bluestacks.

    OdpowiedzUsuń
  3. Enjoyed reading the article above , really explains everything in detail,the article is very interesting and effective.Thank you and good luck for the upcoming articles.Data science training in Pune| Data science courses in pune

    OdpowiedzUsuń
  4. hello ,
    such a great article thanks for sharing , really you writte well article as always , thanks again for this amazing article


    gbwhatsapp

    OdpowiedzUsuń
  5. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  6. Nice Article…..
    Really appreciate your efforts
    Romantic Shayari

    OdpowiedzUsuń
  7. Use dual account with Gb whatsapp Apk Latest Application With free of cost.

    OdpowiedzUsuń
  8. Thanks For This Information please visit our website ApkGlo To Download fresh android apps.

    OdpowiedzUsuń
  9. GBWhatsapp It will help you to get rid of most of those restrictions that the official version imposes on you. In simple words, the gbwa is a modded application which has some extra features that you won’t be able to find in the stock version. Some of the most noteworthy and popular features of the gbwa mod are hiding blue tick, online status, last seen, theme customizations and the brand new auto-reply.

    OdpowiedzUsuń
  10. Lucky Patcher gives you unlimited in-game resources & removes ads from any type of android application.

    GBWhatsApp Apk:

    GBWhatsApp is the best version of Official WhatsApp.

    OdpowiedzUsuń
  11. Nice post. I learn something totally new and challenging on websites I stumbleupon every day. It's always useful to read through articles from other authors and practice something from other sites.
    Thanks for sharing this information with us. Download Free Xmod and information.
    .

    OdpowiedzUsuń
  12. Great information for new guy like me. This shows not only particular heck but also give idea about. Thanks for sharing this information. How to download instagram videos free

    OdpowiedzUsuń
  13. What a great article! Awesome tropic and Excellent Content. Thanks for Providing that very important information.
    PSC Result 2019
    PSC exam Result 2019
    JSC Result 2019
    JSC Result DPE

    OdpowiedzUsuń
  14. This game has more space so your gadget ought to contain more than 2GB RAM. More space guarantees that your game will run smooth and without hanging issue. Numerous different advances and high designs games like Dragon Ball Z, Call of Duty, NBA, Fifa, FarCry, and GTA additionally perfect with Happychick Emulator. You need to adhere to guidelines for establishment.
    happy chick
    happy chick apk
    happy chick download

    OdpowiedzUsuń
  15. Want to buy water purifier click here to get best deals bestpurifierguide.com

    OdpowiedzUsuń
  16. Such A nice post... thanks For Sharing !!Great information for new guy like Happy New year 2020

    OdpowiedzUsuń
  17. Download redbox tv apk for free and watch latest shows.

    OdpowiedzUsuń

  18. The Tutu App is the one of the best ios,android

    App store to get the tons of free app and game. Here the latest version of gta vice city apk of free.

    OdpowiedzUsuń

  19. the WhatsApp Plus APK is one of the best mod app for official WhatsApp Plus Download for free, get unlimited features of whatsapp plus for free. Here Click to download the latest version whatsapp plus apk.

    OdpowiedzUsuń

  20. The Tutu App download is the best app to download latest

    app and Apk for free so use now to TutuApp ios

    free App.

    OdpowiedzUsuń

  21. the panda helper apk is the best app to download latest app for free so download now panda app to unlock a many feature now download now.

    OdpowiedzUsuń
  22. very nice <a href=" http://motivation456.com/happy-new-year/happy-new-year.html>happy-new-year</a>

    OdpowiedzUsuń
  23. I really thank you for the valuable info on this great subject and look forward to more great posts.Nice Article ,keep it up ,It is very helpful.Instagram Usernames|WhatsApp Dares|Leadership Team Names|Golden Hour Captions

    OdpowiedzUsuń
  24. it looks very nice and fantastic. thank you very much for sharing this info with us.
    Vavoo Apk Latest Version 2020
    Watching movies and series on TV is a good way of spending free time. This helps people get rid of anxiety, depression, and tiredness. You feel fresh, relax and mentally alert if you watch drama and movies and other programs on TV. But this is not possible to keep TV everywhere along with you. Vavoo is the application that lets you watch your TV shows on your phone. You can easily search the movies, TV shows, and other programs in the app by using the search bar. Watch your favorite shows online or download them so that you can watch them later.
    visit and check
    famedram apk

    OdpowiedzUsuń
  25. NICE POST THXU FOR GOOD INFO
    HERE ARE SOME WAYS TO DWONLOAD FM WHATSAPP
    https://www.trickzgang.com/fm-whatsapp-apk-download-anti-ban/

    OdpowiedzUsuń
  26. This is one of the finest post i have ever seen. The information is genuine and relatable . We are really grateful for your blog post.
    regards
    iso certification in saudi arabia | iso 9001 certification in saudi arabia

    OdpowiedzUsuń
  27. This is one of the best post i have read in months, its really great and inspiring, i will really like to read more form you and will like to share with others as well, keep writing more
    Buy Weed Seeds Online
    Buy A-796,260 Online
    Buy Phenethylamine Psychedelics online
    Subutex 8mg Online
    Order Quaaludes Mandrax 300mg online
    Buy DMT Dimethyltryptamine Online
    Valium Diazepam For Sale Online
    Buy Harvoni ledipasvir sofosbuvir online
    Cannabis Oil For Sale
    Buy enzodiazepines online you can as well Whatsapp/Text +1(646)883-3072 , Telegram: primenature or email:primepharma0@gmail.com for more details.

    OdpowiedzUsuń
  28. The above article is very interesting Click here to get more queries.

    OdpowiedzUsuń
  29. SSC Exam Result is a trending now in Bangladesh. SSC Examination was completed. All students are waiting to get their SSC Exam Result 2020. This year SSC Result 2020 will publish on 1st week in May. On the result day, after 12PM all students will get their SSC Exam Result 2020 from Bangladesh Education Board official website. Also Dakhil Result 2020 and SSC Vocational Result 2020 will publish on 6 May 2020

    OdpowiedzUsuń
  30. Very nice post. Thanks for sharing. Keep it up. Check out the FMWhatsApp and make group and add me Thanks

    OdpowiedzUsuń
  31. For more information, Contact us via:
    Email: counterfeitnotesonline@gmail.com
    Whatsapp number:+1 (480)269-2191
    Webside: www.counterfeitnotesonline.com
    Web Link: https://www.counterfeitnotesonline.com

    Page links:

    Buy Fake Euros online
    https://www.counterfeitnotesonline.com/2019/12/09/buy-fake-euros-online/

    OdpowiedzUsuń
  32. Here is the best and free GB Whatsapp 2020 new for download official webpage

    OdpowiedzUsuń
  33. Download antiban Pro GB Whatsapp 2020 new form official website

    OdpowiedzUsuń
  34. I am glad that you just shared this useful information with us It is truly a nice and useful piece of info. Also check out GB Whatsapp

    OdpowiedzUsuń
  35. best site for Satta king result, leak number & all game record charts. We provide 100% fix number direct from Satta king gali company which includes all famous games like Satta king Desawar, Gali Satta, Ghaziabad, Faridabad, Shri Ganesh Satta, Taj Satta King, charminar and other games of Satta Market Matka is also a simple game and essentially is a form of old lottery games. Ratan Khatri was the founder of this game in the 70 century and was become popular up until the 90 century. The game is not played that much anymore mostly in the regions of North India and Pakistan. Instead, many enjoy the lottery games more so these days.
    Here is an example card. satta-king.online is the no1 satta king site where you can get the fastest Satta result, Satta king leak number (confirm jodi), Old Satta King ghaziabad, Daily leak Jodi, Desawar Jodi, Satta king faridabad, Satta record chart, Satta king taj, Gali Satta result, Ghaziabad Satta Result, Satta Bazar result and 100% passing fix Jodi today.

    OdpowiedzUsuń
  36. Hello my dear visitors. Hope everyone is well. Today, I’m going to write a post. In addition, I’m recording some video lessons about SSC Result 2020. At present one of the most highlights topic is SSC. On the other hand Currently the most discussed topic is Secondary School Certificate (SSC) Result SSC. Exam Result 2020 publishing date is knocking at the door. After successfully complete Secondary School Certificate (SSC) exam candidates are eagerly waiting for result. According to the Education Board Bangladesh authority, the result of SSC is to be announced by July 17, 2020 after 12pm. At first SSC Result 2020 published online on the official web site. Such as Educationboardresults.gov.bd and on eboardresults.com. But every year candidates face many problem to get SSC Result. For them we give a better solution. We create a server for SSC candidates only for easily get result. To check your SSC Result 2020 visit BDJobResult. It is an educational website. In order to get the result, the candidates must be need to submit their SSC exam Roll number, Registration number, Passing year, Board name. Without this information candidate cannot get their SSC Result. So candidates are you ready for get result? Don’t worry If you give a good exam then you will 100% pass in this exam. Otherwise don’t be upset.
    Please visit the link given below for more details: SSC Result 2020

    OdpowiedzUsuń
  37. SSC Exam Result is a trending now in Bangladesh. SSC Examination was completed. All students are waiting to get their SSC Exam Result 2020. This year SSC Result 2020 will publish on 1st week in May. On the result day, after 12PM all students will get their SSC Exam Result 2020 from Bangladesh Education Board official website. Also Dakhil Result 2020 and SSC Vocational Result 2020 will publish on 6 May 2020

    OdpowiedzUsuń
  38. SSC Exam Result 2020 in Bangladesh. SSC Result coming soon. All students are waiting to get their SSC Result 2020. This year SSC Result 2020 will publish on 06 May 2020. Students can collect their SSC Result 2020 from Bangladesh Education Board official website.

    OdpowiedzUsuń
  39. SSC Exam Result is trending now in Bangladesh. All SSC Examinee are waiting to get their SSC Result 2020. This year SSC Exam Result will publish on 1st week in May 2020. Students will collect their Result form Bangladesh Educational Board Official website. Also We will share SSC Result 2020 on our website. Students will collect their Result from our website. Candidates can collect their Dakhil Result 2020 and Vocational Result 2020 from Bangladesh Education Board official website.

    OdpowiedzUsuń
  40. HSC Examination was completed few days ago. Now HSC Result is the trending topic in Bangladesh. All candidates will check their HSC Result 2020 from Bangladesh Educational official website at educationboardresults.gov.bd.

    OdpowiedzUsuń
  41. You completely match our expectation and the variety of our information.gbwhatsapp ios

    OdpowiedzUsuń
  42. The website 9xflix operates through the domain 9xflix Home. Yesmovies ||
    Downloadming ||
    9xFlix ||

    OdpowiedzUsuń
  43. Thanks for sharing, nice post! Post really provice useful information!

    Áo khoác Đà Lạt chuyên sỉ và lẻ áo khoác Đà Lạt với giá ưu đãi. Luôn cập nhật mẫu mới chất lượng và dày ấm nhất kể cả với thời tiết lạnh giá các nước có du học sinh và xuất khẩu lao động. Áo khoác Đà Lạt mong được đồng hành cùng các bạn!!!!

    OdpowiedzUsuń
  44. SSC Exam Result is a trending now in Bangladesh. SSC Examination was completed. All students are waiting to get their SSC Exam Result 2020. This year SSC Result 2020 will publish on 1st week in May. On the result day, after 12PM all students will get their SSC Exam Result 2020 from Bangladesh Education Board official website. Also Dakhil Result 2020 and SSC Vocational Result 2020 will publish on 6 May 2020

    OdpowiedzUsuń
  45. SSC Exam Result is a trending now in Bangladesh. SSC Examination was completed. All students are waiting to get their SSC Exam Result 2020. This year SSC Result 2020 will publish on 1st week in May. On the result day, after 12PM all students will get their SSC Exam Result 2020 from Bangladesh Education Board official website. Also Dakhil Result 2020 and SSC Vocational Result 2020 will publish on 6 May 2020

    OdpowiedzUsuń
  46. SSC Exam Result 2020 in Bangladesh. SSC Result coming soon. All students are waiting to get their SSC Result 2020. This year SSC Result 2020 will publish on 06 May 2020. Students can collect their SSC Result 2020 from Bangladesh Education Board official website.

    OdpowiedzUsuń
  47. HSC Examination was completed few days ago. Now HSC Result 2020 is the trending topic in Bangladesh. All HSC Examinee waiting to get their HSC Result. All candidates will check their HSC Result 2020 from Bangladesh Educational official website at educationboardresults.gov.bd.

    OdpowiedzUsuń
  48. Are you movie lover like me? If you want to download all new Hollywood and Bollywood movies. Then visit MovieRulz Website 2020. You will find here Movierulz New Link 2020. So, visit this website and watch or download all latest movies.

    OdpowiedzUsuń
  49. Thanks for sharing Shala Darpan with us, guys! You are doing a great thing!

    OdpowiedzUsuń
  50. Admiring the time and effort you put into your blog and detailed information you offer!..


    average rice purity test

    OdpowiedzUsuń
  51. The next time I read a blog, I hope that it doesnt disappoint me as much as this one. I mean, I know it was my choice to read, but I actually thought you have something interesting to say. All I hear is a bunch of whining about something that you could fix if you werent too busy looking for attention.


    notepad++ osx

    OdpowiedzUsuń
  52. SSC Result 2020 will be published after few days. If you want to see Full marksheet SSC Result 2020 click here.
    Full Marksheet also can see here at SSC Result 2020

    OdpowiedzUsuń
  53. This is an awesome article. There are many articles related to this post. You can read Banglalink Recharge Offer 2020 which is trending now.
    Banglalink Minute Bundle Offer 2020
    for better understanding about room heater price in India. And this will be helpful to you if you are looking for New Sim Offer 2020 & Banglalink Internet Offer 2020

    OdpowiedzUsuń
  54. Thanks for share this information.... Make videos on Cute Cut Pro Apk
    and share the video by Anonytun Pro Apk

    OdpowiedzUsuń
  55. You came here to know how to get ssc result 2020 full marksheet. Wellcome to Lekhapora and the post SSC Result 2020. Here you are going to get some information like: About SSC Result 2020, SSC Result Online, SSC Result SMS, SSC Exam Result, SSC Result with Marksheet. Moreover, you are going to know about SSC Madrasha Board Result 2020.

    SSC Institution Result 2020: EIIN refers to Educational Institute Identification Number. Every school and college has its own EIIN Number. One can get all the information and JSC, SSC & HSC Result by this EIIN Number. If anyone wants to all the SSC results of any school then he/she can try the SSC Result EIIN Method.

    But unfortunately, most of the Muslim children go to general education from their childhood instated of Madrasah education. So, Details of Dakhil Result 2020 is shared below.

    SSC Result Bangladesh is near to the door. It is very important for the students of SSC Exam, Dakhil Exam, and Vocational Examination in 2020. SSC stands for Secondary School Certificate which is the most significant for every student. Though it is the third board exam of a student it still has the most significant on a student’s life. Before the 2013 SSC Exam was the first board exam on a student’s life.

    SSCExmResults.com is significant for who sat for the SSC or Dakhil or Vocational Examination in the year of 2020. In our counry Bangladesh, SSC or Secondary School Certificate examination is hard for a Secondary level students.

    OdpowiedzUsuń
  56. here are several websites available over the internet. Which just place download links
    Free Fire Usernames
    Whatsapp Dare
    Loud Updates
    Jalo Bhai

    OdpowiedzUsuń
  57. SSC Result 2020 will be published in 1st or Second Week of May, 2020. SSC Result 2020 Kobe Dibe? Ans: May 1st or 2nd Week 2020. According to the Ministry of Education, the date of publication of the SSC Result is 10th May, 2020 (probable) ssc result 2020

    OdpowiedzUsuń
  58. Hello my dear visitors. How are you? I think everyone is fine. Today I am going to discuss about SSC Result 2020. If you are an SSC examiner then this post is very important for you. On the other hand if you are not an SSC candidates then request from me that please share this post with your friends and relatives. SSC Result is going to published. According to the SSC Routine 2020 SSC Exam is starts on 01 February, 2020 and ends on 23 February, 2020. After successfully complete SSC examination candidates are eagerly waiting for SSC Exam Result. Finally Education Board Bangladesh announced SSC Exam Result 2020publishing dates & time. So check your SSC Result With Marksheet to visit our BDJobResults. Here you can easily get your SSC Result 2020with full marksheet. Thank you for reading my article.

    OdpowiedzUsuń
  59. If you are an educated person and are looking for Sarkari Naukri in government sector or want to appear in any sarkari vibhag pariksha, you should check Zid News Blog

    OdpowiedzUsuń
  60. Visit Health Orchid blog, here you will get to read interesting stories and information from various fields. We are waiting to hear your thoughts

    OdpowiedzUsuń
  61. Spot on with this write-up, I actually think this amazing site needs a great deal more attention. I’ll probably be returning to read through more, thanks for the advice!
    WhatsApp MODS

    OdpowiedzUsuń
  62. SSC Result 2020 Published today. So, you can now check your SSC Result 2020 on our website. Follow the link below to check your SSC Result 2020. Secondary School Certificate Result published for the Year of 2020. Now Everyone can check SSC Result 2020 on Jagobahe Website. Follow the link below to check your SSC Result 2020. After Pass the SSC Exam Every student have to apply on XI Class Admission Circular process. After the XI Class HSC Admission Result every students can join the college.
    You may also follow TikkaMix for regular new gadget and products update. They review some electronics products and amazing cool gear.
    Or you can also visit Nutrisetter for your daily nutrition plan. Here you will also get diet and food menu. Healty living will be easy for using nutrisetter website.
    But If you Have any problem you can also follow the LyricsAfy for download any kind of Bangla, Hindi, English, Panjabi, Tamil, Tehegu Song Lyrics.

    OdpowiedzUsuń
  63. Hello Friend, Thank you for this outstanding post.
    PSC Result 2020 will be published after few days. If you want to see Full marksheet SSC Result 2020 click here.
    Dakhil Result 2020
    Full Marksheet also can see here at SSC Result 2020
    SSC Result 2020 by SMS

    OdpowiedzUsuń
  64. Thanks to this type visit url for PSC exam result Bangladesh ssc result 2020 board wise marksheet know by online.

    OdpowiedzUsuń
  65. I really appreciate this wonderful post that you have provided for us. I assure this would be beneficial for most of the people. Thanks for sharing the information keep updating,
    looking forward to more posts. Thank you
    quotes

    OdpowiedzUsuń
  66. Anonymous said...
    I regularly visit your site and find a lot of interesting information. Thank you and look forward to your page growing stronger.
    informer

    OdpowiedzUsuń
  67. Thankyou for this wondrous post, I am happy I watched this site on yippee. ExcelR Data Science Course In Pune

    OdpowiedzUsuń
  68. Kine Master Pro Apk has many features like unlimited resources unlocking facilities and much more. I have downloaded this premium or pro Apk of a Kine master from this Kinemaster Pro and it’s 100 percent genuine website you can also go on it and download it for Free.

    OdpowiedzUsuń
  69. I have bookmarked your website because this site contains valuable information in it. I am really happy with articles quality and presentation. Thanks a lot for keeping great stuff. I am very much thankful for this site.

    gb whatsapp download free

    OdpowiedzUsuń
  70. movies123 any prompting from me, which was particularly annoying.

    OdpowiedzUsuń
  71. Kinemaster pro apk is a full-featured free video editing app for android users. It is very easy and simple to use. It has lots of powerful tools that help you to make a professionals video.

    OdpowiedzUsuń
  72. kinemaster pro apk is a fully unlocked video editor app for android without watermark. It is the best powerful android video editing software. You can easily edit your project videos like a professional level.

    OdpowiedzUsuń