środa, 7 stycznia 2015

yammer.com - Same Origin Method Execution

SOME ;-) time ago@BenHayak talked about Same-Origin Method Execution on BlackHat EU. At the time of posting this article, there's no public whitepaper yet (only leaked slides) - that's why I'd love to share one of first posts that show this attack in action.

Yammer.com is part of Microsoft Bug Bounty for Online Services. During some research in used Flash files I found this one: video-js.swf (source).

Take a look to this piece of code:



As far as you probably know - the ExternalInterface is ActionScript class that allows (for example) to communicate Flash object with browser’s Javascript. First parameter is function name, that we want to call. As you can see - it’s readyFunction parameter (from GET), but it’s also sanitized with cleanEIString which looks like this:


So - only chars we are able to use is alphanumeric, underscore and a dot - to prevent Cross-Site Scripting. For example - if we’ll provide readyFunction=alert - our flash file will execute alert function, but we have no control over arguments (because we can't use brackets), so it’s useless for XSS purposes.

...and here is the place where we can start talking about Same-Origin Method Execution :-) Let take evil.com, that have hyperlink to vulnerable videoplayer. After clicking to this link, it opens the flash file in new tab, and next - redirect evil.com to yammer.com (in the same tab). From now on - newly opened tab have access to previous tab by window.opener (because they are both in Same Origin - yammer.com), and it’s also able to access DOM and execute functions in context of opened yammer.com page. 

The goal is to authorize user to some malicious application without his knowledge. Attack scenario will look this way:

1. User is visiting evil PoC site
2. He/she clicks on link which -in the end - redirect user to video player with readyFunction param described later
3. We’re redirecting Poc site to our yammer.com application - all we need to know is client_id - link example here: 


4. We need to wait few seconds to be 100% sure that redirect from point 3 happend (that's why I used proxy.php that sleeps and then returns 30x).
5. Flash Video Player will execute this readyFunction:

window.opener.new_message_popup.nextElementSibling.lastElementChild.firstChild.nextElementSibling.click()

...which is simply the “Allow” button + click() function :->

As you can imagine - this will cause clicking on the button and authorizing application to victim’s account, which is dangerous. :)

Proof of Concept goes here: http://ropchain.org/poc/yammer-some.html

...and demo:


150 komentarzy:

  1. Nice! Just saw the BlackHat talk. A minor correction, readyFunction=alert isn't completely useless. @garethheyes have some interesting payloads that work without paranetsis, document.domain=name might pass forexample.

    OdpowiedzUsuń
    Odpowiedzi
    1. GBWhatsApp - It will help you to get rid of most of those restrictions that the official version imposes on you. In simple words, the gbwa is a modded application which has some extra features that you won’t be able to find in the stock version. Some of the most noteworthy and popular features of the gbwa mod are hiding blue tick, online status, last seen, theme customizations and the brand new auto-reply. سیاوش قمیشی

      شادمهر عقیلی

      افشین

      Usuń
  2. Enjoyed reading the article above , really explains everything in detail,the article is very interesting and effective.Thank you and good luck for the upcoming articles.Data science training in Pune| Data science courses in pune

    OdpowiedzUsuń
  3. hello ,
    such a great article thanks for sharing , really you writte well article as always , thanks again for this amazing article


    gbwhatsapp

    OdpowiedzUsuń
  4. GBWhatsapp It will help you to get rid of most of those restrictions that the official version imposes on you. In simple words, the gbwa is a modded application which has some extra features that you won’t be able to find in the stock version. Some of the most noteworthy and popular features of the gbwa mod are hiding blue tick, online status, last seen, theme customizations and the brand new auto-reply.

    OdpowiedzUsuń
  5. Lucky Patcher gives you unlimited in-game resources & removes ads from any type of android application.

    GBWhatsApp Apk:

    GBWhatsApp is the best version of Official WhatsApp.

    OdpowiedzUsuń
  6. Nice post. I learn something totally new and challenging on websites I stumbleupon every day. It's always useful to read through articles from other authors and practice something from other sites.
    Thanks for sharing this information with us. Download Free Xmod and information.
    .

    OdpowiedzUsuń
  7. Really nice information shared bro .... thanks for it

    vpn master premium
    funny group chat names

    OdpowiedzUsuń
  8. What a great article! Awesome tropic and Excellent Content. Thanks for Providing that very important information.
    PSC Result 2019
    PSC exam Result 2019
    JSC Result 2019
    JSC Result DPE

    OdpowiedzUsuń

  9. The Tutu App is the one of the best ios,android

    App store to get the tons of free app and game. Here the latest version of gta vice city apk of free.

    OdpowiedzUsuń

  10. The Tutu App download is the best app to download latest

    app and Apk for free so use now to TutuApp ios

    free App.

    OdpowiedzUsuń

  11. the panda helper apk is the best app to download latest app for free so download now panda app to unlock a many feature now download now.

    OdpowiedzUsuń
  12. I really thank you for the valuable info on this great subject and look forward to more great posts.Nice Article ,keep it up ,It is very helpful.Instagram Usernames|WhatsApp Dares|Leadership Team Names|Golden Hour Captions

    OdpowiedzUsuń
  13. it looks very nice and fantastic. thank you very much for sharing this info with us.
    Vavoo Apk Latest Version 2020
    Watching movies and series on TV is a good way of spending free time. This helps people get rid of anxiety, depression, and tiredness. You feel fresh, relax and mentally alert if you watch drama and movies and other programs on TV. But this is not possible to keep TV everywhere along with you. Vavoo is the application that lets you watch your TV shows on your phone. You can easily search the movies, TV shows, and other programs in the app by using the search bar. Watch your favorite shows online or download them so that you can watch them later.
    visit and check
    famedram apk

    OdpowiedzUsuń
  14. NICE POST THXU FOR GOOD INFO
    HERE ARE SOME WAYS TO DWONLOAD FM WHATSAPP
    https://www.trickzgang.com/fm-whatsapp-apk-download-anti-ban/

    OdpowiedzUsuń
  15. This is one of the finest post i have ever seen. The information is genuine and relatable . We are really grateful for your blog post.
    regards
    iso certification in saudi arabia | iso 9001 certification in saudi arabia

    OdpowiedzUsuń
  16. Very nice post. Thanks for sharing. Keep it up. Check out the FMWhatsApp and make group and add me Thanks

    OdpowiedzUsuń
  17. For more information, Contact us via:
    Email: counterfeitnotesonline@gmail.com
    Whatsapp number:+1 (480)269-2191
    Webside: www.counterfeitnotesonline.com
    Web Link: https://www.counterfeitnotesonline.com

    Page links:

    Buy Fake Euros online
    https://www.counterfeitnotesonline.com/2019/12/09/buy-fake-euros-online/

    OdpowiedzUsuń
  18. Here is the best and free GB Whatsapp 2020 new for download official webpage

    OdpowiedzUsuń
  19. Download antiban Pro GB Whatsapp 2020 new form official website

    OdpowiedzUsuń
  20. I am glad that you just shared this useful information with us It is truly a nice and useful piece of info. Also check out GB Whatsapp

    OdpowiedzUsuń
  21. The website 9xflix operates through the domain 9xflix Home. Yesmovies ||
    Downloadming ||
    9xFlix ||

    OdpowiedzUsuń
  22. Thanks for sharing, nice post! Post really provice useful information!

    Áo khoác Đà Lạt chuyên sỉ và lẻ áo khoác Đà Lạt với giá ưu đãi. Luôn cập nhật mẫu mới chất lượng và dày ấm nhất kể cả với thời tiết lạnh giá các nước có du học sinh và xuất khẩu lao động. Áo khoác Đà Lạt mong được đồng hành cùng các bạn!!!!

    OdpowiedzUsuń
  23. Admiring the time and effort you put into your blog and detailed information you offer!..


    average rice purity test

    OdpowiedzUsuń
  24. The next time I read a blog, I hope that it doesnt disappoint me as much as this one. I mean, I know it was my choice to read, but I actually thought you have something interesting to say. All I hear is a bunch of whining about something that you could fix if you werent too busy looking for attention.


    notepad++ osx

    OdpowiedzUsuń
  25. This is an awesome article. There are many articles related to this post. You can read Banglalink Recharge Offer 2020 which is trending now.
    Banglalink Minute Bundle Offer 2020
    for better understanding about room heater price in India. And this will be helpful to you if you are looking for New Sim Offer 2020 & Banglalink Internet Offer 2020

    OdpowiedzUsuń
  26. Thanks for share this information.... Make videos on Cute Cut Pro Apk
    and share the video by Anonytun Pro Apk

    OdpowiedzUsuń
  27. here are several websites available over the internet. Which just place download links
    Free Fire Usernames
    Whatsapp Dare
    Loud Updates
    Jalo Bhai

    OdpowiedzUsuń
  28. SSC Result 2020 will be published in 1st or Second Week of May, 2020. SSC Result 2020 Kobe Dibe? Ans: May 1st or 2nd Week 2020. According to the Ministry of Education, the date of publication of the SSC Result is 10th May, 2020 (probable) ssc result 2020

    OdpowiedzUsuń
  29. Visit Health Orchid blog, here you will get to read interesting stories and information from various fields. We are waiting to hear your thoughts

    OdpowiedzUsuń
  30. Spot on with this write-up, I actually think this amazing site needs a great deal more attention. I’ll probably be returning to read through more, thanks for the advice!
    WhatsApp MODS

    OdpowiedzUsuń
  31. Thanks to this type visit url for PSC exam result Bangladesh ssc result 2020 board wise marksheet know by online.

    OdpowiedzUsuń
  32. I really appreciate this wonderful post that you have provided for us. I assure this would be beneficial for most of the people. Thanks for sharing the information keep updating,
    looking forward to more posts. Thank you
    quotes

    OdpowiedzUsuń
  33. Anonymous said...
    I regularly visit your site and find a lot of interesting information. Thank you and look forward to your page growing stronger.
    informer

    OdpowiedzUsuń
  34. Thankyou for this wondrous post, I am happy I watched this site on yippee. ExcelR Data Science Course In Pune

    OdpowiedzUsuń
  35. I have bookmarked your website because this site contains valuable information in it. I am really happy with articles quality and presentation. Thanks a lot for keeping great stuff. I am very much thankful for this site.

    gb whatsapp download free

    OdpowiedzUsuń
  36. movies123 any prompting from me, which was particularly annoying.

    OdpowiedzUsuń
  37. Kinemaster pro apk is a full-featured free video editing app for android users. It is very easy and simple to use. It has lots of powerful tools that help you to make a professionals video.

    OdpowiedzUsuń
  38. kinemaster pro apk is a fully unlocked video editor app for android without watermark. It is the best powerful android video editing software. You can easily edit your project videos like a professional level.

    OdpowiedzUsuń
  39. Kine Master Mod Apk is a free video editor app for Android phone. This app helps you to create high-quality videos. It has multiple features like no watermark, multiple-layer, instant preview, and all premium unlocked. You can download this Kine Master Mod APK From here Kinemaster Pro Last Week I am download this app and it is best to edit any video

    OdpowiedzUsuń
  40. GP Skitto Internet Offer is now a hot topic in Online world. They brought a revolution in Internet Price and service in speed. So, People look for Skitto mb offer. In this post we will discuss about how to buy internet in Skitto.

    When you are a Robi Sim user and look for Robi Internet Offers of 2020, this post about Internet packages will really help you a lot. Robi stands on second position in the question of Internet service. Let’s start our post about best robi Internet offers of the year.

    Do you need Banglalink Internet offers 2020? Many like you look for Banglalink Data offer and its activation code as well as they want to know the price and validity period. In this post, we tried to explain more details about Banglalink internet recharge offer and Banglalink free internet offer.

    In this post we will introduce with GP Internet offers 2020. Here on this page, Offers are frequently updated. So you will get the latest and accurate information regarding Grameenphone Internet Packages. You will also get GP Internet Setting and know how to set it up.

    If you looking for Airtel Internet Offer in Bangladesh, then you are on the right palce. You will get some extra information about Data validity, code, price and recharge money.

    OdpowiedzUsuń
  41. Thanks for sharing. just discovered the root android
    check out the buy smartphone online
    Also check out the Best Android games Reviews
    Thanks. you are best source of knowledge

    OdpowiedzUsuń
  42. Online recharge fast and easy services all typs of recharge visit us : Jainand digital point.

    OdpowiedzUsuń
  43. download the whatsapp plus in your android phone or Iphone from the link provided

    OdpowiedzUsuń
  44. Normally I do not learn from post on blogs, however I wish to say that this write-up has compelled me to do so. Your writing taste has been amazed me. Thanks, quite great article.
    Checkout: Best Organizations That Help With Vet Bills

    OdpowiedzUsuń
  45. Amazing i like it thisw is very usefull for me also check Fouad whatsapp A

    OdpowiedzUsuń
  46. Dhaka City College admission result will publish soon. Students can check the Dhaka City College Admission Result on examresulthub.com

    OdpowiedzUsuń
  47. The University of Rajshahi Admission Test Result has been published. The RU Admission Result 2021 can be known by Mobile SMS and from admission ru ac bd website.

    OdpowiedzUsuń
  48. Its a pretty helpful for me. Thanks for the post.
    Kinemaster Mod Apk

    OdpowiedzUsuń
  49. National University is published the nu honours 4th year exam result 2021 on online. Students now can check the result from nu.ac.bd/results as well as examresulthub.com

    OdpowiedzUsuń
  50. SMS Blast APK best article for user hope you will get best app for prank

    OdpowiedzUsuń
  51. Without too many features that can be customized and an extra friend can help, this app will leave you more than you want, which is the best in FMWhatsApp APK and Fouad WhatsApp. Like the original, you can make text calls and send files.

    OdpowiedzUsuń

  52. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  53. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  54. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  55. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń
  56. Excellent Blog! I would like to thank for the efforts you have made in writing this post.Also check this uk lottery result.

    thunderball tonight

    OdpowiedzUsuń
  57. Nice blog post,
    Social Media Marketing Course in Hyderabad is designed for people who would like to learn just social media marketing. Social Media platforms are widely used these days by more than 50% of every country’s population.

    OdpowiedzUsuń
  58. great blog learned alot from this today. will follow it with the help of Forest mod apk as it have make disciplined.

    OdpowiedzUsuń
  59. NID Card Online Copy Download 2021: Those who for NID Ctard Application but have not received NID Card now. They can visit the Bangladesh Election Commission Office through download National Identity Card (NID) collect template use. Also our website method you know every process. so folow to our website.

    OdpowiedzUsuń
  60. Nice Blog Thanks For Sharing This Useful Blog.
    Java Training
    Visit us: java course

    OdpowiedzUsuń
  61. National University https://www.jobnewsbd24.com/103-113-200-29-student_covidinfo/ from all students protection has been published by the NU authority. students can (Covid-19) Vaccine Registration online as well our website - jobnewsbd24.com every information found.

    OdpowiedzUsuń

  62. Wonderful information! I found amazing information on the blogs i suggest everyone to follow the links below to get download files from this website.

    FmWhatsapp apk

    OdpowiedzUsuń
  63. hello ,
    such a great article thanks for sharing , really you writte well article as always , thanks again for this amazing article
    Skitto New SIM Offer
    bkash cash out charge
    SEO meaning Bangla

    OdpowiedzUsuń
  64. Looking forward to more great posts from you! Thank you for sharing your knowledge and expertise - I appreciate it. Also, check out my blog too Master PC

    OdpowiedzUsuń
  65. I am so grateful for your excellent post. Thank you!
    I'm sure that most people will find this information helpful and it is great to know there's an update coming soon with more content just as always. Keep up the good work :)

    lightroom crack adobe photoshop lightroom

    OdpowiedzUsuń
  66. I am always on the lookout for great content, and it's so refreshing when someone takes their time to give me something new. Thank you very much; keep up the good work!
    powerdvd 18 ultra crack

    OdpowiedzUsuń
  67. Nice blog. Thank you sharing informaction

    OdpowiedzUsuń
  68. It's a very informative post...Thanks for sharing the code instructions. It's very helpful. Also check out Kinemaster MOD APK

    OdpowiedzUsuń
  69. Windows VPS Hosting India We provide the best windows VPS in India at affordable prices

    OdpowiedzUsuń
  70. The ministry of education is published the gsa result 2022 for
    all government school on gsa result teletalk com bd official
    website.


    examresulthub.com is an extensive educatinal portal where you can find admission, board, job and any exam result.


    OdpowiedzUsuń
  71. Government School Admission (GSA) Authority is published the class 1-9 admission result based on lottery on gsa.teletalk.com.bd result as well as exam result hub educational portal.

    OdpowiedzUsuń
  72. I enjoy it for creating the details, keep up the truly amazing perform continuing data scientist course in surat

    OdpowiedzUsuń
  73. Thanks for sharing the valuable information here. So i think i got some useful information with this content. Thank you and please keep update like this informative details.
    evs full form
    raw agent full form
    full form of tbh in instagram
    dbs bank full form
    https full form
    tft full form
    pco full form
    kra full form in hr
    tbh full form in instagram story
    epc full form

    OdpowiedzUsuń
  74. The Instant audio quick bass is the second plugin in the Instant Audio camp, and it’s the continuation of their QuickAG plugin, which combined almost all the treatments you would normally use on an acoustic guitar (or any other strummed acoustic string instrument for that matter) into one easy de- Use, instrument-specific channel solution for the modern DAW.

    OdpowiedzUsuń
  75. The PDF-XChange Editor Crack the worthy successor of PDF-XChange Viewer, does not only include all features of PDF-XChange Viewer, including the only recently added OCR feature, but now also provides you with an option to edit existing PDF documents.

    OdpowiedzUsuń
  76. The iTunes Backup Extractor Free Edition Crack can automatically detect any iPhone / iPad / iPad backup file on your computerBesides, it also extracts all data from iTunes backup including contacts, SMS messages, call logs, photos, videos, notes, calendar, reminders, WhatsApp, Viber, Safari bookmarks and more.

    OdpowiedzUsuń
  77. Góð síða : Zonahobisaya
    Góð síða : Logo
    Góð síða : Zonahobisaya
    Góð síða : Zonahobisaya
    Góð síða : Zonahobisaya
    Góð síða : Zonahobisaya
    Góð síða : Sinopsis Film Terbaru
    Góð síða : Zonahobisaya

    OdpowiedzUsuń
  78. Buon sito web : Zonahobisaya
    Buon sito web : One Piece
    Buon sito web : lambang
    Buon sito web : One Piece
    Buon sito web : Zonahobisaya
    Buon sito web : One Piece
    Buon sito web : Zonahobisaya
    Buon sito web : Zonahobisaya

    OdpowiedzUsuń
  79. Great post, I share it with WhatsApp Plus apk to have more privacy.

    OdpowiedzUsuń
  80. With GB WhatsApp I can spread without restrictions this great article that I liked so much.

    OdpowiedzUsuń
  81. I was looking on ideas to write a good comments and ended up here through google. I could not get what i wanted but read you article though. Nice One. Best of Luck! Checkout FMWhatsapp APK

    OdpowiedzUsuń
  82. CHED Scholarship is open apply now. The Commission on Higher Education (CHED) CHED Scholarship is an attached agency to the Office of the President for administrative purposes. Its mandate is to promote relevant and higher quality education that will make graduates and professionals CHED Scholarship, highly competent and recognized in the international arena.

    OdpowiedzUsuń
  83. What may you recommend about SEO Firm Chicago publish that you simply made Digital Evrima some days ago...

    OdpowiedzUsuń
  84. GogoAnime - Watch anime online in English Dub. watch free your
    favorite anime series and movies online with English subtitle.


    GoGoAnime

    OdpowiedzUsuń
  85. Thank you for writing amazing article. You can get All Bank Job Circular in Bangladesh from the BD Gov Job website. We publish All BD Jobs Circular, Bank Jobs in Bangladesh, and more.

    OdpowiedzUsuń
  86. Kinemaster mod apk has many great features that make it easy for anyone to create amazing videos

    OdpowiedzUsuń
  87. good post, android 14 is coming soon so see some best features of android 14

    OdpowiedzUsuń
  88. very nice blog I really like it thanks for sharing Punjabi Status Maa

    OdpowiedzUsuń