Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: niekt0 <niekt0 <at> hysteria.sk>
Subject: Juniper VPN client rdesktop clickhack
Newsgroups: gmane.comp.security.bugtraq
Date: Monday 22nd November 2010 22:39:37 UTC (over 6 years ago)
Juniper VPN client rdesktop clickhack
================================
discovered by [email protected]

PRODUCT: Juniper VPN client + Windows remote desktop (or console access)

VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)

EXPOSURE: Remote code execution (SYSTEM privileges)

SYNOPSIS
========
By simple clicking it is possible to spawn a
Internet Explorer instance on rdesktop session
before authentication.
Account on target server is not required.

PROOF OF CONCEPT
================
If small blue icon "network logon" is available in right down corner,
system may be vulnerable (windows vista & 7).
Click on the icon and keep clicking like a real power user until
you get your explorer.
Probably at least one VPN or Dial-UP connection must be defined.
Illustrated guide is available at
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/

WORKAROUND
==========
None known.

VENDOR RESPONSE
===============
Not contacted. (try calling "helpdesk")

NOTICE
======
It is not really clear, if this is only juniper issue.
After third click, ale spawned screens are legitimate windows menu.
According to some guides it should be possible to create
"network logon" icon just by setting Windows. However,
I was not able to do so, at least not in Windows 7 ultimate.

Thanks to #brmlab, biiter
 
CD: 3ms