2aed99237c
8 changes to exploits/shellcodes/ghdb Proxmox VE - TOTP Brute Force RoyalTSX 6.0.1 - RTSZ File Handling Heap Memory Corruption PoC GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities 101 News 1.0 - Multiple-SQLi Academy LMS 6.2 - Reflected XSS Academy LMS 6.2 - SQL Injection Grocy <=4.0.2 - CSRF
149 lines
No EOL
8.1 KiB
Text
149 lines
No EOL
8.1 KiB
Text
RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC
|
|
|
|
|
|
Vendor: Royal Apps GmbH
|
|
Web page: https://www.royalapps.com
|
|
Affected version: 6.0.1.1000 (macOS)
|
|
|
|
Summary: Royal TS is an ideal tool for system engineers and
|
|
other IT professionals who need remote access to systems with
|
|
different protocols. Not only easy to use, it enables secure
|
|
multi-user document sharing.
|
|
|
|
Desc: The application receives SIGABRT after RAPortCheck.createNWConnection()
|
|
function is handling the SecureGatewayHost object in the RoyalTSXNativeUI.
|
|
When the hostname has an array of around 1600 bytes and Test Connection is
|
|
clicked the app crashes instantly.
|
|
|
|
Tested on: MacOS 13.5.1 (Ventura)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5788
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5788.php
|
|
|
|
|
|
05.09.2023
|
|
|
|
--
|
|
|
|
|
|
-------------------------------------
|
|
Translated Report (Full Report Below)
|
|
-------------------------------------
|
|
|
|
Process: RoyalTSX [23807]
|
|
Path: /Applications/Royal TSX.app/Contents/MacOS/RoyalTSX
|
|
Identifier: com.lemonmojo.RoyalTSX.App
|
|
Version: 6.0.1 (6.0.1.1000)
|
|
Code Type: X86-64 (Native)
|
|
Parent Process: launchd [1]
|
|
User ID: 503
|
|
|
|
Date/Time: 2023-09-05 16:09:46.6361 +0200
|
|
OS Version: macOS 13.5.1 (22G90)
|
|
Report Version: 12
|
|
Bridge OS Version: 7.6 (20P6072)
|
|
|
|
Time Awake Since Boot: 21000 seconds
|
|
Time Since Wake: 1106 seconds
|
|
|
|
System Integrity Protection: enabled
|
|
|
|
Crashed Thread: 0 tid_103 Dispatch queue: com.apple.main-thread
|
|
|
|
Exception Type: EXC_BAD_ACCESS (SIGABRT)
|
|
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000050
|
|
Exception Codes: 0x0000000000000001, 0x0000000000000050
|
|
|
|
Termination Reason: Namespace SIGNAL, Code 6 Abort trap: 6
|
|
Terminating Process: RoyalTSX [23807]
|
|
|
|
VM Region Info: 0x50 is not in any region. Bytes before following region: 140737488273328
|
|
REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL
|
|
UNUSED SPACE AT START
|
|
--->
|
|
shared memory 7ffffffec000-7ffffffed000 [ 4K] r-x/r-x SM=SHM
|
|
|
|
Application Specific Information:
|
|
abort() called
|
|
|
|
|
|
Thread 0 Crashed:: tid_103 Dispatch queue: com.apple.main-thread
|
|
0 libsystem_kernel.dylib 0x7ff809ef7202 __pthread_kill + 10
|
|
1 libsystem_pthread.dylib 0x7ff809f2eee6 pthread_kill + 263
|
|
2 libsystem_c.dylib 0x7ff809e55b45 abort + 123
|
|
3 libmonosgen-2.0.1.dylib 0x1028daa1b altstack_handle_and_restore + 235
|
|
4 libmonosgen-2.0.1.dylib 0x102879db6 summarize_frame_internal + 310
|
|
5 libmonosgen-2.0.1.dylib 0x102879f66 summarize_frame + 198
|
|
6 libmonosgen-2.0.1.dylib 0x10287578f mono_walk_stack_full + 1135
|
|
7 libmonosgen-2.0.1.dylib 0x102873944 mono_summarize_managed_stack + 100
|
|
8 libmonosgen-2.0.1.dylib 0x102a0f478 mono_threads_summarize_execute_internal + 1256
|
|
9 libmonosgen-2.0.1.dylib 0x102a0f8aa mono_threads_summarize + 346
|
|
10 libmonosgen-2.0.1.dylib 0x1028e0b67 mono_dump_native_crash_info + 855
|
|
11 libmonosgen-2.0.1.dylib 0x10287864e mono_handle_native_crash + 318
|
|
12 libmonosgen-2.0.1.dylib 0x1027d1966 mono_crashing_signal_handler + 86
|
|
13 libsystem_platform.dylib 0x7ff809f5c5ed _sigtramp + 29
|
|
14 ??? 0x101e9502c ???
|
|
15 RoyalTSXNativeUI 0x109e50012 RAPortCheck.createNWConnection() + 290
|
|
16 RoyalTSXNativeUI 0x109e4f6d2 RAPortCheck.connect() + 242
|
|
17 RoyalTSXNativeUI 0x10a021c70 static RASecureGatewayPropertyPageHelper.testConnection(hostname:port:logger:localizer:parentWindow:progressIndicator:testConnectionButton:) + 592
|
|
18 RoyalTSXNativeUI 0x10a0b94e7 RAPropertyPageSecureGatewayMain.testConnection() + 359
|
|
19 RoyalTSXNativeUI 0x10a0b9573 @objc RAPropertyPageSecureGatewayMain.buttonTestConnection_action(_:) + 51
|
|
20 AppKit 0x7ff80d29742c -[NSApplication(NSResponder) sendAction:to:from:] + 323
|
|
21 AppKit 0x7ff80d2972b0 -[NSControl sendAction:to:] + 86
|
|
22 AppKit 0x7ff80d2971e2 __26-[NSCell _sendActionFrom:]_block_invoke + 131
|
|
23 AppKit 0x7ff80d2970eb -[NSCell _sendActionFrom:] + 171
|
|
24 AppKit 0x7ff80d297031 -[NSButtonCell _sendActionFrom:] + 96
|
|
25 AppKit 0x7ff80d293ee5 NSControlTrackMouse + 1816
|
|
26 AppKit 0x7ff80d2937a9 -[NSCell trackMouse:inRect:ofView:untilMouseUp:] + 121
|
|
27 AppKit 0x7ff80d29367c -[NSButtonCell trackMouse:inRect:ofView:untilMouseUp:] + 606
|
|
28 AppKit 0x7ff80d292ac0 -[NSControl mouseDown:] + 659
|
|
29 AppKit 0x7ff80d290f9d -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 4330
|
|
30 AppKit 0x7ff80d2087d7 -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 404
|
|
31 AppKit 0x7ff80d208427 -[NSWindow(NSEventRouting) sendEvent:] + 345
|
|
32 AppKit 0x7ff80d206e01 -[NSApplication(NSEvent) sendEvent:] + 345
|
|
33 AppKit 0x7ff80d3413ae -[NSApplication _doModalLoop:peek:] + 360
|
|
34 AppKit 0x7ff80d4c2219 __33-[NSApplication runModalSession:]_block_invoke_2 + 69
|
|
35 AppKit 0x7ff80d4c21c1 __33-[NSApplication runModalSession:]_block_invoke + 78
|
|
36 AppKit 0x7ff80d33f773 _NSTryRunModal + 100
|
|
37 AppKit 0x7ff80d4c20be -[NSApplication runModalSession:] + 128
|
|
38 RoyalTSXNativeUI 0x109f17044 RAPropertiesWindowController._showModal() + 628
|
|
39 RoyalTSXNativeUI 0x109f17548 @objc RAPropertiesWindowController._showModal() + 24
|
|
40 Foundation 0x7ff80ae84951 -[NSObject(NSThreadPerformAdditions) performSelector:onThread:withObject:waitUntilDone:modes:] + 379
|
|
41 Foundation 0x7ff80ae84676 -[NSObject(NSThreadPerformAdditions) performSelectorOnMainThread:withObject:waitUntilDone:] + 124
|
|
42 libffi.dylib 0x7ff81a5fd8c2 ffi_call_unix64 + 82
|
|
43 libffi.dylib 0x7ff81a5fd214 ffi_call_int + 830
|
|
|
|
Thread 0 crashed with X86 Thread State (64-bit):
|
|
rax: 0x0000000000000000 rbx: 0x00007ff84d608700 rcx: 0x00007ff7be10fbc8 rdx: 0x0000000000000000
|
|
rdi: 0x0000000000000103 rsi: 0x0000000000000006 rbp: 0x00007ff7be10fbf0 rsp: 0x00007ff7be10fbc8
|
|
r8: 0x0000000000000212 r9: 0x00007fafaeaf64a8 r10: 0x0000000000000000 r11: 0x0000000000000246
|
|
r12: 0x0000000000000103 r13: 0x00007ff7be110418 r14: 0x0000000000000006 r15: 0x0000000000000016
|
|
rip: 0x00007ff809ef7202 rfl: 0x0000000000000246 cr2: 0x00007ff84d611068
|
|
|
|
Logical CPU: 0
|
|
Error Code: 0x02000148
|
|
Trap Number: 133
|
|
|
|
Thread 0 instruction stream:
|
|
0f 84 24 01 00 00 49 8b-79 08 4c 89 45 c0 89 4d ..$...I.y.L.E..M
|
|
d4 48 89 55 c8 4d 89 cc-e8 5d 79 0e 00 48 89 c3 .H.U.M...]y..H..
|
|
4b 8d 7c 3e 04 48 8b 73-30 ba 8c 00 00 00 e8 07 K.|>.H.s0.......
|
|
7f 25 00 4c 8b 45 c0 48-8b 43 58 4b 89 84 3e a0 .%.L.E.H.CXK..>.
|
|
00 00 00 41 8b 44 24 04-43 89 84 3e 90 00 00 00 ...A.D$.C..>....
|
|
48 8b 43 38 4b 89 84 3e-a8 00 00 00 48 8b 43 60 H.C8K..>....H.C`
|
|
[8b]40 50 43 89 84 3e b0-00 00 00 8b 43 40 43 89 .@PC..>.....C@C. <==
|
|
84 3e b4 00 00 00 48 8b-45 c8 43 89 84 3e 98 00 .>....H.E.C..>..
|
|
00 00 8b 45 d4 43 89 84-3e 94 00 00 00 eb 18 48 ...E.C..>......H
|
|
8d 05 80 ff 26 00 e9 96-00 00 00 43 c7 84 3e 90 ....&......C..>.
|
|
00 00 00 ff ff ff ff 49-8b 45 10 48 8b 18 41 83 .......I.E.H..A.
|
|
38 00 74 24 4b 8d 7c 3e-04 4d 89 c4 e8 69 d8 14 8.t$K.|>.M...i..
|
|
|
|
Binary Images:
|
|
0x101deb000 - 0x101df6fff com.lemonmojo.RoyalTSX.App (6.0.1) <328845a4-2e68-3c0f-a495-033ac725bb43> /Applications/Royal TSX.app/Contents/MacOS/RoyalTSX
|
|
...
|
|
... |