1. Exploiting e-mail sandbox
backdoor it with one evil
Nikolay Klendar
bsploit gmail.com

2. Who am I Head of IT Security at Offensive Security Certified Expert
Not a bug hunter
Hobbies:
programming
kitesurfing, snowboarding

3. DDEI Implementation scheme
Access to Web UI could be restricted

4. Source Code Analysis

5. WhiteBox Analysis. Admin UI RCE
Conditions:
No authentication required
No CSRF protection

6. Multiple RCEs /hidden/firewall_setting/firewall_setting.php
/hidden/db_export/db_export.php
/hidden/network_dump/php/network_dump.php
/hidden/kdump/php/kdump_setting.php
/hidden/url_extract/url_extract.php
/hidden/url_filter/url_filter.php
/hidden/postfix_setting/postfix_setting.php
/admin/php/network_setting.php
/report/report_ui/php/report_setting.php
/usandbox/import_native_sandbox.php
/php/screenshot.php
/php/syslog_setting.php
/detections/download_pdf.php
/detections/write_new_html_with_svg.php
get_filesize.php
ajax_checklicense_AC.php

7. Potential vectors of compromise
Direct request from management network
Place <img src=“ at own site and wait for admin
Something more interesting?

8. GrayBox Analysis. HTML injection

9. Possible attack scenario
1. Attacker: creates an with malicious content (link or attachment) and puts exploit in to subject
2. Admin: opens Dashboards->Trends tab. Exploit runs without additional user interaction
3. Reverse shell from SandBox to attacker C&C => full compromise with root privileges

10. Connecting Sandbox to C&C

11. Critical Patch
-in-trend-micro-deep-discovery- -inspector-ddei-2-5

12. Conclusion 16 RCEs with CVSS 10 were reported and confirmed by vendor
Harden even security systems
Implement source code analysis in SDLC
Join to HCFB security team: bsploit gmail.com