Top 10 winner

Infiltrating Corporate Intranet Like NSA: Pre-Auth RCE On Leading SSL VPNs

Orange Tsai and Meh Chang · HITCON · 15 November 2019

Pre-auth remote code execution chains against Fortigate and Pulse Secure SSL VPNs: traversal file reads, a heap overflow in the web proxy, an undocumented password-reset key, and command injection through a flaw in Pulse's Perl I/O redirection guard. Stolen session databases defeat two-factor auth, and the logon-script feature turns the VPN into a way to compromise every connected client.

Record

Researcher

Orange Tsai and Meh Chang

Published by

HITCON

Date

15 November 2019

Format

Recording

In the archive

• Ranked #8 in the 2019 Top 10 Web Hacking Techniques

Related sources

• Slides
• Talk recording

Tags

• rce
• path-traversal
• command-injection
• auth-bypass
• info-leak
• attack-chain
• cve
• perl
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai and Meh Chang, first published at the original source. Preserved copies are kept so the citation survives its host.