Home | VerSprite Resources

Microsoft Windows Vulnerabilities

We are passionate about helping our clients chart a course that brings security and business together.

Windows userland attack surface

Blog Post

Microsoft Windows Vulnerabilities

Windows Userland Application Attack Surface Enumeration

Inside the domain of vulnerability research, many different methodologies exist for how a researcher may start their journey with auditing an application. This blog provides information on how to enumerate the attack surface of userland applications that are deployed on the Windows operating system.

Learn more

Abusing Insecure Windows Communication Foundation (WCF) Endpoints

Presentation

Microsoft Windows Vulnerabilities

Abusing Insecure Windows Communication Foundation (WCF) Endpoints

A trend that the VerSprite Research team noticed in .NET services is the exposure of dangerous methods through insecure WCF endpoints. Download this presentation for a high-level overview of the WCF terminals and receive a practical analysis.

Learn more

Insecure Windows Communication Foundation Endpoints

Blog Post

Exploitation of Vulnerabilities

Abusing Insecure Windows Communication Foundation (WCF) Endpoints

During an audit of several Windows VPN services, we identified several WCF endpoints that offered direct control of command line parameters used in the creation of an elevated process. This allowed for local privilege escalation to the SYSTEM user.

Learn more

TunnelBear for Windows vulnerability

Advisory

Microsoft Windows Vulnerabilities

TunnelBear for Windows

TunnelBear for Windows suffers from a SYSTEM privilege escalation vulnerability through the TunnelBearMaintenanceservice. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods.

Learn more

CyberGhost 6 for Windows vulnerability

Advisory

Microsoft Windows Vulnerabilities

CyberGhost 6 for Windows

CyberGhost 6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the CG6Service service. This service establishes an NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The ConnectToVpnServer method accepts a connectionParams argument that provides attacker control of the OpenVpn command line.

Learn more

SaferVPN for Windows vulnerability

Advisory

Microsoft Windows Vulnerabilities

SaferVPN for Windows

SaferVPN for Windows suffers from a SYSTEM privilege escalation vulnerability in its SaferVPN.Service service. The SaferVPN.Service service executes openvpn.exe using OpenVPN config files located within the current user’s local application data directory i.e. \AppData\Local\SaferVPN\OvpnConfig\.

Learn more

VyprVPN for Windows vulnerability

Advisory

Microsoft Windows Vulnerabilities

VyprVPN for Windows

VyprVPN for Windows suffers from a SYSTEM privilege escalation vulnerability through the VyprVPN service. This service establishes an NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods.

Learn more

PureVPN for Windows vulnerability

Advisory

Microsoft Windows Vulnerabilities

PureVPN for Windows

PureVPN for Windows suffers from a SYSTEM privilege escalation vulnerability in its sevpnclient service. When configured to use the OpenVPN protocol, the sevpnclient service executes openvpn.exe using the OpenVPN config file located at C:\ProgramData\purevpn\config\config.ovpn.

Learn more

Private Internet Access VPN Client for Windows vulnerability

Advisory

Microsoft Windows Vulnerabilities

Private Internet Access VPN Client for Windows

A vulnerability in Private Internet Access VPN Client for Windows could allow an unauthenticated, local attacker to run executable files with elevated privileges. The vulnerability is due to insufficient implementation of the access controls.

Learn more

We are an international squad of professionals working as one.

Email

[email protected]

logos