Hello and welcome to the Friday, July 21st, 2020, 3 edition of the Sandsenet Storm Center's Stormcast.

My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida.

Still a little bit under the weather, so trying to keep this reasonable short here.

But we got a couple things to talk about here. First

of all, in Diaries, we got a dot-bat file from Xavier, where Xavié is walking you again

through some de-offuscation. So for the malware analysts out here, certainly a worthwhile

read to see how to purify the code from obfuscation, how to use Cyber Chef, but it's actually just, I think, released version 10, and how to then analyze the resulting code.

And for the Citrix users out there looking for more help figuring out if your Citrix ADC or NetSkiller device is already compromised.

A blog post on Data.net has a checklist walking you through different items that you should check in order to verify if your particular device was already attacked by this CVE 2020-3-35-19 vulnerability.

And Qualis provided some instructions on how to exploit a recent open SSH vulnerability.

CVE 202338408. It's a vulnerability and SSH agent. SSAH agent is a tool that allows

you to manage private keys and easily forward privacy keys as you sort of connect from one

system to another. It's always considered a little bit a risky tool to use, but what I found here

was a way how an attacker who already has some access to the system is able to then basically

get a user using SH agent to execute arbitrary code on the attacker's behalf. Pretty interesting

exploit here, pretty lengthy description also,

but all the details needed to actually exploit it are in this post. And VMware released an update

for the Spring Framework that's maintained by VMware. The update does fix a flaw in the configuration file

where if you're using double wild cards, so basically asterix, asterix, well, you create

patterns that can be bypassed if you're trying to use that for any kind of access control.

And then we have yet another vulnerability in a basement management controller.

...