ideriev Posted June 26, 2014 ID:846444 Share Posted June 26, 2014 I used Metasploit to test MBAE Free and got mixed results:- CVE-2014-0515 (Windows 7 SP1, IE 11, Flash Player 12) was successfully blocked- but CVE-2013-2465 (Windows 7 SP1, IE 11, JRE 1.7u5) wasn't. And the same with some other similar Java-exploits.What is the reason? Would support team like to comment? mbae-logs.zip Link to post Share on other sites More sharing options...
Staff pbust Posted June 26, 2014 Staff ID:846453 Share Posted June 26, 2014 Welcome to the forum and thanks for posting.What msf payloads are you using? Link to post Share on other sites More sharing options...
Staff pbust Posted June 27, 2014 Staff ID:846620 Share Posted June 27, 2014 CVE-2013-2465 blocked here under similar circumstances (Win7, IE, JRE 1.7u4). Can you please share some details on your test setup? Link to post Share on other sites More sharing options...
Staff pbust Posted June 27, 2014 Staff ID:846621 Share Posted June 27, 2014 Tried other payloads (down_exec and meterpreter) with same results. Link to post Share on other sites More sharing options...
ideriev Posted June 30, 2014 Author ID:847525 Share Posted June 30, 2014 Hi pbust.Thanks for you answer and sorry for my delay.I also have tried (through web interface Metasploit) 4 different combination of Target setting (Generic-Java payload/Windows Universal) and Payload type (Meterpreter/Command Shell). Actually MBAE didn't block only one of them - Generic+Meterpreter and was successful in three others. Link to post Share on other sites More sharing options...
Staff pbust Posted June 30, 2014 Staff ID:847543 Share Posted June 30, 2014 Thanks for the info, we'll investigate further and get back to you. Thanks again for testing! Link to post Share on other sites More sharing options...
Francois_Blais Posted July 7, 2014 ID:850050 Share Posted July 7, 2014 Any news on this issue? Link to post Share on other sites More sharing options...
Staff pbust Posted July 8, 2014 Staff ID:850223 Share Posted July 8, 2014 We're closing 1.04 and looking into this in parallel. As soon as we have an update I'll post here. Link to post Share on other sites More sharing options...
ideriev Posted August 12, 2014 Author ID:865804 Share Posted August 12, 2014 How is it possible that after our investigation MBAE 1.04 passed CVE-2013-2465 with all payloads in August test from www.pitci.net? Link to post Share on other sites More sharing options...
Staff pbust Posted August 12, 2014 Staff ID:865852 Share Posted August 12, 2014 The problem is not with the CVE but with the payload used. In fact they used the same payload configuration as you in the 4 fails that are shown for MBAE. So basically they found the same bypass as you but applied it to a different CVE. Link to post Share on other sites More sharing options...
Staff pbust Posted November 5, 2014 Staff ID:902859 Share Posted November 5, 2014 Can you please try MBAE 1.05?https://forums.malwarebytes.org/index.php?/topic/160317-mbae-experimental-10531010/ When you try this again please make sure that the Metasploit machine is physically different than the attacked machine. It is a known issue that when the payload is delivered from the same machine it does not behave the same way as if it is remote. Link to post Share on other sites More sharing options...
ideriev Posted November 8, 2014 Author ID:904791 Share Posted November 8, 2014 MBAE 1.05 still does not detect combination of Generic settings and Meterpreter payload.(Metasploit server and exploitable machine were different VMs) Link to post Share on other sites More sharing options...
Staff pbust Posted November 9, 2014 Staff ID:905257 Share Posted November 9, 2014 Yes it seems that some scenarios cause the bypass. We're reviewing the findings. Thanks for testing this again! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now