Pulse Secure SSL VPN PreAuth Remote Code Execution with Compromising All the Connected VPN Clients

It chained the CVE-2019-11510 and CVE-2019-11539 to a preAuth RCE! We also demonstrate how to leverage the logon script feature to compromise back all the connected VPN clients!
More details can be found from the slides "Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs" by Orange Tsai & Meh Chang

[@hamankoo]

how did you curl just the admin DSID excluding other users?

[@loremipsum685]

11/10 pwnage

[@happymix2792]

perfect !!!

[@davidl.6930]

so awesome! =O

[@adam55719]

So a infected file wouldn’t be noticed by any av after being executed?

[@punitdarji1871]

Does it script available?

[@highecuador1873]

Nice try FBI

[@noname-el5ij]

can you share the script ?

[@JoeSmith-fm5ew]

See script here ruclips.net/video/VcXTeG4rECI/видео.html

[@userou-ig1ze]

@@JoeSmith-fm5ew can you reshare? it's offline