| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/bishopfox/sliver | ≥ 1.5.0, < 1.5.40 | 1.5.40 |
| sliver | ≥ 1.5.0, < 1.5.40 | 1.5.40 |
The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)
Please see the PoC repo.
Please also see the PoC repo. To setup a simple PoC environment,
notepad.exe window should pop up on the implanted VM.A successful attack grants the attacker permission to execute arbitrary code on the implanted device.
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go
https://github.com/tangent65536/Slivjacker
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí