Antoine Goichot

It's not the weapon that's important, it's the Ninja wielding it.

[Cooper @Ministraitor]

OverLAPS: Overriding LAPS Logic - Antoine Goichot
https://t.co/A6PsbcWG4Z
#HackLu @hack_lu

[Max @maxime_tz]

The slides of my talk "Defeating VPN Always-On : https://t.co/N0W40NMpth

The videos and code:
https://t.co/82LuBsWw40

[Max @maxime_tz]

🥳 achievement unlocked!
Presenting at @defcon in front of a FULL room! 🤩 Thank you all so much for attending my talk! Amazing audience, amazing experience 🥰

[Max @maxime_tz]

How it started. @hack_lu
How it's going. @defcon

Believe in your dreams... And work your ass off!

#Hack_lu #DEFCON31

[Max @maxime_tz]

🚨 📢 Big announcement ! 📢 🚨

I have been selected to present a talk on the main track of 🏴‍☠️ @defcon 31 🏴‍☠️ this August!

The title of my presentation is "Defeating VPN Always-On", a nice feature that you might have in your own organisation 😈

https://t.co/Y7TUBx6hxz

[Antoine Goichot @AntoineGoichot]

@yorickkoster @crypt0ad @tiraniddo @serializingme Indeed! All my gratitude gentlemen!

[Antoine Goichot @AntoineGoichot]

Great job! Thank you guys for the shout out!
Cc @yorickkoster thank you again for CVE-2020-3153 and your advisory!

[Cobalt Strike @_CobaltStrike]

The team has been hard at work. Read our analysis of the Cisco AnyConnect Posture (HostScan) CVE-2021-1366: https://t.co/9E2mQjfNRF

[CVE @CVEnew]

CVE-2020-27123 A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected ... https://t.co/cmONLgSQse

[Antoine Goichot @AntoineGoichot]

@kmkz_security Thank you!

[Antoine Goichot @AntoineGoichot]

My 3 vulns on AnyConnect (Windows) are public! CVE-2020-3433 (high, privesc https://t.co/J6OmZiy3Qx), CVE-2020-3434 (medium, DoS https://t.co/Pz5LQCR5ez) and CVE-2020-3435 (medium, Always-On bypass https://t.co/LoeczkJBY1). Patch it! Full details & exploits soon ;)

[Antoine Goichot @AntoineGoichot]

@NotMedic @userID_404 https://t.co/6loB5ezI33 PR created just now :)

[Antoine Goichot @AntoineGoichot]

Thanks to @rapid7 's work (@n00tmeg ) on the @metasploit module for CVE-2020-3153 (@yorickkoster), my own MSF module for the new CVE-2020-3433 I discovered (Windows privesc on AnyConnect < 4.9.00086) is ready! Update before the exploit gets public ;)

[Antoine Goichot @AntoineGoichot]

@_th3y @HackingLZ Sure! You can read @serializingme posts that could help you to understand AnyConnect’s IPC protocol (https://t.co/A8e1Y3ais1 and https://t.co/QqBMk1O0YM). I also wrote a post on a privesc on AnyConnect: CVE-2020-3153 (discovered by @yorickkoster) https://t.co/reO88J9Bny

[Antoine Goichot @AntoineGoichot]

Greetings to my colleagues from @PwC_Luxembourg cyber security team

[Christophe De La Fuente @n00tmeg]

Cisco AnyConnect (<4.8.02042) Privesc through Path Traversal on Windows. Brand new #Metasploit module: https://t.co/0lNzKy6IRz

[Antoine Goichot @AntoineGoichot]

@maxime_tz and for the proofreading :)

[Antoine Goichot @AntoineGoichot]

I have released my exploit for CVE-2020-3153 - Cisco AnyConnect privilege escalation through path traversal https://t.co/1xSxJUjhuJ

My notes on this vuln: https://t.co/reO88J9Bny

Kudos to @yorickkoster for the advisory & for the -ipc help!
Thank you @maxime_tz for the diagrams!

[Antoine Goichot @AntoineGoichot]

@nixhacker @yorickkoster @jarsnah12 I mainly used ProcMon / Wireshark during real auto-updates (4.5.02036 to 4.6.03049) of AnyConnect to understand normal behavior of the sofware.
A disasembler can be helpful to identify args.
FYI, AnyConnect logs a lot of information that you can read in Windows Event Viewer.

[Antoine Goichot @AntoineGoichot]

@yorickkoster I updated my PoC, it's working on AnyConnect 4.8.01090. Thank you @yorickkoster for the nudge :-)

[Antoine Goichot @AntoineGoichot]

@yorickkoster Thank your for your PoC and thank you again for your detailed advisory!