"Playing in the Sandbox: Adobe Flash Exploitation Tales"
summary
Demonstrates two concrete Adobe Flash sandbox escapes that actually work: a local-with-filesystem bypass using file:// URIs that embed UNC paths so Flash parses remote SMB shares as local, splitting files into 260-byte URL‑encoded chunks and exfiltrating hosts and other files; and a remote-sandbox redirect abuse that combines permissive crossdomain.xml handling with HTTP→SMB redirects to capture NTLMv2 challenge/response. Tools include a Python SMB trap server, Wireshark traces and offline cracking (rainbow tables / brute force); fixes land in Flash Player 23 and 26 and require application refactors.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:46Adobe Flash
- 2:24Embedding Flash Binaries
- 2:55Flash Sandbox Security
- 3:33Local by Definition - Flash
- 8:41Escaping the Local Sandbox (2)
- 12:24SMB Authentication
- 13:31SMB Relay Attack
- 16:23Attack Variant: SMB Trap
- 18:19Local Sandbox Escape - CVE-2016-4271 (1)
- 21:55The (Revised) Remote Sandbox
- 22:31SMB Attacks, Revisited (1)
- 23:42Testing for Susceptibility - Basic Idea
- 24:16Testing for Susceptibility - First Try
- 24:51Side Track: Cross-Domain Policy File
- 25:46Testing for Susceptibility - Second Try
- 27:18Remote Sandbox Escape - CVE-2017-3085 (1)
- 28:32Remote Sandbox Escape - CVE-2017-3085 (3)
- 29:13Adobe Deprecates Flash
- 29:25Browser Vendors - Flash EOL Roadmap
- 30:19Planning for a Post-Flash World (1)
- 31:12Flash - A Thing of the Past? (1)
- 33:10Conclusions (1)
related talks
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
57mDigging for IE11 Sandbox Escapes Part 1
40mDigging for IE11 Sandbox Escapes Part 2
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
42mModern web application bugs
43mAttacking Modern Web Technologies
02h 27mHow hacking works (Workshop edition)