Pre-Auth RCE Chains on an MDM: Exploiting Quest KACE SMA
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).
Summary
Mobile Device Management (MDM) as Single Points of Failure
Centralized endpoint management appliances maintain privileged administrative agents across an entire enterprise fleet, making them prime targets for initial access.
Auditing the Quest KACE SMA Web Interface
Jeffrey Hofmann details reverse engineering the KACE SMA firmware, discovering authentication bypasses and unauthenticated SQL injection flaws.
Chaining Vulnerabilities into Root Remote Code Execution
Hofmann demonstrates chaining unauthenticated API endpoints with command injection in backend PHP handlers to achieve instant root-level shell access.
Vendor Remediation and Enterprise MDM Hardening
The author outlines the coordinated vulnerability disclosure timeline and offers hardening advice for isolating management appliances behind VPN perimeters.
Related talks
Main Stage·48 min
Orange Tsai
Orange Tsai reveals a revolutionary attack surface on Microsoft Exchange Server, chaining pre-auth SSRF, authentication bypass, and post-auth RCE into ProxyLogon, ProxyOracle, and ProxyShell.
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Main Stage·37 min
James 'albinowax' Kettle
James Kettle unleashes novel HTTP request smuggling and desync attack classes against modern web infrastructure, arguing for the retirement of HTTP/1.1.