Majes vpnwall-services

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Recommended Extentions:

uBlock Origin

https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

Settings

Make sure the following options are off:

Disable pre-fetching

Reset Forgotten FZ PIN

`::` Last updated May 5th 2022. `::`

First method

Plug your device in to a PC and open qFlipper.
On the device, hold LEFT and BACK simultaneously for 2 seconds.
Release BACK first, then wait until the LED becomes blue to release LEFT.
In qFlipper settings (Wrench icon), set Firmware Update Channel to "Development."
If you see a blue "REPAIR" button and the text "Dev XXXXXXXX" (With X being a random character) click the repair button.
Accept the confirmation prompt.

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

Here is the best setup (I think so :D) for K-series Keychron keyboards on Linux.

Note: many newer Keychron keyboards use QMK as firmware and most tips here do not apply to them. Maybe the ones related to Bluetooth can be useful, but everything related to Apple's keyboard module (hid_apple) on Linux, won't work. As far as I know, all QMK-based boards use the hid_generic module instead. Examples of QMK-based boards are: Q, Q-Pro, V, K-Pro, etc.

Most of these commands have been tested on Ubuntu 20.04 and should also work on most Debian-based distributions. If a command happens not to work for you, take a look in the comment section.

Make Fn + F-keys work (NOT FOR QMK-BASED BOARDS)

Older Keychron keyboards (those not based on QMK) use the hid_apple driver on Linux, even in the Windows/Android mode, both in Bluetooth and Wired modes.

See bootableinstaller.com

How to create a Bootable MacOS Recovery USB from Linux

If your Mac is out-of-order or you otherwise cannot download macOS from the App Store, you can still create a bootable OS X recovery USB, and you can use that to create an Installer USB.

The downloads used in this process are legal and freely avaliable - including disk images directly from Apple's IT support pages, and open source utilities for extracting and converting pkg, dmg, and HFS+.

1. Install tools and config IPXE

# Install compiler and dependencies
sudo apt-get install -y git gcc make liblzma-dev

# Grab the source code
git clone https://github.com/ipxe/ipxe.git
cd ipxe/src

# Enable NFS support

	# MINIMAL USB gadget setup using CONFIGFS for simulating Razer Gaming HID
	# devices for triggering the vulnerable Windows Driver installer
	# credits for the Windows Driver install vuln: @j0nh4t
	#
	# https://twitter.com/j0nh4t/status/1429049506021138437
	# https://twitter.com/an0n_r0/status/1429263450748895236
	#

	# the script was developed & tested on Android LineageOS 18.1

	# Builds NGINX from the QUIC+HTTP/3 development branch
	# - Based on the official NGINX docker image, including all modules built by default
	# - OpenSSL replaced with LibreSSL to support QUIC's TLS requirements (statically linked)
	#
	# docker build --no-cache -t nginx:quic .
	# docker run -d -p 443:443 -p 443:443/udp nginx:quic
	#
	# Note that a suitable configuration file and TLS certificates are required for testing!
	# See <https://quic.nginx.org/readme.html> for more info

	#!/bin/bash

	meetsh=$(basename "$0")
	meetctl=$(basename "${0%%.sh}")
	# jitsi components
	jitsi=(-f docker-compose.yml)
	jitsilst=$meetctl.lst
	test -f $jitsilst && {
	# read list of additional jitsi components
	while read line; do