Advanced-Loader-Reverse-Engineering

Shellhostから3つのDLLへ：ペイロードインジェクション、CFGバイパス、ダウングレード攻撃を含む高度なローダーの分析 概要 この分析は、Shellhost.exe、amsi.dll、mstscax.dll、clbcatq.dllを標的とした高度な多段階ローダーを扱います。このローダーは、モジュールストンピング、CFGバイパス、COMハイジャック、およびダウングレード攻撃を使用します。 Shellhost – ペイロードインジェクションの主要標的 ローダーは、ペイロードインジェクションの主要プロセスとしてShellhost.exeを標的にします。モジュールストンピング...

-CVE-2018-0834-aab-aar

@reubensammutにシャウトアウト、お前はすごいやつだG。CVE-2018-0834 完全なコード実行。静的オフセットを含み、cfg, dep, aslr をバイパス : 楽しんで...

Microsoft Internet Explorer 11 and WPAD service 'Jscript.dll' - Use-After-Free

Exploit Title: Microsoft Internet Explorer 8/11 and WPAD service 'Jscript.dll' - Use-After-Free Date: 2021-05-04 Exploit Author: deadlock Forrest Orr Vendor Homepage: https://www.microsoft.com/ Software Link: https://www.microsoft.com/en-gb/download/internet-explorer.aspx Versions: IE 8-11 64-bit...

CVE-2018-8276

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard CFG to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore...

PT-2018-18523

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified ChakraCore affected versions not specified Description A security feature bypass issue exists in the Microsoft Chakra scripting engine, allowing Control Flow Guard CFG to be bypassed. This issue...

CVE-2018-0818

Microsoft ChakraCore allows an attacker to bypass Control Flow Guard CFG in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feature Bypass"...

PT-2018-9083

Name of the Vulnerable Software and Affected Versions: Microsoft ChakraCore affected versions not specified Description: The issue allows an attacker to bypass Control Flow Guard CFG in conjunction with another vulnerability, enabling them to run arbitrary code on a target system. This is due to...

Microsoft Edge Chakra CFG Bypass With leafInterpreterFrame Vulnerability

Chakra suffers from a CFG bypass with leafInterpreterFrame. Every JavaScript variable in Chakra except a tagged int is a pointer. From this pointer, using an arbitrary read, it is possible to follow a chain of pointers and end up with a pointer to the native stack. This allows disclosing the stac...

Microsoft Edge Chakra CFG Bypass Due To Bug In ServerFreeAllocation Vulnerability

Charka suffers from a CFG bypass due to a bug in ServerFreeAllocation. Chakra: CFG bypass due to a bug in ServerFreeAllocation CVE-2017-11874 Chakra JIT server exposes a ServerFreeAllocation method that can be used to free an existing JIT allocation for example when the corresponding function get...

PT-2017-12279

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description A security feature bypass issue exists due to how memory is accessed in code compiled by the Edge Just-In-Time JIT compiler, allowing Control Flow Guard CFG to be bypassed. This issue...