32 matches found
CVE-2018-8174_EXP
CVE-2018-8174EXP 用法: CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT Exploit for CVE-2018-8174 （CVE-2018-8174 漏洞利用工具） 可选参数: -h, --help 显示此帮助信息并退出 -u URL, --url URL 漏洞利用页面 URL -o OUTPUT, --output OUTPUT 输出的漏洞利用 rtf 文件 -i IP, --ip IP netcat 监听的 IP -p PORT, --port PORT netcat 监听的端口 示例: 1. python...
CVE-2018-8174-exp
CVE-2018-8174EXP 使用法: CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT CVE-2018-8174 のエクスプロイト オプション引数: -h, --help このヘルプメッセージを表示して終了 -u URL, --url URL エクスプロイトURL -o OUTPUT, --output OUTPUT エクスプロイトRTFを出力 -i IP, --ip IP netcat用のIP -p PORT, --port PORT netcat用のポート 例: 1. python CVE-2018-8174.py -u...
CVE-2018-8174_EXP
CVE-2018-8174EXP usage: CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT CVE-2018-8174 のエクスプロイト optional arguments: -h, --help show this help message and exit -u URL, --url URL exp の URL -o OUTPUT, --output OUTPUT エクスプロイト RTF の出力先 -i IP, --ip IP netcat 用 IP アドレス -p PORT, --port PORT netcat 用...
cve-2018-8174_analysis
最新ブラウザエクスプロイトの解析: CVE-2018-8174 のケーススタディ 概要 このエクスプロイトが2018年4月から5月にかけて初めて登場したとき、私は強い興味を抱きました。なぜなら、高度に難読化されているにもかかわらず、コード構造はよく整理されており、脆弱性のエクスプロイトコードは十分に小さく、解析が簡単だったからです。GitHubのPoC...
Rig-Exploit-for-CVE-2018-8174
Rig-Exploit-for-CVE-2018-8174 针对CVE-2018-8174的Rig漏洞利用。与之前的活动一样，Rig的Seamless活动使用恶意广告。这种情况下，恶意广告包含一个隐藏的iframe，将受害者重定向到Rig的着陆页，该页面包含针对CVE-2018-8174的漏洞利用代码和shellcode。这能够对着陆页中混淆的shellcode实现远程代码执行。成功利用后，会检索一个第二阶段下载器，根据URL来看似乎是SmokeLoader的一个变种。随后它会下载最终载荷——一个门罗币矿工。...
RIG Exploit Kit Now Infects Victims' PCs With Dridex Instead of Raccoon Stealer
The operators behind the Rig Exploit Kit have swapped the Raccoon Stealer malware for the Dridex financial trojan as part of an ongoing campaign that commenced in January 2022. The switch in modus operandi, spotted by Romanian company Bitdefender, comes in the wake of Raccoon Stealer temporarily...
Threat profile: Egregor ransomware is making a name for itself
What is Egregor? Egregor ransomware is a relatively new ransomware first spotted in September 2020 that seems intent on making its way to the top right now. Egregor is considered a variant of Ransom.Sekhmet based on similarities in obfuscation, API-calls, and the ransom note. As weve reported in...
Magnitude exploit kit – evolution
Exploit kits are not as widespread as they used to be. In the past, they relied on the use of already patched vulnerabilities. Newer and more secure web browsers with automatic updates simply do not allow known vulnerabilities to be exploited. It was very different back in the heyday of Adobe Fla...
Exploit for Out-of-bounds Write in Microsoft
IE11 VBScript Exploit Exploit Generator for CVE-2018-8174 &...
Exploit kits: spring 2019 review
Exploit kit activity remains fairly unchanged since our last winter review in terms of active distribution campaigns. But this spring edition will feature a new exploit kit and another atypical EK, in that it specifically goes after routers. The main driver behind these drive-by download attacks...
New backdoor malware hits Slack and Github platforms
By Waqas The cybersecurity researchers at Trend Micro have discovered A new malware strain tapped into GitHub posts and Slack channels. Dubbed Slub by researchers; the malware works by exploiting a VBScript engine vulnerability that is classified as CVE-2018-8174 patched by Microsoft last year. B...
Exploit kits: winter 2019 review
Active malvertising campaigns in December and the new year have kept exploit kit activity from hibernating in winter 2019. We mostly observed Fallout and RIG with the occasional, limited GrandSoft appearance for wider geo-targeting. In addition, narrowly-focused exploit kits such as Magnitude,...
Exploit kits: fall 2018 review
Exploit kit EK activity continues to surprise us as the weather cools, the leaves change, and we move into the fall of 2018. Indeed, shortly after our summer review, a new exploit kit was discovered, and while no new vulnerabilities were added to the current EKs, several malvertising chains are...
Multiple Cobalt Personality Disorder
Introduction Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that ar...
Exploit kits: Spring 2018 review
Since our last report on exploit kits, there have been some new developments with the wider adoption of the February Flash zero-day, as well as the inclusion of a new exploit for Internet Explorer. We have not seen that many changes in the drive-by landscape for a long time, although these are th...
Internet Explorer zero-day: browser is once again under attack
Update 2018-05-25: CVE-2018-8174 has been added to the RIG exploit kit MDNC. Update 2018-05-22: Security researcher Richard Warren mentioned that a fully working IE zero-day now patched with payload was uploaded to VirusTotal. We decided to test Malwarebytes against it, since last time we only ha...
CVE-2018-8174
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1,...
CVE-2018-8174
CVE-2018-8174 is a Windows VBScript Engine out-of-bounds write vulnerability enabling remote code execution. Public documentation confirms an RCE when the VBScript engine handles in-memory objects, affecting Windows 7, Server 2008/2012/2016, Windows 8.1, Windows 10 and server variants. Public wri...
Microsoft Patches Two Zero-Day Flaws Under Active Attack
It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...
Microsoft Patches Two Zero-Day Flaws Under Active Attack
It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...