32 matches found
cve-2018-8174_analysis
Разбор современного браузерного эксплойта: практический анализ CVE-2018-8174 Обзор Когда этот эксплойт впервые появился на рубеже апреля и мая, он вызвал мой интерес, поскольку, несмотря на сильную обфускацию, структура кода казалась хорошо организованной, а код эксплуатации уязвимости — достаточ...
CVE-2018-8174_EXP
CVE-2018-8174EXP utilisation : CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT Exploit pour CVE-2018-8174 arguments optionnels : -h, --help affiche ce message d'aide et quitte -u URL, --url URL url de l'exploit -o OUTPUT, --output OUTPUT Fichier RTF de sortie de l'exploit -i IP, --ip IP ip pou...
CVE-2018-8174_EXP
CVE-2018-8174EXP 사용법: CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT CVE-2018-8174 익스플로잇 선택적 인수: -h, --help 이 도움말 메시지를 표시하고 종료 -u URL, --url URL 익스플로잇 URL -o OUTPUT, --output OUTPUT 익스플로잇 RTF 파일 출력 -i IP, --ip IP netcat용 IP -p PORT, --port PORT netcat용 포트 예: 1. python CVE-2018-8174.py -u...
Rig-Exploit-for-CVE-2018-8174
Rig-Exploit-for-CVE-2018-8174 Rig Exploit for CVE-2018-8174. 이전 캠페인과 마찬가지로, Rig의 Seamless 캠페인은 악성 광고를 사용합니다. 이 경우, 악성 광고에는 숨겨진 iframe이 포함되어 피해자를 Rig의 랜딩 페이지로 리디렉션하며, 해당 페이지에는 CVE-2018-8174 익스플로잇과 셸코드가 포함되어 있습니다. 이를 통해 랜딩 페이지에서 난독화된 셸코드의 원격 코드 실행이 가능해집니다. 성공적인 익스플로잇 후, 2단계 다운로더가 검색되는데, URL로 보아...
CVE-2018-8174-exp
CVE-2018-8174EXP 使用法: CVE-2018-8174.py -h -u URL -o OUTPUT -i IP -p PORT CVE-2018-8174 のエクスプロイト オプション引数: -h, --help このヘルプメッセージを表示して終了 -u URL, --url URL エクスプロイトURL -o OUTPUT, --output OUTPUT エクスプロイトRTFを出力 -i IP, --ip IP netcat用のIP -p PORT, --port PORT netcat用のポート 例: 1. python CVE-2018-8174.py -u...
RIG Exploit Kit Now Infects Victims' PCs With Dridex Instead of Raccoon Stealer
The operators behind the Rig Exploit Kit have swapped the Raccoon Stealer malware for the Dridex financial trojan as part of an ongoing campaign that commenced in January 2022. The switch in modus operandi, spotted by Romanian company Bitdefender, comes in the wake of Raccoon Stealer temporarily...
Threat profile: Egregor ransomware is making a name for itself
What is Egregor? Egregor ransomware is a relatively new ransomware first spotted in September 2020 that seems intent on making its way to the top right now. Egregor is considered a variant of Ransom.Sekhmet based on similarities in obfuscation, API-calls, and the ransom note. As weve reported in...
Magnitude exploit kit – evolution
Exploit kits are not as widespread as they used to be. In the past, they relied on the use of already patched vulnerabilities. Newer and more secure web browsers with automatic updates simply do not allow known vulnerabilities to be exploited. It was very different back in the heyday of Adobe Fla...
Exploit for Out-of-bounds Write in Microsoft
IE11 VBScript Exploit Exploit Generator for CVE-2018-8174 &...
Exploit kits: spring 2019 review
Exploit kit activity remains fairly unchanged since our last winter review in terms of active distribution campaigns. But this spring edition will feature a new exploit kit and another atypical EK, in that it specifically goes after routers. The main driver behind these drive-by download attacks...
New backdoor malware hits Slack and Github platforms
By Waqas The cybersecurity researchers at Trend Micro have discovered A new malware strain tapped into GitHub posts and Slack channels. Dubbed Slub by researchers; the malware works by exploiting a VBScript engine vulnerability that is classified as CVE-2018-8174 patched by Microsoft last year. B...
Exploit kits: winter 2019 review
Active malvertising campaigns in December and the new year have kept exploit kit activity from hibernating in winter 2019. We mostly observed Fallout and RIG with the occasional, limited GrandSoft appearance for wider geo-targeting. In addition, narrowly-focused exploit kits such as Magnitude,...
Exploit kits: fall 2018 review
Exploit kit EK activity continues to surprise us as the weather cools, the leaves change, and we move into the fall of 2018. Indeed, shortly after our summer review, a new exploit kit was discovered, and while no new vulnerabilities were added to the current EKs, several malvertising chains are...
Multiple Cobalt Personality Disorder
Introduction Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that ar...
Exploit kits: Spring 2018 review
Since our last report on exploit kits, there have been some new developments with the wider adoption of the February Flash zero-day, as well as the inclusion of a new exploit for Internet Explorer. We have not seen that many changes in the drive-by landscape for a long time, although these are th...
Internet Explorer zero-day: browser is once again under attack
Update 2018-05-25: CVE-2018-8174 has been added to the RIG exploit kit MDNC. Update 2018-05-22: Security researcher Richard Warren mentioned that a fully working IE zero-day now patched with payload was uploaded to VirusTotal. We decided to test Malwarebytes against it, since last time we only ha...
CVE-2018-8174
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1,...
CVE-2018-8174
CVE-2018-8174 is a Windows VBScript Engine out-of-bounds write vulnerability enabling remote code execution. Public documentation confirms an RCE when the VBScript engine handles in-memory objects, affecting Windows 7, Server 2008/2012/2016, Windows 8.1, Windows 10 and server variants. Public wri...
Microsoft Patches Two Zero-Day Flaws Under Active Attack
It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...
Microsoft Patches Two Zero-Day Flaws Under Active Attack
It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...