chakra-exploit-framework

Framework de explotación de Chakra Este repositorio contiene el framework de explotación de navegadores que escribí para prepararme para mi curso EXP-401. El framework está dirigido al motor Chakra, que formó parte de Edge hasta su migración a v8 en 2019. La vulnerabilidad de demostración utiliza...

Chakra-CVE-2019-0567

Chakra-CVE-2019-0567 Una PoC de un bug de confusión de tipos en el framework chakracore que conduce a ejecución de código. Del blog de Connor McGar https://connormcgarr.github.io/ NOTA: Los offsets y los gadgets ROP dependen de la versión de Windows que uses, por lo que podría no funcionar para t...

Microsoft Edge Chakra JIT NewScObjectNoCtor / InitProto Type Confusion

Microsoft Edge: Chakra: JIT: Type confusion via NewScObjectNoCtor or InitProto CVE-2019-0567 NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the SetIsPrototype method of the type handler that can cause transition to a new type. This ca...

CVE-2019-0567

creationtimestamp| type| source ---|---|--- 2019-01-09 14:53:48+00:00| seen| MISP/5c360a14-9018-4d13-b6c9-714c0a021402 2019-01-18 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46203 2022-03-16 15:23:15+00:00| published-proof-of-concept| https://t.me/cKure/9046 2022-04-19...

Remote Code Execution (RCE)

Microsoft.ChakraCore is vulnerable to remote code execution. This is due to a type confusion via NewScObjectNoCtor or InitProto which would allow an attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2019-0567, CVE-2019-0568...

Microsoft Windows Multiple Vulnerabilities (KB4480961)

This host is missing a critical security update according to Microsoft KB4480961 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-0567

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0568...

CVE-2019-0567

CVE-2019-0567 is a remote code execution in the Chakra scripting engine used by Microsoft Edge and ChakraCore, stemming from memory handling issues in Chakra. Public exploits are referenced in Exploit-DB (e.g., 46203) and are part of a trio of Edge Chakra memory‑corruption advisories (CVE-2019-05...

Microsoft Patch Tuesday — January 2019: Vulnerability disclosures and Snort coverage

Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 49 vulnerabilities, seven of which are rated “critical,” 40 that are considered “important” and one that is “moderate.” This release also...

KB4480961: Windows 10 Version 1607 and Windows Server 2016 January 2019 Security Update

The remote Windows host is missing security update 4480961. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtai...

Microsoft Edge Chakra Scripting Engine Memory Corruption (CVE-2019-0567)

A memory corruption vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

KLA11397 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in Microsoft Edge can be exploited remotely via specially...

KB4480962: Windows 10 January 2019 Security Update

The remote Windows host is missing security update 4480962. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtai...