15 matches found
PetitPotam
PetitPotam PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions : The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it's more prevalent. But it's possible to trigger with the EFSRPC named...
Metasploit Wrap-Up
Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...
CVE-2021-36942
Windows LSA Spoofing Vulnerability...
CVE-2021-36942 Windows LSA Spoofing Vulnerability
...
CVE-2021-36942 Windows LSA Spoofing Vulnerability
...
CVE-2021-36942
CVE-2021-36942 corresponds to Windows LSA Spoofing vulnerability (LSARPC) that can coerce a domain controller to authenticate to an attacker host via NTLM. In August 2021 Microsoft Patch Tuesday released fixes (KB5005413) and mitigations; multiple sources note patching as a priority. CISA’s KEV c...
Critical Vulnerabilities revealed in Microsoft’s Patch Tuesday
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Multiple vulnerabilities have been patched by Microsoft in August 2021 Patch Tuesday. Three of them have been labeled as zero-day vulnerabilities CVE-2021-36936, CVE-2021-36942, and CVE-2021-36948. One of them CVE-2021-36948...
CVE-2021-36942
creationtimestamp| type| source ---|---|--- 2021-08-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=628 2021-08-11 18:46:50+00:00| seen| https://t.me/truesecator/1993 2021-08-23 11:49:49+00:00| seen| MISP/b4779706-9ec4-44cb-afe8-97771711623b 2021-10-25 22:32:43+00:00|...
August 10, 2021—KB5005076 (Monthly Rollup)
None None...
August 10, 2021—KB5005090 (Monthly Rollup)
None None...
August 10, 2021—KB5005094 (Security-only update)
None None...
KB5005089: Windows 7 and Windows Server 2008 R2 Security Update (August 2021)
The remote Windows host is missing security update 5005089 or cumulative update 5005088. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-26425, CVE-2021-34483, CVE-2021-34484,...
Microsoft Releases August 2021 Security Updates
Updated: August 24, 2021 CISA is aware of open source reporting on the active exploitation of CVE-2021-36942 PetitPotam. To address this vulnerability, Microsoft released a patch and mitigation guidance as part of its August 2021 security updates. CISA strongly encourages users and administrators...
KB5005030: Windows 10 Version 1809 and Windows Server 2019 Security Update (August 2021)
The remote Windows host is missing security update 5005030. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-26424, CVE-2021-26432,...
KB5005106: Windows 8.1 and Windows Server 2012 R2 Security Update (August 2021)
The remote Windows host is missing security update 5005106 or cumulative update 5005076. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,...