15 matches found
PetitPotam
PetitPotam PoC 工具，通过 MS-EFSRPC 的 EfsRpcOpenFileRaw 或其他函数强制 Windows 主机向其他机器进行身份验证 : 该工具使用 LSARPC 命名管道及接口 c681d488-d850-11d0-8c52-00c04fd90f7e，因为它更为普遍。但也可以通过 EFSRPC 命名管道和接口 df1941c5-fe89-4e79-bf10-463657acf44d 触发。对域控制器无需凭据 :D 禁用 EFS 服务似乎无法缓解该“特性” Python 版本需要安装 Impacket，Windows PoC 在 VS 2019 Communi...
Metasploit Wrap-Up
Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...
CVE-2021-36942
Windows LSA Spoofing Vulnerability...
CVE-2021-36942 Windows LSA Spoofing Vulnerability
...
CVE-2021-36942
CVE-2021-36942 corresponds to Windows LSA Spoofing vulnerability (LSARPC) that can coerce a domain controller to authenticate to an attacker host via NTLM. In August 2021 Microsoft Patch Tuesday released fixes (KB5005413) and mitigations; multiple sources note patching as a priority. CISA’s KEV c...
CVE-2021-36942 Windows LSA Spoofing Vulnerability
...
Critical Vulnerabilities revealed in Microsoft’s Patch Tuesday
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Multiple vulnerabilities have been patched by Microsoft in August 2021 Patch Tuesday. Three of them have been labeled as zero-day vulnerabilities CVE-2021-36936, CVE-2021-36942, and CVE-2021-36948. One of them CVE-2021-36948...
CVE-2021-36942
creationtimestamp| type| source ---|---|--- 2021-08-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=628 2021-08-11 18:46:50+00:00| seen| https://t.me/truesecator/1993 2021-08-23 11:49:49+00:00| seen| MISP/b4779706-9ec4-44cb-afe8-97771711623b 2021-10-25 22:32:43+00:00|...
August 10, 2021—KB5005094 (Security-only update)
None None...
August 10, 2021—KB5005076 (Monthly Rollup)
None None...
August 10, 2021—KB5005090 (Monthly Rollup)
None None...
KB5005106: Windows 8.1 and Windows Server 2012 R2 Security Update (August 2021)
The remote Windows host is missing security update 5005106 or cumulative update 5005076. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,...
KB5005089: Windows 7 and Windows Server 2008 R2 Security Update (August 2021)
The remote Windows host is missing security update 5005089 or cumulative update 5005088. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-26425, CVE-2021-34483, CVE-2021-34484,...
Microsoft Releases August 2021 Security Updates
Updated: August 24, 2021 CISA is aware of open source reporting on the active exploitation of CVE-2021-36942 PetitPotam. To address this vulnerability, Microsoft released a patch and mitigation guidance as part of its August 2021 security updates. CISA strongly encourages users and administrators...
KB5005030: Windows 10 Version 1809 and Windows Server 2019 Security Update (August 2021)
The remote Windows host is missing security update 5005030. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-26424, CVE-2021-26432,...