Microsoft Office COM Object - els.dll DLL Planting (MS15-134)

Microsoft Office COM Object - els.dll DLL Planting MS15-134 Source: https://code.google.com/p/google-security-research/issues/detail?id=514 It is possible for an attacker to execute a DLL planting attack in Microsoft Office with a specially crafted OLE object. Testing was performed on a Windows 7...

Microsoft Windows CVE-2015-6128 DLL Loading Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition. Note: This issue was previously titl...

JRSoft InnoSetup DLL Hijack

Hi @ll, executable installers ° created with JRSoft InnoSetup see ; this includes of course InnoSetup itself too are vulnerable: 1. They load and execute a rogue/bogus/malicious UXTheme.dll ' eventually found in the directory they are started from the "application directory". For software...

SumatraPDF DLL Hijack

Hi @ll, the executable installers ° of all versions of SumatraPDF see are vulnerable: 1. On Windows Embedded POSReady 2009 alias Windows XP SP3 the installer of the current version 3.1.1 loads and executes a rogue/bogus/malicious DCIMan32.dll ' eventually found in the directory it is started from...

Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)

require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...

VLC DLL Hijack

Hi @ll, the executable installers ° of the videolan client VLC, see are vulnerable: 1. They load and execute a rogue/bogus/malicious ShFolder.dll '² and other DLLs like SetupAPI.dll or UXTheme.dll too eventually found in the directory they are started from the "application directory". For softwar...

Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on March 3, 2015, and is being released to the NCCIC/ICS-CERT web site. Ivan Sanchez of NullCode & Evilcode Team has identified multiple DLL Hijacking vulnerabilities in a software component included with Rockwell...

迅雷权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

迅雷极速版权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

Advantech WebAccess < 8.0.2015.08.16 Unspecified DLL String Handling Arbitrary Code Execution

Binary data scadaadvantechwebaccess820150816.nbin...

PowerTools - Collection Of PowerShell Projects With A Focus On Offensive Operations

Veil's PowerTools are a collection of PowerShell projects with a focus on offensive operations. This collection contains five projects: PowerUp PowerBreach PowerPick PewPewPew PowerView PowerUp PowerUp is a powershell tool to assist with local privilege escalation on Windows systems. It contains...

Symantec Endpoint Protection-RU6-MP3 Untrusted Search Path Vulnerability

Symantec Endpoint Protection is a new generation of enterprise-class antivirus software developed by Symantec. Symantec Endpoint Protection 12.1-RU6-MP3 A previous version of 12.1 contained an untrusted search path vulnerability that allowed a local user to gain privileges via a Trojan horse DLL...

Design/Logic Flaw

Untrusted search path vulnerability in the client in Symantec Endpoint Protection SEP 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492...

CVE-2015-8113

Summary (CVE-2015-8113): SEP 12.1 before 12.1-RU6-MP3 is vulnerable to local privilege escalation via an untrusted search path (Trojan horse DLL) in a client install package. This stems from an incomplete fix for CVE-2015-1492 and affects SEP clients; the issue can be exploited locally to gain pr...

Microsoft Windows Excel Viewer Remote Code Execution Vulnerability (3104540)

This host is missing an important security update according to Microsoft Bulletin MS15-116. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Office Excel Multiple Remote Code Execution Vulnerabilities (3104540)

This host is missing a critical security update according to Microsoft Bulletin MS15-116. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Internet Explorer ShowSaveFileDialog Protected Mode Sandbox Escape Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the usage o...

Researcher releases Free Hacking Tool that Can Steal all Your Secrets from Password Manager

Unless we are a human supercomputer, remembering a different password for every different site is not an easy task. But to solve this problem, there is a growing market of best password manager and lockers, which remembers your password for every single account and simultaneously provides an extr...

KeeFarce - Extracts Passwords From A Keepass 2.X Database, Directly From Memory

KeeFarce allows for the extraction of KeePass 2.x password database information from memory. The cleartext information, including usernames, passwords, notes and url's are dumped into a CSV file in %AppData% General Design KeeFarce uses DLL injection to execute code within the context of a runnin...

Schneider Electric Multiple Products Buffer Overflow Vulnerability

OVERVIEW NCCIC/ICS-CERT received a report from Ariele Caltabiano kimiya with HP’s Zero Day Initiative ZDI concerning a buffer overflow vulnerability in Schneider Electric’s SoMove Lite software package. While addressing this vulnerability, Schneider Electric identified multiple vulnerable Schneid...