73 matches found
Receiver | keyboard language set on VDA is over ridden by the one set on the endpoint
User from non domain joined endpoint logs on the VDA Language set on the VDA is overridden by the one set on endpoint machine Receiver. We want to ensure that the keyboard language set on the VDA is the one user gets inside the session. In other words, keyboard language set on the endpoint Receiv...
WMI Command Shell Wrapper: WMIcmd
WMI Command Shell Wrapper When doing low impact investigations and other similar activities you may want to minimize what is written to disk / obvious. This tool allows us to execute commands via WMI and get information not otherwise available via this channel. Purpose A small utility which only...
Using the Registry to Discover Unix Systems and Jump Boxes
On red team engagements, Mandiant consultants are often tasked with identifying and obtaining access to critical Unix systems within our client’s environments. The objectives may include obtaining payment card data on point of sale terminals or accessing intellectual property residing on Apple...
CVE-2016-3300
The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of Privilege Vulnerability...
Privilege escalation
The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of Privilege Vulnerability...
MS16-101: Description of the security update for Windows authentication methods: August 9, 2016
None None...
MS16-101: Security update for Windows authentication methods: August 9, 2016
Resolves vulnerabilities in Windows that could allow elevation of privilege if an attacker runs a specially crafted application on a domain-joined system.Important This article contains information that shows you how to help lower security settings or how to turn off security features on a...
MS16-072: Description of the security update for Group Policy: June 14, 2016
None None...
MS15-122: Security Update for Kerberos to Address Security Feature Bypass (3105256)
The remote Windows host is affected by a security feature bypass vulnerability in Kerberos due to a failure to check the password change of a user signing into a workstation. A remote attacker can exploit this vulnerability by connecting a workstation to a malicious Kerberos Key Distribution Cent...
MS15-027: Vulnerability in NETLOGON could allow spoofing: March 10, 2015
None None...
Microsoft Windows Group Policy Remote Code Execution (MS15-011; CVE-2015-0008)
A remote code execution vulnerability exists in Microsoft Windows. The vulnerability is due to the way Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. An attacker can exploit this vulnerability by convincing a victim with a...
MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow
This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect function using the Workstation service in Windows 2000 SP4 and Windows XP SP2. In order to exploit this vulnerability, you must specify the name of a valid Windows DOMAIN. It may be possible to satisfy this conditio...
