APT Trends report Q2 2017

Introduction Since 2014, Kaspersky Lab's Global Research and Analysis Team GReAT has been providing threat intelligence reports to a wide-range of customers worldwide, leading to the delivery of a full and dedicated private reporting service. Prior to the new service offering, GReAT published...

Immunity Canvas: SPECIAL_LNK

Name| speciallnk ---|--- CVE| CVE-2017-8464 Exploit Pack| CANVAS Description| speciallnk Notes| References: 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464', 'http://paper.seebug.org/357/', 'http://www.vxjump.net/files/vulnanalysis/cve-2017-8464.txt' CVE Name:...

Linux Kernel 3.11 < 4.8 0 - SO_SNDBUFFORCE & SO_RCVBUFFORCE Local Privilege Escalation Exploi

Exploit for linux platform in category local exploits // CAPNETADMIN - root LPE exploit for CVE-2016-9793 // No KASLR, SMEP or SMAP bypass included // Affected kernels: 3.11 - 4.8 // Tested in QEMU only // https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793 // // Usage: // gcc...

GNS3 Mac OS-X 1.5.2 ubridge Privilege Escalation

!/bin/sh GNS-3 Mac OS-X LPE local root exploit ===================================== GNS-3 on OS-X bundles the "ubridge" binary as a setuid root file. This file can be used to read arbitary files using "-f" arguement but also as it runs as root can also write arbitrary files with "pcapfile"...

Updated shadow-utils packages fix security vulnerabilities

It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid CVE-2016-6251. It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int...

MacOS Kernel < 10.12.2 / iOS < 10.2 - _kernelrpc_mach_port_insert_right_trap Reference Count L

Exploit for multiple platform in category local exploits / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=941 Proofs of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40956.zip The previous ref count overflow bugs were all kinda...

RedStar 3.0 Server - BEAM & RSSMON Command Execution (Shellshock) Exploit

Exploit for linux platform in category local exploits !/usr/bin/env python RedStar OS 3.0 Server BEAM & RSSMON shellshock exploit ======================================================== BEAM & RSSMON are Webmin based configuration utilities that ship with RSS server 3.0. These packages are the...

RSSMON / BEAM (Red Star OS 3.0) Shellshock

!/usr/bin/env python RedStar OS 3.0 Server BEAM & RSSMON shellshock exploit ======================================================== BEAM & RSSMON are Webmin based configuration utilities that ship with RSS server 3.0. These packages are the recommended GUI configuration components and listen on ...

RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection

!/usr/bin/env python RedStar OS 3.0 Server BEAM & RSSMON shellshock exploit ======================================================== BEAM & RSSMON are Webmin based configuration utilities that ship with RSS server 3.0. These packages are the recommended GUI configuration components and listen on ...

RedStar 3.0 Server - Shellshock BEAM RSSMON Command Injection

RedStar 3.0 Server - Shellshock BEAM RSSMON Command Injection !/usr/bin/env python RedStar OS 3.0 Server BEAM & RSSMON shellshock exploit ======================================================== BEAM & RSSMON are Webmin based configuration utilities that ship with RSS server 3.0. These packages a...

$90K Windows Zero Day Gets a Price Cut

A Windows zero-day for sale on the black market for $90,000 just received a price drop. The flaw that allegedly leaves all versions of Windows users exposed to a local privilege escalation LPE vulnerability can now be snatched up for $85,000. According to Trustwave, which has been monitoring the...

Windows Zero Day Selling for $90,000

Hackers claim to have unearthed a zero-day vulnerability giving attackers admin rights to any Windows machine from Windows 2000 to a fully patched version of Windows 10. The zero day is for sale on the black market for $90,000. Security experts say the zero-day exploit looks legitimate and in the...

Acunetix WVS 10 - Remote Command Execution

''' Acunetix WVS 10 - Remote command execution SYSTEM privilege - Author: Daniele Linguaglossa Overview ========= Acunetix WVS 10 1 is an enterprise web vulnerability scanner developer by Acunetix Inc. Two major flaws exists in the last version of Acunetix, these bug allow a remote attacker, to...

Acunetix WVS 10 - Remote Command Execution

Acunetix WVS 10 - Remote Command Execution ''' Acunetix WVS 10 - Remote command execution SYSTEM privilege - Author: Daniele Linguaglossa Overview ========= Acunetix WVS 10 1 is an enterprise web vulnerability scanner developer by Acunetix Inc. Two major flaws exists in the last version of...

2 0 1 5 Microsoft Windows vulnerability report-vulnerability warning-the black bar safety net

! This article is mainly for 2 0 1 5 year Microsoft, Google, etc. the company corresponding products of the newsecuritymechanism or security feature for analysis. In fact the previous year, namely 2 0 1 4 year of report Windows exploitation in 2 0 1 4, We also mentioned a current network attack t...

Microsoft Windows - Local Privilege Escalation (MS15-051)

Source: https://github.com/hfiref0x/CVE-2015-1701 Win32k LPE vulnerability used in APT attack Original info: https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html Credits R136a1 / hfiref0x Compiled EXE: x86 +...

Microsoft Windows - Local Privilege Escalation (MS15-051)

Microsoft Windows - Local Privilege Escalation MS15-051 Source: https://github.com/hfiref0x/CVE-2015-1701 Win32k LPE vulnerability used in APT attack Original info: https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html Credits R136a1 / hfiref0x Compiled EXE: x86 +...

Yosemite discovered a local privilege escalation vulnerability-vulnerability warning-the black bar safety net

Overview: following the previous research, we for Mac OS X the latest version of Yosemite 10.10.1 on IOBluetoothHCIController services were performed on more test results and found that in addition to 5 security vulnerabilities. We have the related issues submitted to the Apple Security, and, on...

KLA10277 LPE vulnerability in Norman Security Suite

An unspecified vulnerability was found in the Norman Security Suite. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited remotely via unknown vectors. Original advisories - Related products Norman-Security-Suite CVE list CVE-2014-0816 high...

qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled

Buffer overflow in the e1000receive function in the e1000 device driver hw/e1000.c in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service guest OS crash and possibly execute arbitrary guest code via a large packet...