Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Vinay Kumar and Chintan Shah · July 19, 2022 Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned CVE-2022-30190 in Microsof...

DFSCoerce

Coerce an authentication attempt over SMB to other machines via MS-DFSNM methods. Module Options msf use auxiliary/scanner/dcerpc/dfscoerce msf auxiliarydfscoerce show actions ...actions... msf auxiliarydfscoerce set ACTION msf auxiliarydfscoerce show options ...show and set options... msf...

SAMR Computer Management

Add, lookup and delete computer / machine accounts via MS-SAMR. By default standard active directory users can add up to 10 new computers to the domain. Administrative privileges however are required to delete the created accounts. Module Options msf use auxiliary/admin/dcerpc/samrcomputer msf...

Fixed CVE-2018-5741 in bind

CVE-2018-5741: update krb5,ms-self,subdomain descriptions...

Malicious code in small-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96bee317ebf983fc6131797932fc73436c62f4f95f0e963ae3622f7ab4647851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6170 Malicious code in small-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96bee317ebf983fc6131797932fc73436c62f4f95f0e963ae3622f7ab4647851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mozilla Firefox ESR < 91.11

The version of Firefox ESR installed on the remote Windows host is prior to 91.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-25 advisory. - The Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101 and Firefox ESR 91.10. Some of...

mtools bug fix and enhancement update

An update is available for mtools. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mtools is a collection of utilities for files created in the MS-DOS operating...

mtools bug fix and enhancement update

An update is available for mtools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mtools is a collection of utilities for files created in the MS-DOS operating...

Security Vulnerabilities fixed in Thunderbird 91.11 and Thunderbird 102 — Mozilla

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. This bug only affects Thunderbird for Linux. Other operating systems are unaffected. Session history navigations m...

Security Vulnerabilities fixed in Firefox 102 — Mozilla

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. This bug only affects Firefox for Linux. Other operating systems are unaffected. Session history navigations may...

DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method

PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot method and probably more but am lazy and its just PoC :P . Documentation: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979 Inspired by: PetitPotam @topotam77...

DFSCoerce, a new NTLM relay attack, can take control over a Windows domain

A researcher has published a Proof-of-Concept PoC for an NTLM relay attack dubbed DFSCoerce. The method leverages the Distributed File System: Namespace Management Protocol MS-DFSNM to seize control of a Windows domain. Active Directory A directory service is a hierarchical arrangement of objects...

New ToddyCat Hacker Group on Experts' Radar After Targeting MS Exchange Servers

An advanced persistent threat APT actor codenamed ToddyCat has been linked to a string of attacks aimed at government and military entities in Europe and Asia since at least December 2020. The relatively new adversarial collective is said to have commenced its operations by targeting Microsoft...

New NTLM Relay Attack Lets Attackers Take Control Over Windows Domain

A new kind of Windows NTLM relay attack dubbed DFSCoerce has been uncovered that leverages the Distributed File System DFS: Namespace Management Protocol MS-DFSNM to seize control of a domain. "Spooler service disabled, RPC filters installed to prevent PetitPotam and File Server VSS Agent Service...

MAL-2022-1200 Malicious code in aws-ms-deploy-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe7c48a4ab3024ab51cf5a3b5bccdd0daa9bd6b87983ef3dd8137c3f697a0993 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6883 Malicious code in uxpin-merge-ms-fabric (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6770965c2fb106f9c16c4bba9ca9724909591f0a1e2f43d34a55f322aca56f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uxpin-merge-ms-fabric (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6770965c2fb106f9c16c4bba9ca9724909591f0a1e2f43d34a55f322aca56f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Real Player v.20.0.8.310 G2 Control - DoGoToURL() Remote Code Execution Exploit

Exploit Title: Real Player v.20.0.8.310 G2 Control - 'DoGoToURL' Remote Code Execution RCE Exploit Author: Eduardo Braun Prado Vendor Homepage: http://real.com/ Software Link: http://real.com/ Version: v.20.0.8.310 Tested on: Windows 7, 8.1, 10 CVE : N/A Full PoC:...

MAL-2022-6333 Malicious code in stripe-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6768625a605caa8f499ca468486f47122cb94054148e3489c677ca9fb25edc28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...