shakeitoff

shakeitoff 更小、更精简、更干净的 InstallerFileTakeOver 版本，即 CVE-2021-41379 的“变种”零日漏洞（后来被分配为 CVE-2021-43883）。此版本 不会 像 InstallerFileTakeOver 那样弹出 shell。该代码的目的是创建一个更简单的概念验证，更可靠地演示文件创建攻击。此概念验证将创建用户请求的任意文件（并将自身复制到该文件中以证明可写性）。演示代码执行是一个留给读者的简单练习。 要了解该攻击的工作原理，请参阅 AttackerKB 文章。 用法 该工具需要三个参数： root@kitploit:...

msiscan

MSI Analyzer This Python script for Linux can analyze Microsoft Windows .msi Installer files and point out potential vulnerabilites. It was developed by Michael Baer @derbaer0 in the SEC Consult Vulnerability Lab. Currently, it is mostly suited for a local privilege escalation also described in o...

qlikview-poc-CVE-2024-29863

Aplicación afectada: QlikView Plataforma: Windows Problema: Escalada de privilegios local mediante el instalador MSI condición de carrera por secuestro de DLL Descubierto y reportado por: Pawel Karwowski y Julian Horoszkiewicz Eviden Red Team Detalles: En sistemas con QuikView12 instalado, es...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

CVE-2023-32353-PoC

CVE-2023-32353 概念验证 免责声明 此概念验证代码仅用于教育目的。 它应鼓励其他人发现类似漏洞，负责任地报告并修复它们。 2023年5月23日，Apple 已发布该漏洞的修复程序。 建议您将 iTunes 更新到最新版本（至少 12.12.9）。 我没有发现此 CVE，我只是做了这个 PoC。请阅读“致谢”部分。 本人及此仓库均与 Apple 无关。 此 PoC（概念验证）的适用性有限。您可以在问答部分了解更多信息。 概要 音乐播放器 Apple iTunes 的 MSI 安装程序存在一个漏洞，允许 Microsoft Windows 计算机上的普通低权限用户以 NT...

Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows

Cybersecurity researchers have warned of an actively expanding botnet dubbed Tsundere that's targeting Windows users. Active since mid-2025, the threat is designed to execute arbitrary JavaScript code retrieved from a command-and-control C2 server, Kaspersky researcher Lisandro Ubiedo said in an...

CVE-2025-11535 MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24...

EUVD-2020-5032

Malware in sbrugna...

EUVD-2020-8229

Malware in sbrugna...

EUVD-2024-35262

Malicious code in bioql PyPI...

EUVD-2024-47737

Malicious code in bioql PyPI...

EUVD-2024-33163

Malicious code in bioql PyPI...

EUVD-2022-45079

Malicious code in bioql PyPI...

CVE-2025-10491 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

CVE-2023-1314

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

CVE-2022-41975

RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...

CVE-2024-42050

The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProviderInst.reg...

CVE-2024-10526

Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITEDACL permission to the BUILTIN\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on...

CVE-2024-10526

The provided data confirms CVE-2024-10526 affects Rapid7 Velociraptor MSI Installer before version 0.73.3. The issue stems from the installer creating the installation directory with WRITE_DACL permissions for BUILTIN\Users, enabling non-admin local users to grant themselves Full Control on Veloc...

Rapid7 Velociraptor MSI Installer 安全漏洞

Rapid7 Velociraptor MSI Installer is a unique, advanced, open source endpoint monitoring, digital forensics, and cyber response platform from Rapid7 USA. A security vulnerability exists in Rapid7 Velociraptor MSI Installer prior to version 0.73.3 that originates from the execution of arbitrary co...