3637 matches found
Microsoft IExpress DLL Hijacking
Hi @ll, IExpress creates executable installers ° or self-extracting archives for Windows by embedding a .CAB archive and some strings as resources into a copy of the program %SystemRoot%\System32\WExtract.exe. These self-extracting archives/executable installers, especially those made by Microsof...
Between a Rock and a Hard Link
Posted by James Forshaw, File System Enthusiast In a previous blog post I described some of the changes that Microsoft has made to the handling of symbolic links from a sandboxed process. This has an impact on the exploitation of privileged file overwrites for sandbox escapes. Windows does suppor...
Error: "The specified network name is no longer available", Profile Fails to Load and user receives Temporary Profile if NTFS permissions changed on User Store
Under certain circumstances, a user profile may fail to load and the user receives a temporary profile. When this occurs an error "The specified network name is no longer available" appears in the Profile Management Log...
Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)
Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass MS15-111 Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Platform: Windows 10 build 10240, earlier versions do not have...
Windows 10 Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)
Exploit for windows platform in category remote exploits Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Platform: Windows 10 build 10240, earlier versions do not have the functionality Class: Securi...
Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)
Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Platform: Windows 10 build 10240, earlier versions do not have the functionality Class: Security Feature Bypass Summary: A mitigation added to Windows ...
Mac OS X < 10.10.4 Multiple Vulnerabilities
Binary data 8801.prm...
Ubuntu: Security Advisory (USN-2617-3)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-2617-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
TestDisk - Partition Recovery and File Undelete for Windows, Linux and Mac
TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software : certain types of viruses or human error such as accidentally deleting a Partition Table...
Windows 10^H^H Symbolic Link Mitigations
Posted by James Forshaw, abusing symbolic links like it’s 1999. For the past couple of years I’ve been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I’ve used multiple times is abusing the symbolic link...
Flash Broker-Based Sandbox Escape via Forward Slash Instead of Backslash Exploit
Exploit for windows platform in category remote exploits Source: https://code.google.com/p/google-security-research/issues/detail?id=278&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Forward Slash IE PM Sandbox Escape 1. Windows 8....
Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving
Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape 1. Windows 8....
Flash Broker-Based Sandbox Escape via Unexpected Directory Lock Exploit
Exploit for windows platform in category remote exploits Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Locked Directory IE PM Sandbox Escape 1. Windows...
Flash Broker-Based - Sandbox Escape via Unexpected Directory Lock
Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Locked Directory IE PM Sandbox Escape 1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBrok...
Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving
Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape 1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker FlashBroker is...
Flash Broker-Based - Sandbox Escape via Forward Slash Instead of Backslash
Source: https://code.google.com/p/google-security-research/issues/detail?id=278&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Forward Slash IE PM Sandbox Escape 1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker...
Flash Broker-Based - Sandbox Escape via Forward Slash Instead of Backslash
Flash Broker-Based - Sandbox Escape via Forward Slash Instead of Backslash Source: https://code.google.com/p/google-security-research/issues/detail?id=278&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Forward Slash IE PM Sandbox...
Flash Broker-Based - Sandbox Escape via Unexpected Directory Lock
Flash Broker-Based - Sandbox Escape via Unexpected Directory Lock Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - Junction Check Bypass With Locked Directory IE PM Sandbox Escape 1...
