3974 matches found
Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager
Execute an x86 payload from a command via PowerShell. Custom shellcode stage. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options msf use payload/cmd/windows/powershell/custom/reversetcpallports msf payloadreversetcpallports show actions ...actions... msf...
Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)
Execute an x86 payload from a command via PowerShell. Custom shellcode stage. Connect back to the attacker over IPv6 Module Options msf use payload/cmd/windows/powershell/custom/reverseipv6tcp msf payloadreverseipv6tcp show actions ...actions... msf payloadreverseipv6tcp set ACTION msf...
Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager
Execute an x64 payload from a command via PowerShell. Custom shellcode stage. Listen for an IPv6 connection Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/custom/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf...
ForceAdmin - Create Infinite UAC Prompts Forcing A User To Run As Admin
ForceAdmin is a c payload builder, creating infinate UAC pop-ups until the user allows the program to be ran. The inputted commands are ran via powershell calling cmd.exe and should be using the batch syntax. Why use? Well some users have UAC set to always show, so UAC bypass techniques are not...
Hackers Use ModernLoader to Infect Systems with Stealers and Cryptominers
As many as three disparate but related campaigns between March and Jun 2022 have been found to deliver a variety of malware, including ModernLoader, RedLine Stealer, and cryptocurrency miners onto compromised systems. "The actors use PowerShell, .NET assemblies, and HTA and VBS files to spread...
ModernLoader delivers multiple stealers, cryptominers and RATs
By Vanja Svajcer Cisco Talos recently observed three separate, but related, campaigns between March and June 2022 delivering a variety of threats, including the ModernLoader bot, RedLine information-stealer and cryptocurrency-mining malware to victims. The actors use PowerShell, .NET assemblies,...
Tenable Nessus Agent < 8.3.4 / 10.x < 10.1.4 Multiple Vulnerabilities (TNS-2022-17) (TNS-2022-13)
According to its self-reported version, the Tenable Nessus agent running on the remote host is prior to 8.3.4 or 10.x prior to 10.1.4. It is, therefore, affected by multiple vulnerabilities: - An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes...
[R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities
R1 Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 08/24/2022 - 12:18 Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified,...
Exploit for CVE-2021-34527
PrintNightmare CVE-2021-34527 This version of the PrintNigh...
Microsoft Exchange Server ChainedSerializationBinder Remote Code Execution Exploit
This Metasploit module exploits vulnerabilities within the ChainedSerializationBinder as used in Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and Exchange Server 2016 CU22 all prior to Mar22SU. Note that authentication is required to exploit these...
Exploit for Improper Certificate Validation in Microsoft
CVE-2022-26923-Powershell-POC A powershell poc to load and aut...
Russian State Hackers Continue to Attack Ukrainian Entities with Infostealer Malware
Russian state-sponsored actors are continuing to strike Ukrainian entities with information-stealing malware as part of what's suspected to be an espionage operation. Symantec, a division of Broadcom Software, attributed the malicious campaign to a threat actor tracked Shuckworm, also known as...
Powershell Code Arbitary Execution Builder FUD Exploit
A desired powershell.ps1 hides the payload with special methods. It allows it to run secretly on the installed computer. Bypasses all modern antivirus protections. Completely FUD...
#StopRansomware: MedusaLocker
Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce multifactor authentication. Note: this joint Cybersecurity Advisory CSA is part of an...
Tenable Nessus 8.x < 8.15.6 Multiple Vulnerabilities (TNS-2022-16)
According to its self-reported version, the Tenable Nessus application running on the remote host is 8.x prior to 8.15.6. It is, therefore, affected by multiple vulnerabilities, including: - An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes...
PowerShell Functions Remote Code Execution
PowerShell functions may be used to exploit remote code execution vulnerabilities. A remote attacker can exploit this vulnerabilities by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the affected system...
Zoho Password Manager Pro XML-RPC Java Deserialization Exploit
This Metasploit module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro before 12101 and PAM360 before 5510. Unauthenticated attackers can send a crafted XML-RPC request containing malicious serialized data to /xmlrpc to gain remote command execution as the SYSTEM user. This...
CVE-2022-31180
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the escape or escapeAll functions with the interpolation option set to true. The result is that if ...