Security feature bypass

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell...

CVE-2018-6668 Bypass Application Control with simple DLL

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell...

CVE-2018-6668

CVE-2018-6668 affects McAfee Application Control and Change Control, version 7.0.1 and earlier. A whitelist bypass vulnerability allows execution bypass, e.g., via a simple DLL through interpreters such as PowerShell. The connected sources confirm the issue and its impact is constrained to bypass...

CVE-2018-6668 Bypass Application Control with simple DLL

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell...

CVE-2018-6668: Undefined Security Weakness

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell...

ThunderDNS - Tool To Forward TCP Traffic Over DNS Protocol

This tool can forward TCP traffic over DNS protocol. Non-compile clients + socks5 support. Run Setting up NS records on our domain: Please wait for clearing DNS-cache. Simple server run: python3 ./server.py --domain oversec.ru Simple server run Dockerfile: docker run -e DOMAIN='' Simple client ru...

Windows Gather PSReadline History

Gathers Power Shell history data from the target machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather PSReadline History', 'Description' = %q Gathers Power Shell history data...

PT-2018-2691

Name of the Vulnerable Software and Affected Versions McAfee Application Control / Change Control version 7.0.1 and earlier Description The issue is related to a whitelist bypass, which can lead to execution bypass. This can be achieved, for example, through simple DLLs and interpreters such as...

Windows UAC Protection Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/exe' require 'msf/core/exploit/powershell' class MetasploitModule 'Windows UAC Protection Bypass Via ComputerDefault Registry Key', 'Descriptio...

The vulnerability of the PowerShell command interpreter for Windows operating systems allows attackers to escalate their privileges and execute arbitrary code.

The vulnerability of the PowerShell command interpreter for Windows operating systems is related to errors in processing objects in memory. Exploiting this vulnerability can allow a remote attacker to increase their privileges and execute arbitrary code using a specially crafted application...

The vulnerability of the PowerShell command interpreter for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the PowerShell command interpreter for Windows operating systems is related to errors in processing objects in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially crafted file...

RHEL 7 : ansible (RHSA-2018:3771)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3771 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does n...

RHEL 7 : ansible (RHSA-2018:3770)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3770 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does n...

New ‘Under the Radar’ report examines modern threats and future technologies

As if you haven't heard it enough from us, the threat landscape is changing. It's always changing, and usually not for the better. The new malware we see being developed and deployed in the wild have features and techniques that allow them to go beyond what they were originally able to do, either...

ansible: become password logged in plaintext when used with PowerShell on Windows

Execution of Ansible content on Microsoft's Windows platform with Powershell 5 or higher may disclose sensitive execution details including 'become' passwords, Ansible module arguments, and return values via Powershell's 'suspicious scriptblock logging' feature, which is enabled by default. The...

ansible: become password logged in plaintext when used with PowerShell on Windows

Execution of Ansible content on Microsoft's Windows platform with Powershell 5 or higher may disclose sensitive execution details including 'become' passwords, Ansible module arguments, and return values via Powershell's 'suspicious scriptblock logging' feature, which is enabled by default. The...

ansible: become password logged in plaintext when used with PowerShell on Windows

Execution of Ansible content on Microsoft's Windows platform with Powershell 5 or higher may disclose sensitive execution details including 'become' passwords, Ansible module arguments, and return values via Powershell's 'suspicious scriptblock logging' feature, which is enabled by default. The...

Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP

In MITREs evaluation of endpoint detection and response solutions, Windows Defender Advanced Threat Protection demonstrated industry-leading optics and detection capabilities. The breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine...

HP Intelligent Management Java Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "HP Intelligent Management Java Deserialization RCE", 'Description' = %q This vulnerability allows remote attackers to execute arbitrary code on...

Powershell Script for Enumerating Vulnerable DCOM Applications: DCOMrade

DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script currently...