RustChain

描述 该工具是一个简单的概念验证，演示如何利用ROP链结合硬件断点隐藏内存工件。ROP链会在休眠（即调用Sleep函数时）将主模块内存页的保护属性更改为N/A。有关此内存扫描逃避技术的更详细信息，请查看原始项目 Gargoyle。仅限 x64 。 其思路是在 kernel32!Sleep 上设置一个硬件断点，并设置一个新的顶层异常过滤器来处理异常。当 Sleep 被调用时，之前设置的异常过滤器函数被触发，使我们能够在无需使用经典函数钩子的情况下调用 ROP 链。这样，我们就避免了在与已知 DLL 相关的进程中留下奇怪且不寻常的私有内存区域。 ROP 链仅需调用 VirtualProtec...

Cisco Secure Endpoint for Windows Scanning Evasion (cisco-sa-secure-endpoint-dos-RzOgFKnd)

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Cisco Secure Endpoint for Windows Scanning Evasion Vulnerability

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Scanning evasion issue in Cisco Secure Email Gateway

Overview Cisco Secure Email Gateway provides anti-virus scanning facility for e-mail attachments. It was reported that a certain crafted file can evade anti-virus scanning facility. This issue was found by Takahiro Ohtani and Michael Joshua Telloyan in the Bug Bounty program at the University of...

How Malicious Android Apps Slip Into Disguise

Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research. At issue is a...

Sophos Anti-Virus CAB, RAR and LZH Scanning Evasion

The version of Sophos Anti-Virus installed on the remote host reportedly contains several problems involving the processing of 'CAB' 'RAR' and 'LZH' files which may allow an attacker to evade the anti- virus scanning by sending a specially-malformed archive. In addition, an attacker may exploit a...

[ GLSA 200501-46 ] ClamAV: Multiple issues

Gentoo Linux Security Advisory GLSA 200501-46 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...