Linux/x86 - Reverse TCP Alphanumeric Staged Shellcode (103 bytes)

Reverse TCP Staged Alphanumeric Shellcode Linux x86 Execve /bin/sh Author: Snir Levi, Applitects 103 Bytes date: 9.2.17 Automatic python shellcode handler with stage preset send will be ready soon: https://github.com/snir-levi/ReverseTCPAlphanumericStagedShellcodeExecve-bin-bash/ IP - 127.0.0.1...

CVE-2016-9000

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct...

Google Android - RKP EL1 Code Loading Bypass Exploit

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=981 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure that the HLOS...

Google Android - Unprotected MSRs in EL1 RKP Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=980 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure that the HLOS kernel running in EL1 remains protected from exploit...

Google Android - RKP EL1 Code Loading Bypass

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=981 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure that the HLOS kernel running in EL1 remains protected from exploit...

PT-2018-5377

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.2.0 and later Description A security issue was discovered where FreeIPA could disclose password hashes to users with the System: Read Stage Users permission. A remote, authenticated attacker could potentially use this flaw t...

Exploit for Race Condition in Linux Linux_Kernel

ocoboroot.c linux AFPACKET race condition exploit exploit for...

CVE-2016-3889: Undefined Security Weakness

Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism by accessing 1 an external tile from a system application, 2 the help feature, or 3 the Settings application during a pre-setup stage, aka...

PT-2016-5721

Name of the Vulnerable Software and Affected Versions Android versions 6.x through 7.0 before 2016-09-01 Description The issue allows physically proximate attackers to bypass the Factory Reset Protection mechanism by accessing certain features during a pre-setup stage, including an external tile...

PEI Stage Backdoor for UEFI Compatible Firmware: PeiBackdoor

PEI Stage Backdoor for UEFI Compatible Firmware This project implements early stage firmware backdoor for UEFI based firmware. It allows to execute arbitrary code written in C during Pre EFI Init PEI phase of Platform Initialization PI. This backdoor might be useful for low level manipulations wi...

UBUNTU-CVE-2015-8939

drivers/video/msm/mdp4util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 2013 devices does not validate r stages, g stages, or b stages data, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28398884 and Qualcomm internal bug...

Reverse engineering DUBNIUM –Stage 2 payload analysis

Recently, we blogged about the basic functionality and features of the DUBNIUM advanced persistent threat APT activity group Stage 1 binary and Adobe Flash exploit used during the December 2015 incident Part 1, Part 2. In this blog, we will go through the overall infection chain structure and the...

MobiControl Stage Programmer - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application MobiControl Stage Programmer published at the 'play' market has multiple vulnerabilities...

Maru OS — Android ROM that Turns into Debian Linux When Connected to a PC

Good News for Linux Techno Freaks! Do you usually mess with your Android smartphone by trying out the continual ins and outs of various apps and custom ROMs? Then this news would be a perfect pick for you! What If, you can effectively carry a Linux computer in your pocket? Hereby introducing a ne...

stage-gate.net XSS vulnerability

Vulnerable URL: http://www.stage-gate.net/sgi/pc/review.php?prodname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1723853 Google...

Adobe Flash - Use-After-Free When Setting Stage

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=629 The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows. Proof of Concept:...

Adobe Flash - Use-After-Free When Setting Stage

Adobe Flash - Use-After-Free When Setting Stage Source: https://code.google.com/p/google-security-research/issues/detail?id=629 The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows. Proof of Concept:...

Adobe Flash - Use-After-Free When Setting Stage

Source: https://code.google.com/p/google-security-research/issues/detail?id=629 The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows. Proof of Concept:...

CVE-2015-5021

IBM InfoSphere Information Server 11.3 and 11.5 allows remote authenticated DataStage users to bypass intended job-execution restrictions or obtain sensitive information via unspecified vectors...

Final HITECH Act Stage 3 Meaningful Use Rules May Require Annual Risk Analysis plus a Risk Management Component

The comments are in and the HHS is scrambling to review them all before they issue the final Stage 3 Meaningful Use rules later this summer. Comments from entities such as CHIME and HIMSS represent good news and bad news for healthcare providers, depending on how you look at it. The HIPAA Securit...