135 matches found
DropSpawn_BOF
DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...
TrustJack
TrustJack Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows Blogpost: https://redteamer.tips/?p=108 To be used with a cmd that does whatever the F you want, for a dll that pops cmd, https://github.com/jfmaes/CMDLL. check the list in wietze's site to check how you...
CVE-2017-11783
CVE-2017-11783 1day Exploit by sheisback It isn't complete exploitexec cmd with system privilege, only create file in system32. So you will complete this, need consent.exe uac technique. Reference A view into ALPC-RPC by Clément Rouault & Thomas Imbert, 2017 PacSec...
CVE-2024-31771
CVE-2024-31771 TotalAV 임의 파일 쓰기 TotalAV 버전 6.0.x https://github.com/restdone/CVE-2024-31771/assets/42227817/ffe0c2ec-4ea6-4c29-852f-456b2e62f5b1 타임라인: 2024년 2월 13일: 6.0.740 취약점 발견 및 TotalAV에 보고. 2024년 2월 15일: TotalAV가 문제를 확인하고 재현함. 2024년 2월 19일: TotalAV가 다른 공급업체와 협력 중이었음. 해당 공급업체가 작업 중이라고 조언함...
ShadowSteal
ShadowSteal | CVE-2021-36934 CVE-2021-36934을 악용하기 위한 순수 Nim 구현, SeriousSAM 로컬 권한 상승LPE. OPSEC에 안전하지 않음... 아직은 ;. 이 익스플로잇의 발견에 대한 공로를 주장하지 않습니다. 빠른 시작 Docker로 빌드 ShadowSteal을 시작하는 것이 Docker 덕분에 그 어느 때보다 쉬워졌습니다! Nim 종속성을 설치하는 데 번거로움을 원하지 않으세요? 내가 도와줄게요! Python 스크립트를 실행하여 Docker 빌드 환경을 만들고, 바이너리를...
CS-DropSpawn_BOF
DropSpawn はじめに DropSpawnは、比較的知られていないDLLハイジャックの手法を用いて追加のBeaconを起動するためのCobaltStrike BOFです。x86-x86、x64-x64、x86-x64/その逆の組み合わせで動作します。プロセスインジェクションの代替手段として使用してください。 Windows実行ファイルは、絶対パスが指定されていないDLLを読み込む際にDLL検索順序に従います： DLLハイジャックには通常、以下のいずれかの条件が必要です： A. ユーザーが、実際のDLLが存在するフォルダよりも検索順序の優先度が高いフォルダに対して書き込み権限を持って...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell 수정 이 PowerShell 스크립트는 CVE-2021-36934를 수정합니다. Joran Slingerland의 원본 스크립트를 기반으로 합니다 https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 PowerShell 스크립트는 다음을 수행합니다: $env:windir\Logs\ 아래에...
CVE-2020-1337
CVE-2020-1337 - Binary Planting CVE-2020-1048 bypass Peleg Hadar @peleghd and Tomer Bar at SafeBreach @safebreach were acknowledged by Microsoft by the CVE-2020-1048, a Windows Spooler Vulnerability that allows an elevation of privilege on Windows 7 and later. Some details were disclosed by Alex...
HardBreacher
HardBreacher Kaspersky Antivirus For Endpoint のゼロデイ権限昇格の脆弱性 この問題は今やMicrosoftの外にも漏れ出しています。ホーム版か商用版のどちらかにバグを見つけるかという投票が行われ、投票結果は商用版となりました。 これを書いている時点で、この概念実証は完全にパッチが適用されたWindows 11 25H2とKaspersky for Endpoint v14.0.0.504で動作します。...
CVE-2026-13133
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
EUVD-2026-55033
A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...
CVE-2026-13133
LineInst.exe (LINE for Windows) before version 26.4.0 is vulnerable because Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer directory to be loaded ahead of the legitimate System32 copy. The CVSS metrics indicate a HIGH ...
CVE-2019-18194
TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937
Hubstaff 1.6.14 is affected by a DLL search order hijacking vulnerability that enables replacing the missing system32 wow64log.dll with a malicious library. An attacker could generate a custom DLL (e.g., via Metasploit) and place it in the system32 directory to obtain a reverse shell when the app...
CVE-2023-53937 Hubstaff 1.6.14 DLL Search Order Hijacking via wow64log Library
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2023-53937: Uncontrolled Search Path Element
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
PT-2025-52316
Name of the Vulnerable Software and Affected Versions Hubstaff version 1.6.14 Description The software contains a DLL search order hijacking issue. An attacker can replace a missing system32wow64log.dll with a malicious library. By using tools like Metasploit to create a custom DLL and placing it...