VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1296 VirtualBox: Windows Process DLL UNC Path Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The...

VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation

VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1296 VirtualBox: Windows Process DLL UNC Path Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevatio...

Skype for Business 2016 - Cross-Site Scripting Vulnerability

Exploit for windows platform in category remote exploits Exploit Title: Skype for Business 2016 XSS Injection - CVE-2017-8550 Exploit Author: @nyxgeek - TrustedSec Date: 2017-04-10 Vendor Homepage: www.microsoft.com Versions: 16.0.7830.1018 32-bit & 16.0.7927.1020 64-bit or lower Requirements:...

Skype for Business 2016 - Cross-Site Scripting

Skype for Business 2016 - Cross-Site Scripting Exploit Title: Skype for Business 2016 XSS Injection - CVE-2017-8550 Exploit Author: @nyxgeek - TrustedSec Date: 2017-04-10 Vendor Homepage: www.microsoft.com Versions: 16.0.7830.1018 32-bit & 16.0.7927.1020 64-bit or lower Requirements: Originating...

Skype for Business 2016 - Cross-Site Scripting

Exploit Title: Skype for Business 2016 XSS Injection - CVE-2017-8550 Exploit Author: @nyxgeek - TrustedSec Date: 2017-04-10 Vendor Homepage: www.microsoft.com Versions: 16.0.7830.1018 32-bit & 16.0.7927.1020 64-bit or lower Requirements: Originating machine needs Lync 2013 SDK installed as well a...

Microsoft IIS Server XSS Vulnerability(CVE-2017-0055)

During a penetration test against the infrastructure of one of our clients we discovered a reflected Cross Site Scripting/HTML injection vulnerability in Microsoft Internet Information Services web server. The vulnerability could be exploited, with the help of user interaction, to inject javascri...

DnsAdmin ServerLevelPluginDll Feature Abuse Privilege Escalation

This module exploits a feature in the DNS service of Windows Server. Users of the DnsAdmins group can set the ServerLevelPluginDll value using dnscmd.exe to create a registry key at HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ named ServerLevelPluginDll that can be made to point to an...

Microsoft Internet Information Services Cross Site Scripting

Cross Site Scripting / HTML injection vulnerability in Microsoft Internet Information Services web server ================================== Versions Affected: MS Internet Information services All platforms and versions ================================== CVE Reference: CVE-2017-0055...

Microsoft Task Scheduler Elevation of Privilege (MS16-130: CVE-2016-7222)

An elevation of privilege vulnerability exists in the Windows Task Scheduler. A locally authenticated attacker can exploit this vulnerability by using Windows Task Scheduler to schedule a new task with a malicious UNC path...

NVIDIA Driver - NvStreamKms 'PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback / Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918 The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a process creation notification routine. In this particular routine, if cur-imagenamescount 0 // info is the PPSCREATENOTIFYINFO that is passed to the...

How to Change Credentials for a Shared Folder in a File to Tape Job

Purpose This article documents how to change credentials used to connect to a UNC path added to a File Backup to Tape job. Solution To add an SMB share to a File Backup to Tape job, the SMB share must be added in the Inventory view under File Shares SMB Shares section. To change which credentials...

Windows Information Disclosure Vulnerability

An information disclosure vulnerability exists when Windows fails to properly validate NT LAN Manager NTLM Single Sign-On SSO requests during Microsoft Account MSA login sessions. An attacker who successfully exploited the vulnerability could attempt to brute force a user’s NTLM password hash. To...

BadTunnel: Cross-Segment hijacking the broadcast Protocol-vulnerability warning-the black bar safety net

! 0x00 introduction This paper proposes a new attack model, can cross network segment hijacking the TCP/IP broadcast Protocol, we named it“BadTunnel” in. Using this method, you can achieve cross-subnet NetBIOS Name Service Spoofing attacks. Both the attacker and the user are in the same network...

MS15-100 Microsoft Windows Media Center MCL Vulnerability

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploi...

Microsoft Windows Media Center MCL MS15-100 Vulnerability

This Metasploit module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the .mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. This module requires Metasploit: http://metasploit.com/download Current source:...

MS15-100 Microsoft Windows Media Center MCL Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploits a vulnerability in Windows Media...

MS15-100 Microsoft Windows Media Center MCL Vulnerability

This module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the .mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. Module Options msf use exploit/windows/fileformat/ms15/100mclexe msf undefined100mclexe show actio...

Microsoft Windows Shell LNK Code Execution

This module exploits a vulnerability in the MS10-046 patch to abuse again the handling of Windows Shortcut files .LNK that contain an icon resource pointing to a malicious DLL. This module creates the required files to exploit the vulnerability. They must be uploaded to an UNC path accessible by...

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection Vulnerability

The Nvidia Mental Ray Satellite Service listens for control commands on port 7414. When it receives the command to load a DLL via an UNC path it will try to connect back to the host on port 7514. If a TCP connection is successful it will then attempt to load the DLL. This Metasploit module has be...

Nvidia Mental Ray Satellite Service Arbitrary DLL Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nvidia Mental Ray Satellite Service Arbitrary DLL Injection', 'Description' = %q The Nvidia Mental Ray Satellite Service listens for...