955 matches found
Increased Use of WMI for Environment Detection and Evasion
Introduction Throughout the past few months, FireEye Labs has observed an increased use of Windows Management Instrumentation WMI queries for environment detection and evasion of dynamic analysis and virtualization engines. WMI provides high-level interaction with Windows objects using C/C++,...
Increased Use of WMI for Environment Detection and Evasion
Introduction Throughout the past few months, FireEye Labs has observed an increased use of Windows Management Instrumentation WMI queries for environment detection and evasion of dynamic analysis and virtualization engines. WMI provides high-level interaction with Windows objects using C/C++,...
WMI vs. WMI: Monitoring for Malicious Activity
Hello my name is: WMI WMI has been a core component of Windows since Windows 98, but it is not exactly old wine in a new bottle. WMI more closely resembles that bottle of ‘61 Bordeaux wine that continues to impress us as it ages and matures. WMI was developed as Microsoft’s interpretation of...
Microsoft Windows Last Boot Time
Nessus was able to collect and report the remote host's last boot time as an ISO 8601 timestamp. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92366; scriptversion"1.7"; scriptcvsdate"Date: 2018/07/09 16:48:24"; scriptnameenglish:"Microsoft Windows Last Boot Time";...
FastIR Collector - Windows Incident Response Tool
This tool collects different artefacts on live Windows and records the results in csv files. With the analyses of this artefacts, an early compromission can be detected. Requirements pywin32 python WMI python psutil python yaml construct distorm3 hexdump pytz Execution ./fastIRx64.py -h for help...
Windows WMI Receive Notification Exploit
This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. Module Options msf use exploit/windows/local/ms16/014wmirecvnotif msf undefined014wmirecvnotif show actions...
Dell Foundation Services 'SOAP WMI API' Remote Information Disclosure
An issue in Dell Foundation Services can be exploited to leak any data provided by the Windows Management Instrumentation WMI. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
OpenVAS - The World's Most Advanced Open Source Vulnerability Scanner and Manager
The Open Vulnerability Assessment System OpenVAS is a framework of several services and tools. The core of this SSL-secured service-oriented architecture is the OpenVAS Scanner. The scanner very efficiently executes the actual Network Vulnerability Tests NVTs which are served with daily updates v...
Microsoft Visual Studio WMI Object Code Execution (MS06-073) - Ver2 (CVE-2006-4704)
A remote code execution vulnerability exists in Microsoft Visual Studio 2005. Microsoft Visual Studio is a software development product for computer programmers. It centers on an integrated development environment which lets programmers create standalone applications, web sites, web applications,...
MS15-038: Description of the security update for Windows: April 14, 2015
None None...
IT-Grundschutz M4.016: Zugangsbeschränkungen für Benutzer-Kennungen und oder Terminals
IT-Grundschutz M4.016: Zugangsbeschränkungen für Benutzer-Kennungen und oder Terminals. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4016.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.016 Authors: Thomas Rotter Copyright: Copyright c 2015...
IT-Grundschutz M5.034: Einsatz von Einmalpasswörtern
IT-Grundschutz M5.034: Einsatz von Einmalpasswörtern Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM5034.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 5.034 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks GmbH,...
IT-Grundschutz M4.014: Obligatorischer Passwortschutz unter Unix
IT-Grundschutz M4.014: Obligatorischer Passwortschutz unter Unix. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4014.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.014 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks...
IT-Grundschutz M4.040: Verhinderung der unautorisierten Nutzung von Rechnermikrofonen und Kameras
IT-Grundschutz M4.040: Verhinderung der unautorisierten Nutzung von Rechnermikrofonen und Kameras Stand: 14. Ergänzungslieferung 14. EL. Hinweis: Nur für Linux umgesetzt. Es ist unter Windows nicht möglich den Status des Mikrofons über Registry/WMI auszulesen. SPDX-FileCopyrightText: 2015 Greenbo...
IT-Grundschutz M4.022: Verhinderung des Vertraulichkeitsverlusts schutzbedürftiger Daten im Unix-System
IT-Grundschutz M4.022: Verhinderung des Vertraulichkeitsverlusts schutzbedürftiger Daten im Unix-System. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4022.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.022 Authors: Thomas Rotter Copyright:...
How to Use Windows Management Instrumentation (WMI) Tester [WBEMTest] to Test WMI Connectivity
Purpose This article documents how to use Windows Management Instrumentation WMI Tester WBEMTest to test connectivity, which can assist in troubleshooting and isolating WMI-related issues with Veeam products. Solution Opening Windows Management Instrumentation WMI Tester 1. Open a Run prompt. Pre...
Microsoft Windows XP/VISTA/2003/2008 - WMI Service Isolation Local Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/34442/info Microsoft Windows is prone to a privilege-escalation vulnerability. Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected...
FreeFloat FTP Server Arbitrary File Upload
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
MiniWeb (Build 300) Arbitrary File Upload
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
Open-FTPD 1.2 - Arbitrary File Upload
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...