shepard

SHEPARD BITS 이 도구는 Windows BITSBackground Intelligent Transfer Service를 활용한 지속성 유지 도구입니다. 기능 파일 다운로드, 파일 유출, 파일 다운로드 + 지속적 실행 사용법 shepard.exe를 관리자 권한으로 실행하고 다음 명령줄 인자를 사용합니다: -d : 선택한 로컬 경로로 일반 파일 다운로드 -e : 선택한 로컬 경로에서 일반 파일 업로드 IIS 서버로만 전송 가능, 이는 BITS의 제한사항입니다 -dr optionalFileArgs : 선택한 경로로 파일...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

VulnCheck KEV: CVE-2020-0787

Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges...

The vulnerability of the Windows Background Intelligent Transfer Service, a file transfer service between the client and the HTTP server, allows a hacker to escalate their privileges.

The vulnerability of the Windows Background Intelligent Transfer Service, which is responsible for intelligent file transfer between clients and Windows HTTP servers, is related to errors in processing links that point to file and directory paths. Exploiting this vulnerability can allow an attack...

Stealth Falcon Targets Middle East with Windows BITS Feature

The notorious Stealth Falcon cyberespionage group has adopted a new backdoor using the Windows Background Intelligent Transfer Service BITS in its ongoing spyware attacks against journalists, activists and dissidents in the Middle East. According to researchers at ESET, attackers are exploiting t...

New Malware Uses Windows BITS Service to Stealthy Exfiltrate Data

Cybersecurity researchers have discovered a new computer virus associated with the Stealth Falcon state-sponsored cyber espionage group that abuses a built-in component of the Microsoft Windows operating system to stealthily exfiltrate stolen data to attacker-controlled server. Active since 2012,...