Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

How to disable the automatic launch Citrix Workspace App for Windows when logging into the OS

How to disable the automatic launch Citrix Workspace App for Windows when logging into the OS...

August 8, 2023—KB5029259 (OS Build 10240.20107) - EXPIRED

None None...

August 8, 2023—KB5029242 (OS Build 14393.6167) - EXPIRED

None None...

Xlight FTP Server 3.9.3.6 - Stack Buffer Overflow Exploit

Exploit Title: Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' DOS Discovered by: Yehia Elghaly Vendor Homepage: https://www.xlightftpd.com/ Software Link : https://www.xlightftpd.com/download/setup.exe Tested Version: 3.9.3.6 Vulnerability Type: Buffer Overflow Local Tested on OS: Windows XP...

Xlight FTP Server 3.9.3.6 Stack Buffer Overflow

Exploit Title: Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' DOS Discovered by: Yehia Elghaly Discovered Date: 2023-08-04 Vendor Homepage: https://www.xlightftpd.com/ Software Link : https://www.xlightftpd.com/download/setup.exe Tested Version: 3.9.3.6 Vulnerability Type: Buffer Overflow...

How to get dump file of random crash process with ProcDump tool

ProcDump can be activated as a postmortem debugger in Windows OS. The crash dump file can be automatically generated if a process crashed...

PrivKit - Simple Beacon Object File That Detects Privilege Escalation Vulnerabilities Caused By Misconfigurations On Windows OS

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS. PrivKit detects following misconfigurations Checks for Unquoted Service Paths Checks for Autologon Registry Keys Checks for Always Install Elevated Registry Keys...

A Few More Reasons Why RDP is Insecure (Surprise!)

If it seems like Remote Desktop Protocol RDP has been around forever, it's because it has at least compared to the many technologies that rise and fall within just a few years. The initial version, known as "Remote Desktop Protocol 4.0," was released in 1996 as part of the Windows NT 4.0 Terminal...

June 13, 2023—Hotpatch KB5027319 (OS Build 20348.1784)

None None...

C2-Hunter - Extract C2 Traffic

C2-Hunter C2-Hunter is a program designed for malware analysts to extract Command and Control C2 traffic from malwares in real-time. The program uses a unique approach by hooking into win32 connections APIs. With C2-Hunter, malware analysts can now intercept and analyze communication in real-time...

May 9, 2023—KB5026363 (OS Build 14393.5921) - EXPIRED

None None...

Security Bulletin: Unprivileged GPU access vulnerability - CVE-2013-5987

Summary NVIDIA device driver bug that could allow an unprivileged user to control target system. Vulnerability Details Abstract NVIDIA device driver bug that could allow an unprivileged user to control target system. Content Vulnerability Details: CVE ID : CVE-2013-5987 Description: NVIDIA Graphi...

New Cylance Ransomware Targets Linux and Windows Operating Systems

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cylance ransomware is a new malware that is capable of adjusting to customized encryption tactics and can accept different command-line parameters. To receive real-time threat advisories, please follow...

CVE-2023-28225 Windows NTLM Elevation of Privilege Vulnerability

...

March 14, 2023—KB5023713 (OS Build 10240.19805) - EXPIRED

None None...

SUSE CVE-2015-3117

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a deni...

SUSE CVE-2015-6711

The DoIdentityDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API...

SUSE CVE-2016-4282

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-4274,...

SUSE CVE-2016-6984

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-4273,...