smbtakeover

smbtakeover Windows上でドライバをロードせず、LSASSへモジュールをロードせず、ターゲットマシンを再起動せずに445/tcpのバインド解除と再バインドを行うためのテクニックです。C2経由でのSMBベースのNTLMリレーの負担を軽減するために実装されました。このテクニックの技術的分析は、x33fconでのRelay Your Heart Away: An OPSEC Concious Approach to 445 Takeoverプレゼンテーションで詳しく説明されています。...

TChopper

TChopper 최근에 발견한 새로운 기법으로, 별명을 'Chop chop'이라고 지었습니다. 이 기법은 Windows 서비스 표시 이름display name과 WMI를 이용해 악성 바이너리를 base64 청크로 밀반입smuggle한 후, TChopper 도구를 사용하여 측면 이동lateral movement을 자동화합니다. image 작동 방식 이 도구는 밀반입하려는 파일을 가져와 base64로 인코딩하여 메모리 스트림에 저장합니다. 각 줄의 길이를 150250자로 나눕니다 250자는 서비스 lpDisplayname 매개변수...

ACEshark

ACEshark これは何ですか？ ACEsharkは、Windowsサービスの構成とアクセス制御エントリ（ACE）を迅速に抽出・分析するためのユーティリティです。accesschk.exe などの非標準バイナリを必要としません。 なぜ？ サービスの権限を効率的に特定・分析し、特権昇格ベクトル（サービスの binpath を変更して再起動するなど）を発見します。 特定のユーザー、またはすべてのグループとアカウントを対象に、サービスの権限を監査します。 仕組み...

Hijack-service-binaries

Hijack-service-binaries 現在のユーザーが変更可能なWindowsサービスバイナリを特定するPowerShellセキュリティ監査ツールです。特権昇格の足掛かりとなる可能性があります。 概要 このスクリプトは、すべてのWindowsサービス（system32およびsvchostを除く）をスキャンし、現在のユーザーがサービス実行ファイルに対して書き込み、変更、またはフルコントロールの権限を持っているかどうかをチェックします。危険な権限が検出された場合、脆弱なサービスに関する詳細情報とともにユーザーに警告します。 特徴 🔍 すべての非システムWindowsサービスをスキャ...

presentations

私のプレゼンテーション その他の資料は私の個人サイトで見つけることができます: https://sites.google.com/site/zhiniangpeng root@kitploit: EXSi の preauth RCE とサンドボックスエスケープの脆弱性の悪用, Typhooncon 2023 OLE オブジェクトは今も危険 — Microsoft Office の悪用, POC 2023 Django-Simple-Captcha — JumpServer の Preauth RCE, Mosec BaijiuCon 2023 APT vs GPT, 2023 年...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder は、Windows レジストリから CLSID エントリと AppID エントリを列挙し、LocalService 値を介して Windows サービスに関連付けられた COM オブジェクトを特定します。 この関数はこれらのエントリを相互に関連付け、結果を CSV ファイルにエクスポートし、関連するサービスが実行中の場合に COM のアクティベーションを試みます。主にリレー攻撃やその他の LPE シナリオにおいて使用可能な CLSID を特定するのに役立つことを目的としています。 使用方法 root@kitploit: PS...

EUVD-2026-15192

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-33253

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-33253

SANUPS SOFTWARE (SANYO DENKI CO., LTD.) exposes a Windows service registration with an unquoted executable path. According to the description, a user with write access to the system drive root can trigger arbitrary code execution with SYSTEM privileges via a local privilege escalation. The connec...

CVE-2026-33253

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

Serviio PRO 代码问题漏洞

Serviio PRO is a multimedia streaming server software developed by the British company Serviio. Version 1.8 of Serviio PRO contains a code vulnerability. This vulnerability stems from improper search paths and directory permissions in Windows services, which may allow local users to execute...

Canon IJ Scan Utility registers Windows services with unquoted file paths

Overview IJ Scan Utility provided by Canon Inc. contains the following vulnerability. Unquoted search path or element CWE-428 - CVE-2026-1585 Canon Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A user may execute arbitrary code with SYSTEM...

CVE-2026-24466

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-24466

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-24466

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2026-24466

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

Oki Electric Industry products and OEM products register Windows services with unquoted file paths

Overview Configuration Tool provided by Oki Electric Industry Co., Ltd., Ricoh Co., Ltd., and Murata Machinery, Ltd. contain the following vulnerability. Unquoted search path or element CWE-428 - CVE-2026-24466 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IP...

PT-2026-7075

Products provided by Oki Electric Industry Co., Ltd. and its OEM products Ricoh Co., Ltd., Murata Machinery, Ltd. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege...

CVE-2019-25281

NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject malicious code that...

CVE-2019-25281

NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject malicious code that...