1503 matches found
SetupHijack
SetupHijack 개요 SetupHijack 은 Windows 설치 프로그램 및 업데이트 프로세스에서 경쟁 조건과 안전하지 않은 파일 처리를 악용하는 보안 연구 도구입니다. 권한 있는 설치 프로그램 또는 업데이터가 %TEMP% 또는 다른 전역 쓰기 가능 위치에 파일을 드롭하면, 공격자가 이러한 파일을 상승된 권한으로 실행되기 전에 교체할 수 있는 시나리오를 대상으로 합니다. 실행하는 데 상승된 권한이 필요하지 않습니다. 파일 시스템 알림을 사용하지 않습니다 대신 변경 사항을 폴링합니다. Authenticode 코드 서명 및...
ShokoServer System - Local File Inclusion (LFI)
ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...
CVE-2023-20178
CVE-2023-20178 이는 Cisco Secure Client 5.0.01242에서 테스트 및 Cisco AnyConnect 4.10.06079에서 테스트의 임의 파일 삭제 취약점에 대한 PoC입니다. 사용자가 VPN에 연결하면 vpndownloader.exe 프로세스가 백그라운드에서 시작되고, 다음과 같은 형식으로 c:\windows\temp에 기본 권한의 디렉터리를 생성합니다: .tmp 이 디렉터리를 생성한 후 vpndownloader.exe는 해당 디렉터리가 비어 있는지 확인하고, 비어 있지 않으면 그 안의 모든...
CVE-2020-0683
CVE-2020-0683 MSRCに送信したオリジナルのPoC。 CVE-2020-0683 - Windows インストーラーの特権昇格 に割り当てられました。 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0683 Visual Studio C++ 2017 用のソースコードです。 すべての調査結果と再現手順を説明しているPDFをお読みください。 "binMsiExploit" の中に、実行するエクスプロイト（exe）があります。 DEMO...
msi-search
MSI Search Windows は MSI ファイルを C:\Windows\Installer\ にキャッシュします。ファイル名はランダム化され、英数字の後に ".msi" 拡張子が付きます。このツールは、レッドチームのオペレーターやセキュリティチームが、どの MSI ファイルがどのソフトウェアに対応するかを特定する作業を簡素化し、MSI 修復を通じたローカル権限昇格の脆弱性を調査するために関連ファイルをダウンロードできるようにします。MSI 修復の脆弱性の詳細については、サードパーティの Windows インストーラーを介した権限昇格 を参照してください。 著者: Andrew...
msiscan
MSI アナライザー この Linux 用 Python スクリプトは、Microsoft Windows の .msi インストーラファイルを解析し、潜在的な脆弱性を指摘することができます。SEC Consult Vulnerability Lab で Michael Baer（@derbaer0）によって開発されました。 現在、これは主にローカル権限昇格に適しており、これについては弊社のブログ記事 https://r.sec-consult.com/msi でも説明しています。 Microsoft はこの脆弱性に対して CVE-2024-38014...
CVE-2026-92369 Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...
CVE-2026-92369
TeamViewer Full Client and Host on Windows prior to version 15.82 are vulnerable to a TOCTOU race condition within the installer rollback mechanism. A local low-privileged attacker can exploit this by replacing rollback backup files in a user-writable temporary directory before an elevated instal...
CVE-2026-92369 Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...
CVE-2026-55567 BleachBit: Exploit File Delete to Escalate Privilege
BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...
CVE-2026-12003
A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...
CVE-2026-68955
The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...
CVE-2026-68955
The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...
EUVD-2026-77216
The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...
CVE-2026-68955
The installer for Rakuten Kobo Desktop Application Windows version insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation...
HTB-NanoCorp-CVE-2024-0670
CVE-2024-0670 - Escalada de Privilegios en la Reparación MSI del Agente CheckMK NanoCorp HTB Este repositorio contiene un script de PowerShell utilizado para explotar CVE-2024-0670 en la máquina NanoCorp de Hack The Box. La vulnerabilidad permite a un usuario con pocos privilegios abusar de la...
CVE-2026-77894
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-72929
Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally...