ProcessStomping - A Variation Of ProcessOverwriting To Execute Shellcode On An Executable'S Section

A variation of ProcessOverwriting to execute shellcode on an executable's section What is it For a more detailed explanation you can read my blog post Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on a targeted sectio...

OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents

In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away from being...

Backdoor.Win32.Bushtrommel.122 MVID-2022-0630 Remote Command Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/76c09bc82984c7f7ef55eb13018e0d87B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Bushtrommel.122 Vulnerability: Unauthenticated Remote Command Execution...

CVE-2022-24138

IOBit Advanced System Care Asc.exe 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with ...

OffensiveRust

This is a collection of Rust code snippets, each implementing a different type of exploit or malicious functionality. The code is organized into several subdirectories, each containing a specific exploit or tool. Here's a summary of the code and its functionality: 1. AllocateWithSyscalls: This co...

Go-Shellcode - A Repository Of Windows Shellcode Runners And Supporting Utilities

go-shellcode is a repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques. The available Shellcode runners include: CreateFiber CreateProcess CreateProcessWithPipe CreateRemoteThread CreateRemoteThreadNati...

ezEmu - Simple Execution Of Commands For Defensive Tuning/Research

ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an "offensive framework for blue teamers ", ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry. Windows See /Linux for ELF ezEmu is compiled as...

Microsoft Windows Unsafe Handling Practices Vulnerability

This post outlines multiple unsafe practices in Microsoft Windows that can allow for local privilege escalation. This multi-part post can be read even without a MIME-compliant program! Back in 2014, I reported a vulnerability in CreateProcess's handling of .cmd and .bat files that Microsoft fixed...

Microsoft Windows Unsafe Handling Practices

Hi @ll, This multi-part post can be read even without a MIME-compliant program! Back in 2014, I reported a vulnerability in CreateProcess's handling of .cmd and .bat files that Microsoft fixed with MS14-019 alias MSKB 2922229 and assigned CVE-2014-0315: command lines with a batch script as first...

Plurox: Modular backdoor

In February this year, a curious backdoor passed across our virtual desk. The analysis showed the malware to have a few quite unpleasant features. It can spread itself over a local network via an exploit, provide access to the attacked network, and install miners and other malicious software on...

PT-2018-10598 · Windscribe +1 · Windscribe +1

Name of the Vulnerable Software and Affected Versions: Windscribe version 1.81 Description: The issue concerns the VPN component in Windscribe, which uses the OpenVPN client and creates a system process named WindScribeService.exe. This process establishes a named pipe endpoint,...

AMD Plays.tv 1.27.5.0 - plays_service.exe Arbitrary File Execution Exploit

Exploit for windows platform in category local exploits http://support.amd.com/en-us/download?cmpid=CCCOffline - Click "Automatically Detect - Download Now" Installation Automatically Installs "Raptr, Inc Plays TV Service" OR https://plays.tv/download Target OS: Windows Any Privilege: SYSTEM Type...

AMD Plays.tv 1.27.5.0 - 'plays_service.exe' Arbitrary File Execution

http://support.amd.com/en-us/download?cmpid=CCCOffline - Click "Automatically Detect - Download Now" Installation Automatically Installs "Raptr, Inc Plays TV Service" OR https://plays.tv/download Target OS: Windows Any Privilege: SYSTEM Type: Arbitrary File Execution Notes: Second minor bug allow...

Command injection

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted...

CVE-2017-18044

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted...

CVE-2017-18044 - Commvault Communications Service execCmd Vulnerability

A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this...

VMware Workstation 12 Pro Denial Of Service

/ Title: NULL pointer dereference vulnerability in vstor2 driver VMware Workstation Pro/Player CVE: 2017-4916 VMSA-2017-0009 Author: Borja Merino @BorjaMerino Date: May 18, 2017 Tested on: Windows 10 Pro and Windows 7 Pro SP1 with VMwareAr Workstation 12 Pro 12.5.5 build-5234757 Affected: VMware...

Microsoft IExpress DLL Hijacking

Hi @ll, IExpress creates executable installers ° or self-extracting archives for Windows by embedding a .CAB archive and some strings as resources into a copy of the program %SystemRoot%\System32\WExtract.exe. These self-extracting archives/executable installers, especially those made by Microsof...

2345王牌输入法本地权限提升漏洞

Microsoft Windows API使用CreateProcess函数创建新的进程及其主线程。 CreateProcess函数的格式如下： BOOL CreateProcess LPCTSTR lpApplicationName, LPTSTR lpCommandLine, LPSECURITYATTRIBUTES lpProcessAttributes, LPSECURITYATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCTST...

Advantech WebAccess bwocxrun.ocx CreateProcess方法远程命令执行漏洞

CVE ID:CVE-2014-0773 Advantech WebAccess HMI/SCADA是一款HMI/SCADA软件。 Advantech WebAccess BWOCXRUN.BwocxrunCtrl.1 ActiveX控件bwocxrun.ocx中的CreateProcess方法存在安全漏洞，如果命令行中包含'\setup.exe', '\bwvbprt.exe'或'\bwvbprtl.exe'，可导致绕过该方法中的命令执行校验机制，以应用程序上下文执行任意命令。 0 Advantech WebAccess 7.1 Advantech WebAccess...