DanderSpritz_lab

DanderSpritz Lab 目的 DanderSpritz Lab 的目标是让研究人员和防御者能够快速搭建一个完整功能的 DanderSpritz 环境——方程式组织的后渗透工具集，并设置一台 Windows Server 2008 域控制器和一台客户端作为目标。Windows 目标上预装了一些我在研究 DanderSpritz 及其能力时觉得有用的逆向工程工具。 关于 DanderSpritz Lab 的更多内容，请阅读：https://medium.com/@francisck/introducing-danderspritz-lab-461912313d7c...

RTF_11882_0802

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Investigación: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Análisis d...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802： https://vulners.com/cve/CVE-2018-0802 0patch 利用与补丁视频： https://www.youtube.com/watch?v=XU-U4K270Z4 奇虎360博客文章 http://www.freebuf.com/vuls/159789.html...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch video de explotación y parche: https://www.youtube.com/watch?v=XU-U4K270Z4 Entrada de blog de Qihoo 360...

CVE-2017-11882

CVE-2017-11882概述 从漏洞利用效果来看，它可以通杀Office 2003到2016的所有版本，并且整个攻击环境的构建非常简单。 此漏洞是由Office软件里面的 公式编辑器 造成的，由于编辑器进程没有对名称长度进行校验，导致缓冲区溢出，攻击者通过构造特殊的字符，可以实现任意代码执行。 举个例子，如果黑客利用这个漏洞，构造带有shell后门的office文件，当普通用户打开这个office文件，则电脑可以被黑客直接控制。 影响版本： root@kitploit: office 2003 office 2007 office 2010 office 2013 office 20...

CVE-2016-6366

CVE-2016-6366 针对 EXTRABACON 漏洞利用的公开改进库，这是一个由方程集团（NSA）编写并由影子经纪人泄露的 Cisco ASA 远程代码执行漏洞。 包含改进的 shellcode、一个 LINA 偏移量查找脚本、一个 Metasploit 模块，以及 extrabacon-2.0。 我们将在不久的将来，在对所有版本进行真实硬件测试后，为大多数 8.x 和 9.x 版本添加补丁。 该版本使用了改进的 shellcode，阶段数少于方程集团版本，因此更加可靠。这将 SNMP 载荷包减少了约 150 字节。此外，泄露的版本仅支持 8.x，而我们已经使其在 9.x...

CVE-2018-0802_CVE-2017-11882

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Investigación: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Análisis d...

nationstate-cyber-tools

NATION-STATE CYBER WEAPONS ARSENAL Live Web Page: htt...

Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload

In 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus. Behind some of this activity is Cloud Atlas, a group we have known since 2014. During our investigation, we identified n...

EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models Via Equation Solving and Code Completion

Large language models LLMs, such as ChatGPT, have achieved remarkable success across a wide range of fields. However, their trustworthiness remains a significant concern, as they are still susceptible to jailbreak attacks aimed at eliciting inappropriate or harmful responses. However, existing...

Cloud Atlas activity in the first half of 2025: what changed

Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process CVE-2018-0802 to download and execute malicious cod...

EUVD-2018-13397

Malware in sbrugna...

EUVD-2021-0424

Malware in sbrugna...

Polyadic Encryption

A novel original procedure of encryption/decryption based on the polyadic algebraic structures and on signal processing methods is proposed. First, we use signals with integer amplitudes to send information. Then we use polyadic techniques to transfer the plaintext into series of special integers...

The Shift from Vulnerability Management to Exposure Management

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Your vulnerability management program is optimized for the wrong war. You're counting patches whil...

BIT-MOODLE-2024-33997 moodle: stored XSS risk when editing another user's equation in equation editor

Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation...

CVE-2018-20859

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem...

CVE-2024-45060

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting XSS vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in...

CVE-2024-45060

Summary (CVE-2024-45060) PhpSpreadsheet (PHPOffice) contains a cross-site scripting (XSS) vulnerability in a sample file. The issue arises when user-supplied input is concatenated directly into spreadsheet formulas in the 45_Quadratic_equation_solver.php script, enabling formula injection and Jav...

Cross-site Scripting (XSS)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Cross-site Scripting XSS through the discriminantFormula and r1Formula processes due to improper user input sanitization. An...