Direct windows syscall evasion technique

This module allows you to generate a Windows EXE that evades Host-based security products such as EDR/AVs. It uses direct windows syscalls to achieve stealthiness, and avoid EDR hooking. please try to use payloads that use a more secure transfer channel such as HTTPS or RC4 in order to avoid...

BlackMatter Ransomware Analysis; The Dark Side Returns

ARCHIVED STORY BlackMatter Ransomware Analysis; The Dark Side Returns By Alexandre Mundo and Marc Elias · September 22, 2021 BlackMatter is a new ransomware threat discovered at the end of July 2021. This malware started with a strong group of attacks and some advertising from its developers that...

Git git-lfs Remote Code Execution Exploit

This Metasploit modules exploits a critical vulnerability in Git Large File Storage Git LFS, an open source Git extension for versioning large files, which allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker’s malicious repository usi...

Code injection

NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged user account. To exploit this, a low-privileged user must change the service configuration or overwrite the binary service...

CVE-2021-35508

CVE-2021-35508 affects NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 . The underlying issue enables a low-privileged user to obtain SYSTEM-level code execution by altering the service configuration or overwriting the service binary. The exploit requires local access and targeted modification of...

DEBIAN-CVE-2021-36690

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges e.g., is intentionally allowe...

CVE-2021-36690

CVE-2021-36690: A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via idxGetTableInfo when given a crafted SQL query. The vendor disputes the relevance (user already has full privileges). Public details note remediation via package upgrades; Debian LTS advi...

Backdoor.Win32.Agent.cu Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ce1963d3fd6a8e1383aac40a1f1c4107C.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.cu Vulnerability: Unauthenticated Remote Command Execution Description: The...

Trojan-Spy.Win32.Xspyout.a Unauthenticated Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/d1791ca15c5df6f8f5d007518efd65b6.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.Xspyout.a Vulnerability: Unauthenticated Open Proxy Description: The malware listen...

Backdoor.Win32.NerTe.781 Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/776e8bb41adf8bd95865c0b03637d8d7B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.NerTe.781 Vulnerability: Unauthenticated Remote Command Execution Description:...

Trojan.Win32.Alien.erf Denial Of Service

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/57ab194d8c60ee97914eda22e4d71b68.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Alien.erf Vulnerability: Remote Denial of Service Description: The malware deploys a SM...

WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path

Exploit Title: WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path Discovery by: Brian Rodriguez Date: 13-06-2021 Vendor Homepage: https://www.wibu.com Software Links: https://www.wibu.com/us/support/user/downloads-user-software/file/download/5792.html Tested Version: 6.51 Vulnerability...

Privilege escalation

The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag...

CVE-2020-27384

CVE-2020-27384 affects the Guild Wars 2 launcher (Gw2-64.exe) in version 106916. The issue is an elevation of privileges caused by improper permissions: the directory tree for Guild Wars 2 has world-writable access due to the F flag (Full Control) granted to Everyone, allowing an authenticated us...

Trojan.Win32.Scar.dxir Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/68ed9d6e4f3e917ab4b91689e2890754.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Scar.dxir Vulnerability: Insecure Permissions Description: Scar.dxir creates a insecure...

Backdoor.Win32.DarkKomet.bhfh Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/2e507b75c0df0fcb2f9a85f4a0c1bc04.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.DarkKomet.bhfh Vulnerability: Insecure Permissions Description: DarkKomet.bhfh create...

Backdoor.Win32.DarkKomet.bhfh Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/66fa06a4e3e799b059910dc17de295ae.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.DarkKomet.bhfh Vulnerability: Insecure Permissions Description: DarkKomet.bhfh create...

Backdoor.Win32.Whisper.b Remote Stack Corruption

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/a0edb91f62c8c083ec35b32a922168d1.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Whisper.b Vulnerability: Remote Stack Corruption Description: Whisper.b listens on TC...

Backdoor.Win32.Levelone.b Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: https://malvuln.com/advisory/3f82e6ddc9f5242f5af200d2fbae4ce4.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Levelone.b Vulnerability: Remote Stack Buffer Overflow Description: The backdoor...

WinAVR Version 20100110 - Insecure Folder Permissions Vulnerability

Exploit Title: WinAVR Version 20100110 - Insecure Folder Permissions Exploit Author: Mohammed Alshehri Vendor Homepage: https://sourceforge.net/projects/winavr/ Software Link: https://sourceforge.net/projects/winavr/files/WinAVR/20100110/WinAVR-20100110-install.exe Version: Version 20100110 Teste...