Threat Outbreak Alert RuleID20584: Email Messages Distributing Malicious Software on January 20, 2016

Medium Alert ID: 43114 First Published: 2016 January 20 19:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20584 may contain the following files: Name |...

ownCloud: Exploiting unauthenticated encryption mode

The owncloud file storage encryption uses the AES encryption algorithm in CFB mode without any authentication. The encryption module is advertised as a way to use a potentially untrusted external storage 1. Let's assume someone uses owncloud with the encryption module and an untrusted storage and...

GlassWire: GlassWireSetup.exe subject to EXE planting attack

GlassWire recently fixed a DLL hijacking attack whereby trojan DLLs would be loaded from the user's \Downloads\ folder. However, it appears that GlasswireSetup.exe still uses an unqualified path when running CertUtil.exe and as a consequence a trojaned CertUtil.exe will execute from the \Download...

Threat Outbreak Alert RuleID20217: Email Messages Distributing Malicious Software on December 21, 2015

Medium Alert ID: 42812 First Published: 2015 December 21 15:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20217 may contain the following files: Name |...

Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)

require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...

Threat Outbreak Alert RuleID19885: Email Messages Distributing Malicious Software on December 3, 2015

Medium Alert ID: 42487 First Published: 2015 December 3 19:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19885 may contain the following files: Name |...

Oracle BeeHive 2 - 'voice-servlet processEvaluation()' Write File (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Oracle BeeHive 2 voice-servlet processEvaluation Vulnerability", 'Description' = %q This module exploits a vulnerability found in...

Threat Outbreak Alert RuleID7930KVR: Email Messages Distributing Malicious Software on July 14, 2016

Medium Alert ID: 42087 First Published: 2015 November 16 14:25 GMT Last Updated: 2016 July 19 12:31 GMT Version: 56 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID7930 an...

Threat Outbreak Alert RuleID4961: Email Messages Distributing Malicious Software on July 6, 2016

Medium Alert ID: 41886 First Published: 2015 November 2 13:41 GMT Last Updated: 2016 July 6 19:09 GMT Version: 50 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID4961 and...

PE Static Malware Analysis: PortEx

PortEx is a Java library for static malware analysis of portable executable files. Its focus is on PE malformation robustness and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading Header information from: MSDOS Header, COFF File Header,...

Threat Outbreak Alert RuleID18013: Email Messages Distributing Malicious Software on September 16, 2015

Medium Alert ID: 41031 First Published: 2015 September 16 13:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18013 may contain the following files: Name ...

MS15-100 Microsoft Windows Media Center MCL Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploits a vulnerability in Windows Media...

Threat Outbreak Alert RuleID17916: Email Messages Distributing Malicious Software on September 11, 2015

Medium Alert ID: 40951 First Published: 2015 September 11 14:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17916 may contain the following files: Name ...

Microsoft Windows HTA (HTML Application) - Remote Code Execution Exploit

Microsoft Windows HTA HTML Application remote code execution exploit that leverages MS14-064. !/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$...

Heroes Of Might And Magic III .h3m Map File Buffer Overflow Exploit

This Metasploit module embeds an exploit into an uncompressed map file .h3m for Heroes of Might and Magic III. Once the map is started in-game, a buffer overflow occurring when loading object sprite names leads to shellcode execution. This module requires Metasploit: http://metasploit.com/downloa...

Threat Outbreak Alert RuleID17006: Email Messages Distributing Malicious Software on July 28, 2015

Medium Alert ID: 40191 First Published: 2015 July 29 14:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17006 may contain the following files: Name | Siz...

Internet Download Manager - OLE Automation Array Remote Code Execution

Internet Download Manager - OLE Automation Array Remote Code Execution !/usr/bin/php Run Site Grabber 4 . Enter any word "Start page/address" 5 . Click Addvance 6 . check "Enter Login and password manually at the following web page" 7 . Enter your exploit link http://ipaddress:80/ 8 . Next -- Nex...

Internet Download Manager - OLE Automation Array Remote Code Execution Exploit

Exploit for windows platform in category remote exploits !/usr/bin/php Run Site Grabber 4 . Enter any word "Start page/address" 5 . Click Addvance 6 . check "Enter Login and password manually at the following web page" 7 . Enter your exploit link http://ipaddress:80/ 8 . Next -- Next -- Next --...

Impero Education Pro Remote Command Execution

/ If you're unsure what Impero is, it's essentially a corporate/educational RAT. Vendor site: https://www.imperosoftware.co.uk/ They recently were in the news about how they implemented "anti-radicalisation" shit or something. They had a booth at BETT back in January. They gave out donuts. Those...

Threat Outbreak Alert RuleID16617: Email Messages Distributing Malicious Software on July 13, 2015

Medium Alert ID: 39895 First Published: 2015 July 13 17:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16617 may contain the following files: Name | Siz...