Windows Manage Persistent EXE Payload Installer

This Module will upload an executable to a remote host and make it Persistent. It can be installed as USER, SYSTEM, or SERVICE. USER will start on user login, SYSTEM will start on system boot but requires privs. SERVICE will create a new service which will start the payload. Again requires privs...

OpenNMS Java Object Unserialization Remote Code Execution

This Metasploit module exploits a vulnerability in the OpenNMS Java object which allows an unauthenticated attacker to run arbitrary code against the system. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

Threat Outbreak Alert RuleID25681: Email Messages Distributing Malicious Software on October 17, 2016

Medium Alert ID: 49311 First Published: 2016 October 17 17:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25681 may contain the following files: Name |...

Python Keylogger: Radium

Python Keylogger With Multiple Features Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording logging the keys struck on a keyboard, typically covertly, so that the person using the keyboard is unaware that their actions are being monitored. Keyloggi...

Threat Outbreak Alert RuleID24600: Email Messages Distributing Malicious Software on August 24, 2016

Medium Alert ID: 48591 First Published: 2016 August 25 13:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24600 may contain the following files: Name |...

Huawang Cloud DLL and exe Hijacking Vulnerability

Huawang Cloud is an Internet broadband resources and server platform architecture system, with a set of cloud computing data center, able to provide a variety of technical services, and able to provide users with a smooth and clear experience of the video conferencing system. There are multiple d...

The vulnerability of the enterprise automation system 1C:Enterprise, which allows a malicious individual to cause service failures

The server processes agent.exe, rmngr.exe, and rhost.exe of the enterprise automation system 1C:Enterprise use the same module rtrsrvc.dll for working with TCP connections. A specially crafted TCP packet leads to an initialization error, which in turn causes incorrect memory reading at the zero...

ACROS Security 0patch 2016.05.19.539 Privilege Escalation

ACROS Security 0patch 0PatchServicex64.exe Unquoted Service Path Privilege Escalation Vendor: ACROS, d.o.o. Product web page: https://www.0patch.com Affected version: 2016.05.19.539 Summary: 0patch pronounced 'zero patch' is a platform for instantly distributing, applying and removing microscopic...

Regsvr32.exe (.sct) Command Delivery Server

This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on a target system. The major advantage of this technique is that you can execute a static command on the target system and dynamically and remotely change the command that will actually run by...

Regsvr32.exe (.sct) Application Whitelisting Bypass Server

This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts an .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This...

JSRat - Reverse HTTP Shell Using JavaScript

JSRat is a reverse HTTP Shell by using JavaScript. JSRat use rundll32.exe to load the JavaScript code in cmd and a HTTP Shell is returned when the code is executed. The special part is that after running the cmd command, rundll32.exe will remain in the background to continuously connect to the...

AppLocker - Execution Prevention Bypass (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit4 'AppLocker Execution Prevention Bypass', 'Description' = %q This module will generate a .NET service executable on the target and utilise InstallUtil to...

Cygwin DLL Hijacking

Hi @ll, Cygwin's setup-x86.exe loads and executes UXTheme.dll on Windows XP also ClbCatQ.dll and some more DLLs from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and If UXTheme.dll or one of...

Threat Outbreak Alert RuleID20584: Email Messages Distributing Malicious Software on January 20, 2016

Medium Alert ID: 43114 First Published: 2016 January 20 19:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20584 may contain the following files: Name |...

ownCloud: Exploiting unauthenticated encryption mode

The owncloud file storage encryption uses the AES encryption algorithm in CFB mode without any authentication. The encryption module is advertised as a way to use a potentially untrusted external storage 1. Let's assume someone uses owncloud with the encryption module and an untrusted storage and...

GlassWire: GlassWireSetup.exe subject to EXE planting attack

GlassWire recently fixed a DLL hijacking attack whereby trojan DLLs would be loaded from the user's \Downloads\ folder. However, it appears that GlasswireSetup.exe still uses an unqualified path when running CertUtil.exe and as a consequence a trojaned CertUtil.exe will execute from the \Download...

Threat Outbreak Alert RuleID20217: Email Messages Distributing Malicious Software on December 21, 2015

Medium Alert ID: 42812 First Published: 2015 December 21 15:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20217 may contain the following files: Name |...

Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)

require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...

Threat Outbreak Alert RuleID19885: Email Messages Distributing Malicious Software on December 3, 2015

Medium Alert ID: 42487 First Published: 2015 December 3 19:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19885 may contain the following files: Name |...

Oracle BeeHive 2 - 'voice-servlet processEvaluation()' Write File (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Oracle BeeHive 2 voice-servlet processEvaluation Vulnerability", 'Description' = %q This module exploits a vulnerability found in...