CVE-2020-0601

CVE-2020-0601 このスクリプトは、お使いのWindowsのバージョンに応じて、CVE-2020-0601の修正プログラムが適用されているかどうかをチェックします。 さらに、既知の脆弱性を悪用しようとする試みがあるかどうかもチェックします。 この.xmlファイルはControlUpユーザー向けです。 通常どおり、XMLファイルをScript（ベース）Actionsにインポートしてください。 すべての情報はこちらで確認できます：...

CVE-2024-1086-checker

CVE-2024-1086-checker 这是一个简单的检查脚本，用于检测容易被利用的内核配置。如果本脚本返回“内核配置不易受攻击”，仅表示该漏洞无法通过当前已知的攻击路径利用。 使用方法 root@kitploit: curl -s "https://raw.githubusercontent.com/kevcooper/CVE-2024-1086-checker/main/checkcve20241086.py" | python3 root@kitploit: git clone...

ZeroLogon-Exploitation-Check

도메인에서 CVE-2020-1472일명 ZeroLogon의 잠재적 악용 여부를 확인하기 위한 자동화 스크립트입니다. 이것은 여러 블로그에서 수집한 CVE-2020-1472의 실제 악용 여부를 판단하는 주요 아티팩트 중 일부를 자동화하는 매우 "빠르고 대충 만든" 스크립트입니다. 이상적으로는 두 번째 확인Security 및 System 이벤트 로그의 이벤트은 SIEM/Syslog/Event collector에서 수행할 수 있으며, 이는 이러한 악용을 탐지할 수 있을 만큼 오래된 이벤트를 유지합니다. 환경에서 netlogon 로그...

SIGRed

CVE-2020-1350 別名 SIGRed v0.30 概要: CVE-2020-1350 別名 SIGRed - CVE スコア 10.0 を介して Microsoft Windows DNS サーバーを悪用しようとする試みを検出するための Zeek パッケージ。 参照: https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/...

CVE-2019-19871-AuditGuide

アップデート 1-22-2020 現在、FireEyeが提供するツールがあり、以下の項目のスキャンに役立ちます。重要なのは、エクスプロイトが実行された後の行動を確認するために、2020年1月9日まで遡れる十分なログが必要であるということです。.XMLペイロードファイルが見つかった場合は、以下の情報を使用して対処方法を決定する必要があります。 https://www.fireeye.com/blog/products-and-services/2020/01/fireeye-and-citrix-tool-scans-for-iocs-related-to-vulnerability.ht...

CVE-2007-2447-Exploitation-SIEM-Detection-Lab

🛡️ CVE-2007-2447 漏洞利用与 SIEM 检测实验室（Wazuh + MITRE ATT&CK） B.Tech 项目（BTP）| IIIT Pune 基于： 《为检测与监控设计和实现有效的网络安全家庭实验室》 — ICCCNT 2023，IIT Delhi 一个基于单台机器、使用免费开源工具构建的功能完整的网络安全家庭实验室。该实验室模拟真实世界的攻击生命周期——侦察 → 利用 → 检测——并演示 SIEM 如何实时检测攻击并将其映射到 MITRE ATT&CK 框架。 📐 实验室架构 root@kitploit:...

Detecting-and-Analyzing-CVE-2024-24919-Exploitation

🔍 Let’s Defend SIEM を使ったゼロデイ攻撃の調査 👉 CVE-2024-24919 エクスプロイトの検知と分析のウォークスルー 🎯 調査の目的 このプロジェクトは、Check Point Security Gateway に対する潜在的なエクスプロイトの試みを調査する ために実施されました。具体的には、ゼロデイ脆弱性 – CVE-2024-24919 を利用したものです。目標は、このアラートが誤検知なのか、正当な侵害の試みなのかを判断し、トラフィックを分析し、適切な封じ込めと対応手順を講じることでした。 🛠️ 使用したツールと環境 SIEM プラットフォーム : Let’...

VulnCheck KEV: CVE-2026-48172

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges...

Exploit for Path Traversal in Rarlab Winrar

!Window...

Vulnerability in Acrobat Reader could lead to remote code execution; Microsoft patches information disclosure issue in Windows API

Cisco Talos' Vulnerability Research team discovered two vulnerabilities have been disclosed and fixed over the past few weeks. Talos discovered a time-of-check time-of-use vulnerability in Adobe Acrobat Reader, one of the most popular PDF readers currently available, and an information disclosure...

Multiple vulnerabilities in Adobe Acrobat Reader could lead to remote code execution

Cisco Talos has disclosed more than 30 vulnerabilities in February, including seven in Adobe Acrobat Reader, one of the most popular PDF editing and reading software currently available. Adversaries could exploit these vulnerabilities to trigger the reuse of a previously freed object, thus causin...

Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware

CVE-2023-20198 An Exploitation script developed to exploit the...

Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware

CVE-2023-20198 An Exploitation script developed to exploit the...

Ingress nginx annotation injection causes arbitrary command execution

Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...

Privilege escalation in project role template binding (PRTB) and -promoted roles

Impact An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding PRTB and -promoted roles. This issue is not present in Rancher 2.7...

Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One™ and Cloud One™

We provide a guide to detecting Dirty Pipe, a Linux kernel vulnerability tracked as CVE-2022-0847...

Worming your way in through IIS - CVE-2022-21907

Worming your way in through IIS - CVE-2022-21907 By Trellix · January 27, 2022 This story was written by Eion Carroll. IIS HTTP Stack History In the first patch Tuesday of 2022, Microsoft released a patch for a wormable vulnerability CVE-2022-21907 within the IIS HTTP stack, or more specifically...

Detecting Credential Stealing Attacks Through Active In-Network Defense

ARCHIVED STORY Detecting Credential Stealing Attacks Through Active In-Network Defense By Chintan Shah · September 22, 2021 Executive Summary Today, enterprises tend to use multiple layers of security defenses, ranging from perimeter defense on network entry points to host based security solution...

Last Week’s Security news: PrintNightmare, Kaseya, Intune, Metasploit Docker escape

Hello guys! The second episode of Last Week’s Security news from June 28 to July 4. The most interesting vulnerability of the last week is of course Microsoft Print Spooler "PrintNightmare". By sending an RpcAddPrinterDriverEx RPC request, for example over SMB, a remote, authenticated attacker ma...

Nethive-Project - Restructured And Collaborated SIEM And CVSS Infrastructure

The Nethive Project provides a Security Information and Event Management SIEM insfrastructure empowered by CVSS automatic measurements. Features Machine Learning powered SQL Injection Detection Server-side XSS Detection based on Chrome's XSS Auditor Post-exploitation Detection powered by Auditbea...