LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

ZombifyProcess

ZombifyProcess http://www.malwaretech.com/2014/12/zombie-processes-as-hips-bypass.html Yes, I use do whilefalse, please don't hate me...

EUVD-2016-8855

Malware in sbrugna...

McAfee Host Intrusion Prevention Services < 8.0.0.5257 DLL Search Order Hijacking (SB10320)

The version of McAfee Host Intrusion Prevention Services HIPS is prior to 8.0.0.5257. It is, therefore, affected by a DLL search order hijacking vulnerability. It allows attackers with local access to execute arbitrary code via execution from a compromised folder. %NASLMINLEVEL 70300 C Tenable...

CVE-2020-15724

In 360 Total Security (version 12.1.0.1005 and earlier), when GameFolder invokes GameChrome.exe, a local privilege escalation vulnerability exists due to DLL hijacking that could enable an arbitrary code execution on the local system. Root cause: DLL hijack during the GameFolder/GameChrome intera...

Windows NSA Information Assurance: Locklevel

Windows NSA Information Assurance LOCKLEVEL was a rapidly built prototype that demonstrates a method for scoring how well Windows systems have implemented some of the NSA Information Assurance top 10 mitigation strategies . This prototype is being shared to encourage industry adoption of these...

CVE-2016-8007

Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...

Authentication flaw

Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...

CVE-2016-8007

Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...

CVE-2016-8007

CVE-2016-8007 affects McAfee Host Intrusion Prevention Services (HIPS) versions prior to 8.0.0.3828 (8.0 Patch 7 and earlier). The root cause is improper permissions on registry keys, enabling a local attacker to bypass authentication by manipulating registry entries under specific conditions. Im...

CVE-2016-8007: Improper Access Control

Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...

PT-2017-9457

Name of the Vulnerable Software and Affected Versions McAfee Host Intrusion Prevention Services HIPS versions 8.0 Patch 7 and earlier Description The issue allows authenticated users to bypass authentication and manipulate the product's registry keys under specific conditions. Recommendations For...

Enigma Fileless UAC Bypass

a This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ Exploit Title : enigmafilelessuacbypass.rb Module...

McAfee Host Intrusion Prevention Services < 8.0.0.3828 Authentication Bypass (SB10173)

The version of McAfee Host Intrusion Prevention Services HIPS is prior to 8.0.0.3828. It is, therefore, affected by an authentication bypass vulnerability due to improper registry key permissions. A local attacker can exploit this, under certain conditions, to manipulate the product's registry...

Butts, legs and hips workout - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Butts, legs and hips workout published at the 'play' market has multiple vulnerabilities...

Comodo Internet Security - HIPS/Sandbox Escape PoC

No description provided by source. Exploit: http://www.joxeankoret.com/download/comodosandboxescape/sandboxtest1.tar.gz Mirror: www.exploit-db.com/sploits/sandboxtest1.tar.gz Video: http://www.joxeankoret.com/download/comodosandboxescape/video/sandboxescape1.htm...

Comodo Internet Security - HIPS/Sandbox Escape

Exploit: http://www.joxeankoret.com/download/comodosandboxescape/sandboxtest1.tar.gz Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34648.tar.gz sandboxtest1.tar.gz Video: http://www.joxeankoret.com/download/comodosandboxescape/video/sandboxescape1.htm...

Multiple Vendor Firewall HIPS Process Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21615/info Multiple vendor firewalls and HIPS host-based intrusion prevention systems are prone to a process-spoofing vulnerability. An attacker can exploit this issue to have an arbitrary malicious program appear to run ...

Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication

Early 2012 ESET company a mysterious malware, dubbed the Avatar rootkit Win32/Rootkit.Avatar, advertised in the underground forums by Russian cyber crime. "We present you here previously announced product. In connection with work on other projects, we moved the release date for the public from Ma...

Chinese search engine Baidu launches free Antivirus Suite

Chinese search engine Baidu has just launched a security product called Baidu Antivirus 2013. Described as a ultra light weight, easy to use, extremely fast anti-virus program that promises to protect your system from malware, viruses, spyware, adware and other malicious programs. Most interestin...