63 matches found
LazyHook
개요 LazyHook은 호스트 침입 방지 시스템HIPS을 우회 하는 은밀한 API 후킹 프레임워크로, 호출 스택 스푸핑을 통해 동작합니다. CPU 수준의 하드웨어 중단점과 Vectored Exception Handling을 활용하여, 신뢰할 수 있는 Microsoft 서명 모듈에서 발생한 것처럼 임의 코드를 실행합니다. 이는 호출 스택 검사와 모듈 출처 확인에 의존하는 행동 분석 엔진을 완전히 속입니다. 신뢰할 수 있는 Microsoft 호출 스택 내에서 악성 코드를 실행하여 행동 분석을 회피하세요 하드웨어 중단점 + VEH를...
ZombifyProcess
ZombifyProcess http://www.malwaretech.com/2014/12/zombie-processes-as-hips-bypass.html 네, 저는 do whilefalse를 사용합니다. 저를 미워하지 말아 주세요...
EUVD-2016-8855
Malware in sbrugna...
McAfee Host Intrusion Prevention Services < 8.0.0.5257 DLL Search Order Hijacking (SB10320)
The version of McAfee Host Intrusion Prevention Services HIPS is prior to 8.0.0.5257. It is, therefore, affected by a DLL search order hijacking vulnerability. It allows attackers with local access to execute arbitrary code via execution from a compromised folder. %NASLMINLEVEL 70300 C Tenable...
CVE-2020-15724
In 360 Total Security (version 12.1.0.1005 and earlier), when GameFolder invokes GameChrome.exe, a local privilege escalation vulnerability exists due to DLL hijacking that could enable an arbitrary code execution on the local system. Root cause: DLL hijack during the GameFolder/GameChrome intera...
Windows NSA Information Assurance: Locklevel
Windows NSA Information Assurance LOCKLEVEL was a rapidly built prototype that demonstrates a method for scoring how well Windows systems have implemented some of the NSA Information Assurance top 10 mitigation strategies . This prototype is being shared to encourage industry adoption of these...
CVE-2016-8007
Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...
Authentication flaw
Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...
CVE-2016-8007
CVE-2016-8007 affects McAfee Host Intrusion Prevention Services (HIPS) versions prior to 8.0.0.3828 (8.0 Patch 7 and earlier). The root cause is improper permissions on registry keys, enabling a local attacker to bypass authentication by manipulating registry entries under specific conditions. Im...
CVE-2016-8007
Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...
CVE-2016-8007: Improper Access Control
Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services HIPS 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions...
Enigma Fileless UAC Bypass
a This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ Exploit Title : enigmafilelessuacbypass.rb Module...
McAfee Host Intrusion Prevention Services < 8.0.0.3828 Authentication Bypass (SB10173)
The version of McAfee Host Intrusion Prevention Services HIPS is prior to 8.0.0.3828. It is, therefore, affected by an authentication bypass vulnerability due to improper registry key permissions. A local attacker can exploit this, under certain conditions, to manipulate the product's registry...
Butts, legs and hips workout - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Butts, legs and hips workout published at the 'play' market has multiple vulnerabilities...
Comodo Internet Security - HIPS/Sandbox Escape PoC
No description provided by source. Exploit: http://www.joxeankoret.com/download/comodosandboxescape/sandboxtest1.tar.gz Mirror: www.exploit-db.com/sploits/sandboxtest1.tar.gz Video: http://www.joxeankoret.com/download/comodosandboxescape/video/sandboxescape1.htm...
Comodo Internet Security - HIPS/Sandbox Escape
Exploit: http://www.joxeankoret.com/download/comodosandboxescape/sandboxtest1.tar.gz Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34648.tar.gz sandboxtest1.tar.gz Video: http://www.joxeankoret.com/download/comodosandboxescape/video/sandboxescape1.htm...
Multiple Vendor Firewall HIPS Process Spoofing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/21615/info Multiple vendor firewalls and HIPS host-based intrusion prevention systems are prone to a process-spoofing vulnerability. An attacker can exploit this issue to have an arbitrary malicious program appear to run ...
Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication
Early 2012 ESET company a mysterious malware, dubbed the Avatar rootkit Win32/Rootkit.Avatar, advertised in the underground forums by Russian cyber crime. "We present you here previously announced product. In connection with work on other projects, we moved the release date for the public from Ma...
Chinese search engine Baidu launches free Antivirus Suite
Chinese search engine Baidu has just launched a security product called Baidu Antivirus 2013. Described as a ultra light weight, easy to use, extremely fast anti-virus program that promises to protect your system from malware, viruses, spyware, adware and other malicious programs. Most interestin...
[CVE-2012-2273] Comodo Internet Security <5.10 BSOD (Win7 x64)
affected software Comodo Internet Security, until 5.9 description BSOD under Windows 7 x64 if a 32b PE with a kernel ImageBase is executed. such files are very unusual, but work perfectly if the PE contains relocations, as shown at http://pe.corkami.comImageBase and http://pe.corkami.comrelocatio...