swarmer

swarmer 一个用于悄悄地添加注册表项到HKCU的工具，EDR/AV无法察觉发生了什么，即使你没有管理员权限 。 如何使用？ 注意：你只有一次机会这样做，一旦NTUSER.MAN成为你的新注册表配置单元，没有管理员权限就无法更改，所以请确保第一次就把所有修改都做好。 使用 regquery BOF 的结果 1. 从 https://github.com/trustedsec/CS-Situational-Awareness-BOF/tree/master/SA/regquery 获取合适的 reqquery BOF。 2. 执行 execute-bof --opsec...

slui-file-handler-hijack-privilege-escalation

Slui File Handler Hijack LPE Información del Exploit| ---|--- Fecha| 15.01.2018 Parcheado| Windows 10 20H1 19041 exploit-db| 44830 Probado en| Windows 8-10, independiente de x86/x64 Descripción slui.exe es un binario auto-elevado que es vulnerable al secuestro de manejadores de archivo. Se realiz...

Windows Persistence Via UserInitMprLogonScript

This Metasploit module establishes persistence by setting the UserInitMprLogonScript value in HKCU\Environment. During user logon, userinit.exe checks this value and executes the specified command or binary. The module writes a payload executable to disk and points UserInitMprLogonScript to that...

PT-2020-9866

Name of the Vulnerable Software and Affected Versions Ivanti WorkSpace Control versions prior to 10.4.40.0 Description A user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives HKCU when starting...

CVE-2019-17066: Improper Privilege Management

In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives HKCU when starting an application with elevated rights...

Enigma Fileless UAC Bypass

a This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ Exploit Title : enigmafilelessuacbypass.rb Module...

Latest Windows UAC Bypass Permits Code Execution

Less than a month after disclosing a Windows User Account Control bypass, researcher Matt Nelson today published another attack that circumvents the security feature and leaves no traces on the hard disk. This time, the bypass relies on Event Viewer eventvwr.exe, a native Windows feature used to...

Microsoft Internet Explorer Enhanced Protected Mode Read-Restrictions Bypass Vulnerability

This vulnerability allows local attackers to partially escape AppContainer limitations on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Windows Gather VNC Password Extraction

This module extract DES encrypted passwords in known VNC locations This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather VNC Password Extraction', 'Description' = %q This module extrac...

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the...

Use of system agreement when the backdoor-vulnerability warning-the black bar safety net

This morning inadvertently open the xFocus of a cow's BLOG...The New Year's firsthaha. Found a very interesting thing. Is the use of the system in the registered agreement to execute the command. 具体 连接 :http://coolice.blogdriver.com/coolice/414334.html Then I on their own machine experiment:it...