IIS-Backdoor

IIS-Backdoor 이 글에서는 Microsoft IISInternet Information Services용 루트킷을 어떻게 설계했는지 설명하겠습니다. 질문은: 왜 웹 서버에 백도어를 심는가? 첫 번째로 떠오르는 명백하지만 쓸모없는 대답: 할 수 있으니까. 좋습니다. 더 영리한 대답을 해보죠. 웹 서버에 백도어를 심는 목적은 두 가지입니다. root@kitploit: 공격자가 클라이언트가 보낸 데이터에 접근할 수 있게 해줍니다. 예를 들어 웹 사이트가 비밀번호로 보호되는 경우, 이 비밀번호를 획득할 수 있습니다. 서버에서...

CVE-1999-0412

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...

EUVD-1999-0842

Malware in sbrugna...

EUVD-2002-1293

Malware in sbrugna...

EUVD-2002-1666

Malware in sbrugna...

EUVD-2000-1132

Malware in sbrugna...

EUVD-2000-0822

Malware in sbrugna...

EUVD-2003-0693

Malware in sbrugna...

EUVD-2006-1398

Malware in sbrugna...

EUVD-2015-4431

Malware in sbrugna...

EUVD-2002-1294

Malware in sbrugna...

EUVD-2003-0327

Malware in sbrugna...

EUVD-2010-5103

Malware in sbrugna...

EUVD-2008-3683

Malware in sbrugna...

CVE-2020-7057

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are...

CVE-2010-5144

The ISAPI Filter plug-in in Websense Enterprise, Websense Web Security, and Websense Web Filter 6.3.3 and earlier, when used in conjunction with a Microsoft ISA or Microsoft Forefront TMG server, allows remote attackers to bypass intended filtering and monitoring activities for web traffic via an...

CVE-2024-46544 Apache Tomcat Connectors: mod_jk: local users can view and modify configuration

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing modjk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49...

Apache mod_isapi Dangling Pointer

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache modisapi Dangling Pointer', 'Description' = %q This module triggers a use-after-free vulnerability in the Apache Software Foundation...

K000139692: Websense vulnerabilities CVE-2006-2035 and CVE-2010-5144

Security Advisory Description CVE-2006-2035 Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL. CVE-2010-5144 The ISAPI Filter plug-in in Websense Enterprise...

DEBIAN-CVE-2023-41081

Important: Authentication Bypass CVE-2023-41081 The modjk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, modjk would use an...