UnCanny

UNCanny Coerce 이 연구의 아이디어는 간단했습니다. 제 자신만의 강제 인증coercion 기법을 찾고 싶었기 때문입니다. 처음에는 새로운 RPC 공격 표면을 찾는 것부터 시작했지만, 마이크로소프트가 RPC 활동 모니터링을 추가한 후https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/microsoft-defender-now-monitors-rpc-activity/4523368, 다른 길을 택하기로 했습니다. UNCanny는 그 토끼굴의 결과물입니다. 제...

BumbleCrypt

BumbleCrypt Bumblebee에서 영감을 받은 Crypter 배경 BumbleCrypt는 Bumblebee의 crypter에서 영감을 받았습니다. Bumblebee의 경우, 메인 Bumblebee DLL이 메모리에 로드되어 다음과 같은 방식으로 실행됩니다: Heap에 페이로드를 복호화하여 기록합니다 NtOpenFile, NtCreateSection, NtMapViewOfSection 세 가지 NtApi를 후킹합니다 LoadLibraryW"gdiplus.dll"를 호출합니다. LoadLibrary가 라이브러리를 로드할 ...

Microsoft Office - COM Object DLL Planting with WMALFXGFXDSP.dll (MS16-007)

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The attached POC docume...

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting (MS16-007)

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting MS16-007 Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The...

Microsoft Vista - NtRaiseHardError Local Privilege Escalation

Microsoft Vista - NtRaiseHardError Local Privilege Escalation //raise.c //26-12-2006 erasmus/ORC //exploit NtRaiseHardError privesc and load dll into csrss //this version only is vista, other version can be worked //with proper offsets, i will complete them soon //imperfect but sometime work, ok...

Microsoft Vista (NtRaiseHardError) Privilege Escalation Exploit

Exploit for unknown platform in category local exploits =============================================================== Microsoft Vista NtRaiseHardError Privilege Escalation Exploit =============================================================== //raise.c //26-12-2006 erasmus/ORC //exploit...