CVE-2024-29988-exploit

CVE-2024-29988-exploit 微软 SmartScreen 恶意执行的漏洞利用程序（2024 年 4 月） 描述 在微软 2024 年 4 月的 Patch Tuesday 更新中发现了一个关键漏洞 CVE-2024-29988。 该漏洞允许威胁行为者绕过微软的 Mark of the Web（MotW）功能，从而执行任意代码。 Trend Micro 零日计划（ZDI）的高级威胁研究员 Peter Girnus 观察到攻击者在野外利用此漏洞。 Microsoft SmartScreen 提示包含一个安全功能绕过漏洞，允许攻击者绕过 Mark of the...

CVE-2025-0411-MoTW-PoC

CVE-2025-0411：7-Zip MoTW 绕过漏洞 简介 CVE-2025-0411 是 7-Zip 中的一个缺陷，可绕过 Windows 的“网络标记”MoTW，使来自特制存档的恶意文件能够在无警告的情况下执行。该漏洞已在 SmokeLoader 攻击活动中被利用，由于 7-Zip 缺乏自动更新机制，因此存在风险。 什么是 MoTW？ MoTW 通过备用数据流 ADS 将互联网下载的文件标记为不安全，从而触发警告或受保护视图。只有在文件处理过程中保留该标记时才有效。 技术细节 7-Zip 未能将 MoTW 的 Zone.Identifier ADS...

7-Zip-CVE-2025-0411-POC

Vulnerabilidad de omisión de Mark-of-the-Web en 7-Zip CVE-2025-0411 - POC Detalles de CVE-2025-0411 "Esta vulnerabilidad PUNTUACIÓN CVSS 7.0 permite a atacantes remotos omitir el mecanismo de protección Mark-of-the-Web en las instalaciones afectadas de 7-Zip. Se requiere interacción del usuario...

PackMyPayload

PackMyPayload - 容器化恶意软件的新兴威胁 跳转到支持的格式 该工具接收文件或目录作为输入，并将其嵌入到充当归档/容器的输出文件中。它可作为概念验证，展示容器文件格式与嵌入恶意软件的新兴风险，同时作为专业红队操作员的助手，以优化其初始访问策略。 目前已知威胁行为者通过多种容器文件格式走私恶意软件，例如： 7zip zip ISO IMG 他们这样做是为了让有效载荷绕过文件内容扫描器，但更重要的是避免在其文件上留下“网络标记”标志 。攻击者不希望在其文件上出现 MOTW 的原因有多种：Microsoft Office 中的受保护视图 一直是其中之一。...

CVE-2025-50327

An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism...

Microsoft Patch Tuesday March 2023: Outlook EoP, MOTW Bypass, Excel DoS, HTTP/3 RCE, ICMP RCE, RPC RCE

Hello everyone! This episode will be about Microsoft Patch Tuesday for March 2023, including vulnerabilities that were added between February and March Patch Tuesdays. Alternative video link for Russia: As usual, I use my open source Vulristics project to analyse and prioritize vulnerabilities. I...

Evasion Techniques Uncovered: An Analysis of APT Methods

By Christiaan Beek, with special thanks to Matt Green DLL search order hijacking is a technique used by attackers to elevate privileges on the compromised system, evade restrictions, and/or establish persistence on the system. The Windows operating system uses a common method to look for required...

Bluenoroff Bypasses MoTW to Target Japanese Organizations

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Bluenoroff is known for targeting financial institutions and government organizations and has been active since at least 2014. From September onwards Bluenoroff threat actors added a new feature, that...

BlueNoroff introduces new methods bypassing MoTW

BlueNoroff group is a financially motivated threat actor eager to profit from its cyberattack capabilities. We have published technical details of how this notorious group steals cryptocurrency before. We continue to track the groups activities and this October we observed the adoption of new...

Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass

Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass Exploit Title: Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass Discovery by: hyp3rlinx Date: 2019-12-03 Vendor Homepage: www.microsoft.com CVE: N/A + Credits: John Page aka hyp3rlinx + Website:...

Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass

Exploit Title: Microsoft Windows Media Center 2002 - XML External Entity MotW Bypass Discovery by: hyp3rlinx Date: 2019-12-03 Vendor Homepage: www.microsoft.com CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...