Researchers Shed Light on CatB Ransomware's Evasion Techniques

The threat actors behind the CatB ransomware operation have been observed using a technique called DLL search order hijacking to evade detection and launch the payload. CatB, also referred to as CatB99 and Baxtoy, emerged late last year and is said to be an "evolution or direct rebrand" of anothe...

New Pingback Malware Using ICMP Tunneling to Evade C&C Detection

Researchers on Tuesday disclosed a novel malware that uses a variety of tricks to stay under the radar and evade detection, while stealthily capable of executing arbitrary commands on infected systems. Called 'Pingback,' the Windows malware leverages Internet Control Message Protocol ICMP tunneli...

Microsoft Windows 2000/2003/XP MSDTC TIP Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15058/info The Microsoft Windows MSDTC Microsoft Distribution Transaction Coordinator service is prone to a denial of service vulnerability. The vulnerability exists in the TIP Transaction Internet Protocol functionality...

Microsoft Windows MSDTC Denial of Service (CVE-2006-1184)

The Microsoft Distributed Transaction Coordinator MSDTC is a transaction infrastructure for distributed systems. It is implemented on the Windows platform as a service. The MSDTC facilitates the interactions between independent programs in a distributed system. A denial of service vulnerability...

Microsoft Distributed Transaction Controller Denial of Service (MS05-051; CVE-2005-1979)

The Microsoft Distributed Transaction Coordinator MSDTC is a transaction infrastructure for distributed systems. It is implemented on the Windows platform as a service. The MSDTC facilitates the interactions between independent programs in a distributed system. A denial of service vulnerability...

Microsoft Windows RPCSS服务隔离本地权限提升漏洞（MS09-012）

BUGTRAQ ID: 34443 CVECAN ID: CVE-2009-0079 Microsoft Windows是微软发布的非常流行的操作系统。 RPCSS服务没有正确地隔离NetworkService或LocalService帐号下运行的进程，本地攻击者可以利用令牌劫持的方式获得权限提升。成功利用此漏洞的攻击者可以完全控制受影响的系统，攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows XP x64 SP2 Microsoft Windows XP x64 Microsoft Windows XP SP3...

Microsoft Windows线程池ACL本地权限提升漏洞（MS09-012）

BUGTRAQ ID: 34444 CVECAN ID: CVE-2009-0080 Microsoft Windows是微软发布的非常流行的操作系统。 Windows对当前ThreadPool中的线程设置了错误的ACL，本地攻击者可以利用令牌劫持的方式获得权限提升。成功利用此漏洞的攻击者可以完全控制受影响的系统，攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows Vista SP1 Microsoft Windows Vista Microsoft Windows Server 2008 临时解决方法： IIS 6.0 -...

Microsoft Windows WMI服务隔离本地权限提升漏洞（MS09-012）

BUGTRAQ ID: 34442 CVECAN ID: CVE-2009-0078 Microsoft Windows是微软发布的非常流行的操作系统。 Windows管理规范（WMI）提供程序没有正确地隔离NetworkService或LocalService帐号下运行的进程，同一帐号下运行的两个独立进程可以完全访问对方的文件句柄、注册表项等资源。WMI提供程序主机进程在某些情况下会持有SYSTEM令牌，如果攻击者可以以...

Microsoft Windows privilege escalation

Privilege escalation with MSDTC, WMI, RPCSS, Windows Thread Pool services...

Microsoft Security Bulletin MS09-012 - Important Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)

Microsoft Security Bulletin MS09-012 - Important Vulnerabilities in Windows Could Allow Elevation of Privilege 959454 Published: April 14, 2009 Version: 1.0 General Information Executive Summary This security update resolves four publicly disclosed vulnerabilities in Microsoft Windows. The...

MS Windows Token Kidnapping local provide the right solutions-vulnerability warning-the black bar safety net

Although it is a time ago of the vulnerability, but had been only concerned with the exploits, and not focus on specific solutions, today inadvertently and the user-chat when mentioned, the user let help to find a solution, the online search under, In The Lancet where to find the relevant...

Mircosoft Windows Token Kidnapping本地提权漏洞

CNCAN ID：CNCAN-2008101007 Microsoft Windows是一款流行的操作系统。 漏洞是由于在NetworkService或LocalService上下文运行的代码，可以访问同样是在 NetworkService或LocalService上下文下运行的进程，部分进程允许提升特权到LocalSystem。 对于IIS，默认安装是不受影响的，以Full Trust运行的ASP.NET代码受此漏洞影响，如果权限低于Full Trust，也不受此漏洞影响。同样旧Asp代码不受此漏洞影响，只有ASP.NET才受影响。 针对SQL...

MS Windows Token Kidnapping local provide the right solutions-vulnerability warning-the black bar safety net

Today MS updated security Bulletin This vulnerability is due inNetworkService or LocalService the following code running, you can access the same in the NetworkService or LocalService processes that run under that certain processes allow elevation of privileges for theLocalSystem it. For IIS, the...

Microsoft Windows MSDTC无效内存访问拒绝服务漏洞（MS06-018）

Microsoft Windows是微软发布的非常流行的操作系统。 Windows系统的MSDTC处理某些畸形DCE-RPC请求时存在内存分配漏洞，远程攻击者可能利用此漏洞对服务器执行拒绝服务攻击。 MS05-051中所述的MSDTC RPC漏洞利用的是MSDTCPRX.DLL中MIDLuserallocate函数实现内存管理器的方式。该函数接收任何分配大小，但最多只能分配4KB的内存。然后RPCRT4会试图将管理数据储存到memory address + requested size，这就可能导致修改任意内存，因为任意大小的分配尝试都会成功，但所保留的内存最多只有4KB。...

Microsoft Windows MSDTC堆溢出漏洞（MS06-018）

Microsoft Windows是微软发布的非常流行的操作系统。 Windows系统的MSDTC进程处理畸形的DCE-RPC请求时存在漏洞，远程攻击者可能利用此漏洞对服务器执行拒绝服务攻击。 在MSDTC.EXE进程中MSDTCPRX.DLL起到了RPC Server的作用，使用动态TCP端口做为其RPC端点，906B0CE0-C70B-1067-B317-00DD010662DA...

[Full-disclosure] Microsoft MSDTC NdrAllocate Validation Vulnerability

McAfee, Inc. McAfee Averttm Labs Security Advisory Public Release Date: 2006-05-09 Microsoft MSDTC NdrAllocate Validation Vulnerability CVE-2006-0034 Synopsis There is an RPC procedure within the MSDTC interface in msdtcprx.dll that may be called remotely without user credentials in such a way th...

Code injection

Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service crash via a BuildContextW request with a large 1 UuidString or 2 GuidIn of a certain length, which causes an out-of-range memory...

CVE-2006-1184

Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service crash via a BuildContextW request with a large 1 UuidString or 2 GuidIn of a certain length, which causes an out-of-range memory...

CVE-2006-0034

Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or...

Heap overflow

Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator MSDTC for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or...