CVE-2024-0197-POC

CVE-2024-0197-POC Thales Sentinel HASP LDK 中本地权限提升的概念验证。 我最初想自己开发一个，但最终发现没有必要。 没有需要争取的竞争条件，从一个已知位置进行简单的 DLL 搜索顺序劫持即可获得 SYSTEM 权限。 我们只需： 1. 将 raw.cpp 编译为 fltlib.dll 并放入 AppData\Local\Temp（它必须是一个正确的代理 DLL，指向 C:\Windows\System32\fltlib.dll）。 2. 然后运行 msiexec.exe /fa PATHTOMSI。...

DCOMUploadExec

DCOM 上传与执行 滥用 IMsiServer 接口的 DCOM 横向移动 POC https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor 该解决方案包含 2 个项目 DCOMUploadExec - 一个承载横向移动攻击代码的 C++ 项目 AssemblyPayload - 一个弹出 MessageBox 的 .NET DLL。它是 DCOMUploadExec 使用的默认载荷 基本用法 编译该解决方案 Usage: DCOMUploadExec.exe...

MAL-002

MAL-002：通过已安装的 Windows MSI 强制系统重启 一旦软件成功安装到系统上，一个或多个受信任的 MSI 文件将出现在“C:\Windows\Installer”文件夹中，并可能允许低权限用户以“NT Authority\System”用户身份执行“修复”和/或“修改”操作，而无需 UAC。通过使用带“/forcerestart”标志的“msiexec.exe”程序，如果攻击者成功执行“修复”操作，目标系统将被重启。 注意： 即使是修复过程，某些 MSI 也可能需要管理员身份验证，但这通常是例外情况，而非普遍情况（例如 Vmware Tools）。 使用场景：...

EUVD-2018-4963

Malware in sbrugna...

Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling

Cybersecurity researchers have called attention to a cyber attack in which unknown threat actors deployed an open-source endpoint monitoring and digital forensic tool called Velociraptor, illustrating ongoing abuse of legitimate software for malicious purposes. "In this incident, the threat actor...

BIT-NODE-MIN-2023-30585

A vulnerability has been identified in the Node.js .msi version installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM...

Unattended Installation of XenServer Tools

This article describes about the unattended installation of XenServer Tools using Microsoft’s Windows Installer program, msiexec. Background XenTools delivered with XenServer 6.1 version are able to make use of Microsoft’s Windows Installer program, msiexec. One of those is a way to install...

Thesycon Software Solutions TUSBAudio 安全漏洞

Thesycon Software Solutions TUSBAudio is a device driver from Thesycon Software Solutions. A security vulnerability exists in Thesycon Software Solutions TUSBAudio versions prior to 5.68.0. A local attacker can exploit this vulnerability to execute arbitrary code via msiexec.exe repair mode...

Microsoft Windows 10 (17763.379) - Install DLL Exploit

Exploit for windows platform in category local exploits edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able to repro anyway. Could be used with malware, you could programmatically trigger the rollback. Maybe you can even pass the...

Update Rollup 7 for System Center 2012 Virtual Machine Manager SP1

Update Rollup 7 for System Center 2012 Virtual Machine Manager SP1 Introduction This article describes the issues that are fixed in Update Rollup 7 for Microsoft System Center 2012 Virtual Machine Manager Service Pack 1 SP1. Additionally, this article contains the installation instructions for...

SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure and SoftControl/SafenSoft Enterprise Suite Security Bypass Vulnerability

SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite are Russian SAFE'N'SEC's proactive defense-capable malware applications. A security vulnerability exists in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft...

MS Windows COM Structured Storage Local Exploit (MS05-012)

No description provided by source. // by Cesar Cerrudo - Argeniss - www.argeniss.com // MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit // // More exploits at www.argeniss.com/products.html // // Works on Win2k sp4, WinXP sp2, Win2k3 sp0 // Close all runing programs to avo...