CVE-2024-0197-POC

CVE-2024-0197-POC Thales Sentinel HASP LDK의 로컬 권한 상승에 대한 개념 증명. 처음에는 하나를 개발하려고 했지만, 결국 불필요한 것으로 판명되었습니다. 극복해야 할 경쟁 조건race condition은 없으며, 알려진 위치에서 간단한 DLL 검색 순서 하이재킹만으로 SYSTEM 권한을 획득할 수 있습니다. 간단히: 1. raw.cpp를 fltlib.dll로 컴파일하여 AppData\Local\Temp에 넣습니다 C:\Windows\System32\fltlib.dll로 이어지는 적절한 프록시...

DCOMUploadExec

DCOM 업로드 및 실행 IMsiServer 인터페이스를 악용하는 DCOM 측면 이동 POC https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor 이 솔루션에는 2개의 프로젝트가 포함되어 있습니다. DCOMUploadExec - 측면 이동 공격 코드를 호스팅하는 C++ 프로젝트 AssemblyPayload - MessageBox를 표시하는 .NET DLL입니다. DCOMUploadExec 가 사용하는 기본 페이로드입니다. 기본 사용법 솔루션을...

MAL-002

MAL-002: 설치된 Windows MSI를 통한 시스템 강제 재시작 시스템에 소프트웨어가 성공적으로 설치되면 하나 이상의 신뢰할 수 있는 MSI 파일이 “C:\Windows\Installer” 폴더에 나타나며, 낮은 권한의 사용자가 UAC를 요구하지 않고 “NT Authority\System” 사용자로 “복구” 및/또는 “수정” 작업을 수행할 수 있게 됩니다. 공격자가 “msiexec.exe” 프로그램을 “/forcerestart” 플래그와 함께 사용하여 “복구” 작업을 성공적으로 수행하면 대상 시스템이 재시작됩니다. 참고...

EUVD-2018-4963

Malware in sbrugna...

Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling

Cybersecurity researchers have called attention to a cyber attack in which unknown threat actors deployed an open-source endpoint monitoring and digital forensic tool called Velociraptor, illustrating ongoing abuse of legitimate software for malicious purposes. "In this incident, the threat actor...

Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling

Cybersecurity researchers have called attention to a cyber attack in which unknown threat actors deployed an open-source endpoint monitoring and digital forensic tool called Velociraptor, illustrating ongoing abuse of legitimate software for malicious purposes. "In this incident, the threat actor...

BIT-NODE-MIN-2023-30585

A vulnerability has been identified in the Node.js .msi version installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM...

Unattended Installation of XenServer Tools

This article describes about the unattended installation of XenServer Tools using Microsoft’s Windows Installer program, msiexec. Background XenTools delivered with XenServer 6.1 version are able to make use of Microsoft’s Windows Installer program, msiexec. One of those is a way to install...

Thesycon Software Solutions TUSBAudio 安全漏洞

Thesycon Software Solutions TUSBAudio is a device driver from Thesycon Software Solutions. A security vulnerability exists in Thesycon Software Solutions TUSBAudio versions prior to 5.68.0. A local attacker can exploit this vulnerability to execute arbitrary code via msiexec.exe repair mode...

Microsoft Windows 10 (17763.379) - Install DLL Exploit

Exploit for windows platform in category local exploits edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able to repro anyway. Could be used with malware, you could programmatically trigger the rollback. Maybe you can even pass the...

Update Rollup 7 for System Center 2012 Virtual Machine Manager SP1

Update Rollup 7 for System Center 2012 Virtual Machine Manager SP1 Introduction This article describes the issues that are fixed in Update Rollup 7 for Microsoft System Center 2012 Virtual Machine Manager Service Pack 1 SP1. Additionally, this article contains the installation instructions for...

SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure and SoftControl/SafenSoft Enterprise Suite Security Bypass Vulnerability

SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite are Russian SAFE'N'SEC's proactive defense-capable malware applications. A security vulnerability exists in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft...

MS Windows COM Structured Storage Local Exploit (MS05-012)

No description provided by source. // by Cesar Cerrudo - Argeniss - www.argeniss.com // MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit // // More exploits at www.argeniss.com/products.html // // Works on Win2k sp4, WinXP sp2, Win2k3 sp0 // Close all runing programs to avo...