Outlook Bug Allowed Hackers to Use .RTF Files To Steal Windows Passwords

A vulnerability in Microsoft Outlook allowed hackers to steal a user’s Windows password just by having the target preview an email with a Rich Text Format RTF attachment that contained a remotely hosted OLE object. The bug was patched by Microsoft as part of its April Patch Tuesday fixes, over a...

Disable Risky Windows Features: Hardentools

Hardentools is a collection of simple utilities designed to disable a number of “features” exposed by operating systems Microsoft Windows, for now, and primary consumer applications. These features, commonly thought for Enterprise customers, are generally useless to regular users and rather pose ...

Exploit for Out-of-bounds Write in Microsoft

PoC exploit for CVE-2018-0802, an arbitrary code execution vulne...

ROKRAT Reloaded

This post was authored by Warren Mercer, Paul Rascagneres and with contributions from Jungsoo An.Executive SummaryEarlier this year, Talos published 2 articles concerning South Korean threats. The first one was about the use of a malicious HWP document which dropped downloaders used to retrieve...

Oolong CVE-2017-8570 samples and behind the idea-vulnerability warning-the black bar safety net

The so-called CVE-2017-8570 sample Last week, 360 days eye lab found foreign hackers on Github released a CVE-2017-8570 exploits code, but then deleted, in order to find quite a few labeled as CVE-2017-8570 Office malware samples, such as the following VirusTotal is marked as CVE-2017-8570 sample...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

Spread banking Trojan the Office 0day Vulnerability(CVE-2017-0199)technical analysis-vulnerability warning-the black bar safety net

Vulnerability overview Microsoft in 4 months of routine patch of 4 on 12, the A Office remote command execution vulnerability, CVE-2017-0199 for the repair, but in fact in the patch before the release there has been more use of this vulnerability in the wild is found, which contains the...

Office OLE DLL Hijacking

require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...

CVE-2 0 1 4-6 3 5 2 vulnerability and targeted attacks sample analysis-vulnerability warning-the black bar safety net

Primer People do,day in look. Recent 3 6 0 days eye the lab captured an example for India the orientation of the attack of the sample,the sample advantage of the sandworm vulnerability patch bypass Vulnerability CVE-2 0 1 4-6 3 5 2,was analyzed after confirmation, we think this is Trend Micro in...

Microsoft Windows OLE Remote Code Execution (MS16-044: CVE-2016-0153)

A vulnerability was identified in Microsoft Word while processing an embedded object within a word document that could lead to a stack memory corruption. The Stack Corruption occures in ole32!OleRegEnumVerbs Functionis with an out of bound write...

Remotely through a browser using Microsoft Office DLL MS15-1 3 2）hijacking vulnerability-vulnerability warning-the black bar safety net

A few weeks ago, security researcher Parvez Anwar, working in their individual tweets posted on a lot of Microsoft Office DLL hijacking vulnerability1. Fig. A few weeks later, Microsoft released MS15-1 3 2 patch, fixed a related vulnerability, while addressing the is Google security research2in a...

Word type confusion vulnerability principle analysis of CVE-2 0 1 5-1 6 4 1-a vulnerability warning-the black bar safety net

The aforementioned word in parsing the docx document processing displacedByCustomXML attribute not customXML object for authentication, can be passed to other tags of the object to be processed, causing the type of Confusion, leading to arbitrary memory write, and ultimately through a carefully...

Microsoft Office - COM Object DLL Planting with WMALFXGFXDSP.dll (MS16-007)

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The attached POC docume...

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting (MS16-007)

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting MS16-007 Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The...

Microsoft Windows - devenum.dll!DeviceMoniker::Load() Heap Corruption Buffer Underflow (MS16-007)

Microsoft Windows - devenum.dll!DeviceMoniker::Load Heap Corruption Buffer Underflow MS16-007 Source: https://code.google.com/p/google-security-research/issues/detail?id=594 Heap corruption buffer underflow in devenum.dll!DeviceMoniker::Load There exists a buffer underflow vulnerability in...

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll (MS15-132)

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll MS15-132 Source: https://code.google.com/p/google-security-research/issues/detail?id=556 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially...

Microsoft Outlook Embedded OLE Object (MS15-131: CVE-2015-6172)

A sandbox bypass vulnerability, known as BadWinMail, exists in Microsoft Outlook. The vulnerability is due to the support provided by Outlook for two file formats that are being parsed automatically by Outlook which does not run under a sandbox and has medium integrity level. A remote attacker ca...

Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)

require 'zip' require 'base64' require 'msf/core' require 'rex/ole' class MetasploitModule 'Office OLE Multiple DLL Side Loading Vulnerabilities', 'Description' = %q Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various...