Boot Verification Program Persistence

This module establishes persistence by configuring the BootVerificationProgram registry key. It uploads a payload executable and modifies the 'ImagePath' value under HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram. The payload is executed by the Service Control Manager early in the...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Snatch Ransomware

During the end of the year 2019, a ransomware named ‘Snatch” was discovered. Snatch ransomware will force Windows to reboot in Safe Mode where most of the software and system drivers will not be running in order to perform the file encryption process. Similar to the other variants of ransomware, ...

Threat Analysis Unit (TAU) Threat Intelligence Notification: SatanCryptor Ransomware

In early January 2020, a new ransomware named ‘SatanCryptor’ was discovered. After it performs file encryption, it will drop a ransom note named “ SATAN CRYPTOR .hta” and append ‘.satan’ as a file extension to the encrypted files. In addition, SatanCryptor will delete itself after the execution t...

Persistence – WMI Event Subscription

Windows Management Instrumentation WMI enables system administrators to perform tasks locally and remotely. From the perspective of red teaming WMI can be used to perform… Continue reading - Persistence - WMI Event Subscription...

Remote code execution

A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 v160 and 2019 v15 consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system...

User Profile Management and Microsoft Store Apps (UWP Apps)

When a user installs an app from the Microsoft Store UWP app onto a Windows 10 VDA with Citrix Profile Management, after a logoff and logon, the application does not persist and must be reinstalled...

CVE-2019-20357: Unquoted Search Path or Element

A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 v160 and 2019 v15 consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system...

PT-2020-10394

Name of the Vulnerable Software and Affected Versions Trend Micro Security versions 15 through 160 Description A Persistent Arbitrary Code Execution issue exists in the Trend Micro Security consumer family of products, potentially allowing an attacker to create a malicious program to escalate...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the MyAccountPortlet fields such as First Name, Middle Name, and Last Name. A user can inject malicious scripts that persist within the database and are executed when other users view these modified fields...

Persistence – Winlogon Helper DLL

Winlogon is a Windows component which handles various activities such as the Logon, Logoff, loading user profile during authentication, shutdown, lock screen etc. This kind of behavior is managed by the registry which defines which processes to start during Windows logon. From a red team...

Persistence – Image File Execution Options Injection

Image File Execution Options is a Windows registry key which enables developers to attach a debugger to an application and to enable "GlobalFlag" for application debugging. This behavior of Windows opens the door for persistence since an arbitrary executable can be used as a debugger of a specifi...

CVE-2019-5063

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file...

Published app sessions not ending due to WEM UI agent appearing in the system tray

In configuration sets where the WEM UI agent is configured to launch for both server desktop and app sessions, published app sessions remain connected after closing the published app. Checking the Connection Center in Citrix Receiver, the WEM agent icon is listed as the only connection back to th...

Persistence – AppInit DLLs

Windows operating systems provide the functionality to allow custom DLL's to be loaded into the address space of almost all application processes. This can give the opportunity for persistence since an arbitrary DLL can be loaded that will execute code when applications processes are created on t...

OpenCV Buffer Overflow Vulnerability (CNVD-2020-01148)

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'persistence' mode in OpenCV version 4.1.0. The vulnerability stems from a networked system or product performing operations in memory without properly validating data...

OpenCV Buffer Overflow Vulnerability (CNVD-2020-01149)

OpenCV is an open source, cross-platform, lightweight computer vision library. A buffer overflow vulnerability exists in the 'persistence' mode in OpenCV version 4.1.0. The vulnerability stems from a networked system or product performing operations in memory without properly validating data...

Design/Logic Flaw

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now...

CVE-2019-5063

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file...

DEBIAN-CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a...

CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a...