3232 matches found
Authorization Bypass
powershell is vulnerable to authorization bypass. An attacker is able to bypass Device Guard due to a flaw in the security feature...
Authorization Bypass
powershell is vulnerable to authorization bypass. An attacker is able to bypass Device Guard due to a flaw in the security feature...
Youzer - Fake User Generator For Active Directory Environments
Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. pip3 install faker You can either supply a wordlist or have the passwords generated...
Slackor - A Golang Implant That Uses Slack As A Command And Control Server
A Golang implant that uses Slack as a command and control channel. This project was inspired by Gcat and Twittor. This tool is released as a proof of concept. Be sure to read and understand the Slack App Developer Policy before creating any Slack apps. Setup Note: The server is written in Python ...
Microsoft Windows: Turn on Module Logging (Module Names)
This policy setting allows you to turn on logging for Windows PowerShell modules. If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent t...
Microsoft Windows: Turn on Module Logging
This policy setting allows you to turn on logging for Windows PowerShell modules. If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent t...
Microsoft Windows: Turn on PowerShell Script Block Logging
This policy setting enables logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. If you enable this policy setting, Windows PowerShell will log the processing of commands, script blocks, functions, and scripts - whether invoked interactively, or throug...
Windows Escalate UAC Protection Bypass Via SilentCleanup Exploit
There's a task in Windows Task Scheduler called "SilentCleanup" which, while it's executed as Users, automatically runs with elevated privileges. When it runs, it executes the file %windir%\system32\cleanmgr.exe. Since it runs as Users, and we can control user's environment variables, %windir%...
Windows Escalate UAC Protection Bypass Via SilentCleanup
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Escalate UAC Protection Bypass Via SilentCleanup', 'Description' = %q There's a task in Windows Task Scheduler called "SilentCleanup"...
GreenFlash Sundown exploit kit expands via large malvertising campaign
Exploit kit activity has been relatively quiet for some time, with the occasional malvertising campaign reminding us that drive-by downloads are still a threat. However, during the past few days we noticed a spike in our telemetry for what appeared to be a new exploit kit. Upon closer inspection ...
CVE-2019-10719
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714. Recent assessments: Leafr...
DNSlivery - Easy Files And Payloads Delivery Over DNS
Easy files and payloads delivery over DNS. Acknowledgments This project has been originally inspired by PowerDNS and Joff Thyer's technical segment on the Paul's Security Weekly podcast 590 youtu.be/CP6cIwFJswQ. Description TL;DR DNSlivery allows delivering files to a target using DNS as the...
Microsoft Windows - UAC Protection Bypass (Via Slui File Handler Hijack) (PowerShell)
Microsoft Windows - UAC Protection Bypass Via Slui File Handler Hijack PowerShell Interactive Version: function SluiHijackBypass Param ParameterMandatory=$True String$command, ValidateSet64,86 int$arch = 64 Create registry structure New-Item "HKCU:\Software\Classes\exefile\shell\open\command"...
Microsoft Windows - UAC Protection Bypass (Via Slui File Handler Hijack) (PowerShell)
Interactive Version: function SluiHijackBypass Param ParameterMandatory=$True String$command, ValidateSet64,86 int$arch = 64 Create registry structure New-Item "HKCU:\Software\Classes\exefile\shell\open\command" -Force Set-ItemProperty -Path "HKCU:\Software\Classes\exefile\shell\open\command" -Na...
Microsoft Windows - UAC Protection Bypass (Via Slui File Handler Hijack) (PowerShell) Exploit
Exploit for windows platform in category local exploits Interactive Version: function SluiHijackBypass Param ParameterMandatory=$True String$command, ValidateSet64,86 int$arch = 64 Create registry structure New-Item "HKCU:\Software\Classes\exefile\shell\open\command" -Force Set-ItemProperty -Path...
Terminus - A Terminal For A More Modern Age
Terminus is a highly configurable terminal emulator for Windows, macOS and Linux Theming and color schemes Fully configurable shortcuts Split panes Remembers your tabs PowerShell and PS Core, WSL, Git-Bash, Cygwin, Cmder and CMD support Integrated SSH client and connection manager Full Unicode...
The vulnerability of PowerShell command interpreters in Windows operating systems allows attackers to compromise the integrity, confidentiality, and accessibility of protected information.
The vulnerability of PowerShell command interpreters in Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow an attacker to compromise the integrity, confidentiality, and accessibility of protected information...
Vulnerabilities of .NET Core, Microsoft.NET Framework, and PowerShell Core automation frameworks, related to errors in request processing, allowing attackers to trigger service failures.
Vulnerabilities of .NET Core, Microsoft.NET Framework, and PowerShell Core automation frameworks are related to request processing errors. Exploiting these vulnerabilities allows attackers to remotely cause service failures by sending specially crafted requests...
Vulnerabilities of .NET Core, Microsoft.NET Framework, and PowerShell Core automation frameworks, related to errors in request processing, allowing attackers to trigger service failures.
Vulnerabilities of .NET Core, Microsoft.NET Framework, and PowerShell Core automation frameworks are related to request processing errors. Exploiting these vulnerabilities allows attackers to remotely cause service failures by sending specially crafted requests...
