88 matches found
Alchimist: A new attack framework in Chinese for Mac, Linux and Windows
By Chetan Raghuprasad, Asheer Malhotra and Vitor Ventura, with contributions from Matt Thaxton. Cisco Talos discovered a new attack framework including a command and control C2 tool called "Alchimist" and a new malware "Insekt" with remote administration capabilities. The Alchimist has a web...
Asian Governments and Organizations Targeted in Latest Cyber Espionage Attacks
Government and state-owned organizations in a number of Asian countries have been targeted by a distinct group of espionage hackers as part of an intelligence gathering mission that has been underway since early 2021. "A notable feature of these attacks is that the attackers leveraged a wide rang...
Metasploit Weekly Wrap-Up
Mucking out the pipes. Thanks to some quick work by timwr, CVE-2022-0847 aka "Dirty Pipe" gives Metasploit a bit of digital plumber's training. The exploit targeting modern Linux v5 kernels helps elevate user privileges by overwriting a SUID binary of your choice by plunging some payload gold...
BlackCat Ransomware group attacks on the rise
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Blackcat Ransomware gang also known as ALPHV has targeted around 25 organizations belonging to multiple sectors globally since November 2021. The group has claimed responsibility for the recent cyber attack on Swissport...
Trellix Global Defenders: BlackCat Ransomware as a Service - The Cat is certainly out of the bag!
Trellix Global Defenders: BlackCat Ransomware as a Service - The Cat is certainly out of the bag! By Trellix · February 8, 2022 Research Contributions and Analysis: Filippo Sitzia This story was written by Arnab Roy Threat Summary Blackcat also known as ALPHV/Noberus is a Ransomware as a Service...
Trellix Global Defenders: BlackCat Ransomware as a Service - The Cat is certainly out of the bag!
Trellix Global Defenders: BlackCat Ransomware as a Service - The Cat is certainly out of the bag! By Trellix · February 8, 2022 Research Contributions and Analysis: Filippo Sitzia This story was written by Arnab Roy Threat Summary Blackcat also known as ALPHV/Noberus is a Ransomware as a Service...
CheeseTools - Self-developed Tools For Lateral Movement/Code Execution
This repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them. CheeseExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context of a...
Nefilim Ransomware
Over the past year there has been a rise in extortion malware that focuses on stealing sensitive data and threatening to publish the data unless a ransom is paid. This technique bypasses some of the mitigations put in place, such as backups, which would allow IT organizations to recover data...
Gargamel - A Forensic Evidence Acquirer
A Forensic Evidence Acquirer Compile Assuming you have Rust 1.41+ installed. Open terminal in the project directory and to compile a release build type cargo build --release Debug build can be compiled using cargo build Compiled executable is located at target/release/gargamel.exe or...
CVE-2021-1733
Sysinternals PsExec Elevation of Privilege Vulnerability...
CVE-2021-1733
Sysinternals PsExec Elevation of Privilege Vulnerability...
Privilege escalation
Sysinternals PsExec Elevation of Privilege Vulnerability...
CVE-2021-1733 Sysinternals PsExec Elevation of Privilege Vulnerability
...
CVE-2021-1733
CVE-2021-1733 corresponds to Sysinternals PsExec Elevation of Privilege. Connected data confirm a local privilege escalation: PsExec contains a security restrictions bypass that allows a local user (non-admin) to escalate to SYSTEM by abusing PsExec. CVSS data from NVD/Microsoft indicate LOCAL at...
CVE-2021-1733 Sysinternals PsExec Elevation of Privilege Vulnerability
...
The vulnerability of the PsExec remote execution tool, related to privilege management errors, allows a hacker to escalate their privileges.
The vulnerability of the remote execution command PsExec is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges...
Sysinternals PsExec Elevation of Privilege (CVE-2021-1733)
An elevation of privilege vulnerability exists in Sysinternals PsExec due to the application not properly imposing security restrictions in PsExec, which leads to a security restrictions bypass and privilege escalation. It is possible for a local attacker who is authenticated as a non-admin user ...
Sysinternals PsExec Elevation of Privilege Vulnerability
...
Microsoft Sysinternals PsExec Security Feature Issue Vulnerability
Microsoft SysInternals is a Microsoft company created in 1996 by Mark Russinovich to host his advanced system utilities and technical information. Whether you are an IT professional or a developer, you will find that Sysinternals utilities can help you manage, troubleshoot, and diagnose your...
KLA12073 Multiple vulnerabilities in Microsoft Developer Tools
Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in .NET Core can be...