CVE-2023-29343

CVE-2023-29343 이것은 Sysmon 버전 14.14의 임의 파일 쓰기 버그에 대한 PoC입니다. 마지막 패치 이후 Sysmon은 Archive 디렉터리가 존재하는지 확인하고, 존재할 경우 해당 디렉터리가 NT AUTHORITY\SYSTEM 소유이고 NT AUTHORITY\SYSTEM에게만 액세스 권한이 부여되었는지 확인합니다. 두 조건이 모두 참이면 Sysmon은 해당 디렉터리에 파일을 쓰거나 삭제합니다. 낮은 권한의 사용자로 파일/디렉터리의 소유권을 변경할 수 없기 때문에, SYSTEM이 소유하지만 낮은 권한의...

RasmanPotato

RasmanPotato 시간이 지남에 따라 지속적으로 소통해 주신 @Wh04m1001 님께 감사드립니다 다른 potato 도구들처럼 RasMan 서비스를 사용하여 권한 상승을 수행하는 또 하나의 potato 도구입니다 Windows 1011은 테스트 안 됨, Windows Server 2012 - 20192022는 테스트 안 됨용입니다 사용법 magicRasMan v0.1 Provided that the current user has the SeImpersonate privilege, this tool will have an...

Exploit for Link Following in Microsoft

CVE-2023-29343 This is PoC for arbitrary file write bug in Sy...

Microsoft Windows RASMAN Service Memory Corruption (MS06-025; CVE-2006-1314)

RASMAN Remote Access Service Manager is a service that handles the details of establishing the connection to the remote server. This service also provides the client with status information during the connection operation. A vulnerability exists in RASMAN service that would allow an attacker who...

High Risk Vulnerability in Microsoft Windows RASMAN Service

Peter Winter-Smith of NGSSoftware has discovered a high risk vulnerability in the Microsoft Windows Remote Access Connection Manager RASMAN service which under certain versions of the OS can allow a remote, anonymous attacker to gain complete control over a vulnerable system. The vulnerability is...

Buffer overflow

Buffer overflow in the Remote Access Connection Manager service RASMAN service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to...

CVE-2006-2371

Buffer overflow in the Remote Access Connection Manager service RASMAN service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to...

CVE-2006-2371

Buffer overflow in the Remote Access Connection Manager service RASMAN service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to...