htattack

htattack.py RTF 문서에서 RCE를 위한 익스플로잇 구현 CVE-2017-0199. 비디오 스페인어: https://www.youtube.com/watch?v=0lDvclMrymM 사용법: python htattack.py -u...

SignHere

SignHere 소개 CVE-2017-11882 - Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1 및 Microsoft Office 2016의 고유 취약점 식별자로, 메모리 내 객체를 적절히 처리하지 못하여 현재 사용자 컨텍스트에서 코드를 실행할 수 있도록 하는 "Microsoft Office 메모리 손상 취약점"입니다. 이 구현은 악성 rtf 문서와 VBScript...

OHTS

OHTS CVE-2017-8759 | .NET Framework 원격 코드 실행 취약점 1. 소개 Microsoft .NET Framework가 신뢰할 수 없는 입력을 처리할 때 원격 코드 실행 취약점이 존재합니다. 이 취약점을 .NET Framework를 사용하는 소프트웨어에서 성공적으로 악용한 공격자는 영향을 받는 시스템을 제어할 수 있습니다. 공격자는 이후 프로그램을 설치하거나, 데이터를 보거나 변경 또는 삭제하거나, 전체 사용자 권한을 가진 새 계정을 만들 수 있습니다. 시스템에서 더 적은 사용자 권한을 갖도록 구성된...

rtf_exploit_extractor

rtfexploitextractor CVE-2015-1641 악성 익스플로잇 문서에서 악성 페이로드와 위장 문서를 추출하는 스크립트 usage: rtfexploitextract.py -h -o OUTFILE -d DECOY -l LENGTH -v inputfile inputfile 검사할 익스플로잇 문서 선택적 인수: -h, --help 이 도움말 메시지를 표시하고 종료 -o OUTFILE, --outfile OUTFILE 추출된 페이로드의 출력 파일 이름 -d DECOY, --decoy DECOY 추출된 위장 문서의 출력 파...

EUVD-2010-3449

Malware in sbrugna...

EUVD-2010-3450

Malware in sbrugna...

CVE-2013-0710

Buffer overflow in Kingsoft Writer 2007 and 2010 before 2724 allows remote attackers to execute arbitrary code via a crafted RTF document...

Cycldek: Bridging the (air) gap

Key findings While investigating attacks related to a group named Cycldek post 2018, we were able to uncover various pieces of information on its activities that were not known thus far. In this blog post we aim to bridge the knowledge gap on this group and provide a more thorough insight into it...

The use of a posture clear odd 11882 format overflow document analysis-vulnerability warning-the black bar safety net

Prior to inadvertently give a very interesting rtf document, the sandbox where the behavior of a pile, the document itself and confuse the very clear odd, so spend a little time to analyze this sample. Substantially clear the sample of the attack techniques and attack the chain, the open part of...

Sea Lotus APT groups use CVE-2017-8570 vulnerability of the new sample and Association analysis-vulnerability warning-the black bar safety net

Sea Lotus（OceanLotus）APT gang is a highly organized, professional foreign national hacker group, the oldest by 360 days eye Labs discovered and disclosed. The organization since at least 2012 and 4 January will be for the Chinese government, research institutes, Maritime institutions, Maritime...

Analyzing an exploit for СVE-2017-11826

The latest Patch Tuesday 17 October brought patches for 62 vulnerabilities, including one that fixed СVE-2017-11826 – a critical zero-day vulnerability used to launch targeted attacks – in all versions of Microsoft Office. The exploit for this vulnerability is an RTF document containing a DOCX...

The Document Foundation LibreOffice RTF Stylesheet Code Execution Vulnerability(CVE-2016-4324)

SUMMARY An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable application...

Microsoft .NET framework SOAP Moniker PrintClientProxy remote code execution vulnerability

Overview The Microsoft .NET framework fails to properly parse WSDL content, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The PrintClientProxy method in the WSDL-parsing component of the Microsoft .NET framework fails to properly...

FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY

FireEye recently detected a malicious Microsoft Office RTF document that leveraged CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft...

Microsoft Office OLE2Link vulnerability (CVE-2017-0199)

Vulnerability details references: Office OLE2Link zero-day from NCCGroup） CVE-2017-0199: In the Wild Attacks Leveraging the HTA Handler From FireEye） HTAsThe Microsoft OLE2Link object contains a vulnerability in the way that it processes remotely-linked content. The remote content is opened based...

Hand to hand teach you how to construct the office exploits EXP（fourth period）-bug warning-the black bar safety net

This is a period of vulnerability to share with you is CVE-2015-1641 learning summary, this vulnerability due to its good versatility and stability claims to have replaced the CVE-2012-0158 trend. The vulnerability is a type confusion class of vulnerability, through which you can achieve arbitrar...

Memory corruption

Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps...

CVE-2016-7193

Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps...

CVE-2016-7193: Improper Restriction of Operations within the Bounds of a Memory Buffer

Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps...

Microsoft Office Information Disclosure (MS16-070: CVE-2016-3234)

An out of bound memory access vulnerability was discovered within Microsoft office word. The root cause comes from wwlib.dll sub components that could lead to an out of bound memory read when processing a malformed rtf document...