24 matches found
CVE-2024-49113
LDAP Nightmare An exploit for CVE-2024-49113 reported by Yuki Chen @guhe120. A vulnerability in Windows Lightweight Directory Access Protocol LDAP. Created by SafeBreach Labs published on January 1st 2025. For the full technical analysis of the vulnerability and how we managed to exploit it check...
CVE-2026-24061
CVE-2026-24061 Exploit de RCE en Telnet - Por SafeBreach Labs Este script explota la vulnerabilidad CVE-2026-24061 en servidores Telnet mediante una variable de entorno USER malformada. Uso Ejecute el script con un host de destino: python telnetrce.py -p Argumentos host: Dirección IP o nombre de...
pinjectra
Pinjectra Pinjectra es una biblioteca C/C++ que implementa técnicas de inyección de procesos con enfoque en Windows 10 de 64 bits en un estilo 'mezcla y combina'. Aquí hay un ejemplo: // CreateRemoteThread Demo + DLL Load i.e., LoadLibraryA as Entry Point executor = new CodeViaCreateRemoteThread...
EUVD-2019-15712
Malware in sbrugna...
CVE-2019-6145
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach La...
LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers
A proof-of-concept PoC exploit has been released for a now-patched security flaw impacting Windows Lightweight Directory Access Protocol LDAP that could trigger a denial-of-service DoS condition. The out-of-bounds reads vulnerability is tracked as CVE-2024-49113 CVSS score: 7.5. It was addressed ...
Exploit for Integer Overflow or Wraparound in Microsoft
PoC exploit for CVE-2024-49112 is uncertain. It is an offensive...
Exploit for Out-of-bounds Read in Microsoft
PoC exploit for CVE-2024-49113, a Windows Server vulnerability...
Exploit for Integer Overflow or Wraparound in Microsoft
PoC exploit for CVE-2024-49113, a Windows Server vulnerability...
Patch Tuesday - August 2024
Microsoft is addressing 88 vulnerabilities this August 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and/or public disclosure for ten of the vulnerabilities published today, which is significantly more than usual. At time of writing, all six of the known-exploited...
Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
Microsoft said it is developing security updates to address two loopholes that it said could be abused to stage downgrade attacks against the Windows update architecture and replace current versions of the operating system files with older versions. The vulnerabilities are listed below -...
PoolParty - A Set Of Fully-Undetectable Process Injection Techniques Abusing Windows Thread Pools
A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - injection-techniques-using-windows-thread-pools-35446"The Pool Party You Will Never Forget: New Process Injection Techniques UsingWindows Thread...
New PoolParty Process Injection Techniques Outsmart Top EDR Solutions
A new collection of eight process injection techniques, collectively dubbed PoolParty, could be exploited to achieve code execution in Windows systems while evading endpoint detection and response EDR systems. SafeBreach researcher Alon Leviev said the methods are "capable of working across all...
Researchers Uncover Undetectable Crypto Mining Technique on Azure Automation
Cybersecurity researchers have developed what's the first fully undetectable cloud-based cryptocurrency miner leveraging the Microsoft Azure Automation service without racking up any charges. Cybersecurity company SafeBreach said it discovered three different methods to run the miner, including o...
New Exploit Lets Malware Attackers Bypass Patch for Critical Microsoft MSHTML Flaw
A short-lived phishing campaign has been observed taking advantage of a novel exploit that bypassed a patch put in place by Microsoft to fix a remote code execution vulnerability affecting the MSHTML component with the goal of delivering Formbook malware. "The attachments represent an escalation ...
Critical 9.9 Vulnerability in Hyper-V Allowed Attackers to Exploit Azure
Guardicore Labs, in collaboration with SafeBreach Labs, found a critical vulnerability in Hyper-V’s virtual network switch driver vmswitch.sys...
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft
PoC exploit for CVE-2020-1048. It is an exploit targeting a bina...
Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406
The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escala...
Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406
The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escala...
AVG Antivirus (All Editions) < 19.8 DLL Preloading Vulnerability - Windows
AVG Antivirus is prone to a dll preloading vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avg:anti-virus";...