25 matches found
pinjectra
Pinjectra Pinjectra is a C/C++ library that implements Process Injection techniques with focus on Windows 10 64-bit in a "mix and match" style. Here's an example: // CreateRemoteThread Demo + DLL Load i.e., LoadLibraryA as Entry Point executor = new CodeViaCreateRemoteThread new...
CVE-2026-24061
CVE-2026-24061 Telnet RCE Exploit - By SafeBreach Labs This script exploits the CVE-2026-24061 vulnerability in Telnet servers using a malformed USER environment variable. Usage Run the script with a target host: python telnetrce.py -p Arguments host: Target IP address or hostname required -p,...
CVE-2024-49113
LDAP Nightmare An exploit for CVE-2024-49113 reported by Yuki Chen @guhe120. A vulnerability in Windows Lightweight Directory Access Protocol LDAP. Created by SafeBreach Labs published on January 1st 2025. For the full technical analysis of the vulnerability and how we managed to exploit it check...
EUVD-2019-15712
Malware in sbrugna...
CVE-2019-6145
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach La...
LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers
A proof-of-concept PoC exploit has been released for a now-patched security flaw impacting Windows Lightweight Directory Access Protocol LDAP that could trigger a denial-of-service DoS condition. The out-of-bounds reads vulnerability is tracked as CVE-2024-49113 CVSS score: 7.5. It was addressed ...
Exploit for Integer Overflow or Wraparound in Microsoft
PoC exploit for CVE-2024-49112 is uncertain. It is an offensive...
Exploit for Out-of-bounds Read in Microsoft
PoC exploit for CVE-2024-49113, a Windows Server vulnerability...
Exploit for Integer Overflow or Wraparound in Microsoft
PoC exploit for CVE-2024-49113, a Windows Server vulnerability...
Patch Tuesday - August 2024
Microsoft is addressing 88 vulnerabilities this August 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and/or public disclosure for ten of the vulnerabilities published today, which is significantly more than usual. At time of writing, all six of the known-exploited...
Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
Microsoft said it is developing security updates to address two loopholes that it said could be abused to stage downgrade attacks against the Windows update architecture and replace current versions of the operating system files with older versions. The vulnerabilities are listed below -...
PoolParty - A Set Of Fully-Undetectable Process Injection Techniques Abusing Windows Thread Pools
A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - injection-techniques-using-windows-thread-pools-35446"The Pool Party You Will Never Forget: New Process Injection Techniques UsingWindows Thread...
Informational Bulletin: Proof of Concept (PoC) Bypasses Protection Modules in Cortex XDR Agent
The Palo Alto Networks Product Security Assurance team is aware of research presented by SafeBreach entitled "The Dark Side of EDR", describing a specifically crafted proof of concept PoC that bypasses Cortex XDR agent endpoint protection modules. Practical attack scenarios require administrative...
New PoolParty Process Injection Techniques Outsmart Top EDR Solutions
A new collection of eight process injection techniques, collectively dubbed PoolParty, could be exploited to achieve code execution in Windows systems while evading endpoint detection and response EDR systems. SafeBreach researcher Alon Leviev said the methods are "capable of working across all...
Researchers Uncover Undetectable Crypto Mining Technique on Azure Automation
Cybersecurity researchers have developed what's the first fully undetectable cloud-based cryptocurrency miner leveraging the Microsoft Azure Automation service without racking up any charges. Cybersecurity company SafeBreach said it discovered three different methods to run the miner, including o...
New Exploit Lets Malware Attackers Bypass Patch for Critical Microsoft MSHTML Flaw
A short-lived phishing campaign has been observed taking advantage of a novel exploit that bypassed a patch put in place by Microsoft to fix a remote code execution vulnerability affecting the MSHTML component with the goal of delivering Formbook malware. "The attachments represent an escalation ...
Critical 9.9 Vulnerability in Hyper-V Allowed Attackers to Exploit Azure
Guardicore Labs, in collaboration with SafeBreach Labs, found a critical vulnerability in Hyper-V’s virtual network switch driver vmswitch.sys...
Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft
PoC exploit for CVE-2020-1048. It is an exploit targeting a bina...
Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406
The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escala...
Confluence on Windows was vulnerable to DLL hijacking - CVE-2019-20406
The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a dll file in a directory in the global path environmental variable variable to inject code & escala...