RustChain

설명 이 도구는 하드웨어 브레이크포인트와 결합된 ROP 체인을 사용하여 메모리 아티팩트를 숨기는 방법에 대한 간단한 PoC입니다. ROP 체인은 Sleep 함수가 호출되는 동안즉, Sleep이 호출될 때 기본 모듈 메모리 페이지의 보호를 N/A로 변경합니다. 이 메모리 스캐닝 회피 기술에 대한 자세한 내용은 원본 프로젝트 Gargoyle을 확인하세요. x64 전용. 아이디어는 kernel32!Sleep에 하드웨어 브레이크포인트를 설정하고 예외를 처리할 새로운 최상위 필터를 설정하는 것입니다. Sleep이 호출되면 이전에 설정된...

Cisco Secure Endpoint for Windows Scanning Evasion (cisco-sa-secure-endpoint-dos-RzOgFKnd)

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Cisco Secure Endpoint for Windows Scanning Evasion Vulnerability

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

Scanning evasion issue in Cisco Secure Email Gateway

Overview Cisco Secure Email Gateway provides anti-virus scanning facility for e-mail attachments. It was reported that a certain crafted file can evade anti-virus scanning facility. This issue was found by Takahiro Ohtani and Michael Joshua Telloyan in the Bug Bounty program at the University of...

How Malicious Android Apps Slip Into Disguise

Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research. At issue is a...

Sophos Anti-Virus CAB, RAR and LZH Scanning Evasion

The version of Sophos Anti-Virus installed on the remote host reportedly contains several problems involving the processing of 'CAB' 'RAR' and 'LZH' files which may allow an attacker to evade the anti- virus scanning by sending a specially-malformed archive. In addition, an attacker may exploit a...

[ GLSA 200501-46 ] ClamAV: Multiple issues

Gentoo Linux Security Advisory GLSA 200501-46 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...