PT-2017-12754

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.2 Description The issue is related to a buffer over-read in the SMB/CIFS parser of tcpdump, which could allow a remote attacker to obtain sensitive information. This can be achieved by sending a specially crafted...

DocuWorks Detection (Windows SMB Login)

Detects the installed version of DocuWorks. The script logs in via smb, searches for SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

DocuWorks Viewer Light Detection (Windows SMB Login)

Detects the installed version of DocuWorks Viewer Light. The script logs in via smb, searches for SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker via a named pipe pivot This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Windows Meterpreter (Reflective Injection), Windows x86 Reverse Named Pipe (SMB) Stager

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker via a named pipe pivot This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

smb-enum-services NSE Script

Retrieves the list of services running on a remote Windows system. Each service attribute contains service name, display name and service status of each service. Note: Modern Windows systems requires a privileged domain account in order to list the services. References: Script Arguments randomsee...

smbudowlani.pl XSS vulnerability

Vulnerable URL: http://www.smbudowlani.pl/galeria.php?gid=70=1274.jpg%22%27--!%3E%3Cscript%3EalertOPENBUGBOUNTY%3C/script%3E=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 366808...

Zerodium Offers $500K for Secure Messaging App Zero Days

Zerodium, a vendor operating in the nebulous exploit acquisition market, has put a premium on zero-day vulnerabilities in secure messaging applications in a new pricing structure announced today. Remote code execution and local privilege elevation zero days in messaging apps such as WhatsApp,...

Symantec VIP Access Desktop Detection (Windows SMB Login)

Detects the installed version of Symantec VIP Access Desktop. The script logs in via smb, searches for SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

SMBLoris: What You Need To Know

What's Up? Astute readers may have been following the recent news around "SMBLoris" -- a proof-of-concept exploit that takes advantage of a vulnerability in the implementation of SMB services on both Windows and Linux, enabling attackers to "kill you softly" with a clever, low-profile...

In a remote sandbox, free to soar: Adobe Flash Windows user credentials disclosure vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently, I published about the Flash sandbox escape vulnerabilities of an article, The final result has survived ten years of the Flash Player local security sandbox died a natural death. Before this vulnerability to show us the input data to verify the correctness of importance. T...

CVE-2017-12420

Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authenticated users to cause a denial of service or execute arbitrary code...

CVE-2017-12420

Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authenticated users to cause a denial of service or execute arbitrary code...

Heap overflow

Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authenticated users to cause a denial of service or execute arbitrary code...

CVE-2017-12420

NetApp Clustered Data ONTAP is affected by a heap-based buffer overflow in the SMB implementation for versions 8.x prior to 8.3.2P8 and 9.x prior to 9.0P2. The vulnerability allows a remote attacker with authentication to cause a denial of service or execute arbitrary code. ONTAP 9.1 and higher a...

CVE-2017-12420

Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authenticated users to cause a denial of service or execute arbitrary code...

PT-2017-12546

Name of the Vulnerable Software and Affected Versions NetApp Clustered Data ONTAP versions prior to 8.3.2P8 NetApp Clustered Data ONTAP versions prior to 9.0P2 Description A heap-based buffer overflow issue exists in the SMB implementation, allowing remote authenticated users to potentially cause...

CVE-2017-12420: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authenticated users to cause a denial of service or execute arbitrary code...

UPDATE: Leviathan Framework v0.1.2!

PenTestIT RSS Feed I seem to have missed about two updates made to the this mass audit toolkit. My last post about the Leviathan Framework can be found here. We now have the latest - Leviathan Framework v0.1.2! What is Leviathan Framework? Leviathan is a mass audit toolkit which has wide range...

Windows Search Bug Worth Watching, and Squashing

Between Conficker and WannaCry, there was a nearly a decade when network worms went dark. WannaCry changed that, riding into enterprises globally on the coattails of a leaked nation-state exploit. In the months since the May 12 ransomware attack, vendors, researchers and network admins have been ...