Advanced Obfuscation Marks Widespread Info-Stealing Campaign

A large-scale spam campaign bent on spreading info-stealing malware is applying advanced obfuscation techniques to get around security scanning and maximize infection rates. According to Lastline researchers, a large botnet is distributing malicious rich text format RTF documents that act as...

Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution

Posted by Samuel Groß, Project Zero This is the third and last post in a series about a remote, interactionless iPhone exploit over iMessage. The first blog post introduced the exploited vulnerability, and the second blog post described a way to perform a heapspray, leaking the shared cache base...

Sony Playstation 4 (PS4) 6.72 - WebKit Code Execution (PoC)

Sony Playstation 4 PS4 6.72 - WebKit Code Execution PoC / badhoist ============ Exploit implementation of CVE-2018-4386. Obtains addrof/fakeobj and arbitrary read/write primitives. Supports PS4 consoles on 6.XX. May also work on older firmware versions, but I am not sure. Bug was fixed in firmwar...

Iran Targets Mideast Oil with ZeroCleare Wiper Malware

A freshly-discovered wiper malware dubbed “ZeroCleare” has been deployed to target the energy and industrial sectors in the Middle East. According to IBM’s X-Force Incident Response and Intelligence Services IRIS, ZeroCleare so-named because of the program database pathname of its binary file was...

Microsoft Windows 7 (x86) - (BlueKeep) RDP Remote Windows Kernel Use After Free Exploit

EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47683.zip import rdp import socket import binascii import time def poolsprays, crypter, payload: times = 10000 count = 0 while count times: count += 1 print'time through %d' % count try:...

Exploit for Use After Free in Microsoft

Run msfconsole meterpreter/multi/handler to listen on 192.1...

Exploit for CVE-2019-2525

VirtualBox 6.0.0 Exploit 1-day 사용할 VBox bug - CVE-2019-2525...

No summer break for Magecart as web skimming intensifies

This summer, you are more likely to find the cybercriminal groups Magecart client-side rather than poolside. Web skimming, which consists of stealing payment information directly from within the browser, is one of today's top web threats. Magecart, the group behind many of these attacks, gained...

Exploit for CVE-2018-8453

leHACK 2019: Analyzing CVE-2018-8453: An interesting tale of U...

iOS 12.1.3 - cfprefsd Memory Corruption Exploit

// c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. // iOS 12.1.3 - cfprefsd Memory Corruption Exploit include import include include include include include define AGENT 1 define...

Arbitrary Code Execution

Mozilla Firefox is vulnerable to arbitrary code execution attacks. This is because the JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks...

How Imperva’s New Attack Crowdsourcing Secures Your Business’s Applications

Attacks on applications can be divided into two types: targeted attacks and “spray and pray” attacks. Targeted attacks require planning and usually include a reconnaissance phase, where attackers learn all they can about the target organization’s IT stack and application layers. Targeted...

Apple macOS 10.13.5 - Local Privilege Escalation

Apple macOS 10.13.5 - Local Privilege Escalation import import import import import import import "offsets.h" //utils define ENFORCEa, label \ do \ if builtinexpect!a, 0 \ \ timedlog"! %s is false l.%d\n", a, LINE; \ goto label; \ \ while 0 // from...

ASAN/SUID - Local Privilege Escalation

!/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a vulnerable system. Supply your own targe...

Linux Kernel 4.4 - 'rtnetlink' Stack Memory Disclosure

/ Briefs - CVE-2016-4486 has discovered and reported by Kangjie Lu. - This is local exploit against the CVE-2016-4486. Tested version - Distro : Ubuntu 16.04 - Kernel version : 4.4.0-21-generic - Arch : x8664 Prerequisites - None Goal - Leak kernel stack base address of current process by...

WebKit JSC JIT JSPropertyNameEnumerator Type Confusion

WebKit: JSC: JIT: A bug with JSPropertyNameEnumerator CVE-2018-4416 When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of eve...

ai.deepsense:seahorse-executor-commons_2.11 (>=1.4.2 <=1.4.3), ai.deepsense:seahorse-executor-deeplang_2.11 (>=1.4.2 <=1.4.3) +505 more potentially affected by CVE-2018-18853 via io.spray:spray-json_2.11 (>=1.2.6 <=1.3.4)

io.spray:spray-json2.11 MAVEN version =1.2.6, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4, =1.0, =0.1.3, =0.1.14, =1.0.0, =0.1.0, =0.5.0, =0.11.1, =0.15.2, =0.5.0, =0.0.8, =0.0.12 and more Source cves: CVE-2018-18853 Source advisory: OSV:GHSA-F94M-MQHR-MC29...

co.actioniq:scalavro-core_2.10 (=0.6.3-c3b519ae67902e6e94aab5b6635744250534e0d0), co.actioniq:scalavro_2.10 (=0.6.3-c3b519ae67902e6e94aab5b6635744250534e0d0) +210 more potentially affected by CVE-2018-18853 via io.spray:spray-json_2.10 (>=1.2.5 <=1.3.4)

io.spray:spray-json2.10 MAVEN version =1.2.5, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.10.3 and more Source cves: CVE-2018-18853 Source advisory: OSV:GHSA-F94M-MQHR-MC29...

ai.agnos:reactive-sparql_2.12 (>=0.3.0 <=0.3.1), be.cetic:rts-gen_2.12 (>=0.1.3 <=0.1.13) +382 more potentially affected by CVE-2018-18853 via io.spray:spray-json_2.12 (>=1.3.2 <=1.3.4)

io.spray:spray-json2.12 MAVEN version =1.3.2, =0.3.0, =0.1.3, =0.1.14, =0.11.1, =0.15.2, =0.2.0, =0.0.82.12, =1.23.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0-RC8 - com.chudsaviet.gradle.avrohugger:com.chudsaviet.gradle.avrohugger.gradle.plugin =0.2.4 - com.cra.figaro:figaro2.12 =5.0.0.0 and more Source...

GHSA-F94M-MQHR-MC29 Uncontrolled Resource Consumption in spray-json when parsing decimal digit fields

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of a field composed of many decimal digits...