New campaign uses government, union-themed lures to deliver Cobalt Strike beacons

By Chetan Raghuprasad and Vanja Svajcer. Cisco Talos discovered a malicious campaign in August 2022 delivering Cobalt Strike beacons that could be used in later, follow-on attacks. Lure themes in the phishing documents in this campaign are related to the job details of a government organization i...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

Cobalt Strike Storage-Type XSS RCE CVE-2022-39197 Run Par...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

CVE-2022-39197-POC 中文版本READMECN.md ---...

CVE-2022-38573

CVE-2022-38573 affects 10-Strike Network Inventory Explorer v9.3, where a buffer overflow is triggered via the Add Computers function. The issue has a CVSS v3.1 base score of 9.8 (CRITICAL), with network access, no privileges required, and no user interaction required. Impact is rated HIGH on con...

CVE-2022-39197

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

CVE-2022-39197

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

Cross site scripting

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

CVE-2022-39197

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

CVE-2022-39197

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

CVE-2022-39197

CVE-2022-39197 affects HelpSystems Cobalt Strike Team Server up through version 4.7, where a cross-site scripting vulnerability in the Teamserver enables an attacker to influence the Beacon configuration by supplying a malformed username in payloads. The public data describe several PoCs and expl...

HelpSystems Cobalt Strike 跨站脚本漏洞

HelpSystems Cobalt Strike is a penetration testing software from HelpSystems USA. HelpSystems Cobalt Strike 4.7 and prior versions suffer from a cross-site scripting vulnerability that stems from an XSS cross-site scripting vulnerability that allows a remote attacker to execute HTML on the Cobalt...

PT-2022-24465 · 10 Strike · 10-Strike Network Inventory Explorer

Name of the Vulnerable Software and Affected Versions: 10-Strike Network Inventory Explorer version 9.3 Description: A buffer overflow issue was discovered in the Add Computers function of the software. Recommendations: For version 9.3, consider disabling the Add Computers function until a patch ...

10-Strike Network Inventory Explorer 安全漏洞

10-Strike Network Inventory Explorer is a scanning software from 10-Strike, Inc. for tracking hardware and software on networked computers. A security vulnerability exists in version v9.3 of 10-Strike Network Inventory Explorer that originates from a buffer overflow contained via the Add Computer...

CVE-2022-39197

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

PT-2022-24798

Name of the Vulnerable Software and Affected Versions HelpSystems Cobalt Strike versions through 4.7 Description A Cross Site Scripting XSS issue was found that allows a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit this issue, an attacker must first inspect a Cobalt...

Emotet Botnet Started Distributing Quantum and BlackCat Ransomware

The Emotet malware is now being leveraged by ransomware-as-a-service RaaS groups, including Quantum and BlackCat, after Conti's official retirement from the threat landscape this year. Emotet started off as a banking trojan in 2014, but updates added to it over time have transformed the malware...

SparklingGoblin Revamps SideWalk Backdoor for Linux Variant

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary SparklingGoblin aka Earth Baku State-backed Chinese hackers has integrated a Linux variant of the SideWalk backdoor. SparklingGoblin Threat actors typically target East and Southeast Asian countries, wit...

Infra Used in Cisco Hack Also Targeted Workforce Management Solution

The attack infrastructure used to target Cisco in the May 2022 incident was also employed against an attempted compromise of an unnamed workforce management solutions holding company a month earlier in April 2022. Cybersecurity firm eSentire, which disclosed the findings, raised the possibility...

Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks

Microsoft has observed the Sliver command-and-control C2 framework now being adopted and integrated in intrusion campaigns by nation-state threat actors, cybercrime groups directly supporting ransomware and extortion, and other threat actors to evade detection. We’ve seen these actors use Sliver...

10-Strike Network Inventory Explorer 9.3 Buffer Overflow Vulnerability

10-Strike Network Inventory Explorer versions 9.3 and below are vulnerable to a SEH based buffer overflow which leads to code execution or local privilege escalation. The vulnerable part of the program is the functionality to add computers from a text file. I. VULNERABILITY...