domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

SEP-14.2-Arbitrary-Write

CVE-2020-5837 익스플로잇 분석 글은 RedyOps Labs 블로그에서 확인할 수 있습니다: https://labs.redyops.com/index.php/2020/04/27/symantec-endpoint-protection-sep-14-2-eop-via-arbitrary-write/ 타사 도구 이 익스플로잇 코드는 James Forshaw가 개발한 symboliclink-testing-tools에 크게 기반하고 있습니다. symboliclink-testing-tools은는 여기에서 찾을 수 있습니다:...

richkit

Richkit Richkit is a python3 package that provides tools taking a domain name as input, and returns addtional information on that domain. It can be an analysis of the domain itself, looked up from data-bases, retrieved from other services, or some combination thereof. The purpose of richkit is to...

CVE-2009-3036

CVE-2009-3036 SpeeDr00t@Black Falcon bid38241 Symantec IM Manager 콘솔 HTML 인젝션 취약점 정보 토론 익스플로잇 해결책 참조 Bugtraq ID: | 38241 ---|--- 클래스: | 입력 검증 오류 CVE: | CVE-2009-3036 원격: | 예 로컬: | 아니오 게시일: | Feb 18 2010 12:00AM 업데이트일: | Feb 18 2010 12:00AM 크레딧: | Rafael B. Brinhosa 취약한: | Symantec IM Manager 8.4...

CVE-2019-19547

CVE-2019-19547 CVE-2019-19547 PoC Symantec EDR 온프레미스 버전 4.3.0 미만은 인증되지 않은 반사형 XSS에 취약하며, 다음 URL을 통해 공격이 가능합니다: https://@IPEDR/r3epmpi/v1/dx/log 참고 https://support.broadcom.com/security-advisory/content/security-advisories/Symantec-Endpoint-Detection-and-Response-XSS/SYMSA1502...

nmap-scripts

nmap-scripts cve-2020-0796 & cve-2019-7238 & cve2019-11580 & cve2017-6327 취약점을 위한 nmap 스크립트 CVE-2020-0796 Microsoft Server Message Block 3.1.1SMBv3 프로토콜이 특정 요청을 처리하는 방식에 원격 코드 실행 취약점이 존재하며, 일명 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'라고 합니다. CVE-2019-7238 Sonatype Nexus...

CVE-2020-5839

CVE-2020-5839 CVE-2020-5839 POC Symantec EDR 온프레미스 버전 4.4.0 미만은 다음 URL을 통해 정보 노출 취약점에 취약합니다: https://@IPEDR/r3epmpi/status/ https://@IPEDR/r3epmpi/status/routes https://@IPEDR/r3epmpi/v1/event/status/ds https://@IPEDR/atpapp/features/list 참조...

CVE-2020-12593

CVE-2020-12593 POC Symantec EDR 온프레미스 버전 "4.5" 이전은 다음 URL을 통해 정보 노출 취약점이 존재합니다: https://@IPEDR/atpapi/v2/policies/blacklist 참고 https://support.broadcom.com/security-advisory/content/security-advisories/Symantec-Endpoint-Detection-Response-Security-Update/SYMSA16562...

CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC

Symantec Encryption Desktop PGPwded.sys 로컬 권한 상승 PoC 이 리포지토리는 낮은 권한의 원시 디스크 읽기/쓰기 프리미티브를 기반으로 하는 Symantec Encryption Desktop의 PGPwded.sys 스토리지 필터에서 로컬 권한 상승 경로에 대한 개념 증명을 포함합니다. 이 PoC는 Symantec Encryption Desktop Pro 10.4.2 MP3를 대상으로 개발 및 테스트되었습니다. 다른 버전은 이 구현으로 테스트되지 않았습니다. 이 작업은 Kyriakos Econom...

CVE-2022-37017

CVE-2022-37017 Symantec Endpoint Protection 14.3.5351 클라이언트 사용자 인터페이스 비밀번호 인증 우회 Symantec Endpoint Protection은 UI에 비밀번호 보호 기능을 설정하여 구성 변경을 방지할 수 있습니다. 이 비밀번호 확인은 PPLProtected Process Light이나 커널 드라이버에 있지 않은 로직으로 구현되어 있습니다. 메모리의 반환 값을 변경하거나 바이너리를 패치하면 공격자가 비밀번호를 우회할 수 있습니다. 이 방법은 Tamper Protection이...

cve-2019-12750

Symantec 로컬 권한 상승 - CVE-2019-12750 Kyriakos Economou의 훌륭한 글을 기반으로 합니다: https://labs.nettitude.com/blog/cve-2019-12750-symantec-endpoint-protection-local-privilege-escalation-part-1/ 현재는 x64 및 구형 Windows 버전만 지원됩니다...

CVE-2008-6827

CVE-2008-6827 Symantec Altiris Client Service 6.8.378 - 로컬 권한 상승 Exploit-DB 게시물: https://www.exploit-db.com/exploits/5625/ 저자 Alex Hernandez 일명 @alt3kx...

CVE-2026-74983

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

VulnCheck KEV: CVE-2016-5312

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. dot dot in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream...

CVE-2026-15380

CVE-2026-15380 : A non-admin interactive user can achieve full SYSTEM code execution via a DCOM/task scheduler logic chain in Symantec ITMS. No network access or memory corruption required. Connected records confirm the vulnerability and impact as stated; no explicit exploit details, mitigations,...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

Exploit for CVE-2019-9702

Symantec Encryption Desktop PGPwded.sys local privilege esca...

GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first...

CVE-2026-11626 Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool

CleanWipe Removal Tool macOS, prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacker with limited privilege access on an affected system can escalate their privileges to gain administrative control...

CVE-2026-11626 Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool

CleanWipe Removal Tool macOS, prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacker with limited privilege access on an affected system can escalate their privileges to gain administrative control...