CVE-2019-18194

TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder...

CVE-2019-18194

TotalAV 2020 4.14.31 is affected by CVE-2019-18194, a privilege-escalation vulnerability where exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder. The vulnerability is supported by multiple sources (Red Hat advisory, CNVD, CVE records,...

CVE-2019-17093

An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process PPL and might bypass some of the self-defense mechanisms. This affects...

Persistence – Time Providers

Windows operating systems are utilizing the time provider architecture in order to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in System32 folder. The service W32Time initiates during the...

CVE-2019-14242

An issue was discovered in Bitdefender products for Windows Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bitdefender Internet Security, and Bitdefender Total Security versions prior to 23.0.24.120 that can lead to local code injection. A local...

UACME - Defeating Windows User Account Control

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. System Requirements x86-32/x64 Windows 7/8/8.1/10 client, some methods however works on server version too. Admin account with UAC set on default settings required. Usage Run executable from command line:...

Microsoft Windows 10 (17763.379) - Install DLL Exploit

Exploit for windows platform in category local exploits edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able to repro anyway. Could be used with malware, you could programmatically trigger the rollback. Maybe you can even pass the...

Win 10 arbitrary file deletion 0day warning-vulnerability warning-the black bar safety net

! 0x00 vulnerability details 2019 5 May 21, sandboxescaper in the github upload a copy of win10 arbitrary file deletion 0Day code: https://github.com/SandboxEscaper/polarbearrepo this is from the 2018 Year 8 months sandboxescaper release of the fifth 0Day the. The vulnerability principle and the...

Microsoft Windows 10 scrrun.dll Active-X Creation / Deletion Issues

Title: Windows 10 'scrrun.dll' Multiple vulnerabilities Author: Nassim Asrir Contact: [email protected] / https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vendor: https://www.microsoft.com/ Test ENV: ======== Browser : IE 11 OS: Windows 10 - x64 Details: ======== scrrun.dll...

HP TouchSmart Calendar 4.1.4245 - Insecure File Permissions Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ========== www.hp.com Product: =========================================== Hewlett Packard TouchSmart Calendar Service File version : 4.1.4245 HP TouchSmart Calendar is a shared calendar where you c...

Microsoft Windows Diagnostics Hub - DLL Load Privilege Escalation (MS16-125)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=887 Windows: Diagnostics Hub DLL Load EoP Platform: Windows 10 10586, not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: The fix for CVE-2016-3231 is insufficient to prevent a normal user specifying an...

Microsoft Windows Diagnostics Hub - DLL Load Privilege Escalation (MS16-125)

Microsoft Windows Diagnostics Hub - DLL Load Privilege Escalation MS16-125 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=887 Windows: Diagnostics Hub DLL Load EoP Platform: Windows 10 10586, not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: The fix...

The vulnerability of the Windows Embedded Standard 2009 operating system allows a perpetrator to trigger a service failure or execute arbitrary code.

The Windows Embedded Standard 2009 operating system contains a vulnerability in the NetprPathCanonicalize function of the netapi32.dll module, which is located in the C:\Windows\System32 directory. This function uses unsafe string functions to copy Unicode strings file paths, resulting in stack...

PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow

No description provided by source. !/usr/bin/python import socket import sys msfvenom -p windows/shellbindtcp lhost=192.168.1.130 lport=4444 -b '\x00\x0a\x0b\x27\x36\xce\xc1\x04\x14\x3a\x44\xe0\x42\xa9\x0d' -f ruby Payload size: 352 bytes shellcode =...

PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: PCMan's FTP Server v2.0 - RENAME command remote buffer overflow Date: 29 Aug 2015 Exploit Author: Koby Vendor Homepage: http://pcman.openfoundry.org/ Version: 2.0.7 Tested on: Windows XP SP3 import socket...

WebGate WinRDS 2.0.8 - StopSiteAllChannel Stack Overflow

WebGate WinRDS 2.0.8 - StopSiteAllChannel Stack Overflow WebGate WinRDS WESPPlayback.WESPPlaybackCtrl.1 StopSiteAllChannel Stack Buffer Overflow Vulnerability 0Day var buff1 = ""; var nops = ""; var buff2 = ""; for i=0;i128; i++ buff1 += "B"; nseh = "\xeb\x08PD"; //pop pop ret = 1007f2a0 0x1007f2...

BigAnt-Server-2.52-SP5-SEH

Exploit Title: BigAnt Server 2.52 SP5 SEH Stack Overflow ROP-based exploit ASLR + DEP bypass Date: 03/11/2012 Exploit Author: Lorenzo Cantoni Vendor Homepage: http://www.bigantsoft.com/ Version: BigAnt Console 2.52 SP5 Tested on: Windows 7 SP0 x86 Italian - expsrv.dll 6.0.9589 Info: Vulnerability...

MS14-060 Microsoft Windows OLE Package Manager Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS14-060 Microsoft Windows OLE Package Manager Code Execution", 'Description' = %q This module exploits a vulnerability found in...

MS14-060 Microsoft Windows OLE Package Manager Code Execution

This module exploits a vulnerability found in Windows Object Linking and Embedding OLE allowing arbitrary code execution, publicly known as "Sandworm". Platforms such as Windows Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be vulnerable. However, based on our...

MW6 Technologies Aztec ActiveX (Data param) - Buffer Overflow

No description provided by source. !-- =========================================================================== Problem: The Data parameter is subject to a buffer overflow DEFINITELY leading to arbitrary code execution. COM Object - F359732D-D020-40ED-83FF-F381EFE36B54 MW6Aztec Class File...