1355 matches found
SetupHijack
SetupHijack 概述 SetupHijack 是一款安全研究工具，利用 Windows 安装程序和更新进程中的竞态条件及不安全文件处理漏洞。它针对特权安装程序或更新程序将文件放入 %TEMP% 或其他人人可写位置，并允许攻击者在这些文件以提升权限执行之前将其替换的场景。 运行不 需要提升权限。 不 使用文件系统通知（而是轮询更改）。 利用 Authenticode 代码签名和安装程序信任模型中的弱点。 可感染 .exe、.msi 和批处理文件（例如 sysinfo、netstat、ipconfig）。 仅用于红队、渗透测试和安全研究。...
CVE-2020-0683
CVE-2020-0683 原始 PoC 已提交至 MSRC。 已分配至 CVE-2020-0683 - Windows Installer 权限提升 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0683 适用于 Visual Studio C++ 2017 的源代码 请阅读 PDF 文件，其中描述了所有发现和复现步骤。 在 "binMsiExploit" 文件夹中，你会找到可执行的漏洞利用程序 exe。 演示 如果你喜欢，请我喝杯啤酒 ;-...
CVE-2023-20178
CVE-2023-20178 这是Cisco Secure Client（测试版本5.0.01242）和Cisco AnyConnect（测试版本4.10.06079）中任意文件删除漏洞的PoC。 当用户连接到VPN时，vpndownloader.exe进程会在后台启动，并在c:\windows\temp目录下创建具有默认权限的目录，格式如下：.tmp。创建此目录后，vpndownloader.exe会检查该目录是否为空，如果不为空，则会删除其中的所有文件/目录。这种行为可被滥用以NT Authority\SYSTEM账户权限执行任意文件删除操作。...
ShokoServer System - Local File Inclusion (LFI)
ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...
msi-search
MSI 搜索 Windows 在 C:\Windows\Installer\ 中以随机文件名（由字母和数字组成，后跟 ".msi" 扩展名）缓存 MSI 文件。该工具简化了红队操作员和安全团队识别哪些 MSI 文件对应哪些软件的任务，并使他们能够下载相关文件，以通过 MSI 修复调查本地权限提升漏洞。更多关于 MSI 修复漏洞的信息，请参阅通过第三方 Windows 安装程序提升权限。 作者：Andrew Oliveau @AndrewOliveau 编译 root@kitploit: x8664-w64-mingw32-gcc -c msisearch.c -o...
msiscan
MSI 分析器 这个用于 Linux 的 Python 脚本可以分析 Microsoft Windows .msi 安装程序文件并指出潜在漏洞。它由 Michael Baer @derbaer0 在 SEC Consult 漏洞实验室开发。 目前，它主要适用于本地权限提升，我们的博客文章中也对此进行了描述：https://r.sec-consult.com/msi。 Microsoft 分配了 CVE-2024-38014 ，并在 2024 年 9...
CVE-2026-77894
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-72929
Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-71339
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-69441
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-62694
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...
EUVD-2026-73723
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-69441
CVE-2026-69441 is a race condition vulnerability in Windows Installer , caused by concurrent execution using a shared resource with improper synchronization . An authorized attacker can exploit this to elevate privileges locally . The vulnerability is rated CVSS 7.0 (HIGH) with a local attack vec...
EUVD-2026-73283
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-77894
CVE-2026-77894 is a local privilege escalation vulnerability in Windows Installer caused by a race condition — specifically, concurrent execution of a shared resource with improper synchronization. An authorized attacker with low privileges can exploit this to gain high integrity over confidentia...
CVE-2026-72929
CVE-2026-72929 is an elevation of privilege vulnerability in Windows Installer , caused by improper validation of an integrity check value . An authorized local attacker can exploit this to gain elevated privileges, with the CVSS 3.1 base score of 7.8 (HIGH) reflecting full impact on confidential...
EUVD-2026-73105
Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-71339
CVE-2026-71339 is a heap-based buffer overflow in Windows Installer that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 6.7 (MEDIUM) with a vector of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating that while high privileges are required, the impact on confident...