Who Contains the Containers?

Posted by James Forshaw, Project Zero This is a short blog post about a research project I conducted on Windows Server Containers that resulted in four privilege escalations which Microsoft fixed in March 2021. In the post, I describe what led to this research, my research process, and insights...

The vulnerability of the DNS server service in Windows Server operating systems allows a perpetrator to cause a service failure.

The vulnerability of the DNS server service in Windows Server operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Windows Gather Exchange Server Mailboxes

This module will gather information from an on-premise Exchange Server running on the target machine. Two actions are supported: LIST default action: List basic information about all Exchange servers and mailboxes hosted on the target. EXPORT: Export and download a chosen mailbox in the form of a...

Microsoft Exchange ProxyLogon Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Exchange ProxyLogon RCE', 'Description' = %q This module exploit a vulnerability on Microsoft Exchange Server that allows an attacker...

Exploit for CVE-2017-0144

CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution Th...

Metasploit Wrap-Up

Windows Server 2012 Fun Community contributor Erik Wynter added a local exploit module for a DLL hijacking vulnerability he discovered in Windows Server 2012. The TiWorker.exe process that runs as NT AUTHORITY\SYSTEM attempts to load SrClient.dll, which does not exist on the system. Because of...

The vulnerability of the DNS server service in Windows Server operating systems allows a hacker to execute arbitrary code.

The vulnerability of the DNS server service in Windows Server operating systems is related to improper code generation management. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the DNS server service in Windows Server operating systems allows a perpetrator to cause a service failure.

The vulnerability of the DNS server service in Windows Server operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

KB5001642: March 9, 2021 update causes Windows Server 2008 SP2 to not print graphical content

KB5001642: March 9, 2021 update causes Windows Server 2008 SP2 to not print graphical content Summary This update resolves the following issue: Addresses an issue that fails to print the graphical content in a document after installing the March 9, 2021 update. Known issues in this update We are...

KB5001641: March 9, 2021 update causes Windows Server 2012 to not print graphical content

KB5001641: March 9, 2021 update causes Windows Server 2012 to not print graphical content Summary This update resolves the following issue: Addresses an issue that fails to print the graphical content in a document after installing the March 9, 2021 update. Known issues in this update We are...

Windows Server 2012 SrClient DLL Hijacking Exploit

All editions of Windows Server 2012 but not 2012 R2 are vulnerable to DLL hijacking due to the way TiWorker.exe will try to call the non-existent SrClient.dll file when Windows Update checks for updates. This issue can be leveraged for privilege escalation if %PATH% includes directories that are...

Windows Server 2012 SrClient DLL Hijacking

class MetasploitModule 'Windows Server 2012 SrClient DLL hijacking', 'Description' = %q All editions of Windows Server 2012 but not 2012 R2 are vulnerable to DLL hijacking due to the way TiWorker.exe will try to call the non-existent SrClient.dll file when Windows Update checks for updates. This...

CVE-2021-27077

Windows Win32k Elevation of Privilege Vulnerability...

CVE-2021-26894

Windows DNS Server Remote Code Execution Vulnerability...

CVE-2021-26877

Windows DNS Server Remote Code Execution Vulnerability...

CVE-2021-27063 Windows DNS Server Denial of Service Vulnerability

...

IBM DB2 Buffer Overflow Vulnerability (CNVD-2021-17192)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 has a security vulnerability that can be exploited by an attacker to trigger a denial of servi...

2021-03 Cumulative Update for Azure Stack HCI, version 20H2 and Windows Server 2019 Datacenter: Azure Edition for x64-based Systems (KB5000801)

Install this update to resolve issues in Azure Stack HCI, version 20H2 and Windows Server 2019 Datacenter: Azure Edition. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, y...

2021-03 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5000808)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

2021-03 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5000822)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...