Windows Printer Driver Enumeration

Binary data wmienumprinterdrivers.nbin...

Nosferatu - Lsass NTLM Authentication Backdoor

Lsass NTLM Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted function is MsvpPasswordValidate, located in NtlmShared.dll. In the pursuit of not being detected, the hooked function will call...

Windows MultiPoint Server 2011 RpcEptMapper and Dnschade Local Privilege Escalation Vulnerability

Exploit Title: Windows MultiPoint Server 2011 SP1 - RpcEptMapper and Dnschade Local Privilege Escalation Exploit Author: it Vendor Homepage: https://www.microsoft.com Software Link: https://www.microsoft.com/pt-br/download/details.aspx?id=8518 Version: Version 6.1 Compilation 7601 Service Pack 1...

SharpStrike - A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems

SharpStrike is a post-exploitation tool written in C that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction...

KnockOutlook - A Little Tool To Play With Outlook

"The best feeling is to win by knockout." - Nonito Donaire Overview KnockOutlook is a C project that interacts with Outlook's COM object in order to perform a number of operations useful in red team engagements. Command Line Usage metadata of every account search : search for the provided keyword...

LockFile Ransomware Bypasses Protection Using Intermittent File Encryption

A new ransomware family that emerged last month comes with its own bag of tricks to bypass ransomware protection by leveraging a novel technique called "intermittent encryption." Called LockFile, the operators of the ransomware have been found exploiting recently disclosed flaws such as ProxyShel...

August 26, 2021—KB5005103 (OS Build 18363.1766) Preview

None None...

August 26, 2021—KB5005102 (OS Build 17763.2145) Preview

None None...

CVE-2021-22928

A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM...

CVE-2021-22928

A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM...

Design/Logic Flaw

A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM...

Vulnerability fixed in Citrix Virtual Apps and Desktops

Citrix has fixed a vulnerability in Virtual Apps and Desktops, XenApp and XenDesktop. A local malicious party could by exploiting this vulnerability within a Windows VDA acquire elevated privileges. The vulnerability resides only in systems using Citrix Profile Management or the Citrix Profile...

Citrix Virtual Apps and Desktops Security Update

A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM. This...

TChopper - Conduct Lateral Movement Attack By Leveraging Unfiltered Services Display Name To Smuggle Binaries As Chunks Into The Target Machine

New technique I have discovered recently and give it a nickname Chop chop to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool. How it works the tool will get the file you willin...

KB5003711: Servicing stack update for Windows 10, version 1809: June 8, 2021

None None...

KB5003710: Servicing stack update for Windows 10, version 1909: June 8, 2021

None None...

June 8, 2021 Servicing Stack Update (KB5004179)

None None...

GSD-2021-1000517 platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios

platform/x86: dell-smbios-wmi: Fix oops on rmmod dellsmbios This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.192 by commit...

UVI-2021-1000517 platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios

platform/x86: dell-smbios-wmi: Fix oops on rmmod dellsmbios This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.192 by commit...

UVI-2021-1000515 platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios

platform/x86: dell-smbios-wmi: Fix oops on rmmod dellsmbios This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.122 by commit...