20 matches found
CVE-2017-8759-Exploit-sample
CVE-2017-8759-Exploit-sample CVE-2017-8759 exploit 샘플을 실행합니다. Exploit 흐름: Word 매크로가 Doc1.doc 파일에서 실행됩니다. 매크로는 wsdl을 통해 잘못된 형식의 txt 파일을 다운로드하며, 이로 인해 WSDL 파서 로그가 트리거됩니다. 그런 다음 파싱 로그로 인해 mshta.exe가 실행되고, 이것이 다시 powershell 명령을 실행하여 mspaint.exe를 실행합니다. 테스트 방법: 포트 8080에서 웹서버를 실행하고, exploit.txt와 cmd.ht...
ransomware-simulator
QuickBuck - 勒索软件模拟器 root@kitploit: / \ / / / / / / // // // // // // '// |/ // // // '/ \\,/// ///\// ,/ ///\ Nextron Systems GmbH 本仓库的目标是提供一种简单、无害的方式来检查您的防病毒软件对勒索软件的防护能力。 该工具模拟典型的勒索软件行为，例如： 从 Word 文档宏中分阶段释放 删除卷影副本 加密文档（由模拟器嵌入并投放至新文件夹中） 将勒索信投放到用户桌面...
o365-attack-toolkit
What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...
macos_sandbox
Introduzione a macOS - la sandbox delle App Continuando con la mia serie di articoli sulla transizione a macOS, vorrei parlare un po' della sandbox delle App di macOS. È vivamente consigliato leggere prima l'articolo Struttura delle app macOS - darò per scontato che il lettore conosca la...
Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats
An Iran-nexus group has been linked to a "coordinated" and "multi-wave" spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world. The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to...
Maldoc in PDF Polyglot converter
A malicious MHT file created can be opened in Microsoft Word even though it has magic numbers and file structure of PDF. If the file has configured macro, by opening it in Microsoft Word, VBS runs and performs malicious behaviors. The attack does not bypass configured macro locks. And the malicio...
New Group of Hackers Targeting Businesses with Financially Motivated Cyber Attacks
Security researchers have tracked down activities of a new group of financially-motivated hackers that are targeting several businesses and organizations in Germany, Italy, and the United States in an attempt to infect them with backdoor, banking Trojan, or ransomware malware. Though the new...
CVE-2019-0561
An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclosure Vulnerability." This affects Microsoft Word, Office 365 ProPlus, Microsoft Office, Word...
Hancitor: fileless attack with a DLL copy trick
This article was authored by David Sánchez, Mickaël Roger, and Jérôme Segura During the past few years, malicious spam campaigns have proven to be one of the most efficient infection vectors, in part due to a combination of social engineering and a regular number of Office vulnerabilities. The...
Exploit for Code Injection in Microsoft
CVE-2017-8759-Exploit-sample Running CVE-2017-8759 exploit sam...
Microsoft Windows .NET Framework - Remote Code Execution
Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample Running CVE-2017-8759 exploit sample. Flow of the exploit: Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running...
Microsoft Windows .NET Framework - Remote Code Execution 0day Exploit
Exploit for windows platform in category remote exploits Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample Running CVE-2017-8759 exploit sample. Flow of the exploit: Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WS...
Microsoft Windows .NET Framework - Remote Code Execution
Microsoft Windows .NET Framework - Remote Code Execution Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample Running CVE-2017-8759 exploit sample. Flow of the exploit: Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WS...
Watch Out! First-Ever Word Macro Malware for Apple Mac OS Discovered in the Wild
After targeting Windows-based computers over the past few years, hackers are now shifting their interest to Macs as well. The emergence of the first macro-based Word document attack against Apple's macOS platform is the latest example to prove this. The concept of Macros dates back to 1990s. You...
Targeted String of Paerls Campaign Includes Word Macro Attack
A targeted malware campaign has been uncovered that combines an old-school Microsoft Word Macro malware attack with a decidedly new school approach of redirecting victims to exploits stored on Dropbox. The String of Paerls attacks, which Cisco’s VRT team reported today, targets industries such as...
Microsoft Windows application policy bypass
It's possible to bypass application restriction policy by directly loading code into suspended process' memory via e.g. Microsoft Word macro...
CVE-2002-1776
Symantec Norton AntiVirus 2002 is affected by CVE-2002-1776. The issue allows remote attackers to bypass virus protection via a Word Macro virus with a .nch or .dbx extension, which is automatically recognized and executed as a Microsoft Office document. The vendor disputes the claim, noting that...
CVE-2002-1776
NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus 2002 allows remote attackers to bypass virus protection via a Word Macro virus with a .nch or .dbx extension, which is automatically recognized and executed as a Microsoft Office document. NOTE: the vendor has disputed th...
CVE-2002-1776
NOTE: this issue has been disputed by the vendor. Symantec Norton AntiVirus 2002 allows remote attackers to bypass virus protection via a Word Macro virus with a .nch or .dbx extension, which is automatically recognized and executed as a Microsoft Office document. NOTE: the vendor has disputed th...