Conti ransomware looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a DLL to execute our own code to control and terminate the malware pre-encryption. The exploit dll will check if the current directory is "C:\Windows\System32". If not, we grab our process ID and terminate. We do not need to rely on hash signature or third-party products, the malware vulnerability will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there is nothing to kill the DLL that just lives on disk waiting. From a defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
9cc7ba098e7d73f1ba5a406536afb6daff209000bfc578d3f4921cd931a7e23f
Conti ransomware looks for and loads a DLL named "wow64log.dll" in Windows\System32. Therefore, we can drop our own DLL to intercept and terminate the malware pre-encryption. The exploit DLL will simply display a Win32API message box and call exit(). Our Conti.Ransom exploit DLL must export the "InterlockedExchange" function or it fails with an error. We do not need to rely on hash signature or third-party products, the malware vulnerability will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there is nothing to kill the DLL that just lives on disk waiting. From a defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
aa9ce885d596135e2fe0d53ecbaf0150134e9b1069abbd9201051712bdcaffad
RedLine looks for and loads a DLL named "wow64log.dll" in Windows\System32. Therefore, we can drop our own DLL to intercept and terminate the malware. The exploit DLL will simply display a Win32API message box and call exit(). Our RedLine exploit DLL must export the "InterlockedExchange" function or it fails with an error. We do not need to rely on a hash signature or third-party product, the malware vulnerability will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there's nothing to kill the DLL that just lives on disk waiting. From a defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
ba283ac98afc491c29dfdfeab95f8ae1dc56fd58e9ff0dffa31fbe553d191fb0
REvil looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vulnerable DLL to execute our own code, control and terminate the malware pre-encryption. The exploit DLL will check if the current directory is "C:\Windows\System32" and if not we grab our process ID and terminate. We do not need to rely on a hash signature or third-party product, the malware's own vulnerability will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there's nothing to kill the DLL that just lives on disk waiting. From a defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
268cdb6f1c42815be3079d4e45fd4bf006bd0c4df1203a033c3ddc55bcdb5be7
Conti looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vulnerable DLL to execute our own code and control and terminate the malware pre-encryption. The exploit DLL will check if the current directory is "C:\Windows\System32" and if not we grab our process ID and terminate. We do not need to rely on a hash signature or third-party product, the malware's own vulnerability will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there is nothing to kill the DLL that just lives on disk waiting. From defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
7dfe899925fd75a7afdeed1c0bdaa8c98cc8b87367a6bd9420dbd8bbcce7f3d3
LokiLocker looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vulnerable DLL to execute our own code, control and terminate the malware pre-encryption. The exploit DLL will check if the current directory is "C:\Windows\System32" and if not we grab our process ID and terminate. We do not need to rely on a hash signature or third-party product as the malware will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there is nothing to kill the DLL that just lives on disk waiting. From defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
cf6779cc7e8fc059a533a276d417fb4939fa7a55fba0ba4f6accd93a624ae862
BlackBasta looks for and loads a DLL named wow64log.dll in Windows\System32. Therefore, we can drop our own DLL to intercept and terminate the malware pre-encryption. The exploit DLL will simply display a Win32API message box and call exit(). Our BlackBasta exploit DLL must export the InterlockedExchange function or it fails with error. We do not need to rely on a hash signature or third-party product, the malware will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there is nothing to kill the DLL that just lives on disk waiting. From a defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
e1c4bddb5154781ba56ed838fb4186594dda0485db70b5497982ad2473999d9a
Ransom.AvosLocker ransomware looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vulnerable DLL to execute our own code and control and terminate the malware pre-encryption. The exploit DLL will check if the current directory is "C:\Windows\System32" and if not we grab our process ID and terminate. We do not need to rely on a hash signature or third-party product, the malware will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there is nothing to kill the DLL that just lives on disk waiting. From a defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.
d0857628bf3ad43e446a4d3786f1d51b4eb563b6e22153fe746ce5261e315ec4
This Metasploit module exploits CVE-2022-22954, an unauthenticated server-side template injection (SSTI) vulnerability in VMware Workspace ONE Access, to execute shell commands as the horizon user.
bf4114fce190a8b9bc1f2bfc2013620b04b05e7030c7cc59f3d685b8db2038b1
Tenda HG6 version 3.3.0 suffers from a remote command injection vulnerability. It can be exploited to inject and execute arbitrary shell commands through the pingAddr and traceAddr HTTP POST parameters in formPing, formPing6, formTracert and formTracert6 interfaces.
49f6e50dad2f50c5f9bee5f1105d5092b826a6f5ba27d2193fc00498390e1373
WordPress Stafflist plugin version 3.1.2 suffers from a cross site scripting vulnerability.
74269ba0f910606e9499b4b87b6ba8ea243f907c7743fde42c4af10707d6f9da
This Metasploit module abuses a vulnerability in certain WSO2 products that allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.
7bdab9b3101da4ba2df8ff1f6a558171e4d8a503d4d44bcbaf0347587fa69a4d
WordPress Stafflist plugin version 3.1.2 suffers from a cross site request forgery vulnerability.
9d6c94780d9e6bad20039cfa30e21ac1263e9e05f4af98d371874857a71295c3
WordPress Stafflist plugin version 3.1.2 suffers from a remote SQL injection vulnerability.
76212ce51a690afcb72976ffdf858974f47d6bff5804091f1c6e89f12d4ebfe3
Strap versions prior to 3.6.9 and 4.1.5 disclose a user's password due to simply base64 encoding it and sticking it in a cookie.
069e678d219ce2bfcd777e3fcf09ee5a7c59fe5b6c563e15e918fd0877c7aff7
LockBit ransomware looks for and executes DLLs in its current directory. This can potentially allow us to execute our own code, control and terminate the malware pre-encryption. The exploit DLL will check if the current directory is "C:\Windows\System32" and if not we grab our process ID and terminate. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as there's nothing to kill the DLL that just lives on disk waiting. All basic tests were conducted successfully in a virtual machine environment.
2309d126cc5ad752cce17568336336941a74bd3cad316628d72b23e6103bbdc2
Covid 19 Travel Pass Management System version 1.0 suffers from a remote SQL injection vulnerability.
8c232ce0a1da7fa75903ca2807d34366340d6c85780e027ddfaa612d65d60aea
Toll Tax Management System version 1.0 suffers from a remote SQL injection vulnerability.
317767316eef211ac935a713d8b56603dc6e80969ace44334e34402ca5937bf6