Exploit the possiblities
Showing 1 - 23 of 23 RSS Feed

Files from James Forshaw

First Active2011-08-11
Last Active2017-11-15
Microsoft Windows WLDP/Scriptlet CLSID UMCI Bypass
Posted Nov 15, 2017
Authored by James Forshaw, Google Security Research

The enlightened lockdown policy check for COM Class instantiation can be bypassed in Scriptlet hosts leading to arbitrary code execution on a system with UMCI enabled (e.g. Device Guard).

tags | exploit, arbitrary, code execution
MD5 | 9f26a70091ba091d126dd62e22de0746
Microsoft Windows WLDP/MSHTML CLSID UMCI Bypass
Posted Oct 14, 2017
Authored by James Forshaw, Google Security Research

The enlightened lockdown policy check for COM Class instantiation can be bypassed in MSHTML hosts leading to arbitrary code execution on a system with UMCI enabled (e.g. Device Guard).

tags | exploit, arbitrary, code execution
advisories | CVE-2017-11823
MD5 | 1b2d4d07eba9dc0ac29034a6908021a0
Microsoft Windows PPL Process Injection Privilege Escalation
Posted Aug 29, 2017
Authored by James Forshaw, Google Security Research

Microsoft Windows suffers from an issue where it is possible to inject code into a PPL protected process by hijacking COM objects leading to accessing PPL processes such as Lsa and AntiMalware from an administrator.

tags | exploit
systems | windows
MD5 | f56afa12662c26fd335723f194b4b1df
VirtualBox Windows Process DLL UNC Path Signature Bypass Privilege Escalation
Posted Aug 4, 2017
Authored by James Forshaw, Google Security Research

VirtualBox suffers from a privilege escalation vulnerability due to a windows process DLL UNC path signature bypass vulnerability.

tags | exploit, bypass
systems | windows
advisories | CVE-2017-10129
MD5 | b7b24727a13df6c61f230dfaf8caa4b7
VirtualBox indows Process DLL Signature Bypass Privilege Escalation
Posted Aug 4, 2017
Authored by James Forshaw, Google Security Research

VirtualBox suffers from a privilege escalation vulnerability due to a windows process DLL signature bypass vulnerability.

tags | exploit, bypass
systems | windows
advisories | CVE-2017-10204
MD5 | e1476610f1872866ca63ea58ddd4a886
Microsoft Windows COM Session Moniker Privilege Escalation
Posted Jul 14, 2017
Authored by James Forshaw, Google Security Research | Site metasploit.com

Microsoft Windows has a bad fix for the COM session moniker that can allow for elevation of privilege.

tags | advisory
systems | windows
advisories | CVE-2017-0298
MD5 | 3415ad73c8d69869f7f6b54856151c87
MS16-032 Secondary Logon Handle Privilege Escalation
Posted Jul 12, 2016
Authored by b33f, James Forshaw, khr0x40sh | Site metasploit.com

This Metasploit module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This Metasploit module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.

tags | exploit
systems | windows, 7
advisories | CVE-2016-0099
MD5 | 37a34759947c810455938c65ab482084
Microsoft Windows Local WebDAV NTLM Reflection Privilege Escalation
Posted Mar 24, 2015
Authored by James Forshaw

A default installation of Windows 7/8 can be made to perform a NTLM reflection attack through WebDAV which allows a local user to elevate privileges to local system. It can also be used to escape application sandboxes if TCP socket access is not blocked. Microsoft will not fix this issue.

tags | advisory, local, tcp
systems | windows, 7
MD5 | acf5e4414852c101a882e4682f56ac7f
Microsoft Windows NtApphelpCacheControl Improper Authorization Check
Posted Jan 15, 2015
Authored by sinn3r, James Forshaw | Site metasploit.com

On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext. This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check. This Metasploit module currently only affects Windows 8 and Windows 8.1, and requires access to C:\Windows\System\ComputerDefaults.exe (although this can be improved).

tags | exploit, local
systems | windows
advisories | CVE-2015-0002
MD5 | 0a24503dad5a5aa40600b53cdb125f0c
ExploitRemotingService .NET Tool
Posted Nov 19, 2014
Authored by James Forshaw

This is a tool to exploit .NET Remoting Services vulnerable to CVE-2014-1806 or CVE-2014-4149. It only works on Windows although some aspects might work in Mono on *nix.

tags | exploit
systems | windows
advisories | CVE-2014-1806, CVE-2014-4149
MD5 | 2f08afabb6a71899af115848864f91b0
MS14-009 .NET Deployment Service IE Sandbox Escape
Posted Jun 27, 2014
Authored by juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module abuses a process creation policy in the Internet Explorer Sandbox which allows to escape the Enhanced Protected Mode and execute code with Medium Integrity. The problem exists in the .NET Deployment Service (dfsvc.exe), which can be run as Medium Integrity Level. Further interaction with the component allows to escape the Enhanced Protected Mode and execute arbitrary code with Medium Integrity.

tags | exploit, arbitrary
advisories | CVE-2014-0257
MD5 | 6fa97cd4c465e9e94afcce09121b97e6
MS13-097 Registry Symlink IE Sandbox Escape
Posted Jun 27, 2014
Authored by juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module exploits a vulnerability in Internet Explorer Sandbox which allows to escape the Enhanced Protected Mode and execute code with Medium Integrity. The vulnerability exists in the IESetProtectedModeRegKeyOnly function from the ieframe.dll component, which can be abused to force medium integrity IE to user influenced keys. By using registry symlinks it's possible force IE to add a policy entry in the registry and finally bypass Enhanced Protected Mode.

tags | exploit, registry
advisories | CVE-2013-5045
MD5 | ef7740b999fc84dc0a624768d0f11944
Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access
Posted Nov 26, 2013
Authored by Vitaliy Toropov, juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module exploits a vulnerability on Microsoft Silverlight. The vulnerability exists on the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible to dereference arbitrary memory which easily leverages to arbitrary code execution. In order to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class from System.Windows.dll. This Metasploit module has been tested successfully on IE6 - IE10, Windows XP SP3 / Windows 7 SP1 on both x32 and x64 architectures.

tags | exploit, arbitrary, code execution, bug bounty, packet storm
systems | windows, xp, 7
advisories | CVE-2013-0074, CVE-2013-3896, OSVDB-91147, OSVDB-98223
MD5 | db77ce1a58c39fd936f1e6241e3e85cb
Apache Santuario XML Security For C++ Signature Bypass
Posted Jun 18, 2013
Authored by James Forshaw

The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content. The vulnerability affects only applications that do not perform proper checking/analysis of the content of the Reference elements in the Signature, but the bug exacerbates this problem by opening such applications to attacks using arbitrary content, instead of just attacks involving malicious, but signed, content. Versions prior to 1.7.1 are affected.

tags | advisory, arbitrary, spoof
advisories | CVE-2013-2153
MD5 | 6909adda4a133b3bb2789f0b09950d0f
Apache Santuario XML Security For C++ Heap Overflow
Posted Jun 18, 2013
Authored by James Forshaw

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitrary code execution. If verification of the signature occurs prior to actual evaluation of a signing key, this could be exploited by an unauthenticated attacker. Apache Santuario XML Security for C++ library versions prior to 1.7.1 are affected.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2013-2156
MD5 | e9bfa2ee300325c5ed08df2593f5a6ff
Apache Santuario XML Security For C++ Denial Of Service / Bypass
Posted Jun 18, 2013
Authored by James Forshaw

A bug exists in the processing of the output length of an HMAC-based XML Signature that would cause a denial of service when processing specially chosen input. Exploitation of this issue does not require authenticated content. In very unusual cases, inputs could be chosen in such a way that the fix for the issue in CVE-2009-0217 could be bypassed, enabling improper verification of a signature. Versions prior to 1.7.1 are affected.

tags | advisory, denial of service
advisories | CVE-2013-2155
MD5 | a1fb07cc6fa97feddc0acf800c8a09d8
Apache Santuario XML Security For C++ Stack Overflow
Posted Jun 18, 2013
Authored by James Forshaw

A stack overflow, possibly leading to arbitrary code execution, exists in the processing of malformed XPointer expressions in the XML Signature Reference processing code. An attacker could use this to exploit an application performing signature verification if the application does not block the evaluation of such references prior to performing the verification step. The exploit would occur prior to the actual verification of the signature, so does not require authenticated content. Versions prior to 1.7.1 are affected.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2013-2154
MD5 | 2e4c041ed6441f26334548c790ec639b
Java Applet Driver Manager Privileged toString() Remote Code Execution
Posted Jun 10, 2013
Authored by juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module abuses the java.sql.DriverManager class where the toString() method is called over user supplied classes, from a doPrivileged block. The vulnerability affects Java version 7u17 and earlier. This exploit bypasses click-to-play on IE throw a specially crafted JNLP file. This bypass is applied mainly to IE, when Java Web Start can be launched automatically throw the ActiveX control. Otherwise the applet is launched without click-to-play bypass.

tags | exploit, java, web, activex
advisories | CVE-2013-1488, OSVDB-91472
MD5 | 8047941c6cbc310111bf58285aeab37e
Microsoft .NET Framework Privilege Escalation
Posted Jan 10, 2013
Authored by James Forshaw, Context Information Security Ltd | Site contextis.co.uk

The Microsoft .NET Framework contains an error in the Intermediate Language (IL) verifier which could allow hosted partial trust code to elevate privileges to escape a sandboxed environment resulting in arbitrary code execution with the permissions of the user. Affected are Microsoft .Net Frameworks versions 1.1 through 4.5.

tags | advisory, arbitrary, code execution
advisories | CVE-2013-0004
MD5 | b2c977d9688a0585d75e1206d9b93d0f
Citrix XenServer 6.0.2 Privilege Escalation
Posted Oct 30, 2012
Authored by James Forshaw, Context Information Security Ltd | Site contextis.co.uk

Citrix XenServer version 5.0 through 6.0.2 suffer from a privilege escalation vulnerability.

tags | advisory
advisories | CVE-2012-4606
MD5 | fc97283d76c9558cee6b0af7236ae621
.NET 4 Remote Code Execution
Posted May 31, 2012
Authored by James Forshaw, Context Information Security Ltd

.NET versions 1.0 through 4 suffer from a remote code execution vulnerability.

tags | advisory, remote, code execution
advisories | CVE-2012-0160, CVE-2012-0161
MD5 | fde464f2676d6b0c6ba962260016eae4
Firefox 4 / 5 Heap Overflows
Posted Aug 19, 2011
Authored by James Forshaw, Context Information Security Ltd

Context discovered two memory corruption issues related to Firefox code that processes WebGL, that could result in remote code execution via a malicious web page. Heap overflows make use of the WebGL shader compiler and the ANGLE library. Versions 4.0.1 and 5 are affected.

tags | advisory, remote, web, overflow, code execution
advisories | CVE-2011-2987, CVE-2011-2988
MD5 | 8811c7f58cd14b6dd8340557070d7ef3
.NET 4 - Microsoft Chart Control Information Disclosure
Posted Aug 11, 2011
Authored by Nico Leidecker, James Forshaw

The Microsoft Chart Control is vulnerable to an information disclosure vulnerability. By sending a specific GET request to an application implementing the chart control, attackers could read arbitrary files on the system.

tags | advisory, arbitrary, info disclosure
advisories | CVE-2011-1977
MD5 | bcbd008986b45a536abfa9e125b3ff01
Page 1 of 1
Back1Next

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close