what you don't know can hurt you
Showing 1 - 25 of 5,467 RSS Feed

Operating System: Windows

Atlassian Confluence Widget Connector Macro Velocity Template Injection
Posted Apr 18, 2019
Authored by Dmitry Shchannikov, Daniil Dmitriev | Site metasploit.com

Widget Connector Macro is part of Atlassian Confluence Server and Data Center that allows embed online videos, slideshows, photostreams and more directly into page. A _template parameter can be used to inject remote Java code into a Velocity template, and gain code execution. Authentication is not required to exploit this vulnerability. By default, Java payload will be used because it is cross-platform, but you can also specify which native payload you want (Linux or Windows). Confluence before version 6.6.12, from version 6.7.0 before 6.12.3, from version 6.13.0 before 6.13.3 and from version 6.14.0 before 6.14.2 are affected.

tags | exploit, java, remote, code execution
systems | linux, windows
advisories | CVE-2019-3396
MD5 | 4099d2952e755caeb70a9a2d8a31e363
Microsoft Windows LUAFV PostLuafvPostReadWrite SECTION_OBJECT_POINTERS Race Condition
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver has a race condition in the LuafvPostReadWrite callback if delay virtualization has occurred during a read leading to the SECTION_OBJECT_POINTERS value being reset to the underlying file resulting in elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0836
MD5 | 6d02ec8a84f62a9cf2ee150b26a8f78a
Microsoft Windows LUAFV Delayed Virtualization Cache Manager Poisoning Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver can confuse the cache and memory manager to replace the contents of privileged file leading to elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0805
MD5 | 77b361493b8c0d502d033818bd814a0b
Microsoft Windows LUAFV NtSetCachedSigningLevel Device Guard Bypass
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the NtSetCachedSigningLevel system call can be tricked by the operation of LUAFV to apply a cached signature to an arbitrary file leading to a bypass of code signing enforcement under UMCI with Device Guard.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2019-0732
MD5 | c842665e8c982e999825c50d9c78df7a
Microsoft Windows LUAFV LuafvCopyShortName Arbitrary Short Name Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver bypasses security checks to copy short names during file virtualization which can be tricked into writing an arbitrary short name leading to elevation of privilege.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2019-0796
MD5 | dd49da95f51474f4c5e19bc2d1015952
Microsoft Windows LUAFV Delayed Virtualization Cross Process Handle Duplication Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver doesn't take into account a virtualized handle being duplicated to a more privileged process resulting in elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0731
MD5 | a1fec4a7c7f902a8a18eb1e16515b938
Microsoft Windows LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the LUAFV driver reuses the file's create request DesiredAccess parameter, which can include MAXIMUM_ACCESS, when virtualizing a file resulting in elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0730
MD5 | 3cb71794adeb390f66e06400fdb22445
Microsoft Windows CSRSS SxSSrv Cached Manifest Privilege Escalation
Posted Apr 16, 2019
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the SxS manifest cache in CSRSS uses a weak key allowing an attacker to fill a cache entry for a system binary leading to elevation of privilege.

tags | exploit
systems | windows
advisories | CVE-2019-0735
MD5 | 9f3bf345b40d34f07347582eafa1a2c3
Microsoft Windows Contact File Format Arbitary Code Execution
Posted Apr 11, 2019
Authored by hyp3rlinx, Brenner Little | Site metasploit.com

This Metasploit module allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw is due to processing of contact files.

tags | exploit, remote, arbitrary
systems | windows
MD5 | 6ee12bdb2b9701fe2b95191dbd4279bd
Microsoft Windows AppX Deployment Service Privilege Escalation
Posted Apr 10, 2019
Authored by Nabeel Ahmed

Microsoft Windows AppX deployment service privilege escalation exploit.

tags | exploit
systems | windows
advisories | CVE-2019-0841
MD5 | 7bd5fc96e46fc99787efb06cec384938
Wireshark Analyzer 3.0.1
Posted Apr 9, 2019
Authored by Gerald Combs | Site wireshark.org

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers.

Changes: Many crash vulnerabilities have been addressed. Various other updates.
tags | tool, sniffer, protocol
systems | windows, unix
advisories | CVE-2019-10894, CVE-2019-10895, CVE-2019-10896, CVE-2019-10897, CVE-2019-10898, CVE-2019-10899, CVE-2019-10900, CVE-2019-10901, CVE-2019-10902, CVE-2019-10903
MD5 | 370a113e1c8ec240c4621cfb5abb0c52
Chrome 73.0.3683.86 Stable Proof Of Concept
Posted Apr 4, 2019
Authored by Istvan Kurucsai

Chrome version 73.0.3683.86 stable exploit for chromium issue 941743, tested on Windows 10 x64, which leverages a flaw in the V8 javascript engine.

tags | exploit, javascript
systems | windows
MD5 | 3942490d2a3c9f4e77eb820e2de2a909
Red Hat Security Advisory 2019-0697-01
Posted Apr 2, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0697-01 - FreeRDP is a free implementation of the Remote Desktop Protocol, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Issues addressed include a buffer overflow vulnerability.

tags | advisory, remote, overflow, protocol
systems | linux, redhat, windows
advisories | CVE-2018-8786, CVE-2018-8787, CVE-2018-8788
MD5 | ab435ae6bcf13a53967e864439c14546
Microsoft Windows Win32k CVE-2019-0808 Local Privilege Escalation
Posted Mar 27, 2019
Authored by ze0r

Microsoft Windows Win32k local privilege escalation proof of concept exploit.

tags | exploit, local, proof of concept
systems | windows
advisories | CVE-2019-0808
MD5 | 54d60becfca69a9adfa1742ac481ac3e
Apple Security Advisory 2019-3-25-6
Posted Mar 26, 2019
Authored by Apple | Site apple.com

Apple Security Advisory 2019-3-25-6 - iCloud for Windows 7.11 is now available and addresses buffer overflow, code execution, and cross site scripting vulnerabilities.

tags | advisory, overflow, vulnerability, code execution, xss
systems | windows, apple, 7
advisories | CVE-2019-6201, CVE-2019-6232, CVE-2019-6236, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8542, CVE-2019-8544, CVE-2019-8551, CVE-2019-8556, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563
MD5 | 98634585031983c9f7d62cc137cb5956
Apple Security Advisory 2019-3-25-5
Posted Mar 26, 2019
Authored by Apple | Site apple.com

Apple Security Advisory 2019-3-25-5 - iTunes 12.9.4 for Windows is now available and addresses buffer overflow, code execution, and cross site scripting vulnerabilities.

tags | advisory, overflow, vulnerability, code execution, xss
systems | windows, apple
advisories | CVE-2019-6201, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8542, CVE-2019-8544, CVE-2019-8551, CVE-2019-8556, CVE-2019-8558, CVE-2019-8559, CVE-2019-8562, CVE-2019-8563
MD5 | 72c9194403f016e24d2f0c479d9b6caf
VMware Host VMX Process COM Class Hijack Privilege Escalation
Posted Mar 25, 2019
Authored by James Forshaw, Google Security Research

The VMX process (vmware-vmx.exe) process configures and hosts an instance of VM. As is common with desktop virtualization platforms the VM host usually has privileged access into the OS such as mapping physical memory which represents a security risk. To mitigate this the VMX process is created with an elevated integrity level by the authentication daemon (vmware-authd.exe) which runs at SYSTEM. This prevents a non-administrator user opening the process and abusing its elevated access. Unfortunately the process is created as the desktop user which results in the elevated process sharing resources such as COM registrations with the normal user who can modify the registry to force an arbitrary DLL to be loaded into the VMX process. Affects VMware Workstation Windows version 14.1.5 (on Windows 10). Also tested on VMware Player version 15.

tags | exploit, arbitrary, registry
systems | windows
advisories | CVE-2019-5512
MD5 | 89f47ed75e40cece6cb2c49cd4ca6364
VMware Host VMX Process Impersonation Hijack Privilege Escalation
Posted Mar 25, 2019
Authored by James Forshaw, Google Security Research

The VMX process (vmware-vmx.exe) process configures and hosts an instance of VM. As is common with desktop virtualization platforms the VM host usually has privileged access into the OS such as mapping physical memory which represents a security risk. To mitigate this the VMX process is created with an elevated integrity level by the authentication daemon (vmware-authd.exe) which runs at SYSTEM. This prevents a non-administrator user opening the process and abusing its elevated access. Unfortunately the process is created as the desktop user and follows the common pattern of impersonating the user while calling CreateProcessAsUser. This is an issue as the user has the ability to replace any drive letter for themselves, which allows a non-admin user to hijack the path to the VMX executable, allowing the user to get arbitrary code running as a trusted VMX process. Affects VMware Workstation Windows version 14.1.5 (on Windows 10). Also tested on VMware Player version 15.0.2.

tags | exploit
systems | windows
advisories | CVE-2018-5511
MD5 | c70a9a606361322046a94717d41168b1
Sourcetree Git Arbitrary Code Execution / URL Handling
Posted Mar 21, 2019
Authored by Atlassian, Terry Zhang

Sourcetree for macOS versions below 3.1.1 to 1.2 and Sourcetree for Windows versions below 3.0.17 to 0.5a suffer from code execution vulnerabilities related to the inclusion of git, a Mercurial hooks argument injection vulnerability, and a URI handling vulnerability.

tags | advisory, vulnerability, code execution
systems | windows
advisories | CVE-2018-17456, CVE-2018-20234, CVE-2018-20235, CVE-2018-20236
MD5 | 8c11e1db6b9aa505af1b9078fb0fe02f
exacqVision 9.8 Unquoted Service Path Privilege Escalation
Posted Mar 18, 2019
Authored by LiquidWorm | Site zeroscience.mk

exacqVision version 9.8 suffers from an unquoted search path issue impacting the services exacqVisionServer, dvrdhcpserver and mdnsresponder for Windows deployed as part of exacqVision software application. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

tags | exploit, arbitrary, local, root
systems | windows
MD5 | 98a9960106f1cef1cf55ce4666251455
Microsoft Windows Binary Planting
Posted Mar 18, 2019
Authored by Frederic Bourla

This is a short write-up on binary planting along with a few old-school 0-days which may still be helpful for pentesters willing to escalate privileges on Windows.

tags | paper
systems | windows
MD5 | 2610f1f8b017ac3a538d7e379b554592
BMC Patrol Agent Privilege Escalation / Command Execution
Posted Mar 15, 2019
Authored by b0yd | Site metasploit.com

This Metasploit module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verifies that the password of the provided user is correct. This also means if the software is running on a domain controller, it can be used to escalate from a normal domain user to domain admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses powershell to execute the payload. The powershell version tends to timeout on the first run so it may take multiple tries.

tags | exploit, remote
systems | windows
advisories | CVE-2018-20735
MD5 | 07522a05b37456d4fcb66eb0e429685a
Microsoft Windows MSHTML Engine Edit Remote Code Execution
Posted Mar 13, 2019
Authored by Eduardo Braun Prado

The Microsoft Windows MSHTML Engine is prone to a vulnerability that allows attackers to execute arbitrary code on vulnerable systems because of improper validation of specially crafted web documents (html, xhtml, etc).

tags | exploit, web, arbitrary
systems | windows
advisories | CVE-2019-0541
MD5 | f319a8657955eabd715a9358f82d0668
Debian Security Advisory 4406-1
Posted Mar 12, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4406-1 - Francis McBratney discovered that the Windows Azure Linux Agent created swap files with world-readable permissions, resulting in information disclosure.

tags | advisory, info disclosure
systems | linux, windows, debian
advisories | CVE-2019-0804
MD5 | 17e85027c8b215cf2925edc737d2cdc5
Microsoft Windows .Reg File / Dialog Box Message Spoofing
Posted Mar 11, 2019
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

The Windows registry editor allows specially crafted .reg filenames to spoof the default registry dialog warning box presented to an end user. This can potentially trick unsavvy users into choosing the wrong selection shown on the dialog box. Furthermore, we can deny the registry editor its ability to show the default secondary status dialog box (Win 10), thereby hiding the fact that our attack was successful.

tags | exploit, spoof, registry
systems | windows
MD5 | 105ff93a7fefdb9d6ae572f2070820c3
Page 1 of 219
Back12345Next

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close