Abusing LNK "Features" for Initial Access and Persistence https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
v3ded.github.io
Abusing LNK "Features" for Initial Access and Persistence
Preface Today we’ll talk about the misuse of .LNK trigger keys as a means of achieving initial access and persistence. I first heard about this topic myself ...
The Race to Native Code Execution in PLCs https://www.claroty.com/2021/05/28/blog-research-race-to-native-code-execution-in-plcs/
Claroty
Siemens PLC Software Vulnerabilities Uncovered | Team82
Claroty has found a severe memory protection bypass vulnerability (CVE-2020-15782) in Siemens PLC Software, the SIMATIC S7-1200 and S7-1500. Learn more.
Memory Analysis For Beginners With Volatility — Coreflood Trojan: Part 2 https://infosecwriteups.com/memory-analysis-for-beginners-with-volatility-coreflood-trojan-part-2-42bdb46683f2
Medium
Memory Analysis For Beginners With Volatility
Hello everyone, welcome back to my memory analysis series. If you didn’t read the first part of the series — go back and read it here:
Overwolf 1-Click Remote Code Execution - CVE-2021-33501 https://swordbytes.com/blog/security-advisory-overwolf-1-click-remote-code-execution-cve-2021-33501/
Overwolf 1-Click Remote Code Execution - CVE-2021-33501 | SwordBytes Security
SwordBytes researchers have identified an Unauthenticated Remote Code Execution (RCE) vulnerability in Overwolf’s Client Application by abusing a Reflected Cross-Site Scripting (XSS) issue present in the “overwolfstore://” URL handler. This vulnerability…
CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required https://blog.bricked.tech/posts/exiftool/
blog.bricked.tech
CVE-2021-22204 - Recreating a critical bug in ExifTool, no Perl smarts required.
This writeup explains how to reverse engineer the security patch and craft an exploit for CVE-2021-22204, without any real Perl knowledge.
Grav CMS 1.7.10 - Code Execution Vulnerabilities https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
Sonarsource
Grav CMS 1.7.10 - Code Execution Vulnerabilities
We responsibly disclosed two code execution vulnerabilities in Grav CMS, one of the most popular flat-file PHP CMS in the market. Let’s see what we can learn from them and discuss their patches!
Database of vulnerabilities showing also economic impacts and black market trading https://hardening-security.com/vulnerabilities
Nice explanation » Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474) https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-solarwinds-orion-deserialization-to-rce-cve-2021-31474-b31a5f168bf0
Medium
Phân tích lỗ hổng SolarWinds Orion Deserialization to RCE (CVE-2021–31474)
Sau 2 tháng trời diff patch Exchange thì tới patch của tháng 5 này thì mình đã bị ngộ độc và quá chán nản,
Dynamic payload generation with mingw https://passthehashbrowns.github.io/dynamic-payload-generation-with-mingw
Public API to lookup hash values against known database of files (from CIRCL) https://hashlookup.circl.lu/
Great Windows Kernel exploitation tutorial. It starts here https://rootkits.xyz/blog/2017/06/kernel-setting-up/, follow the other links from the post
rootkit
Windows Kernel Exploitation Tutorial Part 1: Setting up the Environment - rootkit
Intro Recently, I had the pleasure to attend the training on Windows Kernel Exploitation at nullcon by the HackSysTeam. The training was well executed, and I got the intro into the world of kernel. But, as you know, nobody could teach you internals about…
Windows Kernel Debugging & Exploitation Part 2 - Stack Overflow https://hacklido.com/blog/147
Great post » The Much Misunderstood SeRelabelPrivilege https://www.tiraniddo.dev/2021/06/the-much-misunderstood.html
www.tiraniddo.dev
The Much Misunderstood SeRelabelPrivilege
Based on my previous blog post I recently had a conversation with a friend and well-known Windows security researcher about token privilege...
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html
Trend Micro
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS
We analyze the patched CVE-2021-30724 vulnerability, affecting macOS, iOS, and iPadOS. If exploited, this flaw can allow privilege escalation.
OSX/Hydromac: A new macOS malware leaked from a Flashcards app https://blog.confiant.com/osx-hydromac-a-new-macos-malware-leaked-from-a-flashcards-app-2af28f1caa9e
Medium
OSX/Hydromac: A new macOS malware leaked from a Flashcards app
At @ConfiantIntel we had some “luck” finding a new malware targeting the new Apple flagship M1 computers. I put “luck” between quotes, as…
Fuzzing the Office Ecosystem https://research.checkpoint.com/2021/fuzzing-the-office-ecosystem/
Check Point Research
Fuzzing the Office Ecosystem - Check Point Research
Research By: Netanel Ben-Simon and Sagi Tzadik Introduction Microsoft Office is a very commonly used software that can be found on almost any standard computer. It is also integrated inside many products of the Microsoft / Windows ecosystem such as Office…
PuzzleMaker attacks with Chrome zero-day exploit chain https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/
CVE-2021–22201: Arbitrary file read on Gitlab https://tradahacking.vn/cve-2021-22201-arbitrary-file-read-on-gitlab-d84d77cd83e3
Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html
iamelli0t’s blog
Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample
The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called…
Taming Virtual Machine Based Code Protection – 1 https://malwareandstuff.com/taming-virtual-machine-based-code-protection-1/
Malware and Stuff
Taming Virtual Machine Based Code Protection – 1
Overcoming obfuscation in binaries has always been an interesting topic for me, especially in combination with malware. Over the last weeks I’ve been playing around with Virtualised Code Prot…