On May 6, 2022, Rarlab released version 6.17, which addresses CVE-2022-30333, a path traversal vulnerability reported to them by Sonar, who posted a write-up a…

Tổng quan * Tháng 5/2022, Rarlab công bố lỗ hổng CVE-2022-30333 của phần mềm unrar các phiên bản trước 6.12 hoặc trước 6.1.7 chạy trên hệ điều hành Linux hoặc UNIX. Lỗ hổng trên cho phép attacker có thể ghi file ra các thư mục tùy ý

For Cloudflare customers, having Cloudflare is like paying a peace of mind insurance that your system will get 99% protection against…

Translated version ( Russian version ) is in the comments hello boys, This is my first post in the forum and in the contest, so I wanted to make it something good. Sorry I am writing this article in English but If you have any question or anything unclear don't hesitate to ask me and I will...

A true story on taking over a client’s Azure tenant via a successful phish. TL;DR A tempting phish got lots of users to disclose their passwords, and a lack of […]

We discovered vulnerabilities in Horde Webmail that allow an attacker to execute arbitrary code on Horde instances by having a victim open an email

0x01 ForewordsRecently I see some discussions about arbitrary file upload in Java environment on Internet. The main takling points are how to bypass file name detection when uploading arbitrary file.

Use POSIX file capabilities and PHP to create a backdoor that opens a root back-channel to the attacker's PC on port TCP 53 when a PHP page is called with a special url.

UAC Bypass via DLL hijacking of Microsoft Support Diagnostic Tool (MSDT). The UAC bypass method described here is based on DLL hijacking which happens when loading the Bluetooth diagnostic package.

How to hide Visual Basic Scripts HTA in other files and generate self playing HTA files without the .hta extension.

Windows Defener... как много боли в этом слове. Вероятнее всего, если вы хоть краем уха были связаны с распространением ВПО -- данный антивирус уже успел доставить вам массу неудобств. Имеющий самую обширную облачную базу в мире АВ не мог остаться без внимания крипторов и малварщиков, в...

Please upgrade your Elementor websites

Ambionics Security team discovered an RCE in Laravel, when the framework is in debug mode.

CTF writeups from GatorSheavesMutably (https://ctftime.org/team/109518) - ctf-writeups/hxp-2020/heiko at master · aels/ctf-writeups

A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.

In 2019, our intelligence team reported ProcessHacker being hijacked to kill a list of targeted processes. Explore more on DoppelPaymer implementation here.

As we head into 2022, ransomware groups continue to plague our digital environment with new and interesting techniques to bypass Antivirus (AV) and Endpoint Detection and Response (EDR) solutions and ensuring the successful execution of their ransomware payloads.   In December 2021, Stroz Friedberg’s Incident Response Services team engaged in a Digital Forensics and Incident […]

Web3 is a newfound technology, and it’s claimed that it can greatly increase the security on the websites using it. In fact, web3 is a new…

How simple link opening leads to RCE

How to semi-automatically find vulnerabilities in WordPress plugins installed on about 10 million websites.

Description

Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI handler has not been patched yet and can also be triggered through other browsers (requires confirmation of an inconspicuous dialog) and desktop applications that allow URI opening.

I often hear that AppLocker is not very safe and it is easy to bypass. Since I really like AppLocker and I recommend it to customers, I decided to do this blogpost series and go over the different …

The unusual technique invokes the Windows App Installer to deliver malware

XAR is a file archive format used in macOS, and is part of various file formats, including .xar, .pkg, .safariextz, and .xip files. XAR archives are extracted using the xar command-line utility. XAR was initially developed under open source, however, the original project appears to be no longer maintained. Apple maintains their own branch of XAR for macOS, which is published on the Apple Open Source website. The xar utility suffers from a logical vulnerability which allows files to be extracted outside of the intended destination folder, resulting in arbitrary file write anywhere on the filesystem (permissions allowing).