Archive

This exploit was brought to you by “reading the manual”, mostly. It is the second local privilege escalation I found while doing an extremely low effort audit of Zimbra. You should read…

We discovered vulnerabilities in Horde Webmail that allow an attacker to execute arbitrary code on Horde instances by having a victim open an email

0x01 ForewordsRecently I see some discussions about arbitrary file upload in Java environment on Internet. The main takling points are how to bypass file name detection when uploading arbitrary file.

Use POSIX file capabilities and PHP to create a backdoor that opens a root back-channel to the attacker's PC on port TCP 53 when a PHP page is called with a special url.

UAC Bypass via DLL hijacking of Microsoft Support Diagnostic Tool (MSDT). The UAC bypass method described here is based on DLL hijacking which happens when loading the Bluetooth diagnostic package.

How to hide Visual Basic Scripts HTA in other files and generate self playing HTA files without the .hta extension.

Automated malware analysis with Hatching Triage, the high-volume sandbox solution for SOCs, CERTs, SOARs, and MSSPs.

SaaS vanity URLs can be spoofed and used for phishing campaigns and other attacks. In this article, we’ll showcase two Box link types, two Zoom link types, and two Google Docs link type that we were able to spoof.

Windows Defener... как много боли в этом слове. Вероятнее всего, если вы хоть краем уха были связаны с распространением ВПО -- данный антивирус уже успел доставить вам массу неудобств. Имеющий самую обширную облачную базу в мире АВ не мог остаться без внимания крипторов и малварщиков, в...

Please upgrade your Elementor websites

Ambionics Security team discovered an RCE in Laravel, when the framework is in debug mode.

CTF writeups from GatorSheavesMutably (https://ctftime.org/team/109518) - ctf-writeups/hxp-2020/heiko at master · aels/ctf-writeups

A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.

In 2019, our intelligence team reported ProcessHacker being hijacked to kill a list of targeted processes. Explore more on DoppelPaymer implementation here.

As we head into 2022, ransomware groups continue to plague our digital environment with new and interesting techniques to bypass Antivirus (AV) and Endpoint Detection and Response (EDR) solutions and ensuring the successful execution of their ransomware payloads.   In December 2021, Stroz Friedberg’s Incident Response Services team engaged in a Digital Forensics and Incident […]

Web3 is a newfound technology, and it’s claimed that it can greatly increase the security on the websites using it. In fact, web3 is a new…

How simple link opening leads to RCE

File upload feature has a command injection vulnerability from which we get AWS credentials to access sensitive file in s3 bucket.

We recently discovered a code vulnerability in Horde Webmail that can be used by attackers to take over email accounts by sending a malicious email.

How to semi-automatically find vulnerabilities in WordPress plugins installed on about 10 million websites.

Take a look at hard statistics on what the 10 most popular secure email gateways of 2022 are.

Как сделать свой токен криптовалюту на базе сети Binance Smart Chain, пошаговая инструкция.  Содержание 1. Создание кошелька MetaMask 1.1. Резервная копия seed-фразы 1.2. Как подключить MetaMask к Binance Smart Chain 1.3. Пополнение кошелька MetaMask 1.3.1. Пополнение через биржу Binance 1.3.2. Пополнение через обменники 2. Выпуск собственного токена 2.1. Добавляем токен в кошелек 2.2. Публикация контракта...

In which we run a normal ELF binary on Linux without touching the filesystem(except /proc).

Description

Java Naming and Directory Interface (JNDI) is a Java API that allows clients to discover and look up data and objects via a name. These objects can be stored in different naming or directory services, such as Remote Method Invocation (RMI), Common Object Request Broker Architecture (CORBA), Lightweight Directory Access Protocol (LDAP), or Domain Name Service (DNS).

Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI handler has not been patched yet and can also be triggered through other browsers (requires confirmation of an inconspicuous dialog) and desktop applications that allow URI opening.

I often hear that AppLocker is not very safe and it is easy to bypass. Since I really like AppLocker and I recommend it to customers, I decided to do this blogpost series and go over the different …