MS Windows GDI+ Proof of Concept (MS08-052) #2
—————————————————————————————–
Operating System: XP SP2
Gdiplus.dll Version: 5.1.3102.2180
Credit:
John Smith,
Evil Fingers
GIF Template Reference: http://www.sweetscape.com/010editor/templates/files/GIFTemplate.bt
PoC Link: http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability_ver2.txt
http://www.evilfingers.com/patchTuesday/PoC.php
========================================================================
阅读全文 »
MS Windows Token Kidnapping本地提权的解决方案
作者：刺
昨天放出来的exp让大家狠狠的爽了一把吧，听说有人连续提权了十多台webshell的。
今天MS更新了安全公告
这个漏洞是由于在NetworkService 或者 LocalService 下运行的代码，可以访问同样是在 NetworkService 或者 LocalService 下运行的进程，某些进程允许提升权限为LocalSystem。
对于IIS，默认安装是不受影响的，受影响的是你的ASP.NET代码是以 Full Trust 运行，如果权限低于 Full Trust，也不会受影响。老的Asp 代码不受影响，只有 ASP.NET才受影响。
阅读全文 »
InsomniaShell
InsomniaShell is a tool for use during penetration tests, when you have ability to upload or create an arbitrary .aspx page. This .aspx page is an example of using native calls through pinvoke to provide either a reverse shell or a bind shell.
It has the added advantage of searching through all accessible processes looking for a SYSTEM or Administrator token to use for impersonation. InsomniaShell.zip
Tags: WebShell扫权限.aspx
作者：cnqing
ScanWriterable.aspx
<%@ Page Language="C#" ValidateRequest="false" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Text" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>ScanWrtieable</title>
</head>
<body>
阅读全文 »MS Windows 2003 Token Kidnapping Local Exploit PoC
鬼仔：提权很好用，直接system。文章末尾贴个TR那里的测试图。
编译好的：http://www.blogjava.net/Files/baicker/Churrasco.rar （via 009）
From：http://nomoreroot.blogspot.com/2008/10/windows-2003-poc-exploit-for-token.html
It has been a long time since Token Kidnapping presentation (http://www.argeniss.com/research/TokenKidnapping.pdf)
was published so I decided to release a PoC exploit for Win2k3 that alows to execute code under SYSTEM account.
阅读全文 »
Real-Time Defender v1.0 多处内核拒绝服务漏洞
作者：MJ0011
Real-time Defender Professional（简称RTD)是一款主机入侵防护系统。
RTD的最新版本v1.0中存在多处内核拒绝服务漏洞，可导致任意权限用户在安装了RTD的系统上可引发蓝屏。
出问题的组件：ProSecur.sys ,版本：1.1.1.0，CheckSum = 0x00046c99 , TimeStamp = 0x48a51de8
阅读全文 »
