ndo

Windows OLE Automation Array Remote Code Execution

This Metasploit module exploits the Windows OLE automation array remote code execution vulnerability. The vulnerability exists in Internet Explorer 3.0 until version 11 within Windows 95 up to Windows 10.





ndo

Banks Turns London Man Into RFID-Enabled Guinea Pig




ndo

Hackers Claim RFID Smart-Card Hack, But Vendor Disagrees




ndo

Microsoft Windows WizardOpium Local Privilege Escalation

Microsoft Windows WizardOpium local privilege escalation exploit.




ndo

Deep Instinct Windows Agent 1.2.29.0 Unquoted Service Path

Deep Instinct Windows Agent version 1.2.29.0 suffers from an unquoted service path vulnerability.




ndo

CoronaBlue / SMBGhost Microsoft Windows 10 SMB 3.1.1 Proof Of Concept

CoronaBlue aka SMBGhost proof of concept exploit for Microsoft Windows 10 (1903/1909) SMB version 3.1.1. This script connects to the target host, and compresses the authentication request with a bad offset field set in the transformation header, causing the decompresser to buffer overflow and crash the target.




ndo

Microsoft Windows SMB 3.1.1 Remote Code Execution

Microsoft Windows SMB version 3.1.1 suffers from a code execution vulnerability.




ndo

Microsoft Windows 10 SMB 3.1.1 Local Privilege Escalation

Microsoft Windows 10 SMB version 3.1.1 SMBGhost local privilege escalation exploit.




ndo

Microsoft Windows Net Use Insufficent Authentication

The Windows "net use" network logon type-3 command does not prompt for authentication when the built-in Administrator account is enabled and both remote and originating systems suffer from password reuse. This also works as "standard" user but unfortunately we do not gain high integrity privileges. However, it opens the door and increases the attack surface if the box we laterally move to has other vulnerabilities present.




ndo

Microsoft Windows NtFilterToken ParentTokenId Incorrect Setting Privilege Escalation

Microsoft Windows suffers from an NtFilterToken ParentTokenId incorrect setting that allows for elevation of privileges.




ndo

Microsoft Windows SE_SERVER_SECURITY Security Descriptor Owner Privilege Escalation

In Microsoft Windows, by using the poorly documented SE_SERVER_SECURITY Control flag it is possible to set an owner different to the caller, bypassing security checks.




ndo

Microsoft Windows Unquoted Service Path Privilege Escalation

This Metasploit module exploits a logic flaw due to how the lpApplicationName parameter is handled. When the lpApplicationName contains a space, the file name is ambiguous. Take this file path as example: C:program fileshello.exe; The Windows API will try to interpret this as two possible paths: C:program.exe, and C:program fileshello.exe, and then execute all of them. To some software developers, this is an unexpected behavior, which becomes a security problem if an attacker is able to place a malicious executable in one of these unexpected paths, sometimes escalate privileges if run as SYSTEM. Some software such as OpenVPN 2.1.1, OpenSSH Server 5, and others have the same problem.





ndo

Windows Has A New Wormable Vulnerability, And There's No Patch In Sight






ndo

Linux/x86 Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode

114 bytes small Linux/x86 random bytes encoder and XOR/SUB/NOT/ROR execve(/bin/sh) shellcode.




ndo

Windows/x86 Dynamic Bind Shell / Null-Free Shellcode

571 bytes small Microsoft Windows x86 dynamic bind shell and null-free shellcode.




ndo

Windows/x86 Null Free WinExec Calc.exe Shellcode

195 bytes small Windows/x86 null-free WinExec Calc.exe shellcode.





ndo

Microsoft Windows NtUserSetWindowFNID Win32k User Callback

An elevation of privilege vulnerability exists in Microsoft Windows when the Win32k component fails to properly handle objects in memory. This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This Metasploit module is tested against Windows 10 v1703 x86.




ndo

Microsoft Windows 7 Build 7601 (x86) Local Privilege Escalation

Microsoft Windows 7 Build 7601 (x86) local privilege escalation exploit.




ndo

Microsoft Windows Internet Settings Security Feature Bypass

Microsoft Windows suffers from an Internet Settings misconfiguration security feature bypass vulnerability. Versions affected include Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019.




ndo

Microsoft Windows 7 (x86) BlueKeep RDP Use-After-Free

Microsoft Windows 7 (x86) BlueKeep remote desktop protocol windows kernel use-after-free exploit.




ndo

Microsoft Windows 7 Screen Lock Shellcode

9 bytes small Microsoft Windows 7 screen locking shellcode.






ndo

Microsoft Windows NtUserMNDragOver Local Privilege Escalation

This Metasploit module exploits a NULL pointer dereference vulnerability in MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver() system call. The NULL pointer dereference occurs because the xxxMNFindWindowFromPoint() function does not effectively check the validity of the tagPOPUPMENU objects it processes before passing them on to MNGetpItemFromIndex(), where the NULL pointer dereference will occur. This module has been tested against Windows 7 x86 SP0 and SP1. Offsets within the solution may need to be adjusted to work with other versions of Windows, such as Windows Server 2008.





ndo

Pandora FMS 7.0NG Remote Code Execution

Pandora FMS version 7.0NG suffers from a net_tools.php remote code execution vulnerability.




ndo

Pandora FMS Ping Authenticated Remote Code Execution

This Metasploit module exploits a vulnerability found in Pandora FMS 7.0NG and lower. net_tools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands.




ndo

Win32/XP SP3 Windows Magnifier Shellcode

52 bytes small Win32/XP SP3 windows magnifier shellcode.




ndo

Mandos Encrypted File System Unattended Reboot Utility 1.8.10

The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.




ndo

netABuse Insufficient Windows Authentication Logic Scanner

netABuse is a scanner that identifies systems susceptible to a Microsoft Windows insufficient authentication logic flaw.





ndo

Windows User Accounts Penetration Testing

Whitepaper called Windows User Accounts Penetration Testing. Written in Persian.




ndo

Microsoft Windows Firewall Disabling Shellcode

644 bytes small Microsoft Windows x86 shellcode that disables the Windows firewall, adds the user MajinBuu with password TurnU2C@ndy!! to the system, adds the user MajinBuu to the local groups Administrators and Remote Desktop Users, and then enables the RDP Service.




ndo

Druva inSync Windows Client 6.5.2 Privilege Escalation

Druva inSync Windows Client version 6.5.2 suffers from a local privilege escalation vulnerability.




ndo

Microsoft Windows Kernel REG_RESOURCE_LIST Memory Disclosure

The Microsoft Windows kernel suffers from a 64-bit pool memory disclosure vulnerability via REG_RESOURCE_LIST registry values (CmResourceTypeDevicePrivate entries).




ndo

Microsoft Windows Kernel REG_RESOURCE_LIST Memory Disclosure

The Microsoft Windows kernel suffers from a 64-bit pool memory disclosure vulnerability via REG_RESOURCE_LIST registry values (videoprt.sys descriptors).




ndo

Microsoft Windows Kernel REG_RESOURCE_REQUIREMENTS_LIST Memory Disclosure

The Microsoft Windows kernel suffers from a 64-bit pool memory disclosure vulnerability via REG_RESOURCE_REQUIREMENTS_LIST registry values.




ndo

Microsoft Windows Desktop Bridge Privilege Escalation

Microsoft Windows suffers from a Desktop Bridge Virtual Registry arbitrary file read / write privilege escalation vulnerability.




ndo

Microsoft Windows Desktop Bridge Privilege Escalation

Microsoft Windows suffers from a Desktop Bridge Virtual Registry NtLoadKey arbitrary file read / write privilege escalation vulnerability.




ndo

Windows UAC Protection Bypass (Via Slui File Handler Hijack)

This Metasploit module will bypass UAC on Windows 8-10 by hijacking a special key in the Registry under the Current User hive, and inserting a custom command that will get invoked when any binary (.exe) application is launched. But slui.exe is an auto-elevated binary that is vulnerable to file handler hijacking. When we run slui.exe with changed Registry key (HKCU:SoftwareClassesexefileshellopencommand), it will run our custom command as Admin instead of slui.exe. The module modifies the registry in order for this exploit to work. The modification is reverted once the exploitation attempt has finished. The module does not require the architecture of the payload to match the OS. If specifying EXE::Custom your DLL should call ExitProcess() after starting the payload in a different process.




ndo

Microsoft Windows Desktop Bridge Virtual Registry Incomplete Fix

The handling of the virtual registry for desktop bridge applications can allow an application to create arbitrary files as system resulting in privilege escalation. This is because the fix for CVE-2018-0880 (MSRC case 42755) did not cover all similar cases which were reported at the same time in the issue.




ndo

Microsoft Windows 10 UAC Bypass By computerDefault

This exploit permits an attacker to bypass UAC by hijacking a registry key during computerSecurity.exe (auto elevate windows binary) execution.




ndo

Microsoft Windows 10 User Sessions Stuck

This exploit modifies a windows language registry key which causes some windows binaries to stick, including login which makes the session unusable. The key is in HKCU and can be modified without admin rights, but with a bypass UAC, all user sessions can be paralyzed by using reg.exe and user's NTUSER.DAT.




ndo

Windows UAC Protection Bypass

This Metasploit module modifies a registry key, but cleans up the key once the payload has been invoked. The module does not require the architecture of the payload to match the OS.




ndo

Microsoft Windows .Reg File / Dialog Box Message Spoofing

The Windows registry editor allows specially crafted .reg filenames to spoof the default registry dialog warning box presented to an end user. This can potentially trick unsavvy users into choosing the wrong selection shown on the dialog box. Furthermore, we can deny the registry editor its ability to show the default secondary status dialog box (Win 10), thereby hiding the fact that our attack was successful.