Published | JUMPSEC LABS

QUEST KACE Desktop Authority Pre-Auth Remote Code Execution (CVE-2021-44031)

by tellson | Sep 8, 2022 | Uncategorized

Software: QUEST KACE Desktop AuthorityAffected Versions: 11.1 and earlier. Vendor page: https://www.quest.com/products/kace-desktop-authority/CVE Reference: CVE-2021-44031Published: 19/11/2021CVSS 3.1 Score: 9.8 CriticalAttack Vector: Pre-authenticated Remote Code ExecutionCredits: Tom Ellson JUMPSEC recently discovered multiple vulnerabilities in Quest KACE Desktop Authority 11.1. This is an endpoint management system that is used widely across the globe and is prevalent within a wide range of organisations. A pre-auth remote code execution on the KACE Desktop Authority platform exists in which successful exploitation of these vulnerabilities would allow an adversary to achieve remote code execution without first needing to authenticate to the service. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44031...

Abusing SharedUserData For Defense Evasion and Exploitation

Over the past few weeks, I have been working on a custom packer in my spare time. In doing so, I needed to create a method of delaying execution within the unpacker stub that...

(ZOHO) ManageEngine Desktop Central – Path Traversal / Arbitrary File Write

Software: Zoho ManageEngine Desktop CentralAffected Versions: Before 10.0.662Vendor page:...

(ZOHO) ManageEngine Desktop Central – SQL Injection / Arbitrary File Write

by tellson | Aug 2, 2022 | Uncategorized

Software: Zoho ManageEngine Desktop CentralAffected Versions: Before 10.0.662Vendor page: https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.htmlCVE Reference: CVE-2021-46164Published: 09/01/2022CVSS 3.1 Score: 8.8 HighAttack Vector: SQL Injection / Arbitrary File WriteCredits: Tom Ellson This is the first post in a two part series on Manage Engine Desktop...

Azure – Securing Shared Access Signatures (SAS)

by tellson | Jul 14, 2022 | Uncategorized

Advisory CVE-2021-41551 Leostream Connection Broker – Authenticated Zip Slip

by lrckt | Jan 26, 2022 | Research, Security Bug, Vulnerability

Software: Leostream Connection BrokerAffected Versions: 9.0.40.17Vendor page: https://leostream.com/CVE Reference: CVE-2021-41551Published: 25/01/2022Attack Vector: path traversal, authenticatedCredits: Andrei Constantin Scutariu, Lenk Ratchakrit Seriamnuai, Andrea Malusardi Summary Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading a...

Advisory CVE-2021-41550 Leostream Connection Broker – Authenticated Remote Code Execution

by lrckt | Jan 26, 2022 | Research, Security Bug, Vulnerability

Software: Leostream Connection BrokerAffected Versions: 9.0.40.17Vendor page: https://leostream.com/CVE Reference: CVE-2021-41550Published: 25/01/2022Attack Vector: Remote, authenticatedCredits: Andrei Constantin Scutariu, Lenk Ratchakrit Seriamnuai, Andrea Malusardi Summary As the Leostream Connection Broker version: 9.0.40.17 allowed an attacker to upload any content through Third Party...

No Logs? No Problem! Incident Response without Windows Event Logs

by editor | Nov 22, 2021 | Forensics, Incident Response, Windows

In this article, we discuss some Digital Forensics and Incident Response (DFIR) techniques you can leverage when you encounter an environment without Windows event logs.

PowerShell Jobs

by editor | Oct 7, 2021 | Detection, Incident Response, Monitoring, Windows

JUMPSEC investigators recently observed an adversary weaponising PowerShell Jobs to schedule their attack whilst responding to an incident. We discuss what PowerShell Jobs are, how they can be leveraged for malicious purposes, and how defenders can protect, detect, and respond to neutralise the threat.

Burp Suite and Beyond: Exploring non-HTTP protocols using MITM_RELAY

by editor | Aug 24, 2021 | Application Security, burpsuite, network, Network Tools, Research

In this article, Muhammet takes us on a deep technical journey to persevere beyond the limitations of the proxy tool Burpsuite, and explore non-HTTP, application-layer protocols using ‘MITM RELAY’.

Running Once, Running Twice, Pwned! Windows Registry Run Keys

by editor | Aug 11, 2021 | Detection, Incident Response, Monitoring, Windows

The Windows registry is a vast and complex topic and cannot be understood and defended in one article. One particular area of interest from a security perspective is registry run keys. In this article, we discuss who uses them, how to uncover abuse, and how to eradicate evil from them.

« Older Entries

JUMPSEC LABS

QUEST KACE Desktop Authority Pre-Auth Remote Code Execution (CVE-2021-44031)

Abusing SharedUserData For Defense Evasion and Exploitation

(ZOHO) ManageEngine Desktop Central – Path Traversal / Arbitrary File Write

(ZOHO) ManageEngine Desktop Central – SQL Injection / Arbitrary File Write

Azure – Securing Shared Access Signatures (SAS)

Advisory CVE-2021-41551 Leostream Connection Broker – Authenticated Zip Slip

Advisory CVE-2021-41550 Leostream Connection Broker – Authenticated Remote Code Execution

No Logs? No Problem! Incident Response without Windows Event Logs

PowerShell Jobs

Burp Suite and Beyond: Exploring non-HTTP protocols using MITM_RELAY

Running Once, Running Twice, Pwned! Windows Registry Run Keys

[Latest Posts]

[Categories]

GitHub Activity

Twitter

Latest from JUMPSEC

Disclaimer