Exploits and Security Updates to Core Impact Threat Intelligence

Exploits and Security Updates to Core Impact Threat Intelligence

When you buy Core Impact, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
Advantech WebAccess Dashboard Viewer Remote Code Execution Exploit This module exploits an arbitrary file upload vulnerability in Advantech WebAccess. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the FileUpload script allows unauthenticated callers to upload arbitrary code to directories in the server where the code can be automatically executed under the high-privilege context of the IIS AppPool. Authentication is not required to exploit this vulnerability. CVE-2016-0854 Exploits/Remote Windows
Apache Struts 2 DefaultActionMapper method Remote Code Execution Exploit The DefaultActionMapper class in Apache Struts 2 supports a Dynamic Method Invocation feature via the "method:" prefix. The information contained in this prefix is not properly sanitized before being evaluated as OGNL expressions on the server side, which allows remote attackers to execute arbitrary Java code on the server. This module exploits the vulnerability in any web application built on top of vulnerable versions of the Apache Struts 2 framework with the "struts.enable.DynamicMethodInvocation" configuration parameter in struts.xml set to True. CVE-2016-3081 Exploits/Remote Windows, Linux
Microsoft Windows Integer Overflow Exploit (MS16-039) This module exploits a "win32k.sys" integer overflow in Windows kernel by calling to "PathToRegion" function with crafted parameters. CVE-2016-0165 Exploits/Local Windows
Reprise License Manager edit_lf_process Write Arbitrary Files Exploit Update 4 The specific flaw exists within the edit_lf_process resource of the Reprise License Manager service. The issue lies in the ability to write arbitrary files with controlled data. An attacker could leverage this vulnerability to execute arbitrary code under the context of SYSTEM. This update specify information about vulnerable targets and add more targets. NOCVE-9999-74481 Exploits/Remote Windows
Microsoft Windows Media Center .MCL File Processing Remote Code Execution (MS16-059) Microsoft Windows Media Center (all versions prior to May 11th, 2016) contains a remote code execution upon processing specially crafted .MCL files. The vulnerability exists because Windows Media Center does not correctly processes paths in the "Run" parameter of the "Application" tag, bypassing the usual security warning displayed upon trying to run programs residing on remote (WebDAV/SMB) shares. CVE-2016-0185 Exploits/Client Side Windows
Hewlett Packard Enterprise Data Protector EXEC_BAR User Name Buffer Overflow Exploit The specific flaw exists within OmniInet.exe which listens by default on TCP port 5555. When parsing a malformed user name field in a request, the process blindly copies user supplied data into a fixed-length stack buffer. A remote attacker can abuse this to execute remote code under the context of SYSTEM. CVE-2016-2005 Exploits/Remote Windows
ManageEngine OpManager Exploit ManageEngine OpManager is vulnerable to abuse a SQL query functionality that allows attackers to insert and export a crafted WAR using 'IntegrationUser' hidden account credentials allowing us to install an agent. CVE-2015-7765 Exploits/Remote Windows
Linux Kernel CONFIG_BPF_SYSCALL Local Privilege Escalation Exploit Update This module exploits a user-after-free vulnerability in the Linux Kernel. When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in __bpf_map_get() and in replace_map_fd_with_map_ptr()). If the file descriptor table of the current task is shared, this causes f_count to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free). This can be exploited to gain root privileges by an unprivileged user. This update improves how the module removes unnecessary files after an exploitation attempt. NOCVE-9999-74975 Exploits/Local Linux
Linux Kernel CONFIG_BPF_SYSCALL Local Privilege Escalation Exploit This module exploits a user-after-free vulnerability in the Linux Kernel. When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in __bpf_map_get() and in replace_map_fd_with_map_ptr()). If the file descriptor table of the current task is shared, this causes f_count to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free). This can be exploited to gain root privileges by an unprivileged user. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. NOCVE-9999-74975 Exploits/Local Linux
Microsoft MSHTML dll based Binary Planting Exploit (MS16-037) Microsoft Internet Explorer 11 ships with MSHTML.DLL referencing various DLLs which are not present on a Windows 7 SP1 installationd.In addition certain applications like Microsoft Word,Excel,Powerpoint,Project,powershell etc , as well as a certain number of third party software are prone to remote binary planting due to using MSHTML.DLL in some ways. CVE-2016-0160 Exploits/Client Side Windows
Image Magick Command Injection Exploit Insufficient input validation in ImageMagick can lead to code execution when processing with certain types of files. This update introduces a module that generates an MVG format file that, when manipulated by the vulnerable versions of ImageMagick tools, deploys an agent in the supported systems. CVE-2016-3714 Exploits/Tools Linux
glibc getaddrinfo Buffer Overflow Verifier This module executes a program designed to check for a buffer overflow in glibc's getaddrinfo function. Multiple stack-based buffer overflows in the send_dg and send_vc functions in the libresolv library in the GNU C Library allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family. CVE-2015-7547 Exploits/Tools Linux
OpenSSH xauth Command Injection Vulnerability Exploit An authenticated user may inject arbitrary xauth commands by sending an x11 channel request that includes a newline character in the x11 cookie. The newline acts as a command separator to the xauth binary. The injected xauth commands are performed with the effective permissions of the logged in user. This attack requires the server to have 'X11Forwarding yes' enabled. This module injects source xauth command to retrieve arbitrary files. CVE-2016-3115 Exploits/Remote File Disclosure Linux
Reprise License Manager edit_lf_process Write Arbitrary Files Exploit Update 3 The specific flaw exists within the edit_lf_process resource of the Reprise License Manager service. The issue lies in the ability to write arbitrary files with controlled data. An attacker could leverage this vulnerability to execute arbitrary code under the context of SYSTEM. This update introduces more accurate information about vulnerable targets. NOCVE-9999-74481 Exploits/Remote Windows
Reprise License Manager activate_doit Command actserver Parameter Buffer Overflow Exploit Update 2 The specific flaw exists within the activate_doit function of the service. The issue lies in the handling of the server parameter which can result in overflowing a stack-based buffer. This update introduces more accurate information about vulnerable targets. CVE-2015-6946 Exploits/Remote Windows
Atlassian Bamboo commons-collections Java Library Deserialization Vulnerability Remote Code Execution Exploit Atlassian Bamboo is prone to a remote vulnerability that allows attackers to take advantage of a deserialization vulnerability present in the commons-collections Java library. By exploiting known methods, it is possible to remotely load a InvokerTransformer Java class, which allows the execution of system commands. CVE-2015-6576 Exploits/Remote Windows
TrendMicro node.js HTTP Server Remote Code Execution Exploit The Password Manager component installed by various Trend Micro products runs a Node.js HTTP server by default. This web server opens multiple HTTP RPC ports for handling API requests. For example, the openUrlInDefaultBrowser API function, which internally maps to a ShellExecute function call, allows and attacker to execute arbitrary commands on localhost without the need of any type of credentials. NOCVE-9999-74958 Exploits/Client Side Windows
Jenkins XStream Java Library Deserialization Vulnerability Remote Code Execution Exploit Jenkins is prone to a remote vulnerability due to deserialization of untrusted inputs, allowing attackers to instantiate arbitrary Java objects leading to remote code execution. There are several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. CVE-2016-0792 Exploits/Remote Windows, Linux
Jenkins XStream Java Library Deserialization Vulnerability Remote Code Execution Exploit Update Jenkins is prone to a remote vulnerability due to deserialization of untrusted inputs, allowing attackers to instantiate arbitrary Java objects leading to remote code execution. There are several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. This update adds support for HTTPS and IPv6. It also allows to change the application root path. CVE-2016-0792 Exploits/Remote Windows, Linux
Apple Mac OS X XPC Entitlements Local Privilege Escalation Exploit The Admin framework in Apple OS X contains a hidden backdoor API to gain root privileges. A local user can exploit this flaw in the checking of XPC entitlements. CVE-2015-1130 Exploits/Local Mac OS X
Microsoft Windows Secondary Logon Vulnerability Exploit (MS16-032) This module exploits a vulnerability in "Windows Secondary Logon Service" when it fails to properly manage request handles in memory. CVE-2016-0099 Exploits/Local Windows
Microsoft Internet Explorer VBScript Filter Type Confusion Exploit (MS15-106) The Filter function of the VBScript engine in Microsoft Internet Explorer is prone to a type confusion vulnerability when processing specially crafted parameters. This vulnerability allows attackers to execute arbitrary code on vulnerable machines by enticing unsuspecting users to visit a specially crafted website. CVE-2015-6053 Exploits/Client Side Windows
Exim perl_startup Configuration Variable Local Privilege Escalation Exploit Exim installations compiled with Perl support do not perform sanitation of the environment before loading a perl script defined with perl_startup setting in exim config file. This can be exploited by malicious local attackers to gain root privileges. CVE-2016-1531 Exploits/Local Linux
FreeBSD Kernel amd64_set_ldt Heap Overflow DoS The amd64_set_ldt() function in sys/amd64/amd64/sys_machdep.c in the FreeBSD kernel code is prone to an integer signedness error when processing a system call with specially crafted parameters originated from user space. This issue ultimately leads to a kernel heap overflow, which can be used by unprivileged local attackers to cause a kernel panic and crash the machine. CVE-2016-1885 Denial of Service/Local FreeBSD
Advantech WebAccess webvrpcs Service BwWebSvc ProjectName sprintf Buffer Overflow Exploit The specific flaw exists within the implementation of the 0x13C83 IOCTL in the BwOpcTool subsystem. A stack-based buffer overflow vulnerability exists in a call to memcpy using the ProjectName parameter. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system. NOCVE-9999-74956 Exploits/Remote Windows
NVIDIA Stereoscopic 3D Driver Service Privilege Escalation This module will exploit a vulnerability in the NVIDIA Stereoscopic 3D Driver Service. It will wait for users to login on the target system, installing agents for every user, until being able to install an agent for a user in the Built In Administrators group. CVE-2015-7865 Exploits/Local Windows
Easy File Sharing Web Server GET Request Exploit Easy File Sharing is prone to a buffer-overflow when handling a specially crafted GET request. NOCVE-9999-74961 Exploits/Remote Windows
Netgear ProSafe Network Management System Arbitrary File Upload Vulnerability Exploit A vulnerability exists in the FileUpload2Controller servlet. This servlet allows unauthenticated file uploads. By uploading a JSP file, an attacker can achieve remote code execution. CVE-2016-1524 Exploits/Remote Windows
Advantech WebAccess webvrpcs Service DrawSrv TagGroup Buffer Overflow Exploit The specific flaw exists within the implementation of the 0x280A IOCTL in the DrawSrv subsystem. A stack-based buffer overflow vulnerability exists in a call to strcpy. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system. CVE-2016-0856 Exploits/Remote Windows
Linux Kernel join_session_keyring Reference Counting Privilege Escalation Exploit The join_session_keyring() function in security/keys/process_keys.c in the Linux kernel is prone to a reference counter overflow that occurs when a process repeatedly tries to join an already existing keyring. This vulnerability can be leveraged by local unprivileged attackers to gain root privileges on the affected systems. CVE-2016-0728 Exploits/Local Linux