ASL IT SECURITY

We develop red team products and provide tools for LEA agencies and governments to combat cyber crime.

[ASL IT SECURITY @ASL_IT]

@doc_guard @subtee @malwrhunterteam @luigi_martire94 @executemalware On which office version did you tested it? The VBS is not getting triggered in office 365 fully updated.

[ASL IT SECURITY @ASL_IT]

#CVE-2022-30333 #zimbra #unrar POC

https://t.co/1k556v72Zg

[ASL IT SECURITY @ASL_IT]

Different orgcharts.exe versions crash on different buffer size. But all are vulnerable.

[ASL IT SECURITY @ASL_IT]

OrgCharts.exe #msoffice Anyone have knowledge of .opx file structure or any reference link?? Possible 0day? More than 160 "AAAAAA....."

[ASL IT SECURITY @ASL_IT]

@HaifeiLi @wdormann @GossiTheDog @EXPMON_ Seems like SE trick, so that the target enables macro.

[ASL IT SECURITY @ASL_IT]

Now I understand HTTPS is secure. The docx POC generated from the builder was detected by 7 Antivirus, a little relief! Until I decided to generate the file with HTTPS in URL :-(
#CVE-2021-40444 #0day #hacking #redteam #infosec #virustotal

[ASL IT SECURITY @ASL_IT]

I have made 3 builders for docx, cab, and HTML for CVE-2021-40444. Goal is to test how easily we can bypass static AV detections for the DOCX file, by just tampering with some characters.

https://t.co/54pwDdgjwt

The results were very predictable.
#infosec #hacking #redteam

[ASL IT SECURITY @ASL_IT]

@Max_Mal_ But you still need cab file to drop the payload to %temp%? Or you are not using cab at all?

[ASL IT SECURITY @ASL_IT]

@JojolionBOT Not yet. But trying.

[ASL IT SECURITY @ASL_IT]

@ksha @vxunderground @vxunderground thanks I got the HTML samples from you. non Obfuscated ones.

[ASL IT SECURITY @ASL_IT]

To achieve exploitation via preview pane, just convert the generated docx to RTF.

PS: Read RTF specs, check old RTF exploit variants. RTF exploits are more fun to FUD, and the tricks are countless. #cve-2021-40444

[j00sean @j00sean]

I'm too late at CVE-2021-40444 party. But i just wanted to take a look at MSIE exploitation. Awesome to see a full exploit (RCE w/ sandbox escape) only using 6 lines of javascript code. Cool no doubt.

[ASL IT SECURITY @ASL_IT]

For VT lovers this is the POC for CVE-2021-40444 generated by these builders. #virustotal

[ASL IT SECURITY @ASL_IT]

Tested again now and confirm that it is working now. The DOCX POC file will not be corrupted now.

#cve-2021-40444 #0day #infosec #redteam #blueteam #hacking #security #securitybreach #malware #cybernews

[ASL IT SECURITY @ASL_IT]

Sorry in the repo _rels dir was not uploaded somehow. Anyone of you who got corrupted docx file, please pull again and try.

[ASL IT SECURITY @ASL_IT]

@novitoll @ulexec cabarc.exe -i 1234 -p -m NONE n https://t.co/T9ITSdTHaF "../championship.inf", Then you need to change the DLL size. Maybe I will release a cab generator tool on github.

[ASL IT SECURITY @ASL_IT]

A couple of modifications and poof. Only 7 AV detected. #cve-2021-40444

[ASL IT SECURITY @ASL_IT]

@mj0011sec Great job!

[ASL IT SECURITY @ASL_IT]

@io_r_us @Edgespot_io No this is not cve-2019-5786. But it seems a PDF document used by readnotify (a service used to know if the receiver of an email read the email, or opened an attachment.)

[ASL IT SECURITY @ASL_IT]

@InfoCap4 No idea. Couldn't figure it out. And without password how it is decrypting to execute the exploit???

[ASL IT SECURITY @ASL_IT]

Help decrypting MS Equation editor sample #cve-2018-0802. This sample is detected by just 3 AV on virustotal and is encrypted using AES/RSA. https://t.co/lFKlZnToVS

PS: You need to rename it to .xlsx for it to work.