{"vulnerability": "CVE-2021-3448", "sightings": [{"uuid": "ed3f3478-1aa3-4529-bd1d-055bce4458d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "14c7d8a1-a13a-4c62-8e31-587da4266c0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "8f8694c3-43e3-4485-be81-3d4207ca1a4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "MISP/7feea642-93ce-4a7b-8892-a36c0332d4c1", "content": "", "creation_timestamp": "2024-11-14T06:09:51.000000Z"}, {"uuid": "9b2dd53d-ff67-412e-90bc-cfe9f7a17650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971483", "content": "", "creation_timestamp": "2024-12-24T20:29:58.541694Z"}, {"uuid": "7aaefd81-4b9f-474f-890e-d8c635ab607d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971491", "content": "", "creation_timestamp": "2024-12-24T20:30:06.108058Z"}, {"uuid": "e21b1b18-cfdc-47ba-b901-0eb10a5ee393", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "ceb91fb6-019a-42bf-978f-e1f13a8898e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:38.000000Z"}, {"uuid": "ad16e327-e531-4bcc-9f21-cd019d131604", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:30.000000Z"}, {"uuid": "b8898e5f-8f15-4ad4-a6de-6b2b7ec53a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:30.000000Z"}, {"uuid": "befafa89-c5d3-41b5-bd10-5ebe10b5dda0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_19/2021", "content": "", "creation_timestamp": "2021-07-01T09:58:27.000000Z"}, {"uuid": "cea5fde3-758a-42a2-91e6-c3e353ff55dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8f383a2c-0933-4595-a47a-b72b986c464e", "content": "", "creation_timestamp": "2026-02-02T12:27:54.438103Z"}, {"uuid": "6f1ecf38-4f8a-4957-9e85-ac35bb7f0a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-34486", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f12a6188-2357-4d44-a15f-010c7da0b35c", "content": "", "creation_timestamp": "2026-02-02T12:27:55.357949Z"}, {"uuid": "36e6735b-c78d-4856-90dc-e9141048e27d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "Telegram/ChiQjS4UaWKnqMA3WFN9IYyYRRDrGxvTzw0QktDoPe9cKg", "content": "", "creation_timestamp": "2021-08-10T23:24:21.000000Z"}, {"uuid": "96f58d0f-8f80-48ca-bcca-d33d273a28db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/cKure/6196", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Microsoft shares guidance on new Windows Print Spooler vulnerability.\n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481\n\nhttps://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/", "creation_timestamp": "2021-07-16T11:21:39.000000Z"}, {"uuid": "a7ce3d47-ea2d-4334-b486-f548458be3cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/cKure/6195", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Zero-day: Microsoft Warns of New Unpatched Windows Print Spooler Vulnerability identified by Jacob Baines.\n\nTracked as\u00a0CVE-2021-34481\u00a0(CVSS score: 7.8), the issue concerns a local privilege escalation flaw that could be abused to perform unauthorized actions on the system.\n\nhttps://thehackernews.com/2021/07/microsoft-warns-of-new-unpatched.html", "creation_timestamp": "2021-07-16T11:20:26.000000Z"}, {"uuid": "d2f5775d-8700-4cbf-9ab8-0470ebf61558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "published-proof-of-concept", "source": "https://t.me/orderofsixangles/1605", "content": "CVE-2021-34486: Event Tracing for Windows (ETW) TimerCallbackContext Object Use-After-Free Vulnerability\nhttps://www.pixiepointsecurity.com/blog/cve-2021-34486.html", "creation_timestamp": "2021-09-28T07:51:42.000000Z"}, {"uuid": "1ce2e4ca-d663-4bad-90b0-f63ef8e9f9fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/BleepingComputer/10148", "content": "Microsoft shares guidance on new Windows Print Spooler vulnerability\n\nMicrosoft is sharing mitigation guidance on a new Windows Print Spooler vulnerability tracked as CVE-2021-34481 that was disclosed tonight. [...]\n\nhttps://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/", "creation_timestamp": "2021-07-16T00:55:47.000000Z"}, {"uuid": "c6bea80a-5dac-4dca-83b2-bc2ecaa83659", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "published-proof-of-concept", "source": "https://t.me/itsec_news/175", "content": "\u041f\u043e\u0434\u0431\u043e\u0440\u043a\u0430 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \ud83d\udc47\n\n\u0412 \u0434\u0432\u0443\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 npm \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043c\u0430\u043b\u0432\u0430\u0440\u044c\nhttps://xakep.ru/2021/11/08/coa-rc-hacked/\n\n\u041d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043a\u0443\u043f\u043a\u0438 \u0432 Apple Pay, Samsung Pay \u0438 Google Pay\nhttps://xakep.ru/2021/11/11/apple-pay-samsung-pay-google-pay/\n\n\u0414\u043b\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0442\u0447\nhttps://xakep.ru/2021/11/12/cve-2021-34484/\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0447\u0430\u0442-\u0431\u043e\u0442\u0430 \u043d\u0430 \u043f\u043e\u0440\u0442\u0430\u043b\u0435 \u0413\u043e\u0441\u0443\u0441\u043b\u0443\u0433\nhttps://xakep.ru/2021/11/12/gosuslugi-attack/\n\n\u0413\u043b\u0430\u0432\u0430 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Methbot \u043f\u0440\u0438\u0433\u043e\u0432\u043e\u0440\u0435\u043d \u043a 10 \u0433\u043e\u0434\u0430\u043c \u0442\u044e\u0440\u044c\u043c\u044b\nhttps://xakep.ru/2021/11/12/methbot-op-sentenced/\n\nWhatsApp \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0442 \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0430\u043a\u0442\u043e\u0432\nhttps://www.securitylab.ru/news/526523.php\n\n\u0428\u043f\u0438\u043e\u043d \u0434\u043b\u044f Android \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440 \u0441\u043e \u0441\u043a\u0432\u043e\u0437\u043d\u044b\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c\nhttps://www.anti-malware.ru/news/2021-11-15-111332/37471\n\n\u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0424\u0411\u0420 \u0438 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u0441\u0442\u0440\u0430\u0448\u0438\u043b\u043a\u0443 \u043e \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0435\nhttps://www.anti-malware.ru/news/2021-11-15-111332/37470", "creation_timestamp": "2021-11-15T07:11:59.000000Z"}, {"uuid": "b9bffcc9-b16a-488e-9ca9-0942332a9e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "published-proof-of-concept", "source": "https://t.me/ptescalator/59", "content": "\ud83d\udd26  \u041a\u0430\u043a \u043c\u044b \u043d\u0430\u0448\u043b\u0438 ITW-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2024-38178\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u0435\u0436\u0435\u043c\u0435\u0441\u044f\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0441\u0432\u0435\u0436\u0435\u0437\u0430\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u044b \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 ESC-VR \u043e\u0431\u0440\u0430\u0449\u0430\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u0422\u0430\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u043d\u0430\u0448\u0435\u0439 \u0433\u043b\u0430\u0432\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0435\u0441\u043b\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a\u0430\u044f \u0431\u044b \u0442\u043e \u043d\u0438 \u0431\u044b\u043b\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u0445. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2024-38178 \u2014 \u044d\u0442\u043e \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0442\u0438\u043f\u0430 Type Confusion (CWE-843). \u0413\u043e\u0432\u043e\u0440\u044f \u043f\u043e-\u043f\u0440\u043e\u0441\u0442\u043e\u043c\u0443: \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f, \u043a\u043e\u0433\u0434\u0430 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u0438, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u043c\u0430\u044f \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u043c \u0442\u0438\u043f\u0430 A, \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u0434\u043e\u043c \u043a\u0430\u043a \u043e\u0431\u044a\u0435\u043a\u0442 \u0442\u0438\u043f\u0430 B.\n\n\u041f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432 \u043f\u0430\u0442\u0447, \u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u0434\u0435\u043b\u0430\u043d\u044b \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0435\u0439 \u0437\u0430 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043c\u0430\u0441\u0441\u0438\u0432\u0430\u043c\u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 GlobOpt::OptArraySrc. \u041f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430\u0441\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438, \u043a\u043e\u0433\u0434\u0430 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0442\u043e\u0440 \u043d\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0438\u043d\u043e\u0433\u0434\u0430 \u0442\u0438\u043f \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0432 runtime.\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0441\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e Google ProjectZero \u0442\u0430\u043a \u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e, \u043a\u0430\u043a \u0438 \u043c\u044b, \u0442\u043e \u0432\u044b \u0443\u0436\u0435 \u043e\u0431\u043e \u0432\u0441\u0435\u043c \u0434\u043e\u0433\u0430\u0434\u0430\u043b\u0438\u0441\u044c \ud83d\ude09\n\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f GlobOpt::OptArraySrc \u0443\u0436\u0435 \u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0432 ITW-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0435, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0432 \u043f\u043e\u0441\u0442\u0435, \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0435\u043c CVE-2022-41128. \n\n\u0412 \u043f\u043e\u0441\u0442\u0435 \u0435\u0441\u0442\u044c PoC, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e CVE-2022\u201341128. \u0412\u0437\u044f\u0432 \u0438\u0437 \u043d\u0435\u0433\u043e \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438, \u043c\u044b \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u043f\u043e\u0438\u0441\u043a \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u0438 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u0445 \u043f\u043e \u0444\u0430\u0439\u043b\u0430\u043c, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u0441\u0442\u0440\u043e\u043a\u0438:\n\n\u2022 6E6577204F626A656374287B0D0A20 \n\u2022 206E657720496E7433324172726179\n\n\u041c\u044b \u043d\u0430\u0448\u043b\u0438 \u0432\u0441\u0435\u0433\u043e \u043e\u0434\u0438\u043d \u0444\u0430\u0439\u043b. \u041e\u043d \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0438\u0437 KR, \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0432 \u044d\u0442\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0435, \u043e \u0447\u0435\u043c \u043a\u043e\u0441\u0432\u0435\u043d\u043d\u043e \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0437 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0438 Microsoft. \n\n\u041f\u0440\u043e\u0433\u043d\u0430\u0432 \u0444\u0430\u0439\u043b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0430\u0442\u0447\u0435\u043c \u0438 \u0431\u0435\u0437 \u043d\u0435\u0433\u043e, \u043c\u044b \u0431\u044b\u0441\u0442\u0440\u043e \u043f\u043e\u043d\u044f\u043b\u0438, \u0447\u0442\u043e \u044d\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u043e, \u0447\u0442\u043e \u043c\u044b \u0438\u0441\u043a\u0430\u043b\u0438. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u0445\u043e\u0436\u0435\u0441\u0442\u044c\u044e \u0441 CVE-2022-41128 \u043c\u044b \u0441\u0447\u0438\u0442\u0430\u0435\u043c, \u0447\u0442\u043e \u0438 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u0444\u0430\u0437\u0437\u0438\u043d\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PoC \u0434\u043b\u044f CVE-2022-41128 \u0438 CVE-2021-34480.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e, \u043a\u043e\u0433\u0434\u0430 JIT-\u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 \u0443\u0431\u0435\u0436\u0434\u0435\u043d, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f X \u0438\u043c\u0435\u0435\u0442 \u0442\u0438\u043f js::TypedArray, \u043d\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 X \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 Y \u0442\u0438\u043f\u0430 js::DynamicObj. \u0414\u0430\u043b\u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e \u0438\u043d\u0434\u0435\u043a\u0441\u0443 4, 11, 12, \u0447\u0442\u043e\u0431\u044b \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u043f\u043e\u043b\u044f \u043c\u0430\u0441\u0441\u0438\u0432\u0430 js::JavaScriptNativeArray, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f Y. \u041c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u043f\u043e\u043b\u044f \u0445\u0440\u0430\u043d\u044f\u0442 \u0440\u0430\u0437\u043c\u0435\u0440 \u043c\u0430\u0441\u0441\u0438\u0432\u0430. \n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u044d\u0442\u043e\u0433\u043e \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0434\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432\u044b \u043d\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0447\u0442\u0435\u043d\u0438\u0435. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0437\u0430\u043d\u044f\u043b\u043e \u0431\u044b \u043d\u0435\u043f\u0440\u0438\u043b\u0438\u0447\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u043e\u0441\u0442\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 stay tunned \u0438 happy hunting \ud83d\ude42\n\nYARA-\u043f\u0440\u0430\u0432\u0438\u043b\u043e (\u043d\u0430 \u0444\u0430\u0439\u043b):\n\n\nrule exploit_CVE_2024_38178 {\n      strings:\n          $a = { 6E6577204F626A656374287B0D0A20 }\n          $b = { 206E657720496E7433324172726179 } \n     condition:\n           all of them\n}\n\n\nIoCs:\n\n\nSHA256: 736092B71A9686FDE43D3C4ABD941A6774721B90B17D946C9D05AF19C84DF0A4\n\n\n\nhttp://img[.]mobonad[.]com/images/20230912/43\n\n\n#escvr #itw #jscript9 #reverse\n@ptescalator", "creation_timestamp": "2024-09-09T12:43:50.000000Z"}, {"uuid": "4fe8a62b-c569-4885-96e7-cc7cedae6d2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "Telegram/bVYj6lfAOHbULrxDvll7Gtzf8qfA5tHx_uN7vfs6iQqBP70Y", "content": "", "creation_timestamp": "2025-02-06T02:41:37.000000Z"}, {"uuid": "55f12785-20df-485f-8de2-1002076ccb09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://t.me/arpsyndicate/1087", "content": "#ExploitObserverAlert\n\nCVE-2021-34484\n\nDESCRIPTION: Exploit Observer has 4 entries related to CVE-2021-34484. Windows User Profile Service Elevation of Privilege Vulnerability\n\nFIRST-EPSS: 0.001960000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-04T02:03:24.000000Z"}, {"uuid": "ccc007a6-2fdc-4d16-92a3-84101f4933d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/363", "content": "#poc #CVE-2021-34484\nWindows user profile service elevation of privilege vulnerability\n_ The problem affects all versions of the operating system, including Windows 10, Windows 11 and Windows Server 2022\n\nhttps://github.com/klinix5/ProfSvcLPE", "creation_timestamp": "2021-10-29T22:19:37.000000Z"}, {"uuid": "c6cb4f63-4a44-4241-9ccd-bd42ee95a54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://t.me/true_secator/2270", "content": "\u041f\u043b\u043e\u0445\u0430\u044f \u043d\u043e\u0432\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u041e\u0421 Windows: \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Windows 10, Windows 11 \u0438 Windows Server 2022, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u043e\u0439 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 LPE.\n \n\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Windows, \u0430 \u0442\u0430\u043a\u0436\u0435 PoC, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e SYSTEM \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n \n\u0412 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0440\u0430\u043d\u0435\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434\u043e\u043c \u041d\u0430\u0441\u0435\u0440\u0438.\n \n\u041d\u043e \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0437\u0443\u0447\u0438\u0432 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, \u043e\u043d \u0441\u043c\u043e\u0433 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u043e\u0432\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043d\u0430 GitHub. \u041e\u043d \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 SYSTEM, \u043f\u043e\u043a\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u043f\u0440\u043e\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (UAC).\n \nZDI \u0438 Microsoft \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0438\u043b\u0438\u0441\u044c \u043b\u0438\u0448\u044c \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0435, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430. \u0412 \u0434\u0440\u0443\u0433\u0438\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0438 \u043f\u0440\u0438\u0447\u0438\u043d\u044b Microsoft \u043d\u0435 \u0441\u0442\u0430\u043b\u0438 \u0443\u0433\u043b\u0443\u0431\u043b\u044f\u0442\u044c\u0441\u044f. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0447\u0435\u043c, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u043c\u043e\u0433 \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438 \u0432\u043d\u043e\u0432\u044c \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n \n\u0425\u043e\u0440\u043e\u0448\u0430\u044f \u043d\u043e\u0432\u043e\u0441\u0442\u044c \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2021-34484 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0437\u043d\u0430\u043d\u0438\u044f \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0430\u043b\u043e\u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e\u0439 \u0434\u043b\u044f \u0430\u0442\u0430\u043a.\n \nCVE-2021-34484, \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u043d\u0435, \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0430, \u043a\u0430\u043a \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 PrintNightmare, \u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e \u0432\u0441\u0435 \u0435\u0449\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430. \u0418 \u043c\u043e\u0433\u0443\u0442 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0435\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0442\u044c \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n \n\u0412\u043f\u0440\u043e\u0447\u0435\u043c, Microsoft \u043a\u0430\u043a \u0432\u0441\u0435\u0433\u0434\u0430 - \u0432 \u0441\u0432\u043e\u0435\u043c \u0440\u0435\u043f\u0435\u0440\u0442\u0443\u0430\u0440\u0435.", "creation_timestamp": "2021-10-29T18:59:00.000000Z"}, {"uuid": "a51b7051-8a1b-4be9-8a8e-c815e3532dd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/2760", "content": "\u200b\u200bMicrosoft \u0432 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0440\u0430\u0437 \u0443\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0447\u0430\u0441\u0442\u043d\u044b\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u0432 \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 IT-\u0433\u0438\u0433\u0430\u043d\u0442 \u0442\u0449\u0435\u0442\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043c\u0435\u0441\u044f\u0446\u0430\u043c\u0438, \u0434\u0430\u0436\u0435 \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0432 \u043f\u0430\u0431\u043b\u0438\u043a\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043f\u043e\u0434 \u043d\u0438\u0445. \n\n0-day CVE-2021-34484 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS v3 7,8 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 Windows 10, Windows 11 \u0438 Windows Server, \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u043e\u0431\u0440\u0435\u043b\u0430 \u0441\u0432\u043e\u0439 \u043f\u0430\u0442\u0447. \u042d\u0442\u0430 \u0442\u0430 \u0441\u0430\u043c\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u00a0\u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434 \u041d\u0430\u0441\u0435\u0440\u0438 \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b PoC, \u043e\u0431\u0445\u043e\u0434\u0438\u0432\u0448\u0438\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f Microsoft.\n\n\u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u044d\u0442\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043b\u043e - \u043e\u043d\u0438 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u043c\u0435\u0442\u0438\u043b\u0438 \u0431\u0430\u0433\u0443 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439, \u0438 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437. \n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0430 \u043f\u043e\u043c\u043e\u0449\u044c \u043c\u0438\u043a\u0440\u043e\u043c\u044f\u0433\u043a\u0438\u043c \u043f\u0440\u0438\u0448\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 0patch, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\u00a0\u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 Windows. \u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0432\u044b\u043a\u0430\u0442\u0438\u043b \u0432\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 PatchTuesday \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 2022 \u0433\u043e\u0434\u0430, \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u0432 \u043e\u0431\u0445\u043e\u0434\u0443 \u043d\u043e\u0432\u044b\u0439 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2022-21919 \u0438\u00a0\u043f\u043e\u043c\u0435\u0442\u0438\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439. \n\n\u041d\u043e \u041d\u0430\u0441\u0435\u0440\u0438 \u0432\u043d\u043e\u0432\u044c \u043d\u0430\u0448\u0435\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, \u0434\u043e\u0431\u0430\u0432\u0438\u0432, \u0447\u0442\u043e \u044d\u0442\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0431\u044b\u043b\u0430 \u00ab\u0445\u0443\u0436\u0435 \u043f\u0435\u0440\u0432\u043e\u0439\u00bb. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u043b\u0435 \u0442\u0435\u0441\u0442\u043e\u0432 \u0435\u0449\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u0434\u043b\u044f profext.dll \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 0patch \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u043e\u043d \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0442 \u043d\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u044d\u0442\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043c\u0435\u0434\u0432\u0435\u0436\u044c\u044f \u0443\u0441\u043b\u0443\u0433\u0430 \u0432 \u0432\u0438\u0434\u0435 \u043d\u043e\u0432\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0442 Microsoft \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u041f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e 0patch\u00a0\u0432\u043d\u043e\u0432\u044c \u0432\u044b\u0440\u0443\u0447\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u0443\u0436\u0435 \u043d\u043e\u0432\u044b\u0439 \u043c\u0438\u043a\u0440\u043e\u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 Windows. \u0421\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e Windows 10 1803, Windows 10 1809 \u0438 Windows 10 2004 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043f\u0430\u0442\u0447\u0435\u043c 0patch, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u044d\u0442\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u0430\u0441\u044c \u0438 \u043e\u043d\u0438 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Microsoft, \u0437\u0430\u043c\u0435\u043d\u044f\u044e\u0449\u0435\u0433\u043e DLL.\n\n\u0421\u0430\u043c\u0438 Microsoft \u043e\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u0434\u0430\u0436\u0435 \u043d\u0435 \u0432 \u043a\u0443\u0440\u0441\u0435 \u0432\u0441\u0435\u0445 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c LPE, \u043d\u043e \u043e\u0431\u0435\u0449\u0430\u043b\u0438 \u0437\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u044d\u0442\u0438\u043c \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u043c, \u0447\u0442\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442, \u043f\u043e\u0436\u0430\u043b\u0443\u0439, \u0442\u043e\u043b\u044c\u043a\u043e \u0431\u043e\u043b\u044c.\n\n\u0421\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u0432\u0441\u0435, \u0447\u0442\u043e \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u043e \u0437\u043d\u0430\u0442\u044c \u043e Microsoft.", "creation_timestamp": "2022-03-22T18:20:00.000000Z"}, {"uuid": "a3e34165-7cb4-4eaf-9356-909895b26d1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://t.me/NeKaspersky/1395", "content": "\u041f\u043e \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u0438 \u0432 \u0425\u044d\u043b\u043b\u043e\u0443\u0438\u043d \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0442 \u0441\u0442\u0440\u0430\u0448\u043d\u044b\u0435 \u0432\u0435\u0449\u0438. \u041d\u043e \u043e\u0442 Microsoft \u0442\u0430\u043a\u043e\u0433\u043e \u0441\u044e\u0440\u043f\u0440\u0438\u0437\u0430 \u043d\u0438\u043a\u0442\u043e \u043d\u0435 \u0436\u0434\u0430\u043b.(\u0421\u043c\u0435\u0445 \u043d\u0430\u0448\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0430 \u043f\u043e \u0418\u0411 \u0437\u0430 \u043a\u0430\u0434\u0440\u043e\u043c)\n\n\u0412\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Windows 10, 11 \u0438 Server 2022 \u0432 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u0438\u0437-\u0437\u0430 \u043d\u043e\u0432\u043e\u0439 zero-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 LPE. \n\nPoC \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0443\u0436\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e System.\n\n\u041a \u0441\u043b\u043e\u0432\u0443, \u0434\u043b\u044f Windows \u0443\u0436\u0435 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0410\u0431\u0434\u0435\u043b\u044c\u0445\u0430\u043c\u0438\u0434 \u041d\u0430\u0441\u0435\u0440\u0438. \u0412 \u043e\u0431\u0449\u0435\u043c, \u041d\u0430\u0441\u0435\u0440\u0438 \u043c\u043e\u043b\u043e\u0434\u0435\u0446, \u043d\u043e \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0441\u0432\u043e\u0435\u0439 \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u043d \u0441\u043d\u043e\u0432\u0430 \u043d\u0430\u0441\u0435\u0440\u0438\u043b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043e\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u043e\u0432\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430. \n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 ZDI \u0438 Microsoft \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d\u0438 \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0438\u043b\u0438\u0441\u044c \u043b\u0438\u0448\u044c \u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0435, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430. \u0414\u0440\u0443\u0433\u0438\u0435 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u0431\u043e\u0448\u043b\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043e\u0439, \u043d\u0435 \u0441\u0442\u0430\u0432 \u0443\u0433\u043b\u0443\u0431\u043b\u044f\u0442\u044c\u0441\u044f. \n\n\u041d\u043e \u043e\u0434\u0438\u043d \u043d\u044e\u0430\u043d\u0441 \u0442\u0443\u0442 \u0440\u0430\u0434\u0443\u0435\u0442: \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-34484 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u043d\u0430\u0442\u044c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041d\u0435 \u0432\u0441\u044f\u043a\u043e\u043c\u0443 \u0437\u0430\u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043d\u0430\u043f\u0440\u044f\u0433\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e. \n\nMicrosoft \u0441\u043a\u043e\u0440\u043e \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f, \u043a\u0430\u043a Facebook \u043f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u0445\u043e\u0442\u044c \u043a\u0430\u043a-\u0442\u043e \u0441\u0442\u0435\u0440\u0435\u0442\u044c \u0441\u043b\u0435\u0434 \u0441\u0432\u043e\u0435\u0439 \u0438\u0441\u043f\u043e\u0440\u0447\u0435\u043d\u043d\u043e\u0439 \u0440\u0435\u043f\u0443\u0442\u0430\u0446\u0438\u0438. PrintNigtmare \u2014 \u044d\u0442\u043e \u0431\u0440\u0435\u043d\u0434, \u0430 CVE-2021-34484 \u2014 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u0435\u0441\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u043d\u0435 \u0442\u0430\u043a\u0438\u043c\u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u043c\u0438, \u043a\u0430\u043a \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.", "creation_timestamp": "2021-10-30T14:34:03.000000Z"}, {"uuid": "0badba23-8994-4342-8790-ee1bd3292f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://t.me/cibsecurity/32325", "content": "\u274c Windows 10 Privilege-Escalation Zero-Day Gets an Unofficial Fix \u274c\n\nResearchers warn that CVE-2021-34484 can be exploited with a patch bypass for a bug originally addressed in August by Microsoft.\n\n\ud83d\udcd6 Read\n\nvia \"Threat Post\".", "creation_timestamp": "2021-11-12T21:13:23.000000Z"}, {"uuid": "7312a556-37ca-4bf4-8112-4864e99465af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "exploited", "source": "https://t.me/pwnwiki_zhchannel/832", "content": "CVE-2021-34481 Windows Print Spooler \u672c\u5730\u6b0a\u9650\u63d0\u5347\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-34481_Windows_Print_Spooler_%E6%9C%AC%E5%9C%B0%E6%AC%8A%E9%99%90%E6%8F%90%E5%8D%87%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:41:58.000000Z"}, {"uuid": "ee63b349-8202-46b7-a865-1d841b1b59a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/thehackernews/1371", "content": "Microsoft warns of a new unpatched vulnerability (CVE-2021-34481) affecting the Windows Print Spooler service.\n\nRead: https://thehackernews.com/2021/07/microsoft-warns-of-new-unpatched.html\n\nAn attacker who successfully exploited it could execute arbitrary code with SYSTEM privileges.", "creation_timestamp": "2021-07-16T06:44:30.000000Z"}, {"uuid": "d5e02d4d-dd49-4c86-9269-1cab9fd86cd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://t.me/xakep_ru/11564", "content": "\u0414\u043b\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u0442\u0447\n\n\u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 CVE-2021-34484, \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u044b\u0448\u0435\u043b \u0435\u0449\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430, \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u0435 \u0434\u043e \u043a\u043e\u043d\u0446\u0430. \u041f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0431\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430\u0445 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Windows User Profile Service \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0443\u0440\u043e\u0432\u043d\u044f SYSTEM.\n\nhttps://xakep.ru/2021/11/12/cve-2021-34484/", "creation_timestamp": "2021-11-12T20:04:07.000000Z"}, {"uuid": "ea102094-561a-46f8-93f2-40dc7cd23988", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1124", "content": "1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086\n#exploit\n@BlueRedTeam", "creation_timestamp": "2021-10-13T10:34:16.000000Z"}, {"uuid": "b740c94c-80f0-4ee6-b98b-1c97c329f583", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1180", "content": "#exploit\nCVE-2021-34484:\nWindows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC:\nhttps://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP\n\n@BlueRedTeam", "creation_timestamp": "2021-11-15T06:54:58.000000Z"}, {"uuid": "d6021464-e5d0-4c66-b95c-346eaccd0c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "published-proof-of-concept", "source": "Telegram/h-AibXDnZg5F4B2jC8WepZFTZlIcNgcGN5QNOmJuz65vcVZD", "content": "", "creation_timestamp": "2021-11-10T23:12:02.000000Z"}, {"uuid": "28020fc8-27b3-455e-ba30-e0bd3e6dde1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4306", "content": "#Fuzzing\nFuzzing Closed-Source JavaScript Engines with Coverage Feedback\nhttps://googleprojectzero.blogspot.com/2021/09/fuzzing-closed-source-javascript.html\n]-> CVE-2021-26419:  https://bugs.chromium.org/p/project-zero/issues/detail?id=2157\n]-> CVE-2021-31959:  https://bugs.chromium.org/p/project-zero/issues/detail?id=2168\n]-> CVE-2021-34480:  https://bugs.chromium.org/p/project-zero/issues/detail?id=2188", "creation_timestamp": "2022-07-12T11:36:29.000000Z"}, {"uuid": "7a56b15b-856b-4c58-9b12-8f3279ffd9ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4016", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (July 1-31)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-34527 - Windows Print Spooler RCE\nhttps://t.me/cybersecuritytechnologies/3750\nCVE-2021-36934 - Windows SeriousSAM EoP\nhttps://t.me/cybersecuritytechnologies/3891\nCVE-2021-33909 - Sequoia - A LPE Vulnerability in Linux\u2019s Filesystem Layer\nhttps://t.me/cybersecuritytechnologies/3884\nCVE-2021-22555 - Heap out-of-bounds write vuln in Linux Netfilter\nhttps://t.me/cybersecuritytechnologies/3841\nCVE-2021-30807 - OOBR in AppleCLCD/IOMobileFrameBuffer\nhttps://t.me/cybersecuritytechnologies/3930\nCVE-2020-27020 - Vulnerability in Kaspersky Password Manager\nhttps://donjon.ledger.com/kaspersky-password-manager\nCVE-2021-35211 - SolarWinds Serv-U Managed File Transfer Vuln\nhttps://t.me/CyberSecurityTechnologies/4714\nCVE-2021-34481 - Windows Print Spooler EoP\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490\nCVE-2021-3438 - Printer\u2019s Drivers Vulnerability\nhttps://t.me/cybersecuritytechnologies/3969", "creation_timestamp": "2024-01-18T03:22:33.000000Z"}, {"uuid": "71561ebd-2d10-4bc3-8029-24ae741b743a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/4757", "content": "#exploit\nCVE-2021-34484:\nWindows User Profile Service 0day LPE\nhttps://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx\n]-> PoC:\nhttps://github.com/klinix5/ProfSvcLPE/tree/main/DoubleJunctionEoP", "creation_timestamp": "2021-11-15T13:14:59.000000Z"}, {"uuid": "ca470a04-e55f-4d67-8f2e-1348e8dbffb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4511", "content": "#exploit\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "creation_timestamp": "2021-10-13T11:07:01.000000Z"}, {"uuid": "3279bfc7-7c74-48a8-9a7f-9e5049098010", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1567", "content": "CVE-2021-34486: Event Tracing for Windows (ETW) TimerCallbackContext Object Use-After-Free Vulnerability https://www.pixiepointsecurity.com/blog/cve-2021-34486.html", "creation_timestamp": "2026-08-03T07:04:24.551027Z"}, {"uuid": "b7ef36f9-0ede-435d-9fe3-53b240a14be0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "exploited", "source": "https://t.me/cisoclub/906", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (9-15 \u0430\u0432\u0433\u0443\u0441\u0442\u0430)\n\n1\ufe0f\u20e3 \ud83e\uddb9\u200d\u2642\ufe0f\u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-20090 \u0432\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c \u041f\u041e Arcadyan, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u043c\u043d\u043e\u0433\u0438\u0445 \ud83c\udf9b\u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0438 \u043c\u043e\u0434\u0435\u043c\u0430\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439.\n\n2\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Adobe \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \ud83d\udd13\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Patch Tuesday, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0435 \u2755\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Magento \u0438 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 Adobe Connect.\n\n3\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \ud83d\udce5\u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u0440\u0443\u043f\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f 44 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0438 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2757\ufe0f\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f. \n\n4\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \ud83d\udeab\u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \ud83d\udcbb\u043d\u043e\u0443\u0442\u0431\u0443\u043a\u0430\u0445 NUC 9 Extreme \u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 Ethernet \u0434\u043b\u044f Linux. \n\n5\ufe0f\u20e3 \u0412 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 SAP \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0433\u043e \ud83d\udcbd\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u0435\u0432\u044f\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0438 \u2755\u00ab\u043e\u0441\u043e\u0431\u043e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udd27\u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-34481 (PrintNightmare). \n\n7\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Siemens \u0438 Schneider Electric \ud83d\udcd1\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 18 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \ud83d\udcc8\u0431\u043e\u043b\u0435\u0435 50 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043b\u0438\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b. \n\n8\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Trend Micro \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \ud83d\udccc\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Apex One \u0438 Apex One as a Service, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n9\ufe0f\u20e3 \u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u2328\ufe0f\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft Exchange Server \u0434\u043b\u044f \ud83d\udcbf\u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0435\u0442 \u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.", "creation_timestamp": "2026-08-03T22:00:05.207356Z"}, {"uuid": "74832262-c78b-4692-8f41-42bd0113eaf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "https://t.me/onelab1337/1832", "content": "#exploit\n\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\n\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\n\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "creation_timestamp": "2026-08-09T05:02:32.111461Z"}, {"uuid": "53fac7cf-6cd2-49dc-af18-b2f7b001b4fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/onelab1337/725", "content": "CVE-2021-36934 POC | Hive nightmare\n\nhttps://youtu.be/NojR0HQETgE\n\nCVE-2021-1675 PoC | Print Nightmare part 1\n\nhttps://youtu.be/m0LQvf07fjA\n\nCVE-2021-34481 PoC | Print nightmare part 2\n\nhttps://youtu.be/lulJ6i7Fusc\n\nWindows graphics privileged escalation | CVE-2021-26868 poc\n\nhttps://youtu.be/un_3xC2DX3U\n\nJuly PoC for windows..\n\nFor more videos\nhttps://www.youtube.com/c/rapidsafeguard\n\nShare with your infosec friends\n\n#redteam #rapidsafeguard", "creation_timestamp": "2026-08-09T05:02:33.564619Z"}, {"uuid": "312cf287-a6ae-4685-a535-58a234718eff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://t.me/onelab1337/1976", "content": "#exploit\nCVE-2021-34484: Windows User Profile Service Elevation of Privilege Vulnerability\n\n- Windows User Profile Service 0day LPE \n\n\ud83d\udd17See on Github\n\n-> PoC:\n\n\ud83d\udd17See on Github", "creation_timestamp": "2026-08-09T05:01:07.198174Z"}, {"uuid": "b32f041f-adac-4b16-9a47-c002cad6ccb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "published-proof-of-concept", "source": "Telegram/bmbtMV3kDPfh5WrAdXEmt6HVLjLyiZ70G2Nfd-UcUIdAsgs", "content": "", "creation_timestamp": "2026-08-12T17:00:04.680678Z"}, {"uuid": "ed3ea2d8-484e-4557-826a-e28ba3685bbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/1832", "content": "#exploit\n\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\n\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\n\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "creation_timestamp": "2026-08-10T00:00:11.611112Z"}, {"uuid": "65aa1448-cbbc-4d0c-bdb6-feab6128bfcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/725", "content": "CVE-2021-36934 POC | Hive nightmare\n\nhttps://youtu.be/NojR0HQETgE\n\nCVE-2021-1675 PoC | Print Nightmare part 1\n\nhttps://youtu.be/m0LQvf07fjA\n\nCVE-2021-34481 PoC | Print nightmare part 2\n\nhttps://youtu.be/lulJ6i7Fusc\n\nWindows graphics privileged escalation | CVE-2021-26868 poc\n\nhttps://youtu.be/un_3xC2DX3U\n\nJuly PoC for windows..\n\nFor more videos\nhttps://www.youtube.com/c/rapidsafeguard\n\nShare with your infosec friends\n\n#redteam #rapidsafeguard", "creation_timestamp": "2026-08-10T00:00:10.172353Z"}, {"uuid": "e044a5f5-4910-46f0-999d-0e2be09b9c07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/1976", "content": "#exploit\nCVE-2021-34484: Windows User Profile Service Elevation of Privilege Vulnerability\n\n- Windows User Profile Service 0day LPE \n\n\ud83d\udd17See on Github\n\n-> PoC:\n\n\ud83d\udd17See on Github", "creation_timestamp": "2026-08-10T00:00:11.821665Z"}, {"uuid": "d51a4ebe-cfab-4be3-b938-d9d234b1b7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.671162Z"}, {"uuid": "4de91573-84ee-4632-8bb6-76143faebc36", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b2979116-58ac-4c54-84ca-3089375c7b60", "content": "", "creation_timestamp": "2026-06-19T12:47:21.128062Z"}, {"uuid": "26df4bcb-13a6-480b-8caa-e9075829c460", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fdb461e0-f4dc-49ec-a2e3-fb9d37e12d86", "content": "", "creation_timestamp": "2026-06-19T12:47:20.366452Z"}, {"uuid": "9d435d01-c836-4f2a-b223-b2ba4032dfc7", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52ed2e24-6cd4-4e96-9cc7-06e1bc0e5736", "content": "", "creation_timestamp": "2026-06-23T14:05:16.848689Z"}, {"uuid": "35400505-89e7-4d98-a983-7dead7fb9641", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ab7f162c-3283-439d-9a97-463784699dc5", "content": "", "creation_timestamp": "2026-06-23T14:05:16.148683Z"}, {"uuid": "a14cfaa4-873b-4059-a093-86197e498f09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst3zuiazw2m", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-34484: Windows User Profile Service Elevation of Privilege Vulnerability\nCVSS 7.8 \u00b7 EPSS 21.7% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-34484\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T17:06:59.277313Z"}, {"uuid": "51752807-bb07-48ae-a6d9-9363811eb40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mst3zw4bu42q", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-34486: Windows Event Tracing Elevation of Privilege Vulnerability\nCVSS 7.8 \u00b7 EPSS 9.3% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-34486\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-11T17:07:00.930808Z"}, {"uuid": "94de2a79-c030-40d1-b463-40b379c4d6c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "https://t.me/reverseame/1567", "content": "CVE-2021-34486: Event Tracing for Windows (ETW) TimerCallbackContext Object Use-After-Free Vulnerability https://www.pixiepointsecurity.com/blog/cve-2021-34486.html", "creation_timestamp": "2026-07-29T12:02:54.186869Z"}, {"uuid": "d8f75041-c043-4bf8-b58b-2932622ff115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/cisoclub/906", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (9-15 \u0430\u0432\u0433\u0443\u0441\u0442\u0430)\n\n1\ufe0f\u20e3 \ud83e\uddb9\u200d\u2642\ufe0f\u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-20090 \u0432\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u043c \u041f\u041e Arcadyan, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u043c\u043d\u043e\u0433\u0438\u0445 \ud83c\udf9b\u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0438 \u043c\u043e\u0434\u0435\u043c\u0430\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439.\n\n2\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Adobe \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \ud83d\udd13\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Patch Tuesday, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0435 \u2755\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Magento \u0438 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 Adobe Connect.\n\n3\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \ud83d\udce5\u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u0440\u0443\u043f\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f 44 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0438 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2757\ufe0f\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f. \n\n4\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \ud83d\udeab\u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \ud83d\udcbb\u043d\u043e\u0443\u0442\u0431\u0443\u043a\u0430\u0445 NUC 9 Extreme \u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445 Ethernet \u0434\u043b\u044f Linux. \n\n5\ufe0f\u20e3 \u0412 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 SAP \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0433\u043e \ud83d\udcbd\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u0435\u0432\u044f\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0438 \u2755\u00ab\u043e\u0441\u043e\u0431\u043e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udd27\u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-34481 (PrintNightmare). \n\n7\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Siemens \u0438 Schneider Electric \ud83d\udcd1\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 18 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \ud83d\udcc8\u0431\u043e\u043b\u0435\u0435 50 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043b\u0438\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b. \n\n8\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Trend Micro \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \ud83d\udccc\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Apex One \u0438 Apex One as a Service, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n9\ufe0f\u20e3 \u041a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u2328\ufe0f\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Microsoft Exchange Server \u0434\u043b\u044f \ud83d\udcbf\u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0435\u0442 \u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.", "creation_timestamp": "2026-07-29T12:03:13.175211Z"}, {"uuid": "b2b8332c-ea6b-4223-8e56-948489003357", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/cisoclub/857", "content": "\u041e\u0431\u0437\u043e\u0440 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e (12-18 \u0438\u044e\u043b\u044f)\n\n1\ufe0f\u20e3 \u0421\u043b\u0443\u0436\u0431\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \ud83c\udf1eSolarWinds \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u00ab\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0445 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445\u00bb. \ud83d\udcdd\u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u2757\ufe0f\u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Serv-U Managed File Transfer \u0438 Serv-U Secure FTP.\n\n2\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \ud83d\udc4d117 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0435 \ud83d\udcbf\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0432 Exchange Server, \ud83d\udd2c\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0430\u043c\u0438 \u043a\u043e\u043d\u043a\u0443\u0440\u0441\u0430 Pwn2Own.\n\n3\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \ud83d\udd10\u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Windows Hello, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \ud83e\uddec\u0431\u0438\u043e\u043c\u0435\u0442\u0440\u0438\u0438. \u0421 \u0435\u0451 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \ud83e\uddb9\u200d\u2642\ufe0f\u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c \u043b\u0438\u0447\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043e\u0431\u043c\u0430\u043d\u044b\u0432\u0430\u044f \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043d\u0438\u044f \ud83d\ude1f\u043b\u0438\u0446, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n4\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Adobe \ud83e\udd1d\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043a\u0440\u0443\u043f\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Patch Tuesday, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \ud83d\udd12\u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Adobe Dimension, Illustrator, Framemaker, Acrobat, Reader \u0438 Bridge. \u0412\u0441\u0435\u0433\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Adobe \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 28 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n5\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \ud83e\uddfe\u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 LinkedIn \ud83c\uddf7\ud83c\uddfa\u00ab\u0440\u0443\u0441\u0441\u043a\u0438\u043c\u0438 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438\u00bb, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 \ud83c\udf0e\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 Safari, Chrome, Internet Explorer.\n\n6\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Microsoft \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \ud83d\udcdc\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \ud83d\udda8\u043f\u0435\u0447\u0430\u0442\u0438 Windows, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2021-34481. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 PrintNightmare, \u044d\u0442\u0443 \u043e\u0448\u0438\u0431\u043a\u0443 CVE-2021-34481 \u043c\u043e\u0436\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \ud83d\udcbb\u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n7\ufe0f\u20e3 \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \ud83c\udfe6WooCommerce \u0434\u043b\u044f WordPress \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e\u0439 \ud83d\ude40\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e WooCommerce, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 90 \u0432\u0435\u0440\u0441\u0438\u0439, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 5.5.0.\n\n8\ufe0f\u20e3 \u041a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f Google \ud83d\udcec\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Chrome 91.0.4472.164 \u0434\u043b\u044f Windows, \ud83d\udda5Mac \u0438 Linux, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0438\u0434\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u203c\ufe0f\u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438.\n\n9\ufe0f\u20e3 \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f D-Link \ud83d\udd16\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 DIR-3040 AC3000. \u041f\u0440\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \ud83e\uddb9\u200d\u2642\ufe0f\u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \ud83d\udcd1\u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u00ab\u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\u00bb.", "creation_timestamp": "2026-07-29T12:03:13.317816Z"}, {"uuid": "6ee57dd0-f950-49c5-972f-35f55e048a4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "seen", "source": "https://t.me/cissp/4592", "content": "Offensive security\nA Look At Some Real-World Obfuscation Techniques\nhttps://research.nccgroup.com/2021/10/12/a-look-at-some-real-world-obfuscation-techniques\n\nBlue Team Techniques\nIncident Response collection and processing scripts\nwith automated reporting scripts\nhttps://github.com/FSecureLABS/\ud83d\udc4d\ud83c\udffdLinuxCatScale\n\n#mThreat Research\n0-Day Hunting\n(Chaining Bugs/Methodology)\nhttps://blog.riotsecurityteam.com/0day-chains\n\nexploit\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "creation_timestamp": "2026-09-01T17:00:38.525254Z"}, {"uuid": "5b7ea2df-2f92-44fd-bb05-c462ff8d69bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "seen", "source": "https://t.me/cissp/4366", "content": "Fuzzing Closed-Source JavaScript Engines with Coverage Feedback\nhttps://googleprojectzero.blogspot.com/2021/09/fuzzing-closed-source-javascript.html\n]-> CVE-2021-26419:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2157\n]-> CVE-2021-31959:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2168\n]-> CVE-2021-34480:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2188\n\nexploit\nCVE-2021-40539:\nZoho ManageEngine ADSelfService \ud83d\ude43Plus <=6113 is vulnerable to REST API authentication bypass with resultant RCE (Patch + PoC)\nhttps://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis\n\nThreat Research\n1. Web Shells Lead to ZeroLogon and Application Impersonation Attacks\ud83d\ude0a\nhttps://www.fortinet.com/blog/threat-research/more-proxyshell-web-shells-lead-to-zerologon-and-application-impersonation-attacks\n2. Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus\nhttps://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html", "creation_timestamp": "2026-09-01T17:00:40.540235Z"}, {"uuid": "6b6e173e-b464-4f97-b13f-3cdee19ea812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/cissp/3797", "content": "Microsoft warns of a new unpatched vulnerability (CVE-2021-34481) affecting the Windows Print Spooler service.\n\nRead: \nhttps://thehackernews.com/2021/07/microsoft-warns-of-new-unpatched.html\n\nAn attacker who successfully exploited it could execute arbitrary code with SYSTEM privileges.", "creation_timestamp": "2026-09-01T17:00:46.139734Z"}, {"uuid": "4c7abbf3-4d0b-47f4-a3cf-0d2a04c07757", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "seen", "source": "https://t.me/hacking_Attack/33025", "content": "r this issue.\n\n\u2014 0patch (@0patch) November 26, 2021\nSee Also: Offensive Security Tool: Hashcat How to install the micropatchTo install the unofficial patch on your system, you will need to register a 0patch account\u00a0and install the 0patch agent.\n\nOnce you launch the agent on your device, the patch will be applied automatically (if there are no custom patching enterprise policies enabled to block it) without requiring a restart.\n\nThis is the second Windows zero-day that received a micropatch this month after Naceri found that patches for another bug (CVE-2021-34484) in the Windows User Profile Service could be bypassed to escalate privileges on all Windows versions, even if fully patched.\n\nMicrosoft also needs to patch a third zero-day bug in the\u00a0Microsoft Windows Installer\u00a0with a proof-of-concept (PoC) exploit released\u00a0by Naceri over the weekend.\n\nIf successfully exploited, the zero-day allows attackers to gain SYSTEM privileges on up-to-date devices running the latest Windows versions, including Windows 10, Windows 11, and Windows Server 2022.\n\nMalware creators have since started testing the\u00a0PoC\u00a0exploit\u00a0in\u00a0low volume attacks likely focused on testing and tweaking it for future full-blown campaigns.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle2 weeks ago\nThe post New Windows 10 zero-day gives admin rights, gets unofficial patch first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.162083Z"}, {"uuid": "a307a2e8-3b3c-41fa-8f77-328b71822c1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "seen", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.965227Z"}, {"uuid": "7902d1f5-e8e8-439d-8958-54f60b000e52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:29.116026Z"}, {"uuid": "25896a83-f85a-441d-ab9d-594739ca2cea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "seen", "source": "https://t.me/hacking_Attack/19794", "content": "Black Hat Ethical Hacking\nActively Exploited Windows Zero-Day Gets a Patch\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Actively Exploited Windows Zero-Day Gets a PatchPost Views: 60 \nReading Time: 2 Minutes\nMicrosoft has patched 51 security vulnerabilities in its scheduled August Patch Tuesday update, including seven critical bugs, two issues that were publicly disclosed but unpatched until now, and one that\u2019s listed as a zero-day that has been exploited in the wild.\nMicrosoft\u2019s August 2021 Patch Tuesday addressed a smaller set of bugs than usual, including more Print Spooler problems, a zero-day and seven critical vulnerabilities.\nOf note, there are 17 elevation-of-privilege (EoP) vulnerabilities, 13 remote code-execution (RCE) issues, eight information-disclosure flaws and two denial-of-service (DoS) bugs.\n\nThe update also includes patches for three more Print Spooler bugs, familiar from the PrintNightmare saga.\n\n\u201cFortunately, it was a lighter month than usual,\u201d said Eric Feldman, senior product marketing manager at Automox, in a Patch Tuesday analysis\u00a0from the vendor. \u201cThis represents a 56 percent reduction in overall vulnerabilities from July, and 33 percent fewer vulnerabilities on average for each month so far this year. We have also seen a similar reduction in critical vulnerabilities this month, with 30 percent less compared to the monthly average.\u201d Windows Critical Security VulnerabilitiesThe seven critical bugs addressed in August\u00a0are as follows:\n\n* CVE-2021-26424 \u2013 Windows TCP/IP RCE Vulnerability\n* CVE-2021-26432 \u2013 Windows Services for NFS ONCRPC XDR Driver RCE Vulnerability\n* CVE-2021-34480 \u2013 Scripting Engine Memory Corruption Vulnerability\n* CVE-2021-34530 \u2013 Windows Graphics Component RCE Vulnerability\n* CVE-2021-34534 \u2013 Windows MSHTML Platform RCE Vulnerability\n* CVE-2021-34535 \u2013 Remote Desktop Client RCE Vulnerability\n* CVE-2021-36936 \u2013 Windows Print Spooler RCE Vulnerability\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers The bug tracked as CVE-2021-26424\u00a0exists in the TCP/IP protocol stack identified in Windows 7 and newer Microsoft operating systems, including servers.\n\n\u201cDespite its CVSS rating of 9.9, this may prove to be a trivial bug, but it\u2019s still fascinating,\u201d said Dustin Childs of Trend Micro\u2019s Zero Day Initiative (ZDI) in his Tuesday analysis. \u201cAn attacker on a guest Hyper-V OS could execute code on the host Hyper-V server by sending a specially crafted IPv6 ping. This keeps it out of the wormable category. Still, a successful attack would allow the guest OS to completely take over the Hyper-V host. While not wormable, it\u2019s still cool to see new bugs in new scenarios being found in protocols that have been around for years.\u201d\n\nThe next bug, CVE-2021-26432\u00a0in Windows Services, is more likely to be exploited given its low complexity status, according to Microsoft\u2019s advisory; it doesn\u2019t require privileges or user interaction to exploit, but Microsoft offered no further details.\n\n\u201cThis may fall into the \u2018wormable\u2019 category, at least between servers with NFS installed, especially since the open network computing remote procedure call (ONCRPC) consists of an External Data Representation (XDR) runtime built on the Winsock Kernel (WSK) interface,\u201d Childs said. \u201cThat certainly sounds like elevated code on a listening network service. Don\u2019t ignore this patch.\u201d\n\nAleks Haugom, product marketing manager at Automox, added, \u201cExploitation results in total loss of confidentiality across all devices managed by the same security authority. Furthermore, attackers can utilize it for denial-of-service attacks or to maliciously modify files. So far, no further details have been divulged by Mic[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:29.252454Z"}, {"uuid": "161e7a57-9b92-4d38-aba6-52887c3f5b30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/hacking_Attack/17020", "content": "Black Hat Ethical Hacking\nMicrosoft: New Unpatched Bug in Windows Print Spooler\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft: New Unpatched Bug in Windows Print SpoolerPost Views: 50 \nReading Time: 1 Minute\nMicrosoft has warned of yet another vulnerability that\u2019s been discovered in its Windows Print Spooler that can allow attackers to elevate privilege to gain full user rights to a system.\nThe advisory comes on the heels of patching two other remote code-execution (RCE) bugs found in the print service that collectively became known as PrintNightmare.\n\nThe company released the advisory\u00a0late Thursday for the latest bug, a Windows Print Spooler elevation-of-privilege vulnerability tracked as CVE-2021-34481. Microsoft credited Dragos vulnerability researcher Jacob Baines for identifying the issue.\n\nThe vulnerability \u201cexists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to Microsoft.\n\nAttackers who successfully exploit the bug can run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change or delete data, or create new accounts with full user rights, the company said.\n\nTo work around the bug, administrators and users should stop and disable the Print Spooler service, Microsoft said. Slightly Less of a \u2018PrintNightmare\u2019The vulnerability (CVE-2021-1675) is the latest in a flurry of problems discovered in Windows Print Spooler, but seems slightly less dangerous, as it can only be exploited locally. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale.\n\nIndeed, Baines told BleepingComputer\u00a0that while the bug is print driver-related, \u201cthe attack is not really related to PrintNightmare.\u201d Baines plans to disclose more about the little-known vulnerability in an upcoming presentation\u00a0at DEF CON in August.\nSee Also: Kaseya ransomware supply chain attack: What you need to know The entire saga surrounding Windows Print Spooler began Tuesday, June 30, when a proof-of-concept (PoC) for an initial vulnerability in the print service was dropped on GitHub showing how an attacker can exploit the flaw to take control of an affected system.\n\nThe response to the situation soon turned into confusion. Though Microsoft released an update for CVE-2021-1675\u00a0in it its usual raft of monthly Patch Tuesday updates, fixing what it thought was a minor elevation-of-privilege vulnerability, the listing was updated later in the week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that Microsoft\u2019s initial patch didn\u2019t fix the entire problem. The federal government even stepped in last Thursday, when CERT/CC offered its own mitigation\u00a0for PrintNightmare that Microsoft has since adopted \u2014 advising system administrators to disable the Windows Print Spooler service in Domain Controllers and systems that do not print. See Also: Offensive Security Tool: Veil To further complicate matters, Microsoft also last Thursday dropped a notice\u00a0for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appeared to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527. The company explained that the second bug was similar to the earlier PrintNightmare vulnerability but also its own distinct entity.\n\nEventually, Microsoft last Wednesday released an emergency cumulative patch\u00a0for both PrintNightmare bugs that included all previous patches as well as protections for CVE-2021-1675 as well as a new fix for CVE-2021-34527. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker However, th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:33.047415Z"}, {"uuid": "ee526eda-6902-4ca1-add6-c9062ddc8252", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/hacking_Attack/24072", "content": "But which exploit should I use?!\n  Probably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.  \nHow does it work?\n  Concealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:  Step 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n  It is important to note that SLASHINGDAMAGE doesn't actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I'd leave the exploit in my evil server... as confusing as that may be.  \nIs this a Windows vulnerability?\n  Arguably, yes. The driver store is a \"trusted collection of ... third-party driver packages\" (https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-store) that requires administrator access to modify. Using GetPrinterDriver a low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.  Microsoft seemed to agree when they issued CVE-2021-34481 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481).  Although... it's arguable that this is simply a feature of the system and not a vulnerability (https://www.kitploit.com/search/label/Vulnerability) at all. It really doesn't matter all that much. An attacker can escalate to SYSTEM on standard Windows installs.  \nWhich verions of Windows are affected by CVE-2021-34481?\n  At least Windows 8.1 and above.  \nHow do I use these tools?\n  Simple! So simple there will be many paragraphs to describe it!  \nCP Server\n  First, let's look at cp_server's command line options:  cp_server.exe   _______  _______  __    _  _______  _______  _______  ___      _______  ______  |       ||       ||  |  | ||       ||       ||   _   ||   |    |       ||      |  |       ||   _   ||   |_| ||       ||    ___||  |_|  ||   |    |    ___||  _    |  |       ||  | |  ||       ||       ||   |___ |       ||   |    |   |___ | | |   |  |      _||  |_|  ||  _    ||      _||    ___||       ||   |___ |    ___|| |_|   |  |     |_ |       || | |   ||     |_ |   |___ |   _   ||       ||   |___ |       |  |_______||_______||_|  |__||_______||_______||__| |__||_______||_______||______|   _______  _______  _______  ___   _______  ___   _______  __    _  |       ||       ||       ||   | |       ||   | |       ||  |  | |  |    _  ||   _   ||  _____||   | |_     _||   | |   _   ||   |_| |  |   |_| ||  | |  || |_____ |   |   |   |  |   | |  | |  ||       |  |    ___||  |_|  ||_____  ||   |   |   |  |   | |  |_|  ||  _    |  |   |    |       | _____| ||   |   |   |  |   | |       || | |   |  |___|    |_______||_______||___|   |___|  |___| |_______||_|  |__|    server!    CLI options:    -h, --help                     Display the help message    -e, --exploit arg              The exploit to use    -c, --cabs arg (=.\\cab_files)  The location of the cabinet files    Exploits available:          ACIDDAMAGE          POISONDAMAGE          RADIANTDAMAGE          SLASHINGDAMAGE    C:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>  \">C:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n _______  _______  __    _  _______  _______  _______  ___      _______  ______\n|       ||       ||  |  | ||       ||       ||   _   ||   |    |       ||      |\n|       ||   _   ||   |_| ||       ||    ___||  |_|  ||   |    |    ___||  _    |", "creation_timestamp": "2026-09-01T20:02:22.273383Z"}, {"uuid": "207516fa-1fda-45a1-a1d6-5c3c38c0f055", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/hacking_Attack/19796", "content": "\u201cThis bug is listed as publicly known, but it\u2019s not clear if this bug is a variant of PrintNightmare or a unique vulnerability all on its own. There are quite a few print-spooler bugs to keep track of. Either way, attackers can use this to execute code on affected systems. Microsoft does state low privileges are required, so that should put this in the non-wormable category, but you should still prioritize testing and deployment of this critical-rated bug.\u201d\n\nThe critical vulnerability is just one of three Print Spooler issues in the August Patch Tuesday release.\n\n\u201cThe specter of the PrintNightmare continues to haunt this patch Tuesday with three more print spooler vulnerabilities, CVE-2021-36947, CVE-2021-36936 and CVE-2021-34481,\u201d said Breen. \u201cAll three are listed as RCE over the network, requiring a low level of access, similar to PrintNightmare. Microsoft has marked these as \u2018Exploitation More Likely\u2019 which, if the previous speed of POC code being published is anything to go by, is certainly true.\u201d RCE Zero-Day in Windows Update Medic ServiceThe actively exploited bug is tracked as CVE-2021-36948\u00a0and is rated as important; it could pave the way for RCE via the Windows Update Medic Service in Windows 10 and Server 2019 and newer operating systems.\n\n\u201cUpdate Medic is a new service that allows users to repair Windows Update components from a damaged state such that the device can continue to receive updates,\u201d Automox\u2019 Jay Goodman explained. \u201cThe exploit is both low complexity and can be exploited without user interaction, making this an easy vulnerability to include in an adversary\u2019s toolbox.\u201d\n\nImmersive\u2019s Breen added, \u201cCVE-2021-36948 is a privilege-escalation vulnerability \u2013 the cornerstone of modern intrusions as they allow attackers the level of access to do things like hide their tracks and create user accounts.\u00a0 In the case of ransomware attacks, they have also been used to ensure maximum damage.\u201d\n\nThough the bug is being reported as being exploited in the wild by Microsoft, activity appears to remain limited or targeted: \u201cWe have seen no evidence of it at Kenna Security at this time,\u201d Jerry Gamblin, director of security research at Kenna Security (now part of Cisco) told Threatpost. Publicly Known Windows LSA Spoofing BugThe second publicly known bug (after the Print Spooler issue covered earlier) is tracked as CVE-2021-36942, and it\u2019s an important-rated Windows LSA (Local Security Authority) spoofing vulnerability.\n\n\u201cIt fixes a flaw that could be used to steal NTLM hashes from a domain controller or other vulnerable host,\u201d Immersive\u2019s Breen said. \u201cThese types of attacks are well known for lateral movement and privilege escalation, as has been demonstrated recently by a new exploit called PetitPotam. It is a post-intrusion exploit \u2013 further down the attack chain \u2013 but still a useful tool for attackers.\u201d\n\nChilds offered a bit of context around the bug.\n\n\u201cMicrosoft released this patch to further protect against NTLM relay attacks by issuing this update to block the LSARPC interface,\u201d he said. \u201cThis will impact some systems, notably Windows Server 2008 SP2, that use the EFS API OpenEncryptedFileRawA function. You should apply this to your Domain Controllers first and follow the additional guidance in ADV210003\u00a0and KB5005413. This has been an ongoing issue since 2009, and, likely, this isn\u2019t the last we\u2019ll hear of this persistent issue.\u201d\n\nMicrosoft\u2019s next Patch Tuesday will fall on September 14.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.844088Z"}, {"uuid": "73c8de4f-4315-4da4-be0d-32684752d1c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://t.me/hacking_Attack/17021", "content": "at fix also was incomplete, and Microsoft continues to work on further remediations as it also works to patch this latest bug, CVE-2021-34481. In the meantime, affected customers should install the most recent Microsoft updates as well as use the workaround to avoid exploitation, the company said.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/linkedin_generic-90x90.jpg Safari Zero-Day Used in Malicious LinkedIn Campaign3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Hello-e1626260072511-90x90.jpg Windows Hello Bypass Fools Biometrics Safeguards in PCs4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/ICS-90x90.jpg Unpatched Critical RCE Bug Allows Industrial, Utility Takeovers5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/patching-against-ransomware-100723134-large-90x90.jpg Kaseya Patches Zero-Days Used in REvil Attacks6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/cisco-90x90.jpg Cisco BPA, WSA Bugs Allow Remote Cyberattacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Untitled-design-8-90x90.png Coursera Flunks API Security Test in Researchers\u2019 Exam1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/macos-trojan-90x90.jpg MacOS Targeted in WildPressure APT Malware Campaign2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/i339637-90x90.jpg Western Digital Users Face Another RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/shutterstock_1968890518-1-90x90.jpg Kaseya ransomware supply chain attack: What you need to know2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/printer-90x90.jpg CISA Offers New Mitigation for PrintNightmare Bug2 weeks ago\nstyle=\"display:block; text-align:center;\"\n data-ad-layout=\"in-article\"\n data-ad-format=\"fluid\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"4517761481\"> \nThe post Microsoft: New Unpatched Bug in Windows Print Spooler first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:33.094830Z"}, {"uuid": "0ce386e4-6ff3-4ee6-8bf0-985504df7698", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34484", "type": "exploited", "source": "https://t.me/hacking_Attack/33025", "content": "r this issue.\n\n\u2014 0patch (@0patch) November 26, 2021\nSee Also: Offensive Security Tool: Hashcat How to install the micropatchTo install the unofficial patch on your system, you will need to register a 0patch account\u00a0and install the 0patch agent.\n\nOnce you launch the agent on your device, the patch will be applied automatically (if there are no custom patching enterprise policies enabled to block it) without requiring a restart.\n\nThis is the second Windows zero-day that received a micropatch this month after Naceri found that patches for another bug (CVE-2021-34484) in the Windows User Profile Service could be bypassed to escalate privileges on all Windows versions, even if fully patched.\n\nMicrosoft also needs to patch a third zero-day bug in the\u00a0Microsoft Windows Installer\u00a0with a proof-of-concept (PoC) exploit released\u00a0by Naceri over the weekend.\n\nIf successfully exploited, the zero-day allows attackers to gain SYSTEM privileges on up-to-date devices running the latest Windows versions, including Windows 10, Windows 11, and Windows Server 2022.\n\nMalware creators have since started testing the\u00a0PoC\u00a0exploit\u00a0in\u00a0low volume attacks likely focused on testing and tweaking it for future full-blown campaigns.\nSee Also: Hacking stories \u2013 Operation Troy \u2013 How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-1-90x90.jpg WordPress sites are being hacked in fake ransomware attacks2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ECS-Instance-Types-90x90.png Alibaba ECS instances actively hijacked by cryptomining malware2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-1-90x90.jpg QBot returns for a new wave of infections using Squirrelwaffle2 weeks ago\nThe post New Windows 10 zero-day gives admin rights, gets unofficial patch first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T03:00:48.685850Z"}, {"uuid": "727ad438-55c0-4cbf-8f4a-e383b06c8175", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T13:00:04.888209Z"}, {"uuid": "4b36ada8-213e-43e2-8958-b89e96c0e8a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24072", "content": "But which exploit should I use?!\n  Probably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.  \nHow does it work?\n  Concealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:  Step 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n  It is important to note that SLASHINGDAMAGE doesn't actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I'd leave the exploit in my evil server... as confusing as that may be.  \nIs this a Windows vulnerability?\n  Arguably, yes. The driver store is a \"trusted collection of ... third-party driver packages\" (https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-store) that requires administrator access to modify. Using GetPrinterDriver a low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.  Microsoft seemed to agree when they issued CVE-2021-34481 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481).  Although... it's arguable that this is simply a feature of the system and not a vulnerability (https://www.kitploit.com/search/label/Vulnerability) at all. It really doesn't matter all that much. An attacker can escalate to SYSTEM on standard Windows installs.  \nWhich verions of Windows are affected by CVE-2021-34481?\n  At least Windows 8.1 and above.  \nHow do I use these tools?\n  Simple! So simple there will be many paragraphs to describe it!  \nCP Server\n  First, let's look at cp_server's command line options:  cp_server.exe   _______  _______  __    _  _______  _______  _______  ___      _______  ______  |       ||       ||  |  | ||       ||       ||   _   ||   |    |       ||      |  |       ||   _   ||   |_| ||       ||    ___||  |_|  ||   |    |    ___||  _    |  |       ||  | |  ||       ||       ||   |___ |       ||   |    |   |___ | | |   |  |      _||  |_|  ||  _    ||      _||    ___||       ||   |___ |    ___|| |_|   |  |     |_ |       || | |   ||     |_ |   |___ |   _   ||       ||   |___ |       |  |_______||_______||_|  |__||_______||_______||__| |__||_______||_______||______|   _______  _______  _______  ___   _______  ___   _______  __    _  |       ||       ||       ||   | |       ||   | |       ||  |  | |  |    _  ||   _   ||  _____||   | |_     _||   | |   _   ||   |_| |  |   |_| ||  | |  || |_____ |   |   |   |  |   | |  | |  ||       |  |    ___||  |_|  ||_____  ||   |   |   |  |   | |  |_|  ||  _    |  |   |    |       | _____| ||   |   |   |  |   | |       || | |   |  |___|    |_______||_______||___|   |___|  |___| |_______||_|  |__|    server!    CLI options:    -h, --help                     Display the help message    -e, --exploit arg              The exploit to use    -c, --cabs arg (=.\\cab_files)  The location of the cabinet files    Exploits available:          ACIDDAMAGE          POISONDAMAGE          RADIANTDAMAGE          SLASHINGDAMAGE    C:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>  \">C:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n _______  _______  __    _  _______  _______  _______  ___      _______  ______\n|       ||       ||  |  | ||       ||       ||   _   ||   |    |       ||      |\n|       ||   _   ||   |_| ||       ||    ___||  |_|  ||   |    |    ___||  _    |", "creation_timestamp": "2026-09-07T14:00:04.438115Z"}, {"uuid": "764ed336-7dfb-4e50-be68-1d9dd1afde58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "exploited", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T20:00:04.835240Z"}, {"uuid": "23ec3b6c-ec78-4c22-a9d3-c8fe42cc4fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "exploited", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T20:00:05.012511Z"}, {"uuid": "b284f99e-4483-4b6a-85ef-8e985eaf1aa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "exploited", "source": "https://t.me/hacking_Attack/19796", "content": "\u201cThis bug is listed as publicly known, but it\u2019s not clear if this bug is a variant of PrintNightmare or a unique vulnerability all on its own. There are quite a few print-spooler bugs to keep track of. Either way, attackers can use this to execute code on affected systems. Microsoft does state low privileges are required, so that should put this in the non-wormable category, but you should still prioritize testing and deployment of this critical-rated bug.\u201d\n\nThe critical vulnerability is just one of three Print Spooler issues in the August Patch Tuesday release.\n\n\u201cThe specter of the PrintNightmare continues to haunt this patch Tuesday with three more print spooler vulnerabilities, CVE-2021-36947, CVE-2021-36936 and CVE-2021-34481,\u201d said Breen. \u201cAll three are listed as RCE over the network, requiring a low level of access, similar to PrintNightmare. Microsoft has marked these as \u2018Exploitation More Likely\u2019 which, if the previous speed of POC code being published is anything to go by, is certainly true.\u201d RCE Zero-Day in Windows Update Medic ServiceThe actively exploited bug is tracked as CVE-2021-36948\u00a0and is rated as important; it could pave the way for RCE via the Windows Update Medic Service in Windows 10 and Server 2019 and newer operating systems.\n\n\u201cUpdate Medic is a new service that allows users to repair Windows Update components from a damaged state such that the device can continue to receive updates,\u201d Automox\u2019 Jay Goodman explained. \u201cThe exploit is both low complexity and can be exploited without user interaction, making this an easy vulnerability to include in an adversary\u2019s toolbox.\u201d\n\nImmersive\u2019s Breen added, \u201cCVE-2021-36948 is a privilege-escalation vulnerability \u2013 the cornerstone of modern intrusions as they allow attackers the level of access to do things like hide their tracks and create user accounts.\u00a0 In the case of ransomware attacks, they have also been used to ensure maximum damage.\u201d\n\nThough the bug is being reported as being exploited in the wild by Microsoft, activity appears to remain limited or targeted: \u201cWe have seen no evidence of it at Kenna Security at this time,\u201d Jerry Gamblin, director of security research at Kenna Security (now part of Cisco) told Threatpost. Publicly Known Windows LSA Spoofing BugThe second publicly known bug (after the Print Spooler issue covered earlier) is tracked as CVE-2021-36942, and it\u2019s an important-rated Windows LSA (Local Security Authority) spoofing vulnerability.\n\n\u201cIt fixes a flaw that could be used to steal NTLM hashes from a domain controller or other vulnerable host,\u201d Immersive\u2019s Breen said. \u201cThese types of attacks are well known for lateral movement and privilege escalation, as has been demonstrated recently by a new exploit called PetitPotam. It is a post-intrusion exploit \u2013 further down the attack chain \u2013 but still a useful tool for attackers.\u201d\n\nChilds offered a bit of context around the bug.\n\n\u201cMicrosoft released this patch to further protect against NTLM relay attacks by issuing this update to block the LSARPC interface,\u201d he said. \u201cThis will impact some systems, notably Windows Server 2008 SP2, that use the EFS API OpenEncryptedFileRawA function. You should apply this to your Domain Controllers first and follow the additional guidance in ADV210003\u00a0and KB5005413. This has been an ongoing issue since 2009, and, likely, this isn\u2019t the last we\u2019ll hear of this persistent issue.\u201d\n\nMicrosoft\u2019s next Patch Tuesday will fall on September 14.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080885[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T20:00:05.190004Z"}, {"uuid": "bb0bb276-b5cf-4c0d-a7d8-66caa5bb41fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34486", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4592", "content": "Offensive security\nA Look At Some Real-World Obfuscation Techniques\nhttps://research.nccgroup.com/2021/10/12/a-look-at-some-real-world-obfuscation-techniques\n\nBlue Team Techniques\nIncident Response collection and processing scripts\nwith automated reporting scripts\nhttps://github.com/FSecureLABS/\ud83d\udc4d\ud83c\udffdLinuxCatScale\n\n#mThreat Research\n0-Day Hunting\n(Chaining Bugs/Methodology)\nhttps://blog.riotsecurityteam.com/0day-chains\n\nexploit\n1. CVE-2021-34486:\nWindows 20H2 x64 Etw LPE\nhttps://github.com/KaLendsi/CVE-2021-34486\n\n2. CVE-2021-26085 / CVE-2021-26086:\nAtlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability / Atlassian Jira Server/DataCenter 8.4.0 - Arbitrary File read\nhttps://github.com/ColdFusionX/CVE-2021-26085\nhttps://github.com/ColdFusionX/CVE-2021-26086", "creation_timestamp": "2026-09-10T17:00:04.375820Z"}, {"uuid": "17406ee0-c922-4212-a9b9-92965dc5bc8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34480", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4366", "content": "Fuzzing Closed-Source JavaScript Engines with Coverage Feedback\nhttps://googleprojectzero.blogspot.com/2021/09/fuzzing-closed-source-javascript.html\n]-> CVE-2021-26419:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2157\n]-> CVE-2021-31959:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2168\n]-> CVE-2021-34480:  \nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2188\n\nexploit\nCVE-2021-40539:\nZoho ManageEngine ADSelfService \ud83d\ude43Plus <=6113 is vulnerable to REST API authentication bypass with resultant RCE (Patch + PoC)\nhttps://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis\n\nThreat Research\n1. Web Shells Lead to ZeroLogon and Application Impersonation Attacks\ud83d\ude0a\nhttps://www.fortinet.com/blog/threat-research/more-proxyshell-web-shells-lead-to-zerologon-and-application-impersonation-attacks\n2. Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus\nhttps://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html", "creation_timestamp": "2026-09-10T19:00:04.971506Z"}, {"uuid": "c906e604-4446-409d-976e-cc2791216220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "seen", "source": "https://gist.github.com/tamtruong90/7bb789712512d01a0ae9bf4fe71aa287", "content": "#Requires -Version 5.1\n<#\n    FixSharePrinter.bundle.ps1 \u2014 File g\u1ed9p t\u1ef1 sinh b\u1edfi Build-Bundle.ps1.\n    KH\u00d4NG s\u1eeda tr\u1ef1c ti\u1ebfp file n\u00e0y \u2014 s\u1eeda trong src\\ ho\u1eb7c Gui\\ r\u1ed3i ch\u1ea1y l\u1ea1i Build-Bundle.ps1.\n    Ng\u00e0y build: 2026-09-27 23:17:02\n#>\nparam([switch]$NoGui)\n$ErrorActionPreference = 'Continue'\n$Script:FSP_LogFile = Join-Path $env:TEMP \"FixSharePrinter_$(Get-Date -Format 'yyyyMMdd_HHmmss').log\"\n\n# ---- src/Logging.ps1 ----\nfunction Write-Log {\n    <#\n    .SYNOPSIS\n        Ghi 1 d\u00f2ng log ra file log d\u00f9ng chung c\u1ee7a module, v\u00e0:\n          - N\u1ebfu giao di\u1ec7n WPF \u0111ang m\u1edf (Script:WpfLogBox t\u1ed3n t\u1ea1i) -> \u0111\u01b0a v\u00e0o khung\n            \"NH\u1eacT K\u00dd HO\u1ea0T \u0110\u1ed8NG\" tr\u00ean GUI (Add-WpfLogLine).\n          - N\u1ebfu ch\u01b0a c\u00f3 GUI (v\u00ed d\u1ee5 \u0111ang ch\u1ea1y -NoGui, ho\u1eb7c log tr\u01b0\u1edbc khi m\u1edf c\u1eeda s\u1ed5) ->\n            in ra console nh\u01b0 b\u00ecnh th\u01b0\u1eddng.\n        Nh\u1edd v\u1eady khi ch\u1ea1y ch\u1ebf \u0111\u1ed9 GUI, to\u00e0n b\u1ed9 n\u1ed9i dung \"console\" \u0111\u1ec1u d\u1ed3n h\u1ebft v\u00e0o \u00f4\n        nh\u1eadt k\u00fd c\u1ee7a c\u1eeda s\u1ed5 WPF thay v\u00ec hi\u1ec7n \u1edf c\u1eeda s\u1ed5 console (c\u1eeda s\u1ed5 console l\u00fac \u0111\u00f3\n        \u0111\u00e3 b\u1ecb \u1ea9n \u2014 xem Set-ConsoleWindowVisibility trong Gui\\WpfShell.ps1).\n    #>\n    param([string]$Message, [string]$Level = 'INFO')\n    $line = \"[{0}] [{1}] {2}\" -f (Get-Date -Format 'HH:mm:ss'), $Level, $Message\n    $color = switch ($Level) {\n        'OK'    { 'Green' }\n        'WARN'  { 'Yellow' }\n        'ERR'   { 'Red' }\n        default { 'Gray' }\n    }\n    if ($Script:FSP_LogFile) {\n        Add-Content -Path $Script:FSP_LogFile -Value $line -ErrorAction SilentlyContinue\n    }\n    if ($Script:WpfLogBox -and (Get-Command -Name Add-WpfLogLine -ErrorAction SilentlyContinue)) {\n        Add-WpfLogLine -Text $line -Color $color\n    } else {\n        Write-Host $line -ForegroundColor $color\n    }\n}\n\n\n# ---- src/Admin.ps1 ----\nfunction Test-IsAdmin {\n    <#\n    .SYNOPSIS\n        Tr\u1ea3 v\u1ec1 $true n\u1ebfu ti\u1ebfn tr\u00ecnh hi\u1ec7n t\u1ea1i \u0111ang ch\u1ea1y v\u1edbi quy\u1ec1n Administrator.\n    #>\n    $id = [Security.Principal.WindowsIdentity]::GetCurrent()\n    $p  = New-Object Security.Principal.WindowsPrincipal($id)\n    return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)\n}\n\nfunction Invoke-SelfElevate {\n    <#\n    .SYNOPSIS\n        N\u1ebfu ti\u1ebfn tr\u00ecnh ch\u01b0a ch\u1ea1y Admin, t\u1ef1 kh\u1edfi \u0111\u1ed9ng l\u1ea1i ch\u00ednh script hi\u1ec7n t\u1ea1i (PSCommandPath)\n        v\u1edbi quy\u1ec1n Administrator (UAC prompt), r\u1ed3i tho\u00e1t ti\u1ebfn tr\u00ecnh hi\u1ec7n t\u1ea1i.\n    .PARAMETER ScriptPath\n        \u0110\u01b0\u1eddng d\u1eabn script c\u1ea7n ch\u1ea1y l\u1ea1i v\u1edbi quy\u1ec1n admin. M\u1eb7c \u0111\u1ecbnh d\u00f9ng $PSCommandPath c\u1ee7a caller.\n    .PARAMETER Arguments\n        C\u00e1c tham s\u1ed1 d\u00f2ng l\u1ec7nh kh\u00e1c c\u1ea7n truy\u1ec1n ti\u1ebfp (v\u00ed d\u1ee5 -NoGui).\n    #>\n    param(\n        [string]$ScriptPath = $MyInvocation.PSCommandPath,\n        [string[]]$Arguments = @()\n    )\n\n    if (Test-IsAdmin) { return $true }\n\n    Write-Host \"\u0110ang y\u00eau c\u1ea7u quy\u1ec1n Qu\u1ea3n tr\u1ecb vi\u00ean (Administrator)...\" -ForegroundColor Yellow\n    try {\n        $target = if ($ScriptPath) { $ScriptPath } else { $PSCommandPath }\n        $argLine = \"-NoProfile -ExecutionPolicy Bypass -File `\"$target`\"\"\n        if ($Arguments -and $Arguments.Count -gt 0) { $argLine += \" \" + ($Arguments -join ' ') }\n        # -WindowStyle Hidden \u0111\u1ec3 gi\u1ea3m vi\u1ec7c ch\u1edbp c\u1eeda s\u1ed5 console tr\u01b0\u1edbc khi ti\u1ebfn tr\u00ecnh m\u1edbi t\u1ef1 \u1ea9n n\u00f3 \u0111i.\n        Start-Process powershell -ArgumentList $argLine -Verb RunAs -WindowStyle Hidden\n    } catch {\n        Write-Host \"Ng\u01b0\u1eddi d\u00f9ng t\u1eeb ch\u1ed1i c\u1ea5p quy\u1ec1n Admin ho\u1eb7c l\u1ed7i khi elevate: $($_.Exception.Message)\" -ForegroundColor Red\n    }\n    return $false\n}\n\n\nif (-not (Test-IsAdmin)) {\n    $extraArgs = @(); if ($NoGui) { $extraArgs += '-NoGui' }\n    Invoke-SelfElevate -ScriptPath $PSCommandPath -Arguments $extraArgs\n    exit\n}\n\n# ---- src/Clear-StalePrinterPorts.ps1 ----\nfunction Clear-StalePrinterPorts {\n    <#\n    .SYNOPSIS\n        D\u1eebng Spooler + kill ti\u1ebfn tr\u00ecnh driver h\u00e3ng m\u00e1y in \u0111ang treo c\u1ed5ng, sau \u0111\u00f3 xo\u00e1 c\u00e1c\n        c\u1ed5ng USB \u1ea3o (USB*/CNUSB*) kh\u00f4ng c\u00f2n m\u00e1y in n\u00e0o tr\u1ecf t\u1edbi, r\u1ed3i rescan l\u1ea1i thi\u1ebft b\u1ecb.\n    #>\n    Write-Log \"\u0110ang d\u1ecdn d\u1eb9p c\u1ed5ng USB \u1ea3o / treo kh\u00f4ng s\u1eed d\u1ee5ng...\"\n    try {\n        Write-Log \"  T\u1ea1m d\u1eebng Spooler & gi\u1ea3i ph\u00f3ng ti\u1ebfn tr\u00ecnh driver h\u00e3ng m\u00e1y in...\"\n        Stop-Service -Name Spooler -Force -ErrorAction SilentlyContinue\n        Get-Process -Name \"Capn*\", \"CPCA*\", \"BrMs*\", \"HPCus*\", \"E_I*\" -ErrorAction SilentlyContinue |\n            Stop-Process -Force -ErrorAction SilentlyContinue\n        Start-Sleep -Seconds 1\n        Start-Service -Name Spooler -ErrorAction Stop\n\n        Write-Log \"  L\u1ecdc v\u00e0 xo\u00e1 c\u00e1c c\u1ed5ng USB kh\u00f4ng c\u00f3 m\u00e1y in s\u1eed d\u1ee5ng...\"\n        $dsPort = Get-PrinterPort -ErrorAction SilentlyContinue | Where-Object { $_.Name -like \"USB*\" -or $_.Name -like \"CNUSB*\" }\n        $portDangDung = (Get-Printer -ErrorAction SilentlyContinue).PortName\n\n        foreach ($port in $dsPort) {\n            if ($portDangDung -notcontains $port.Name) {\n                try {\n                    Remove-PrinterPort -Name $port.Name -ErrorAction Stop\n                    Write-Log \"  + \u0110\u00e3 xo\u00e1 c\u1ed5ng kh\u00f4ng d\u00f9ng: $($port.Name)\" \"OK\"\n                } catch {\n                    Write-Log \"  + Kh\u00f4ng xo\u00e1 \u0111\u01b0\u1ee3c c\u1ed5ng '$($port.Name)': $($_.Exception.Message)\" \"WARN\"\n                }\n            }\n        }\n\n        pnputil /scan-devices | Out-Null\n        Write-Log \"Ho\u00e0n t\u1ea5t d\u1ecdn d\u1eb9p c\u1ed5ng m\u00e1y in.\" \"OK\"\n    } catch {\n        Write-Log \"Clear-StalePrinterPorts: $($_.Exception.Message)\" \"ERR\"\n    }\n}\n\n\n# ---- src/Disable-PrinterWorkOfflineMode.ps1 ----\nfunction Disable-PrinterWorkOfflineMode {\n    <#\n    .SYNOPSIS\n        B\u1ecf ch\u1ebf \u0111\u1ed9 \"Work Offline\" cho t\u1ea5t c\u1ea3 m\u00e1y in \u0111ang b\u1eadt ch\u1ebf \u0111\u1ed9 n\u00e0y, chuy\u1ec3n ch\u00fang v\u1ec1 ONLINE.\n    #>\n    Write-Log \"\u0110ang ki\u1ec3m tra m\u00e1y in \u0111ang \u1edf ch\u1ebf \u0111\u1ed9 Work Offline...\"\n    try {\n        $dsMayInOffline = Get-Printer -ErrorAction SilentlyContinue | Where-Object { $_.WorkOffline -eq $true }\n        if (-not $dsMayInOffline) {\n            Write-Log \"T\u1ea5t c\u1ea3 m\u00e1y in \u0111\u1ec1u \u0111ang \u1edf ch\u1ebf \u0111\u1ed9 ONLINE.\" \"OK\"\n            return\n        }\n        foreach ($mayIn in $dsMayInOffline) {\n            try {\n                Set-Printer -Name $mayIn.Name -WorkOffline $false -ErrorAction Stop\n                Write-Log \"  + \u0110\u00e3 chuy\u1ec3n '$($mayIn.Name)' v\u1ec1 ONLINE.\" \"OK\"\n            } catch {\n                Write-Log \"  + Kh\u00f4ng chuy\u1ec3n \u0111\u01b0\u1ee3c '$($mayIn.Name)': $($_.Exception.Message)\" \"WARN\"\n            }\n        }\n        Write-Log \"\u0110\u00e3 chuy\u1ec3n to\u00e0n b\u1ed9 m\u00e1y in v\u1ec1 ch\u1ebf \u0111\u1ed9 ONLINE.\" \"OK\"\n    } catch {\n        Write-Log \"Disable-PrinterWorkOfflineMode: $($_.Exception.Message)\" \"ERR\"\n    }\n}\n\n\n# ---- src/Enable-GuestAndNullSessionAccess.ps1 ----\nfunction Enable-GuestAndNullSessionAccess {\n    <#\n    .SYNOPSIS\n        Cho ph\u00e9p truy c\u1eadp ki\u1ec3u Guest/Null-session \u2014 c\u1ea7n thi\u1ebft khi share m\u00e1y in/file ki\u1ec3u\n        workgroup kh\u00f4ng d\u00f9ng t\u00e0i kho\u1ea3n \u0111\u00edch danh (ai trong m\u1ea1ng LAN c\u0169ng k\u1ebft n\u1ed1i \u0111\u01b0\u1ee3c).\n    .L\u01afU \u00dd\n        C\u00e1c thi\u1ebft l\u1eadp n\u00e0y l\u00e0m gi\u1ea3m m\u1ee9c b\u1ea3o m\u1eadt. Ch\u1ec9 n\u00ean d\u00f9ng trong m\u1ea1ng LAN n\u1ed9i b\u1ed9 tin c\u1eady,\n        kh\u00f4ng expose m\u00e1y ra Internet.\n    #>\n    Write-Log \"\u0110ang c\u1ea5u h\u00ecnh Guest/Null-session access cho chia s\u1ebb ki\u1ec3u workgroup...\"\n    try {\n        Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters' -Name 'RestrictNullSessAccess' -Value 0 -Type DWord -Force\n        Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name 'EveryoneIncludesAnonymous' -Value 1 -Type DWord -Force\n        Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name 'limitblankpassworduse' -Value 0 -Type DWord -Force\n        Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name 'ForceGuest' -Value 1 -Type DWord -Force\n\n        net user Guest /active:yes *> $null\n        net localgroup Guests Guest /add *> $null\n\n        Write-Log \"\u0110\u00e3 b\u1eadt Guest account + n\u1edbi Null-session/Anonymous access.\" \"OK\"\n        Write-Log \"  (C\u00e2n nh\u1eafc: ch\u1ec9 n\u00ean b\u1eadt khi m\u1ea1ng LAN n\u1ed9i b\u1ed9 tin c\u1eady, kh\u00f4ng expose ra Internet.)\" \"WARN\"\n    } catch {\n        Write-Log \"L\u1ed7i khi c\u1ea5u h\u00ecnh Guest/Null-session: $($_.Exception.Message)\" \"WARN\"\n    }\n}\n\n\n# ---- src/Enable-NetworkDiscoveryAndSharing.ps1 ----\nfunction Enable-NetworkDiscoveryAndSharing {\n    <#\n    .SYNOPSIS\n        B\u1eadt Network Discovery + File and Printer Sharing tr\u00ean firewall,\n        v\u00e0 chuy\u1ec3n network profile hi\u1ec7n t\u1ea1i t\u1eeb Public sang Private n\u1ebfu c\u1ea7n.\n    #>\n    Write-Log \"\u0110ang b\u1eadt Network Discovery + File and Printer Sharing...\"\n    try {\n        Set-NetFirewallRule -DisplayGroup \"Network Discovery\" -Enabled True -ErrorAction SilentlyContinue\n        Set-NetFirewallRule -DisplayGroup \"File and Printer Sharing\" -Enabled True -ErrorAction SilentlyContinue\n\n        Get-NetConnectionProfile | ForEach-Object {\n            if ($_.NetworkCategory -eq 'Public') {\n                try {\n                    Set-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -NetworkCategory Private -ErrorAction SilentlyContinue\n                    Write-Log \"  + \u0110\u00e3 chuy\u1ec3n network '$($_.Name)' t\u1eeb Public sang Private.\" \"OK\"\n                } catch {\n                    Write-Log \"  + Kh\u00f4ng \u0111\u1ed5i \u0111\u01b0\u1ee3c profile m\u1ea1ng '$($_.Name)' (c\u00f3 th\u1ec3 do domain policy).\" \"WARN\"\n                }\n            }\n        }\n        Write-Log \"Network Discovery / File and Printer Sharing \u0111\u00e3 b\u1eadt.\" \"OK\"\n    } catch {\n        Write-Log \"L\u1ed7i khi b\u1eadt Network Discovery: $($_.Exception.Message)\" \"WARN\"\n    }\n}\n\n\n# ---- src/Enable-RequiredServices.ps1 ----\nfunction Enable-RequiredServices {\n    <#\n    .SYNOPSIS\n        B\u1eadt (StartupType + Start-Service) c\u00e1c d\u1ecbch v\u1ee5 Windows c\u1ea7n thi\u1ebft cho\n        chia s\u1ebb file/m\u00e1y in v\u00e0 kh\u00e1m ph\u00e1 m\u1ea1ng (Network Discovery) trong LAN.\n    #>\n    Write-Log \"\u0110ang b\u1eadt c\u00e1c d\u1ecbch v\u1ee5 c\u1ea7n thi\u1ebft cho chia s\u1ebb m\u00e1y in/m\u1ea1ng LAN...\"\n    $services = @(\n        @{Name='Spooler';           Note='Print Spooler'},\n        @{Name='FDResPub';          Note='Function Discovery Resource Publication'},\n        @{Name='fdPHost';           Note='Function Discovery Provider Host'},\n        @{Name='LanmanServer';      Note='Server (chia s\u1ebb file/m\u00e1y in)'},\n        @{Name='LanmanWorkstation'; Note='Workstation (SMB client)'},\n        @{Name='RpcSs';             Note='Remote Procedure Call (RPC)'},\n        @{Name='RpcEptMapper';      Note='RPC Endpoint Mapper'},\n        @{Name='DcomLaunch';        Note='DCOM Server Process Launcher'},\n        @{Name='SSDPSRV';           Note='SSDP Discovery'},\n        @{Name='upnphost';          Note='UPnP Device Host'},\n        @{Name='Dnscache';          Note='DNS Client'},\n        @{Name='LmHosts';           Note='TCP/IP NetBIOS Helper'}\n    )\n    foreach ($svc in $services) {\n        try {\n            $s = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue\n            if ($s) {\n                if ($s.StartType -eq 'Disabled') { Set-Service -Name $svc.Name -StartupType Manual }\n                if ($s.Status -ne 'Running') { Start-Service -Name $svc.Name -ErrorAction SilentlyContinue }\n                Write-Log (\"  + {0} ({1}) OK\" -f $svc.Name, $svc.Note) \"OK\"\n            }\n        } catch {\n            Write-Log (\"  + Kh\u00f4ng b\u1eadt \u0111\u01b0\u1ee3c {0}: {1}\" -f $svc.Name, $_.Exception.Message) \"WARN\"\n        }\n    }\n}\n\n\n# ---- src/Enable-SMB1CifsSharing.ps1 ----\nfunction Enable-SMB1CifsSharing {\n    <#\n    .SYNOPSIS\n        B\u1eadt chia s\u1ebb m\u00e1y in/file qua giao th\u1ee9c SMB1/CIFS (d\u00f9ng cho thi\u1ebft b\u1ecb \u0111\u1eddi c\u0169:\n        Windows XP/Server 2003, NAS/m\u00e1y in c\u0169 ch\u1ec9 h\u1ed7 tr\u1ee3 SMB1).\n    #>\n    Write-Log \"=== B\u1eaeT \u0110\u1ea6U C\u1ea4U H\u00ccNH CHIA S\u1eba QUA SMB1/CIFS (GIAO TH\u1ee8C C\u0168) ===\" \"WARN\"\n\n    try {\n        $feature = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue\n        if ($feature -and $feature.State -ne 'Enabled') {\n            Write-Log \"\u0110ang b\u1eadt Windows Feature: SMB1Protocol (y\u00eau c\u1ea7u c\u00f3 th\u1ec3 kh\u1edfi \u0111\u1ed9ng l\u1ea1i m\u00e1y)...\"\n            Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -All -NoRestart -ErrorAction Stop | Out-Null\n            Write-Log \"\u0110\u00e3 b\u1eadt SMB1Protocol. C\u00f3 th\u1ec3 c\u1ea7n RESTART m\u00e1y \u0111\u1ec3 c\u00f3 hi\u1ec7u l\u1ef1c ho\u00e0n to\u00e0n.\" \"OK\"\n        } else {\n            Write-Log \"SMB1Protocol \u0111\u00e3 \u0111\u01b0\u1ee3c b\u1eadt s\u1eb5n.\" \"OK\"\n        }\n    } catch {\n        Write-Log \"Kh\u00f4ng b\u1eadt \u0111\u01b0\u1ee3c SMB1Protocol qua DISM: $($_.Exception.Message)\" \"WARN\"\n        Write-Log \"Th\u1eed b\u1eadt b\u1eb1ng Set-SmbServerConfiguration...\"\n    }\n\n    try {\n        Set-SmbServerConfiguration -EnableSMB1Protocol $true -Force -ErrorAction SilentlyContinue\n        Set-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\" -Name \"DependOnService\" -Value @(\"Bowser\",\"MRxSmb20\",\"MRxSmb10\",\"NSI\") -Type MultiString -ErrorAction SilentlyContinue\n        Write-Log \"\u0110\u00e3 b\u1eadt SMB1 ph\u00eda Server (Set-SmbServerConfiguration).\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c SMB1 qua Set-SmbServerConfiguration: $($_.Exception.Message)\" \"WARN\"\n    }\n\n    try {\n        $gpoPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation\"\n        if (-not (Test-Path $gpoPath)) { New-Item -Path $gpoPath -Force | Out-Null }\n        Set-ItemProperty -Path $gpoPath -Name \"AllowInsecureGuestAuth\" -Value 1 -Type DWord -Force\n\n        $lanmanWkParamPath = \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\"\n        if (-not (Test-Path $lanmanWkParamPath)) { New-Item -Path $lanmanWkParamPath -Force | Out-Null }\n        Set-ItemProperty -Path $lanmanWkParamPath -Name \"AllowInsecureGuestAuth\" -Value 1 -Type DWord -Force\n\n        Write-Log \"\u0110\u00e3 b\u1eadt AllowInsecureGuestAuth=1 (c\u1ea3 GPO path v\u00e0 Parameters path) \u2014 cho ph\u00e9p guest logon qua SMB1.\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c AllowInsecureGuestAuth: $($_.Exception.Message)\" \"WARN\"\n    }\n\n    try {\n        $lsaPath = \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\n        Set-ItemProperty -Path $lsaPath -Name \"LmCompatibilityLevel\" -Value 1 -Type DWord -Force\n        Write-Log \"\u0110\u00e3 h\u1ea1 LmCompatibilityLevel=1 \u0111\u1ec3 t\u01b0\u01a1ng th\u00edch m\u00e1y/NAS \u0111\u1eddi c\u0169.\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c LmCompatibilityLevel: $($_.Exception.Message)\" \"WARN\"\n    }\n\n    Write-Log \"=== HO\u00c0N T\u1ea4T C\u1ea4U H\u00ccNH SMB1/CIFS. Khuy\u1ebfn ngh\u1ecb RESTART m\u00e1y \u0111\u1ec3 \u00e1p d\u1ee5ng \u0111\u1ea7y \u0111\u1ee7. ===\" \"WARN\"\n}\n\n\n# ---- src/Enable-SMB2Sharing.ps1 ----\nfunction Enable-SMB2Sharing {\n    <#\n    .SYNOPSIS\n        B\u1eadt chia s\u1ebb m\u00e1y in/file qua giao th\u1ee9c SMB2/SMB3 (khuy\u1ebfn ngh\u1ecb cho m\u1ea1ng LAN\n        hi\u1ec7n \u0111\u1ea1i, Windows 7 SP1 tr\u1edf l\u00ean), \u0111\u1ed3ng th\u1eddi t\u1eaft SMB1 \u0111\u1ec3 t\u0103ng b\u1ea3o m\u1eadt.\n    #>\n    Write-Log \"=== B\u1eaeT \u0110\u1ea6U C\u1ea4U H\u00ccNH CHIA S\u1eba QUA SMB2/SMB3 (GIAO TH\u1ee8C M\u1edaI, KHUY\u1ebeN NGH\u1eca) ===\" \"OK\"\n\n    try {\n        Set-SmbServerConfiguration -EnableSMB2Protocol $true -Force -ErrorAction SilentlyContinue\n        Write-Log \"\u0110\u00e3 b\u1eadt SMB2/SMB3 ph\u00eda Server.\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c EnableSMB2Protocol: $($_.Exception.Message)\" \"WARN\"\n    }\n\n    try {\n        $gpoPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation\"\n        if (-not (Test-Path $gpoPath)) { New-Item -Path $gpoPath -Force | Out-Null }\n        Set-ItemProperty -Path $gpoPath -Name \"AllowInsecureGuestAuth\" -Value 1 -Type DWord -Force\n        Write-Log \"\u0110\u00e3 b\u1eadt AllowInsecureGuestAuth=1 cho SMB2 (h\u1ed7 tr\u1ee3 workgroup kh\u00f4ng d\u00f9ng t\u00e0i kho\u1ea3n).\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c AllowInsecureGuestAuth cho SMB2: $($_.Exception.Message)\" \"WARN\"\n    }\n\n    try {\n        $feature = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue\n        if ($feature -and $feature.State -eq 'Enabled') {\n            Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction SilentlyContinue | Out-Null\n            Write-Log \"\u0110\u00e3 t\u1eaft SMB1Protocol (b\u1ea3o m\u1eadt h\u01a1n khi \u0111\u00e3 d\u00f9ng SMB2).\" \"OK\"\n        }\n        Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force -ErrorAction SilentlyContinue\n    } catch {\n        Write-Log \"Kh\u00f4ng t\u1eaft \u0111\u01b0\u1ee3c SMB1 (b\u1ecf qua, kh\u00f4ng \u1ea3nh h\u01b0\u1edfng SMB2): $($_.Exception.Message)\" \"WARN\"\n    }\n\n    try {\n        Set-SmbServerConfiguration -RequireSecuritySignature $false -Force -ErrorAction SilentlyContinue\n        Write-Log \"\u0110\u00e3 \u0111\u1eb7t RequireSecuritySignature=false \u0111\u1ec3 tr\u00e1nh l\u1ed7i k\u1ebft n\u1ed1i trong m\u1ea1ng LAN n\u1ed9i b\u1ed9.\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c RequireSecuritySignature: $($_.Exception.Message)\" \"WARN\"\n    }\n\n    Write-Log \"=== HO\u00c0N T\u1ea4T C\u1ea4U H\u00ccNH SMB2/SMB3. ===\" \"OK\"\n}\n\n\n# ---- src/Fix-Error0x0000011b.ps1 ----\nfunction Fix-Error0x0000011b {\n    <#\n    .SYNOPSIS\n        V\u00e1 l\u1ed7i 0x0000011b \"Operation could not be completed\" ph\u00e1t sinh sau b\u1ea3n v\u00e1\n        b\u1ea3o m\u1eadt Point and Print / RPC hardening c\u1ee7a Microsoft (CVE-2021-34481 v\u00e0 li\u00ean quan).\n    #>\n    Write-Log \"\u0110ang v\u00e1 l\u1ed7i 0x0000011b (Point and Print / RPC hardening)...\"\n    $paths = @(\n        'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers',\n        'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\RPC',\n        'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Print'\n    )\n    foreach ($p in $paths) {\n        if (-not (Test-Path $p)) { New-Item -Path $p -Force | Out-Null }\n    }\n    try {\n        # Set \u1edf c\u1ea3 3 v\u1ecb tr\u00ed registry: v\u1ecb tr\u00ed Policy (\u00e1p d\u1ee5ng khi c\u00f3 domain GPO)\n        # v\u00e0 v\u1ecb tr\u00ed Control\\Print (\u00e1p d\u1ee5ng m\u00e1y standalone/workgroup).\n        Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers' -Name 'RpcAuthnLevelPrivacyEnabled' -Value 0 -Type DWord -Force\n        Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\RPC' -Name 'RpcAuthnLevelPrivacyEnabled' -Value 0 -Type DWord -Force\n        Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Print' -Name 'RpcAuthnLevelPrivacyEnabled' -Value 0 -Type DWord -Force\n\n        $ppPath = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint'\n        if (-not (Test-Path $ppPath)) { New-Item -Path $ppPath -Force | Out-Null }\n        Set-ItemProperty -Path $ppPath -Name 'RestrictDriverInstallationToAdministrators' -Value 0 -Type DWord -Force\n        Set-ItemProperty -Path $ppPath -Name 'NoWarningNoElevationOnInstall' -Value 1 -Type DWord -Force\n        Set-ItemProperty -Path $ppPath -Name 'UpdatePromptSettings' -Value 2 -Type DWord -Force\n\n        Write-Log \"\u0110\u00e3 set RpcAuthnLevelPrivacyEnabled=0 (c\u1ea3 3 v\u1ecb tr\u00ed registry) v\u00e0 n\u1edbi l\u1ecfng Point and Print policy.\" \"OK\"\n    } catch {\n        Write-Log \"L\u1ed7i khi v\u00e1 0x0000011b: $($_.Exception.Message)\" \"ERR\"\n    }\n}\n\n\n# ---- src/Fix-Error0x00000709.ps1 ----\nfunction Fix-Error0x00000709 {\n    <#\n    .SYNOPSIS\n        V\u00e1 l\u1ed7i 0x00000709 \"Windows could not set the default printer\".\n    #>\n    Write-Log \"\u0110ang v\u00e1 l\u1ed7i 0x00000709 (kh\u00f4ng set \u0111\u01b0\u1ee3c m\u00e1y in m\u1eb7c \u0111\u1ecbnh)...\"\n    try {\n        $wnKey = 'HKCU:\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows'\n        if (Test-Path $wnKey) {\n            Set-ItemProperty -Path $wnKey -Name 'LegacyDefaultPrinterMode' -Value 1 -Type DWord -Force\n            Write-Log \"\u0110\u00e3 b\u1eadt LegacyDefaultPrinterMode=1 (d\u00f9ng c\u01a1 ch\u1ebf set default printer ki\u1ec3u c\u0169).\" \"OK\"\n        }\n        Restart-PrintSpoolerSafe\n    } catch {\n        Write-Log \"L\u1ed7i khi v\u00e1 0x00000709: $($_.Exception.Message)\" \"WARN\"\n    }\n}\n\n\n# ---- src/Fix-RpcNamedPipeAndExtendedErrors.ps1 ----\nfunction Fix-RpcNamedPipeAndExtendedErrors {\n    <#\n    .SYNOPSIS\n        V\u00e1 l\u1ed7i 0x00000040 / 0x000006e4 \u2014 RPC qua Named Pipes b\u1ecb ch\u1eb7n,\n        th\u01b0\u1eddng g\u1eb7p tr\u00ean Windows 11 khi k\u1ebft n\u1ed1i m\u00e1y in m\u1ea1ng.\n    #>\n    Write-Log \"\u0110ang v\u00e1 l\u1ed7i RPC Named Pipes (0x00000040 / 0x000006e4)...\"\n    try {\n        $rpcPath = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\RPC'\n        if (-not (Test-Path $rpcPath)) { New-Item -Path $rpcPath -Force | Out-Null }\n        Set-ItemProperty -Path $rpcPath -Name 'RpcUseNamedPipesAuth' -Value 1 -Type DWord -Force\n        Set-ItemProperty -Path $rpcPath -Name 'RpcProtocols' -Value 7 -Type DWord -Force\n        Set-ItemProperty -Path $rpcPath -Name 'RpcTcpPort' -Value 0 -Type DWord -Force\n        Write-Log \"\u0110\u00e3 b\u1eadt RpcUseNamedPipesAuth=1, RpcProtocols=7, RpcTcpPort=0.\" \"OK\"\n    } catch {\n        Write-Log \"L\u1ed7i khi v\u00e1 RPC Named Pipes: $($_.Exception.Message)\" \"WARN\"\n    }\n}\n\n\n# ---- src/Fix-RpcServerUnavailable.ps1 ----\nfunction Fix-RpcServerUnavailable {\n    <#\n    .SYNOPSIS\n        M\u1edf firewall cho RPC (port 135 + d\u1ea3i dynamic port DCOM) \u0111\u1ec3 kh\u1eafc ph\u1ee5c\n        l\u1ed7i \"The RPC server is unavailable\" khi add/k\u1ebft n\u1ed1i m\u00e1y in qua m\u1ea1ng.\n    #>\n    Write-Log \"\u0110ang v\u00e1 l\u1ed7i RPC server unavailable...\"\n    try {\n        netsh advfirewall firewall set rule group=\"Windows Management Instrumentation (WMI)\" new enable=yes | Out-Null\n        netsh advfirewall firewall set rule group=\"Remote Administration\" new enable=yes | Out-Null\n        New-NetFirewallRule -DisplayName \"RPC Endpoint Mapper (TCP-In) Custom\" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow -ErrorAction SilentlyContinue | Out-Null\n        New-NetFirewallRule -DisplayName \"RPC Dynamic Ports (TCP-In) Custom\" -Direction Inbound -Protocol TCP -LocalPort 49152-65535 -Action Allow -ErrorAction SilentlyContinue | Out-Null\n        Write-Log \"\u0110\u00e3 m\u1edf port RPC 135 v\u00e0 d\u1ea3i dynamic port tr\u00ean firewall.\" \"OK\"\n    } catch {\n        Write-Log \"L\u1ed7i khi c\u1ea5u h\u00ecnh firewall RPC: $($_.Exception.Message)\" \"WARN\"\n    }\n}\n\n\n# ---- src/Get-LocalPrinters.ps1 ----\nfunction Get-LocalPrinters {\n    <#\n    .SYNOPSIS\n        Tr\u1ea3 v\u1ec1 danh s\u00e1ch to\u00e0n b\u1ed9 m\u00e1y in local (Get-Printer), d\u00f9ng cho c\u1ea3 console l\u1eabn GUI.\n    #>\n    return Get-Printer -ErrorAction SilentlyContinue\n}\n\n\n# ---- src/Invoke-FixCommonPrinterErrors.ps1 ----\nfunction Invoke-FixCommonPrinterErrors {\n    <#\n    .SYNOPSIS\n        Ch\u1ea1y to\u00e0n b\u1ed9 c\u00e1c b\u01b0\u1edbc v\u00e1 l\u1ed7i d\u00f9ng chung (RPC, 0x0000011b, 0x00000709,\n        Named Pipes, Guest/Null-session) \u2014 kh\u00f4ng \u0111\u1ed5i c\u1ea5u h\u00ecnh SMB1/SMB2.\n        D\u00f9ng cho c\u1ea3 2 l\u1ef1a ch\u1ecdn giao th\u1ee9c v\u00e0 cho t\u00f9y ch\u1ecdn \"ch\u1ec9 v\u00e1 l\u1ed7i\".\n    #>\n    Enable-RequiredServices\n    Fix-RpcServerUnavailable\n    Fix-Error0x0000011b\n    Fix-RpcNamedPipeAndExtendedErrors\n    Fix-Error0x00000709\n    Enable-GuestAndNullSessionAccess\n    Enable-NetworkDiscoveryAndSharing\n}\n\n\n# ---- src/Invoke-SetupSmb1Sharing.ps1 ----\nfunction Invoke-SetupSmb1Sharing {\n    <#\n    .SYNOPSIS\n        Ch\u1ea1y to\u00e0n b\u1ed9 quy tr\u00ecnh: v\u00e1 l\u1ed7i d\u00f9ng chung + b\u1eadt chia s\u1ebb qua SMB1/CIFS (giao th\u1ee9c c\u0169).\n    #>\n    Invoke-FixCommonPrinterErrors\n    Enable-SMB1CifsSharing\n    Write-Log \">>> N\u1ebfu v\u1eeba b\u1eadt SMB1 l\u1ea7n \u0111\u1ea7u, h\u00e3y RESTART m\u00e1y r\u1ed3i th\u1eed l\u1ea1i. <<<\" \"WARN\"\n}\n\n\n# ---- src/Invoke-SetupSmb2Sharing.ps1 ----\nfunction Invoke-SetupSmb2Sharing {\n    <#\n    .SYNOPSIS\n        Ch\u1ea1y to\u00e0n b\u1ed9 quy tr\u00ecnh: v\u00e1 l\u1ed7i d\u00f9ng chung + b\u1eadt chia s\u1ebb qua SMB2/SMB3 (giao th\u1ee9c m\u1edbi).\n    #>\n    Invoke-FixCommonPrinterErrors\n    Enable-SMB2Sharing\n}\n\n\n# ---- src/Remove-OfflinePrinterCopies.ps1 ----\nfunction Remove-OfflinePrinterCopies {\n    <#\n    .SYNOPSIS\n        Xo\u00e1 c\u00e1c m\u00e1y in c\u00f3 h\u1eadu t\u1ed1 \"Copy\"/\"B\u1ea3n sao\" (th\u01b0\u1eddng do Windows t\u1ef1 t\u1ea1o khi c\u00e0i driver\n        l\u1ed7i/tr\u00f9ng) m\u00e0 \u0111ang \u1edf tr\u1ea1ng th\u00e1i offline. Kh\u00f4ng \u0111\u1ee5ng t\u1edbi c\u00e1c m\u00e1y in Copy \u0111ang online.\n    #>\n    Write-Log \"\u0110ang d\u00f2 c\u00e1c m\u00e1y in Copy/B\u1ea3n sao \u0111ang offline...\"\n    try {\n        $regexCopy = '(\\(?Copy\\s*\\d+\\)?|\\(?B\u1ea3n sao\\s*\\d+\\)?|copy\\d+)$'\n        $dsMayIn = Get-Printer -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $regexCopy }\n\n        if (-not $dsMayIn) {\n            Write-Log \"Kh\u00f4ng t\u00ecm th\u1ea5y m\u00e1y in n\u00e0o c\u00f3 h\u1eadu t\u1ed1 Copy/B\u1ea3n sao.\" \"WARN\"\n            return\n        }\n\n        foreach ($mayIn in $dsMayIn) {\n            if ($mayIn.WorkOffline -eq $true -or $mayIn.PrinterStatus -eq 'Offline') {\n                try {\n                    Remove-Printer -Name $mayIn.Name -ErrorAction Stop\n                    Write-Log \"\u0110\u00e3 xo\u00e1 m\u00e1y in offline: $($mayIn.Name)\" \"OK\"\n                } catch {\n                    Write-Log \"Kh\u00f4ng xo\u00e1 \u0111\u01b0\u1ee3c m\u00e1y in '$($mayIn.Name)': $($_.Exception.Message)\" \"WARN\"\n                }\n            }\n        }\n        Write-Log \"Ho\u00e0n t\u1ea5t x\u1eed l\u00fd m\u00e1y in Copy/B\u1ea3n sao offline.\" \"OK\"\n    } catch {\n        Write-Log \"Remove-OfflinePrinterCopies: $($_.Exception.Message)\" \"ERR\"\n    }\n}\n\n\n# ---- src/Restart-PrintSpoolerSafe.ps1 ----\nfunction Restart-PrintSpoolerSafe {\n    <#\n    .SYNOPSIS\n        D\u1eebng Spooler, xo\u00e1 job in b\u1ecb k\u1eb9t trong h\u00e0ng \u0111\u1ee3i, r\u1ed3i kh\u1edfi \u0111\u1ed9ng l\u1ea1i Spooler.\n    #>\n    Write-Log \"\u0110ang kh\u1edfi \u0111\u1ed9ng l\u1ea1i d\u1ecbch v\u1ee5 Print Spooler...\"\n    try {\n        Stop-Service -Name Spooler -Force -ErrorAction SilentlyContinue\n        Start-Sleep -Seconds 2\n        $spoolPath = \"$env:SystemRoot\\System32\\spool\\PRINTERS\"\n        if (Test-Path $spoolPath) {\n            Get-ChildItem $spoolPath -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue\n        }\n        Set-Service -Name Spooler -StartupType Automatic\n        Start-Service -Name Spooler\n        Write-Log \"Print Spooler \u0111\u00e3 ch\u1ea1y l\u1ea1i th\u00e0nh c\u00f4ng.\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng th\u1ec3 kh\u1edfi \u0111\u1ed9ng l\u1ea1i Spooler: $($_.Exception.Message)\" \"ERR\"\n    }\n}\n\n\n# ---- src/Set-PrinterSharedByName.ps1 ----\nfunction Set-PrinterSharedByName {\n    <#\n    .SYNOPSIS\n        B\u1eadt chia s\u1ebb (Shared=$true) cho 1 m\u00e1y in theo t\u00ean, t\u1ef1 sinh ShareName h\u1ee3p l\u1ec7.\n    .PARAMETER PrinterName\n        T\u00ean m\u00e1y in (Name trong Get-Printer) c\u1ea7n chia s\u1ebb.\n    #>\n    param([Parameter(Mandatory)][string]$PrinterName)\n    try {\n        $shareName = ($PrinterName -replace '[\\\\\\/:\\*\\?\"<>\\|]', '_')\n        Set-Printer -Name $PrinterName -Shared $true -ShareName $shareName -ErrorAction Stop\n        Write-Log \"\u0110\u00e3 chia s\u1ebb m\u00e1y in '$PrinterName' v\u1edbi t\u00ean share '$shareName'.\" \"OK\"\n        return $true\n    } catch {\n        Write-Log \"Kh\u00f4ng chia s\u1ebb \u0111\u01b0\u1ee3c m\u00e1y in '$PrinterName': $($_.Exception.Message)\" \"ERR\"\n        return $false\n    }\n}\n\n\n# ---- src/Set-SharePermissionsEveryoneReadWrite.ps1 ----\nfunction Set-SharePermissionsEveryoneReadWrite {\n    <#\n    .SYNOPSIS\n        C\u1ea5p quy\u1ec1n Full cho 'Everyone' tr\u00ean 1 share (d\u00f9ng cho m\u1ea1ng LAN n\u1ed9i b\u1ed9 tin c\u1eady).\n    .PARAMETER ShareName\n        T\u00ean share c\u1ea7n c\u1ea5p quy\u1ec1n.\n    #>\n    param([string]$ShareName)\n    try {\n        Grant-SmbShareAccess -Name $ShareName -AccountName \"Everyone\" -AccessRight Full -Force -ErrorAction SilentlyContinue | Out-Null\n        Write-Log \"\u0110\u00e3 c\u1ea5p quy\u1ec1n Full cho 'Everyone' tr\u00ean share '$ShareName' (khuy\u1ebfn ngh\u1ecb si\u1ebft l\u1ea1i quy\u1ec1n NTFS n\u1ebfu c\u1ea7n b\u1ea3o m\u1eadt h\u01a1n).\" \"OK\"\n    } catch {\n        Write-Log \"Kh\u00f4ng set \u0111\u01b0\u1ee3c quy\u1ec1n share '$ShareName': $($_.Exception.Message)\" \"WARN\"\n    }\n}\n\n\n# ---- src/Show-ConsolePrinterShareMenu.ps1 ----\nfunction Show-ConsolePrinterShareMenu {\n    <#\n    .SYNOPSIS\n        Li\u1ec7t k\u00ea m\u00e1y in local ch\u01b0a chia s\u1ebb ra console, cho ng\u01b0\u1eddi d\u00f9ng ch\u1ecdn r\u1ed3i g\u1ecdi\n        Set-PrinterSharedByName. D\u00f9ng cho ch\u1ebf \u0111\u1ed9 console (kh\u00f4ng GUI).\n    #>\n    Write-Log \"\u0110ang li\u1ec7t k\u00ea m\u00e1y in local \u0111\u1ec3 chia s\u1ebb...\"\n    $printers = Get-LocalPrinters | Where-Object { -not $_.Shared -and $_.Type -eq 'Local' }\n    if (-not $printers) {\n        Write-Log \"Kh\u00f4ng t\u00ecm th\u1ea5y m\u00e1y in local n\u00e0o ch\u01b0a \u0111\u01b0\u1ee3c chia s\u1ebb (ho\u1eb7c t\u1ea5t c\u1ea3 \u0111\u00e3 share s\u1eb5n).\" \"WARN\"\n        $all = Get-LocalPrinters\n        if ($all) {\n            Write-Host \"`nDanh s\u00e1ch m\u00e1y in hi\u1ec7n c\u00f3:\" -ForegroundColor Cyan\n            $all | Format-Table Name, Shared, ShareName, Type -AutoSize\n        }\n        return\n    }\n\n    Write-Host \"`nC\u00e1c m\u00e1y in local ch\u01b0a chia s\u1ebb:\" -ForegroundColor Cyan\n    for ($i = 0; $i -lt $printers.Count; $i++) {\n        Write-Host \"  [$i] $($printers[$i].Name)\"\n    }\n    $sel = Read-Host \"`nNh\u1eadp s\u1ed1 th\u1ee9 t\u1ef1 m\u00e1y in mu\u1ed1n chia s\u1ebb (Enter \u0111\u1ec3 chia s\u1ebb T\u1ea4T C\u1ea2)\"\n\n    $targets = if ([string]::IsNullOrWhiteSpace($sel)) { $printers } else { @($printers[[int]$sel]) }\n\n    foreach ($pr in $targets) {\n        Set-PrinterSharedByName -PrinterName $pr.Name\n    }\n}\n\n\n# ---- Gui/WpfShell.ps1 ----\n# ====================================================================\n# GIAO DI\u1ec6N WPF (shell ch\u00ednh) \u2014 theo m\u1eabu WpfShell.ps1, b\u1ecdc c\u00e1c h\u00e0m module\n# FixSharePrinter (\u0111\u00e3 Import-Module tr\u01b0\u1edbc khi g\u1ecdi Show-WpfShell). Kh\u00f4ng \u0111\u1ed5i\n# logic x\u1eed l\u00fd trong module \u2014 file n\u00e0y ch\u1ec9 v\u1ebd giao di\u1ec7n v\u00e0 g\u1ecdi h\u00e0m module.\n# ====================================================================\nAdd-Type -AssemblyName PresentationFramework\n\n$Script:WpfWindow     = $null\n$Script:WpfLogBox     = $null\n$Script:WpfStatus     = $null\n$Script:WpfBusyPanel  = $null\n$Script:WpfBusyDesc   = $null\n$Script:WpfBusy       = $false\n$Script:WpfLogNoNl    = $false\n$Script:WpfPages      = @{}\n$Script:WpfNavButtons = @{}\n\nfunction Get-WpfLogBrush {\n    param($Color)\n    $hex = switch (\"$Color\") {\n        'Green'     { '#34D399' }\n        'Red'       { '#F87171' }\n        'Yellow'    { '#FBBF24' }\n        'DarkYellow'{ '#F59E0B' }\n        'Cyan'      { '#22D3EE' }\n        'DarkCyan'  { '#06B6D4' }\n        'Blue'      { '#60A5FA' }\n        'Magenta'   { '#E879F9' }\n        'DarkGray'  { '#94A3B8' }\n        'Gray'      { '#94A3B8' }\n        'White'     { '#E5E7EB' }\n        default     { '#CBD5E1' }\n    }\n    return [Windows.Media.BrushConverter]::new().ConvertFromString($hex)\n}\n\nfunction Set-ConsoleWindowVisibility {\n    <#\n    .SYNOPSIS\n        \u1ea8n/hi\u1ec7n c\u1eeda s\u1ed5 console (n\u1ebfu ti\u1ebfn tr\u00ecnh \u0111\u01b0\u1ee3c ch\u1ea1y t\u1eeb powershell.exe -File n\u00ean\n        c\u00f3 1 c\u1eeda s\u1ed5 console ri\u00eang). D\u00f9ng \u0111\u1ec3 \u1ea9n h\u1eb3n console khi m\u1edf GUI, ch\u1ec9 \u0111\u1ec3 l\u1ea1i\n        1 c\u1eeda s\u1ed5 WPF duy nh\u1ea5t; to\u00e0n b\u1ed9 output console l\u00fac \u0111\u00f3 \u0111\u00e3 \u0111\u01b0\u1ee3c Write-Log \u0111\u01b0a\n        v\u00e0o khung nh\u1eadt k\u00fd c\u1ee7a GUI thay v\u00ec in ra console.\n    #>\n    param([Parameter(Mandatory)][bool]$Visible)\n    try {\n        if (-not ('FixSharePrinter.NativeMethods' -as [type])) {\n            Add-Type -Namespace FixSharePrinter -Name NativeMethods -MemberDefinition @'\n[System.Runtime.InteropServices.DllImport(\"kernel32.dll\")]\npublic static extern System.IntPtr GetConsoleWindow();\n[System.Runtime.InteropServices.DllImport(\"user32.dll\")]\npublic static extern bool ShowWindow(System.IntPtr hWnd, int nCmdShow);\n'@ -ErrorAction Stop\n        }\n        $handle = [FixSharePrinter.NativeMethods]::GetConsoleWindow()\n        if ($handle -eq [System.IntPtr]::Zero) { return $false }\n        [void][FixSharePrinter.NativeMethods]::ShowWindow($handle, $(if ($Visible) { 5 } else { 0 }))\n        return $true\n    } catch {\n        return $false\n    }\n}\n\nfunction Pump-WpfDispatcher {\n    if (-not $Script:WpfWindow) { return }\n    try {\n        $Script:WpfWindow.Dispatcher.Invoke([Action]{}, 'Background')\n    } catch { }\n}\n\nfunction ConvertTo-WpfLogText {\n    param([string]$Text)\n    if ($null -eq $Text) { return '' }\n    $s = [string]$Text\n    $esc = [char]27\n    $s = [regex]::Replace($s, \"$esc\\[[0-9;]*m\", '')\n    return $s\n}\n\nfunction Add-WpfLogLine {\n    param(\n        [string]$Text,\n        $Color = 'Gray',\n        [switch]$NoNewline\n    )\n    if (-not $Script:WpfLogBox) { return }\n    try {\n        $box = $Script:WpfLogBox\n        $raw = ConvertTo-WpfLogText $Text\n        $isProgress = $raw.IndexOf([char]13) -ge 0\n        $raw = $raw -replace \"`r`n\", \"`n\" -replace \"`r\", ''\n        $brush = Get-WpfLogBrush $Color\n\n        $apply = {\n            param($tb, $chunk, $br, $mode)\n            $run = New-Object Windows.Documents.Run $chunk\n            $run.Foreground = $br\n            $para = $null\n            if ($tb.Document.Blocks.Count -gt 0) {\n                $para = $tb.Document.Blocks.LastBlock\n            }\n            if (-not $para -or $para -isnot [Windows.Documents.Paragraph]) {\n                $para = New-Object Windows.Documents.Paragraph\n                $para.Margin = New-Object Windows.Thickness 0\n                [void]$tb.Document.Blocks.Add($para)\n            }\n\n            if ($mode -eq 'replace') {\n                $para.Inlines.Clear()\n                [void]$para.Inlines.Add($run)\n            } elseif ($mode -eq 'close') {\n                $p2 = New-Object Windows.Documents.Paragraph\n                $p2.Margin = New-Object Windows.Thickness 0\n                [void]$tb.Document.Blocks.Add($p2)\n            } else {\n                [void]$para.Inlines.Add($run)\n                if ($mode -eq 'append') {\n                    $p3 = New-Object Windows.Documents.Paragraph\n                    $p3.Margin = New-Object Windows.Thickness 0\n                    [void]$tb.Document.Blocks.Add($p3)\n                }\n            }\n\n            $tb.ScrollToEnd()\n            while ($tb.Document.Blocks.Count -gt 800) {\n                $tb.Document.Blocks.Remove($tb.Document.Blocks.FirstBlock)\n            }\n        }\n\n        if ([string]::IsNullOrEmpty($raw)) {\n            if ($NoNewline) { return }\n            $mode = if ($Script:WpfLogNoNl) { 'close' } else { 'append' }\n            $chunk = ''\n        } elseif ($isProgress) {\n            $mode = 'replace'\n            $chunk = if ($raw.Contains(\"`n\")) { ($raw -split \"`n\" | Select-Object -Last 1) } else { $raw }\n        } elseif ($NoNewline) {\n            $mode = 'partial'\n            $chunk = $raw\n        } else {\n            $mode = 'append'\n            $chunk = $raw\n        }\n\n        if ($Script:WpfWindow.Dispatcher.CheckAccess()) {\n            & $apply $box $chunk $brush $mode\n        } else {\n            $Script:WpfWindow.Dispatcher.Invoke($apply, $box, $chunk, $brush, $mode)\n        }\n        $Script:WpfLogNoNl = ($mode -eq 'partial')\n        Pump-WpfDispatcher\n    } catch { }\n}\n\nfunction Set-WpfBusy {\n    param(\n        [bool]$Busy,\n        [string]$Status = '',\n        [string]$Description = '',\n        [string]$DescriptionColor = '#94A3B8'\n    )\n    $Script:WpfBusy = $Busy\n    if ($Script:WpfBusyPanel) {\n        $Script:WpfBusyPanel.Visibility = if ($Busy) {\n            [Windows.Visibility]::Visible\n        } else {\n            [Windows.Visibility]::Collapsed\n        }\n        $Script:WpfBusyPanel.IsHitTestVisible = $Busy\n    }\n    if ($Script:WpfBusyDesc) {\n        if ($Busy -and $Description) {\n            $Script:WpfBusyDesc.Text = $Description\n            $Script:WpfBusyDesc.Foreground = [Windows.Media.BrushConverter]::new().ConvertFromString($DescriptionColor)\n            $Script:WpfBusyDesc.Visibility = [Windows.Visibility]::Visible\n        } else {\n            $Script:WpfBusyDesc.Text = ''\n            $Script:WpfBusyDesc.Visibility = [Windows.Visibility]::Collapsed\n        }\n    }\n    if ($Script:WpfWindow) { $Script:WpfWindow.IsEnabled = -not $Busy }\n    if ($Script:WpfStatus -and $Status) { $Script:WpfStatus.Text = $Status }\n    elseif ($Script:WpfStatus -and -not $Busy) { $Script:WpfStatus.Text = 'S\u1eb5n s\u00e0ng' }\n    Pump-WpfDispatcher\n}\n\nfunction Confirm-WpfAction {\n    param([string]$Title, [string]$Message)\n    $owner = $Script:WpfWindow\n    $r = if ($owner -and $owner.IsVisible) {\n        [System.Windows.MessageBox]::Show(\n            $owner, $Message, $Title,\n            [System.Windows.MessageBoxButton]::YesNo,\n            [System.Windows.MessageBoxImage]::Warning\n        )\n    } else {\n        [System.Windows.MessageBox]::Show(\n            $Message, $Title,\n            [System.Windows.MessageBoxButton]::YesNo,\n            [System.Windows.MessageBoxImage]::Warning\n        )\n    }\n    return ($r -eq [System.Windows.MessageBoxResult]::Yes)\n}\n\nfunction Show-WpfNotice {\n    param([Parameter(Mandatory)][string]$Message)\n    if ($Script:WpfWindow) {\n        [void][System.Windows.MessageBox]::Show($Script:WpfWindow, $Message, 'Fix Share Printer',\n            [System.Windows.MessageBoxButton]::OK, [System.Windows.MessageBoxImage]::Information)\n    }\n}\n\nfunction Invoke-WpfAction {\n    param(\n        [Parameter(Mandatory)][string]$Title,\n        [Parameter(Mandatory)][scriptblock]$Action,\n        [switch]$Confirm,\n        [string]$ConfirmMessage = '',\n        [string]$Description = '',\n        [string]$DescriptionColor = '#94A3B8'\n    )\n    if ($Script:WpfBusy) { return }\n    if ($Confirm) {\n        $msg = if ($ConfirmMessage) { $ConfirmMessage } else { \"Ch\u1ea1y t\u00e1c v\u1ee5: $Title ?\" }\n        if (-not (Confirm-WpfAction -Title $Title -Message $msg)) { return }\n    }\n\n    Set-WpfBusy $true \"\u0110ang ch\u1ea1y: $Title\" -Description $Description -DescriptionColor $DescriptionColor\n    Add-WpfLogLine -Text \"\" -Color Gray\n    Add-WpfLogLine -Text \"=== $Title ===\" -Color Cyan\n    $sw = [System.Diagnostics.Stopwatch]::StartNew()\n    try {\n        & $Action\n        $sw.Stop()\n        Add-WpfLogLine -Text (\"Ho\u00e0n t\u1ea5t: {0}  ({1:N1}s)\" -f $Title, $sw.Elapsed.TotalSeconds) -Color Green\n        if ($Script:WpfStatus) { $Script:WpfStatus.Text = \"Xong: $Title\" }\n    } catch {\n        $sw.Stop()\n        $message = $_.Exception.ToString()\n        Add-WpfLogLine -Text \"L\u1ed7i: $message\" -Color Red\n        Write-Log \"WPF action '$Title': $message\" -Level ERR\n        if ($Script:WpfStatus) { $Script:WpfStatus.Text = \"L\u1ed7i: $Title\" }\n    } finally {\n        Set-WpfBusy $false\n    }\n}\n\nfunction Show-WpfPage {\n    param([Parameter(Mandatory)][string]$Name)\n    foreach ($key in $Script:WpfPages.Keys) {\n        $Script:WpfPages[$key].Visibility = if ($key -eq $Name) {\n            [Windows.Visibility]::Visible\n        } else {\n            [Windows.Visibility]::Collapsed\n        }\n    }\n    foreach ($key in $Script:WpfNavButtons.Keys) {\n        $btn = $Script:WpfNavButtons[$key]\n        if ($key -eq $Name) {\n            $btn.Background = [Windows.Media.BrushConverter]::new().ConvertFromString('#123044')\n            $btn.BorderBrush = [Windows.Media.BrushConverter]::new().ConvertFromString('#22D3EE')\n        } else {\n            $btn.Background = [Windows.Media.Brushes]::Transparent\n            $btn.BorderBrush = [Windows.Media.Brushes]::Transparent\n        }\n    }\n}\n\nfunction Update-WpfPrintersList {\n    <# N\u1ea1p l\u1ea1i danh s\u00e1ch m\u00e1y in v\u00e0o ListBox 'PrintersList' c\u1ee7a trang Qu\u1ea3n l\u00fd m\u00e1y in. #>\n    $listBox = $Script:WpfWindow.FindName('PrintersList')\n    if (-not $listBox) { return }\n    $listBox.Items.Clear()\n    $printers = Get-LocalPrinters\n    if (-not $printers) {\n        Add-WpfLogLine -Text \"Kh\u00f4ng t\u00ecm th\u1ea5y m\u00e1y in n\u00e0o tr\u00ean m\u00e1y n\u00e0y.\" -Color Yellow\n        return\n    }\n    foreach ($pr in $printers) {\n        $cb = New-Object Windows.Controls.CheckBox\n        $label = \"$($pr.Name)\"\n        if ($pr.Shared) { $label += \"  [\u0111ang chia s\u1ebb: $($pr.ShareName)]\" }\n        $cb.Content = $label\n        $cb.Tag = $pr.Name\n        $cb.Foreground = [Windows.Media.BrushConverter]::new().ConvertFromString('#E2E8F0')\n        $cb.Margin = New-Object Windows.Thickness 4\n        [void]$listBox.Items.Add($cb)\n    }\n}\n\nfunction Get-WpfMainWindowXaml {\n    return @'\n\n  \n    \n    \n    \n      \n      \n      \n      \n      \n      \n      \n      \n      \n      \n        \n          \n            \n              \n            \n          \n        \n      \n    \n    \n      \n      \n      \n      \n      \n      \n      \n      \n      \n      \n        \n          \n            \n              \n            \n            \n              \n                \n                \n              \n            \n          \n        \n      \n    \n    \n      \n      \n      \n      \n      \n      \n        \n          \n            \n              \n            \n          \n        \n      \n    \n    \n      \n      \n      \n    \n  \n\n  \n    \n      \n      \n    \n    \n      \n      \n      \n    \n\n    \n      \n        \n          \n          \n            \n          \n        \n        \n      \n    \n\n    \n      \n        \n          \n        \n        \n          \n          \n          \n          \n          \n          \n        \n      \n    \n\n    \n      \n        \n        \n        \n      \n\n      \n      \n        \n          \n          \n        \n        \n          \n          \n        \n        \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n        \n      \n\n      \n      \n        \n          \n          \n        \n        \n          \n          \n        \n        \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n        \n      \n\n      \n      \n        \n          \n          \n        \n        \n          \n          \n        \n        \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n          \n            \n              \n              \n            \n          \n        \n      \n\n      \n      \n        \n          \n          \n          \n          \n        \n        \n        \n          Ch\u1ecdn m\u00e1y in c\u1ea7n chia s\u1ebb r\u1ed3i b\u1ea5m \"Chia s\u1ebb \u0111\u00e3 ch\u1ecdn\". B\u1ea5m \"L\u00e0m m\u1edbi\" \u0111\u1ec3 t\u1ea3i l\u1ea1i danh s\u00e1ch.\n        \n        \n          \n        \n        \n          \n          \n        \n      \n\n      \n      \n        \n          \n          \n            Fix Share Printer \u2014 c\u00f4ng c\u1ee5 kh\u1eafc ph\u1ee5c l\u1ed7i chia s\u1ebb m\u00e1y in n\u1ed9i b\u1ed9 (RPC, 0x0000011b, 0x00000709...)\n            v\u00e0 b\u1eadt chia s\u1ebb qua SMB1/CIFS ho\u1eb7c SMB2/SMB3. Kh\u00f4ng c\u00f3 c\u00f4ng c\u1ee5 n\u00e0o \u0111\u1ea3m b\u1ea3o gi\u1ea3i quy\u1ebft 100% m\u1ecdi\n            t\u00ecnh hu\u1ed1ng trong m\u1ecdi m\u00f4i tr\u01b0\u1eddng (c\u00f2n ph\u1ee5 thu\u1ed9c driver m\u00e1y in, GPO domain, ph\u1ea7n c\u1ee9ng...).\n          \n          \n        \n      \n\n      \n\n      \n        \n          \n            \n            \n          \n          \n            \n              \n                \n              \n            \n          \n        \n      \n    \n\n    \n      \n        \n        \n      \n    \n\n    \n      \n        \n          \n            \n              \n            \n          \n          \n        \n        \n        \n      \n    \n  \n\n'@\n}\n\nfunction Show-WpfShell {\n    <# Kh\u1edfi t\u1ea1o c\u1eeda s\u1ed5 WPF, wire c\u00e1c n\u00fat b\u1ea5m v\u00e0o h\u00e0m module, r\u1ed3i ShowDialog(). #>\n    try {\n        Add-Type -AssemblyName PresentationFramework -ErrorAction Stop\n        Add-Type -AssemblyName PresentationCore -ErrorAction Stop\n        Add-Type -AssemblyName WindowsBase -ErrorAction Stop\n        Add-Type -AssemblyName System.Xaml -ErrorAction Stop\n    } catch {\n        Write-Warning \"Kh\u00f4ng n\u1ea1p \u0111\u01b0\u1ee3c WPF: $($_.Exception.Message)\"\n        return $false\n    }\n\n    $xamlText = Get-WpfMainWindowXaml\n    try {\n        $xml = New-Object System.Xml.XmlDocument\n        $xml.LoadXml($xamlText)\n        $reader = New-Object System.Xml.XmlNodeReader $xml\n        $window = [Windows.Markup.XamlReader]::Load($reader)\n    } catch {\n        Write-Warning \"L\u1ed7i XAML WPF: $($_.Exception.Message)\"\n        return $false\n    }\n\n    $Script:WpfWindow    = $window\n    $Script:WpfLogBox    = $window.FindName('LogBox')\n    $Script:WpfStatus    = $window.FindName('StatusText')\n    $Script:WpfBusyPanel = $window.FindName('BusyPanel')\n    $Script:WpfBusyDesc  = $window.FindName('BusyDesc')\n\n    $hdr = $window.FindName('HdrMeta')\n    if ($hdr) { $hdr.Text = \"PowerShell $($PSVersionTable.PSVersion)\" }\n\n    $logPath = $window.FindName('TxtLogPath')\n    if ($logPath) { $logPath.Text = \"Log: $Script:FSP_LogFile\" }\n    $infoLogPath = $window.FindName('TxtInfoLogPath')\n    if ($infoLogPath) { $infoLogPath.Text = \"File log phi\u00ean hi\u1ec7n t\u1ea1i: $Script:FSP_LogFile\" }\n\n    # \u0110\u0103ng k\u00fd c\u00e1c trang + n\u00fat \u0111i\u1ec1u h\u01b0\u1edbng\n    $Script:WpfPages = @{\n        Home     = $window.FindName('PageHome')\n        Share    = $window.FindName('PageShare')\n        FixPrint = $window.FindName('PageFixPrint')\n        Printers = $window.FindName('PagePrinters')\n        Info     = $window.FindName('PageInfo')\n    }\n    $Script:WpfNavButtons = @{\n        Home     = $window.FindName('NavHome')\n        Share    = $window.FindName('NavShare')\n        FixPrint = $window.FindName('NavFixPrint')\n        Printers = $window.FindName('NavPrinters')\n        Info     = $window.FindName('NavInfo')\n    }\n\n    # --- \u0110i\u1ec1u h\u01b0\u1edbng ---\n    $window.FindName('NavHome').Add_Click({ Show-WpfPage Home })\n    $window.FindName('NavShare').Add_Click({ Show-WpfPage Share })\n    $window.FindName('NavFixPrint').Add_Click({ Show-WpfPage FixPrint })\n    $window.FindName('NavPrinters').Add_Click({ Show-WpfPage Printers; Update-WpfPrintersList })\n    $window.FindName('NavInfo').Add_Click({ Show-WpfPage Info })\n\n    # --- Card \u1edf trang T\u1ed5ng quan: \u0111i\u1ec1u h\u01b0\u1edbng sang trang t\u01b0\u01a1ng \u1ee9ng ---\n    $window.FindName('CardShare').Add_Click({ Show-WpfPage Share })\n    $window.FindName('CardFixPrint').Add_Click({ Show-WpfPage FixPrint })\n    $window.FindName('CardSmb1').Add_Click({\n        Invoke-WpfAction -Title \"V\u00e1 l\u1ed7i + B\u1eadt SMB1/CIFS\" -Confirm `\n            -ConfirmMessage \"SMB1 c\u00f3 l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt \u0111\u00e3 bi\u1ebft. Ch\u1ec9 b\u1eadt khi thi\u1ebft b\u1ecb b\u1eaft bu\u1ed9c d\u00f9ng SMB1. Ti\u1ebfp t\u1ee5c?\" `\n            -Description \"D\u00f9ng khi m\u00e1y in ho\u1eb7c thi\u1ebft b\u1ecb kh\u00e1c trong m\u1ea1ng LAN \u0111\u1eddi c\u0169 (Windows XP, Server 2003, NAS/\u0111\u1ea7u thu m\u1ea1ng c\u0169) ch\u1ec9 h\u1ed7 tr\u1ee3 SMB1 v\u00e0 kh\u00f4ng th\u1ec3 n\u00e2ng c\u1ea5p. S\u1ebd b\u1eadt SMB1Protocol, guest-logon, h\u1ea1 m\u1ee9c b\u1ea3o m\u1eadt LAN Manager, \u0111\u1ed3ng th\u1eddi v\u00e1 l\u1ed7i RPC/0x0000011b/0x00000709 tr\u01b0\u1edbc. SMB1 c\u00f3 l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt \u0111\u00e3 bi\u1ebft \u2014 ch\u1ec9 d\u00f9ng khi b\u1eaft bu\u1ed9c.\" `\n            -DescriptionColor \"#FCA5A5\" `\n            -Action { Invoke-SetupSmb1Sharing }\n    })\n    $window.FindName('CardSmb2').Add_Click({\n        Invoke-WpfAction -Title \"V\u00e1 l\u1ed7i + B\u1eadt SMB2/SMB3\" `\n            -Description \"Khuy\u1ebfn ngh\u1ecb cho m\u1ea1ng LAN hi\u1ec7n \u0111\u1ea1i (Windows 7 SP1 tr\u1edf l\u00ean). S\u1ebd b\u1eadt SMB2/3, t\u1eaft SMB1 \u0111\u1ec3 an to\u00e0n h\u01a1n, n\u1edbi security signature \u0111\u1ec3 tr\u00e1nh l\u1ed7i k\u1ebft n\u1ed1i trong LAN n\u1ed9i b\u1ed9, \u0111\u1ed3ng th\u1eddi v\u00e1 l\u1ed7i RPC/0x0000011b/0x00000709 tr\u01b0\u1edbc.\" `\n            -DescriptionColor \"#6EE7B7\" `\n            -Action { Invoke-SetupSmb2Sharing }\n    })\n    $window.FindName('CardFix').Add_Click({\n        Invoke-WpfAction -Title \"V\u00e1 l\u1ed7i RPC/0x0000011b/0x00000709\" `\n            -Description \"V\u00e1 c\u00e1c l\u1ed7i RPC server unavailable, 0x0000011b (Point and Print / RPC hardening), 0x00000709 (kh\u00f4ng set \u0111\u01b0\u1ee3c default printer) v\u00e0 RPC Named Pipes (0x00000040 / 0x000006e4), kh\u00f4ng \u0111\u1ed5i c\u1ea5u h\u00ecnh SMB1/SMB2 hi\u1ec7n t\u1ea1i.\" `\n            -DescriptionColor \"#93C5FD\" `\n            -Action { Invoke-FixCommonPrinterErrors }\n    })\n    $window.FindName('CardPrinters').Add_Click({ Show-WpfPage Printers; Update-WpfPrintersList })\n\n    # --- Trang S\u1eeda l\u1ed7i in: 4 card ch\u1ea1y tr\u1ef1c ti\u1ebfp ---\n    $window.FindName('CardRemoveCopies').Add_Click({\n        Invoke-WpfAction -Title \"Xo\u00e1 m\u00e1y in Copy offline\" `\n            -Description \"Xo\u00e1 c\u00e1c m\u00e1y in c\u00f3 h\u1eadu t\u1ed1 'Copy'/'B\u1ea3n sao' (th\u01b0\u1eddng do Windows t\u1ef1 t\u1ea1o khi c\u00e0i driver l\u1ed7i/tr\u00f9ng) \u0111ang \u1edf tr\u1ea1ng th\u00e1i offline. Kh\u00f4ng \u0111\u1ee5ng t\u1edbi c\u00e1c m\u00e1y in Copy \u0111ang online.\" `\n            -DescriptionColor \"#FDBA74\" `\n            -Action { Remove-OfflinePrinterCopies }\n    })\n    $window.FindName('CardClearPorts').Add_Click({\n        Invoke-WpfAction -Title \"D\u1ecdn c\u1ed5ng USB \u1ea3o\" -Confirm `\n            -ConfirmMessage \"Thao t\u00e1c s\u1ebd t\u1ea1m d\u1eebng Spooler, kill ti\u1ebfn tr\u00ecnh driver h\u00e3ng m\u00e1y in \u0111ang ch\u1ea1y, v\u00e0 xo\u00e1 c\u1ed5ng USB kh\u00f4ng d\u00f9ng. Ti\u1ebfp t\u1ee5c?\" `\n            -Description \"D\u1eebng Spooler + gi\u1ea3i ph\u00f3ng ti\u1ebfn tr\u00ecnh driver h\u00e3ng m\u00e1y in \u0111ang treo c\u1ed5ng, xo\u00e1 c\u00e1c c\u1ed5ng USB \u1ea3o (USB*/CNUSB*) kh\u00f4ng c\u00f2n m\u00e1y in n\u00e0o tr\u1ecf t\u1edbi, r\u1ed3i rescan l\u1ea1i thi\u1ebft b\u1ecb.\" `\n            -DescriptionColor \"#A5B4FC\" `\n            -Action { Clear-StalePrinterPorts }\n    })\n    $window.FindName('CardDisableOffline').Add_Click({\n        Invoke-WpfAction -Title \"B\u1ecf Work Offline\" `\n            -Description \"Chuy\u1ec3n to\u00e0n b\u1ed9 m\u00e1y in \u0111ang \u1edf ch\u1ebf \u0111\u1ed9 'Work Offline' v\u1ec1 ONLINE.\" `\n            -DescriptionColor \"#6EE7B7\" `\n            -Action { Disable-PrinterWorkOfflineMode }\n    })\n    $window.FindName('CardSpooler').Add_Click({\n        Invoke-WpfAction -Title \"Kh\u1edfi \u0111\u1ed9ng l\u1ea1i Print Spooler\" `\n            -Description \"Xo\u00e1 job in b\u1ecb k\u1eb9t v\u00e0 restart d\u1ecbch v\u1ee5 Print Spooler.\" -DescriptionColor \"#C4B5FD\" `\n            -Action { Restart-PrintSpoolerSafe }\n    })\n\n    $window.FindName('BtnRefreshPrinters').Add_Click({ Update-WpfPrintersList })\n    $window.FindName('BtnShareSelected').Add_Click({\n        $listBox = $window.FindName('PrintersList')\n        $selected = @($listBox.Items | Where-Object { $_.IsChecked })\n        if (-not $selected -or $selected.Count -eq 0) {\n            Show-WpfNotice \"Ch\u01b0a ch\u1ecdn m\u00e1y in n\u00e0o \u0111\u1ec3 chia s\u1ebb.\"\n            return\n        }\n        Invoke-WpfAction -Title \"Chia s\u1ebb m\u00e1y in \u0111\u00e3 ch\u1ecdn\" -Action {\n            foreach ($cb in $selected) {\n                Set-PrinterSharedByName -PrinterName $cb.Tag\n            }\n        }\n        Update-WpfPrintersList\n    })\n    $window.FindName('BtnClearLog').Add_Click({\n        if ($Script:WpfLogBox) { $Script:WpfLogBox.Document.Blocks.Clear() }\n    })\n\n    $window.Add_Closed({\n        $Script:WpfWindow    = $null\n        $Script:WpfLogBox    = $null\n        $Script:WpfStatus    = $null\n        $Script:WpfBusyPanel = $null\n        $Script:WpfBusy      = $false\n        # Tr\u1ea3 l\u1ea1i c\u1eeda s\u1ed5 console khi \u0111\u00f3ng GUI (ph\u00f2ng khi ch\u1ea1y t\u01b0\u01a1ng t\u00e1c t\u1eeb 1 shell c\u00f3 s\u1eb5n)\n        Set-ConsoleWindowVisibility -Visible:$true | Out-Null\n    })\n\n    Show-WpfPage Home\n    Add-WpfLogLine -Text \"Ch\u1ecdn m\u1ed9t t\u00e1c v\u1ee5 \u1edf B\u1ea3ng \u0111i\u1ec1u khi\u1ec3n ho\u1eb7c c\u00e1c th\u1ebb \u0110i\u1ec1u h\u01b0\u1edbng.\" -Color Cyan\n\n    # Ch\u1ec9 hi\u1ec7n \u0111\u00fang 1 c\u1eeda s\u1ed5 WPF \u2014 \u1ea9n h\u1eb3n c\u1eeda s\u1ed5 console ph\u00eda sau (n\u1ebfu c\u00f3).\n    Set-ConsoleWindowVisibility -Visible:$false | Out-Null\n\n    [void]$window.ShowDialog()\n    return $true\n}\n\n\nfunction Show-ConsoleMenu {\n    do {\n        Clear-Host\n        Write-Host \"=======================================================\" -ForegroundColor Cyan\n        Write-Host \"   FIX & SHARE PRINTER TOOL - Khac phuc loi chia se may in\" -ForegroundColor Cyan\n        Write-Host \"=======================================================\" -ForegroundColor Cyan\n        Write-Host \" [1] Chia se qua giao thuc CU   - SMB1 / CIFS\"\n        Write-Host \" [2] Chia se qua giao thuc MOI  - SMB2 / SMB3 (khuyen nghi)\"\n        Write-Host \" [3] Chi chay va loi (RPC / 0x0000011b / 0x00000709), khong doi SMB\"\n        Write-Host \" [4] Quan ly / chia se may in\"\n        Write-Host \" [0] Thoat\"\n        Write-Host \"=======================================================\"\n        $choice = Read-Host \"Chon (0/1/2/3/4)\"\n        switch ($choice) {\n            '1' { Invoke-SetupSmb1Sharing }\n            '2' { Invoke-SetupSmb2Sharing }\n            '3' { Invoke-FixCommonPrinterErrors; Restart-PrintSpoolerSafe }\n            '4' { Show-ConsolePrinterShareMenu }\n            '0' { Write-Host \"Thoat.\" }\n            default { Write-Host \"Lua chon khong hop le.\" -ForegroundColor Red }\n        }\n        if ($choice -ne '0') {\n            Write-Host \"`nLog chi tiet da luu tai: $Script:FSP_LogFile\" -ForegroundColor Cyan\n            Read-Host \"`nNhan Enter de quay lai menu (hoac dong cua so de thoat)\"\n        }\n    } while ($choice -ne '0')\n}\n\nif (-not $NoGui) { Set-ConsoleWindowVisibility -Visible:$false | Out-Null }\nWrite-Log \"FixSharePrinter (bundle) khoi dong. Log: $Script:FSP_LogFile\"\n\nif ($NoGui) {\n    Show-ConsoleMenu\n} else {\n    $ok = Show-WpfShell\n    if (-not $ok) {\n        Set-ConsoleWindowVisibility -Visible:$true | Out-Null\n        Write-Log \"Khong mo duoc giao dien WPF, chuyen sang menu console.\" \"WARN\"\n        Show-ConsoleMenu\n    }\n}\n\n", "creation_timestamp": "2026-09-27T16:28:31.000000Z"}]}