{"vulnerability": "CVE-2022-33675", "sightings": [{"uuid": "c5f396d3-8eea-4621-a795-9fa31f8da1e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "exploited", "source": "https://t.me/avleonovrus/35", "content": "\u041c\u0430\u0439\u043a\u0440\u043e\u0441\u043e\u0444\u0442 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0442\u0432\u043e\u0440\u044f\u0442 \u0434\u0438\u0447\u044c, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u043f\u043e\u0432\u043e\u0434 \u043d\u0435 \u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b. \u0412\u043e \u0432\u0441\u044f\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u043e\u043a\u0430. \u041d\u0443 \u0438 \u0442\u043e\u0447\u043d\u043e \u043d\u0435 \u043f\u043e\u0432\u043e\u0434 \u043d\u0435 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \ud83d\ude42 \u0422\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0432\u0438\u0434\u044f\u0448\u043a\u0430 \u043f\u0440\u043e \u0438\u044e\u043b\u044c\u0441\u043a\u0438\u0439 Patch Tuesday \u0431\u0443\u0434\u0435\u0442, \u043d\u043e \u043a\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u043f\u043e\u0440\u0430\u043d\u044c\u0448\u0435, \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e \u0440\u0435\u043f\u043e\u0440\u0442 Vulristics. \u0422\u0435\u043f\u0435\u0440\u044c \u0432\u0441\u0451 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043d\u0435\u0441\u0443 \u0432 \u0442\u0435\u043b\u0435\u0436\u0435\u043d\u044c\u043a\u0443 avleonovrus. \ud83d\ude09\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e. \u0421\u0432\u0435\u0440\u0445\u0443 \u0441\u043f\u0438\u0441\u043a\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0432\u0436\u0438\u0432\u0443\u044e Elevation of Privilege \u0432 Windows CSRSS (CVE-2022-22047), \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u0435\u0439\u043d\u0441\u0442\u0440\u0438\u043c\u043d\u044b\u0435 \u043c\u0435\u0434\u0438\u0430 \u043f\u0440\u043e\u0442\u0440\u0443\u0431\u0438\u043b\u0438. \u041c\u043e\u0436\u043d\u043e \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 SYSTEM. \u041f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0432\u0438\u0434\u043d\u043e. \n\n\u0414\u0430\u043b\u044c\u0448\u0435 \u043c\u0435\u043d\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. Remote Code Execution \u0432 Remote Procedure Call Runtime (CVE-2022-22038). \u0422\u0443\u0442 \u0443 Microsoft \u0435\u0441\u0442\u044c POC \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. \u041d\u043e \u0432\u0440\u044f\u0434 \u043b\u0438 \u0434\u043e\u0432\u0435\u0434\u0443\u0442 \u0434\u043e \u0447\u0435\u0433\u043e-\u0442\u043e \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e, \u0442.\u043a. Exploitation Less Likely. \n\n\u041c\u0435\u0436\u0434\u0443 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u043c \u0438 \u0438\u044e\u043b\u044c\u0441\u043a\u0438\u043c Patch Tuesday \u0432\u044b\u0448\u043b\u0430 Memory Corruption \u0432 Microsoft Edge (CVE-2022-2294), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u0438\u0434\u0438\u043c\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 RCE \u0438 Google \u043f\u0438\u0448\u0443\u0442, \u0447\u0442\u043e \u043e\u043d\u0430 \u0432\u0436\u0438\u0432\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f.   \n\n\u0415\u0449\u0451 \u0437\u0430\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0432 \u044d\u0442\u043e\u043c Patch Tuesday \u0431\u043e\u043b\u044c\u0448\u0435 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u044b \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044d\u0442\u043e EoP. \u0422\u0430\u043a\u0436\u0435 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Azure Site Recovery. \u0418 EoP, \u0438 RCE, \u0438 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u0441 \u043d\u0435\u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430\u043c\u0438 \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0440\u0435\u043b\u043e\u0441\u0442\u0438 POC. \u041f\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044e  Azure Site Recovery \u044d\u0442\u043e \"Site Recovery is a native disaster recovery as a service (DRaaS)\", \u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b \u0434\u043e\u043b\u0436\u043d\u043e \u043f\u0430\u0442\u0447\u0438\u0442\u044c\u0441\u044f \u0441\u0430\u043c\u0438\u043c\u0438 Microsoft, \u043d\u043e \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u0442\u0430\u043c \u0435\u0441\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u0445\u043e\u0441\u0442\u0430\u0445 Microsoft Azure Site Recovery suite \u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0447\u0430\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044d\u0442\u043e \u0432 \u043d\u0435\u043c. Tenable \u043f\u0440\u043e CVE-2022-33675 \u043f\u0438\u0448\u0443\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e SYSTEM.\n\n@avleonovrus #Microsoft #PatchTuesday #Vulristics", "creation_timestamp": "2023-09-21T09:26:48.000000Z"}, {"uuid": "61a6ffda-0323-48df-8c68-c7a5e9c284ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61245", "content": "Black Hat Ethical Hacking\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugs\n\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.\n\nThe Azure Site Recovery service is a disaster recovery service that will automatically fail-over workloads to secondary locations when a problem is detected.\n\nAs part of the July 2022 Patch Tuesday, Microsoft fixed 84 flaws, with Azure Site Recovery vulnerability accounting for more than a third of the bugs fixed today.\n\nOf the thirty-two vulnerabilities fixed in Azure Site Recovery, two allow remote code execution, and a whopping thirty vulnerabilities allow for elevation of privileges.\n\nIn an advisory released today, Microsoft states that SQL injection vulnerabilities caused most of the privilege escalation bugs.\n\nHowever, Microsoft also highlighted a CVE-2022-33675 vulnerability caused by a DLL hijacking vulnerability discovered by Tenable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course A DLL hijacking flawThe DLL hijacking flaw is tracked as CVE-2022-33675\u00a0and has a CVSS v3 severity rating of 7.8. It was discovered by researchers at Tenable, who disclosed it to Microsoft on April 8, 2022.\n\nDLL hijacking attacks exploit vulnerabilities caused by insecure permission on folders that a Windows OS searches and loads DLLs required when an application is launched.\n\nTo perform the attack, a threat actor can create a custom, malicious DLL using the same name as a regular DLL loaded by the Azure Site Recovery application. This malicious DLL is then stored in a folder that Windows searches, causing it to be loaded and executed when the application starts.\n\nAccording to Tenable, the \u201ccxprocessserver\u201d service of ASR runs with SYSTEM level privileges by default, and its executable lies in a directory that has been incorrectly set to allow \u2018write\u2019 permissions to any user.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/wrong-permissions(1).png \nPotential implicationsBy acquiring admin-level privileges on a target system, an attacker would be free to change the OS security settings, make changes to user accounts, access all files on the system without restrictions, and install additional software.\n\nConsidering how widely\u00a0ASR is used in corporate environments that rely on uninterrupted cloud applications and services, it could serve as a crucial weak point [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.796962Z"}, {"uuid": "e2c9f00e-edd5-4623-9320-54911f84ac31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61247", "content": "in network intrusions.\n\nTenable highlights the scenario of ransomware attacks where the threat actors could leverage CVE-2022-33675 to wipe backups and make free data restoration impossible. However, this is just one of the many examples.\n\nMicrosoft has also published an advisory\u00a0to provide an overview of all the issues fixed in ASR this month, mentioning SQL injection and remote code execution in the impact section.\n\nFor these attacks, administrative credentials on the VMs are required; hence, CVE-2022-33675 can\u2019t be used as a funnel to widen the scope of impact, but it could help lay the ground for acquiring those credentials on the target.\n\nTo address all security issues, make sure to apply this month\u2019s updates. Those who can\u2019t apply the patches could mitigate the risk by manually changing the write permission setting on the impacted directory. \u200bTrending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News \u2013 new template postJuly 13, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022\nReading Time: 4 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.830977Z"}, {"uuid": "2d0b7125-9b55-4215-80c1-8a1040e93e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61245", "content": "Black Hat Ethical Hacking\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugs\n\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.\n\nThe Azure Site Recovery service is a disaster recovery service that will automatically fail-over workloads to secondary locations when a problem is detected.\n\nAs part of the July 2022 Patch Tuesday, Microsoft fixed 84 flaws, with Azure Site Recovery vulnerability accounting for more than a third of the bugs fixed today.\n\nOf the thirty-two vulnerabilities fixed in Azure Site Recovery, two allow remote code execution, and a whopping thirty vulnerabilities allow for elevation of privileges.\n\nIn an advisory released today, Microsoft states that SQL injection vulnerabilities caused most of the privilege escalation bugs.\n\nHowever, Microsoft also highlighted a CVE-2022-33675 vulnerability caused by a DLL hijacking vulnerability discovered by Tenable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course A DLL hijacking flawThe DLL hijacking flaw is tracked as CVE-2022-33675\u00a0and has a CVSS v3 severity rating of 7.8. It was discovered by researchers at Tenable, who disclosed it to Microsoft on April 8, 2022.\n\nDLL hijacking attacks exploit vulnerabilities caused by insecure permission on folders that a Windows OS searches and loads DLLs required when an application is launched.\n\nTo perform the attack, a threat actor can create a custom, malicious DLL using the same name as a regular DLL loaded by the Azure Site Recovery application. This malicious DLL is then stored in a folder that Windows searches, causing it to be loaded and executed when the application starts.\n\nAccording to Tenable, the \u201ccxprocessserver\u201d service of ASR runs with SYSTEM level privileges by default, and its executable lies in a directory that has been incorrectly set to allow \u2018write\u2019 permissions to any user.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/wrong-permissions(1).png \nPotential implicationsBy acquiring admin-level privileges on a target system, an attacker would be free to change the OS security settings, make changes to user accounts, access all files on the system without restrictions, and install additional software.\n\nConsidering how widely\u00a0ASR is used in corporate environments that rely on uninterrupted cloud applications and services, it could serve as a crucial weak point [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.528370Z"}, {"uuid": "c0fadb72-a2d9-443a-ade1-725c616450d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61247", "content": "in network intrusions.\n\nTenable highlights the scenario of ransomware attacks where the threat actors could leverage CVE-2022-33675 to wipe backups and make free data restoration impossible. However, this is just one of the many examples.\n\nMicrosoft has also published an advisory\u00a0to provide an overview of all the issues fixed in ASR this month, mentioning SQL injection and remote code execution in the impact section.\n\nFor these attacks, administrative credentials on the VMs are required; hence, CVE-2022-33675 can\u2019t be used as a funnel to widen the scope of impact, but it could help lay the ground for acquiring those credentials on the target.\n\nTo address all security issues, make sure to apply this month\u2019s updates. Those who can\u2019t apply the patches could mitigate the risk by manually changing the write permission setting on the impacted directory. \u200bTrending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News \u2013 new template postJuly 13, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022\nReading Time: 4 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.573695Z"}, {"uuid": "8d76960d-3916-4ab5-b258-43771f3085f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61247", "content": "in network intrusions.\n\nTenable highlights the scenario of ransomware attacks where the threat actors could leverage CVE-2022-33675 to wipe backups and make free data restoration impossible. However, this is just one of the many examples.\n\nMicrosoft has also published an advisory\u00a0to provide an overview of all the issues fixed in ASR this month, mentioning SQL injection and remote code execution in the impact section.\n\nFor these attacks, administrative credentials on the VMs are required; hence, CVE-2022-33675 can\u2019t be used as a funnel to widen the scope of impact, but it could help lay the ground for acquiring those credentials on the target.\n\nTo address all security issues, make sure to apply this month\u2019s updates. Those who can\u2019t apply the patches could mitigate the risk by manually changing the write permission setting on the impacted directory. \u200bTrending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News \u2013 new template postJuly 13, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022\nReading Time: 4 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T15:00:06.327529Z"}, {"uuid": "ac452299-c9c4-4364-8b2f-5d447cd6eda8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61245", "content": "Black Hat Ethical Hacking\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugs\n\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.\n\nThe Azure Site Recovery service is a disaster recovery service that will automatically fail-over workloads to secondary locations when a problem is detected.\n\nAs part of the July 2022 Patch Tuesday, Microsoft fixed 84 flaws, with Azure Site Recovery vulnerability accounting for more than a third of the bugs fixed today.\n\nOf the thirty-two vulnerabilities fixed in Azure Site Recovery, two allow remote code execution, and a whopping thirty vulnerabilities allow for elevation of privileges.\n\nIn an advisory released today, Microsoft states that SQL injection vulnerabilities caused most of the privilege escalation bugs.\n\nHowever, Microsoft also highlighted a CVE-2022-33675 vulnerability caused by a DLL hijacking vulnerability discovered by Tenable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course A DLL hijacking flawThe DLL hijacking flaw is tracked as CVE-2022-33675\u00a0and has a CVSS v3 severity rating of 7.8. It was discovered by researchers at Tenable, who disclosed it to Microsoft on April 8, 2022.\n\nDLL hijacking attacks exploit vulnerabilities caused by insecure permission on folders that a Windows OS searches and loads DLLs required when an application is launched.\n\nTo perform the attack, a threat actor can create a custom, malicious DLL using the same name as a regular DLL loaded by the Azure Site Recovery application. This malicious DLL is then stored in a folder that Windows searches, causing it to be loaded and executed when the application starts.\n\nAccording to Tenable, the \u201ccxprocessserver\u201d service of ASR runs with SYSTEM level privileges by default, and its executable lies in a directory that has been incorrectly set to allow \u2018write\u2019 permissions to any user.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/wrong-permissions(1).png \nPotential implicationsBy acquiring admin-level privileges on a target system, an attacker would be free to change the OS security settings, make changes to user accounts, access all files on the system without restrictions, and install additional software.\n\nConsidering how widely\u00a0ASR is used in corporate environments that rely on uninterrupted cloud applications and services, it could serve as a crucial weak point [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T15:00:06.359846Z"}, {"uuid": "f8eb0d87-ff5e-45a9-9f09-0f2f39a8c342", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61247", "content": "in network intrusions.\n\nTenable highlights the scenario of ransomware attacks where the threat actors could leverage CVE-2022-33675 to wipe backups and make free data restoration impossible. However, this is just one of the many examples.\n\nMicrosoft has also published an advisory\u00a0to provide an overview of all the issues fixed in ASR this month, mentioning SQL injection and remote code execution in the impact section.\n\nFor these attacks, administrative credentials on the VMs are required; hence, CVE-2022-33675 can\u2019t be used as a funnel to widen the scope of impact, but it could help lay the ground for acquiring those credentials on the target.\n\nTo address all security issues, make sure to apply this month\u2019s updates. Those who can\u2019t apply the patches could mitigate the risk by manually changing the write permission setting on the impacted directory. \u200bTrending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News \u2013 new template postJuly 13, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022\nReading Time: 4 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:43.599074Z"}, {"uuid": "860b0424-52b9-4098-859b-d8e6013eedc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33675", "type": "seen", "source": "https://t.me/hacking_Attack/61245", "content": "Black Hat Ethical Hacking\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugs\n\nMicrosoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.\n\nThe Azure Site Recovery service is a disaster recovery service that will automatically fail-over workloads to secondary locations when a problem is detected.\n\nAs part of the July 2022 Patch Tuesday, Microsoft fixed 84 flaws, with Azure Site Recovery vulnerability accounting for more than a third of the bugs fixed today.\n\nOf the thirty-two vulnerabilities fixed in Azure Site Recovery, two allow remote code execution, and a whopping thirty vulnerabilities allow for elevation of privileges.\n\nIn an advisory released today, Microsoft states that SQL injection vulnerabilities caused most of the privilege escalation bugs.\n\nHowever, Microsoft also highlighted a CVE-2022-33675 vulnerability caused by a DLL hijacking vulnerability discovered by Tenable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course A DLL hijacking flawThe DLL hijacking flaw is tracked as CVE-2022-33675\u00a0and has a CVSS v3 severity rating of 7.8. It was discovered by researchers at Tenable, who disclosed it to Microsoft on April 8, 2022.\n\nDLL hijacking attacks exploit vulnerabilities caused by insecure permission on folders that a Windows OS searches and loads DLLs required when an application is launched.\n\nTo perform the attack, a threat actor can create a custom, malicious DLL using the same name as a regular DLL loaded by the Azure Site Recovery application. This malicious DLL is then stored in a folder that Windows searches, causing it to be loaded and executed when the application starts.\n\nAccording to Tenable, the \u201ccxprocessserver\u201d service of ASR runs with SYSTEM level privileges by default, and its executable lies in a directory that has been incorrectly set to allow \u2018write\u2019 permissions to any user.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/wrong-permissions(1).png \nPotential implicationsBy acquiring admin-level privileges on a target system, an attacker would be free to change the OS security settings, make changes to user accounts, access all files on the system without restrictions, and install additional software.\n\nConsidering how widely\u00a0ASR is used in corporate environments that rely on uninterrupted cloud applications and services, it could serve as a crucial weak point [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:43.639133Z"}]}