Initial Access Intelligence

Test and Exploit Scripts for CVE 2022-1388 (F5 Big-IP)

Python

PowerShell and C++ PoCs for critical / high impact Windows Spooler vulnerabilities found in 2020-22

C++ C PowerShell

Various documentation on known exploit methodologies

A "Mishandling of Input to API" or "Exposed Dangerous Method or Function" vulnerability in PrintixService.exe, in Kofax Printix's "Printix Secure Cloud Print Management", Version 1.3.1156.0 and below allows a Local Or Remote attacker the ability to attack any enterprise installation running in KioskMode by exploiting the local PrintixProxy class to invoke an error with localhost/e/?error=INVALID_CREDENTIAL&errorMessage={kioskModeValue}. When an attacker combines this with CVE-2022-29552, the attacker may change the ProgramDir registry value to invoke any program named unis000.exe.

C#

A "Exposed Dangerous Method or Function" or "Use of Hard-coded, Security-relevant Constants" vulnerability in PrintixService.exe, in Kofax Printix's "Printix Secure Cloud Print Management", Version 1.3.1156.0 and below allows a Local Or Remote attacker the ability to override the "ProgramDir" registry value and point it to a directory that contains a malicious PrintixServiceTask.xml file. This allows an attacker the ability to escalate their privileges to a system session.

C#

A "Incorrect Use of Privileged APIs" vulnerability in PrintixService.exe, in Kofax Printix's "Printix Secure Cloud Print Management", Version 1.3.1156.0 and below allows a Local Or Remote attacker the ability change any values within the LocalMachine\Software\Printix\ Registry. This was an insufficient fix to CVE-2022-25089.

C#

A "Exposed Dangerous Method or Function" vulnerability in PrintixService.exe, in Kofax Printix's "Printix Secure Cloud Print Management", Version 1.3.1156.0 and below allows a Local Or Remote attacker the ability to install malicious printer drivers and run them through the Printix Service. An attacker can use this to execute malicious driver code remotely to escalate their privileges to system.

C#

None

Python

A Zeek package to detect CVE-2022-23270, a PPTP vulnerability in Windows.

Zeek Standard ML Makefile Shell

Proof of concept exploit for CVE-2022-30525 (Zxyel firewall command injection)

exploit poc zyxel cve-2022-30525

Python