ASL IT SECURITY @ASL_IT

We develop red team products and provide tools for LEA agencies and governments to combat cyber crime. aslitsecurity.com India Joined October 2014

Tweets

58
Followers

148
Following

445
Likes

40

ASL IT SECURITY @ASL_IT

4 years ago

@doc_guard @SubTee @malwrhunterteam @luigi_martire94 @executemalware On which office version did you tested it? The VBS is not getting triggered in office 365 fully updated.

0 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

4 years ago

#CVE-2022-30333 #zimbra #unrar POC github.com/aslitsecurity/…

0 1 3 0 0

View Details

ASL IT SECURITY @ASL_IT

4 years ago

Different orgcharts.exe versions crash on different buffer size. But all are vulnerable.

1 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

4 years ago

OrgCharts.exe #msoffice Anyone have knowledge of .opx file structure or any reference link?? Possible 0day? More than 160 "AAAAAA....."

2 1 1 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

@HaifeiLi @wdormann @GossiTheDog @EXPMON_ Seems like SE trick, so that the target enables macro.

0 0 1 0 0

View Details

Now I understand HTTPS is secure. The docx POC generated from the builder was detected by 7 Antivirus, a little relief! Until I decided to generate the file with HTTPS in URL :-( #CVE-2021-40444 #0day #hacking #redteam #infosec #virustotal

1 0 2 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

I have made 3 builders for docx, cab, and HTML for CVE-2021-40444. Goal is to test how easily we can bypass static AV detections for the DOCX file, by just tampering with some characters. github.com/aslitsecurity/… The results were very predictable. #infosec #hacking #redteam

6 74 169 0 34

View Details

ASL IT SECURITY @ASL_IT

5 years ago

@Max_Mal_ But you still need cab file to drop the payload to %temp%? Or you are not using cab at all?

1 0 1 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

@JojolionBOT Not yet. But trying.

0 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

@ksha @vxunderground @vxunderground thanks I got the HTML samples from you. non Obfuscated ones.

0 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

To achieve exploitation via preview pane, just convert the generated docx to RTF. PS: Read RTF specs, check old RTF exploit variants. RTF exploits are more fun to FUD, and the tricks are countless. #cve-2021-40444

0 0 2 0 0

View Details

j00sean @j00sean

5 years ago

I'm too late at CVE-2021-40444 party. But i just wanted to take a look at MSIE exploitation. Awesome to see a full exploit (RCE w/ sandbox escape) only using 6 lines of javascript code. Cool no doubt.

5 151 485 0 63

View Details

ASL IT SECURITY @ASL_IT

5 years ago

For VT lovers this is the POC for CVE-2021-40444 generated by these builders. #virustotal

0 0 3 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

Tested again now and confirm that it is working now. The DOCX POC file will not be corrupted now. #cve-2021-40444 #0day #infosec #redteam #blueteam #hacking #security #securitybreach #malware #cybernews

0 2 6 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

Sorry in the repo _rels dir was not uploaded somehow. Anyone of you who got corrupted docx file, please pull again and try.

0 1 3 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

@novitoll @ulexec cabarc.exe -i 1234 -p -m NONE n asdbc11.cab "../championship.inf", Then you need to change the DLL size. Maybe I will release a cab generator tool on github.

0 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

5 years ago

A couple of modifications and poof. Only 7 AV detected. #cve-2021-40444

0 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

7 years ago

@mj0011sec Great job!

0 0 2 0 0

View Details

ASL IT SECURITY @ASL_IT

7 years ago

@io_r_us @Edgespot_io No this is not cve-2019-5786. But it seems a PDF document used by readnotify (a service used to know if the receiver of an email read the email, or opened an attachment.)

1 0 2 0 0

View Details

ASL IT SECURITY @ASL_IT

8 years ago

@InfoCap4 No idea. Couldn't figure it out. And without password how it is decrypting to execute the exploit???

0 0 0 0 0

View Details

ASL IT SECURITY @ASL_IT

8 years ago

Help decrypting MS Equation editor sample #cve-2018-0802. This sample is detected by just 3 AV on virustotal and is encrypted using AES/RSA. virustotal.com/file/d65b4b653… PS: You need to rename it to .xlsx for it to work.