{"uuid": "a287b79f-bc99-42d5-a7d8-bebbc82627af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26420", "type": "seen", "source": "https://t.me/cissp/4545", "content": "Red Team Tactics\n1. Automatic Exploit Generation (AEG)\nusing concolic execution\nhttps://github.com/aesophor/requiem\n2. Practical strategies for exploiting FILE READ vulnerabilities\nhttps://afinepl.medium.com/practical-strategies-for-exploiting-file-read-vulnerabilities-272abe792078\n\nThreat Research\nRCE in Microsoft SharePoint via Workflow Compilation (PoC for CVE-2021-26420)\nhttps://www.zerodayinitiative.com/blog/2021/10/5/cve-2021-26420-remote-code-execution-in-sharepoint-via-workflow-compilation\n\nMalware analysis\n1. ESPecter bootkit:\nUEFI threats moving to the ESP\nhttps://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit\n2. Apostle Ransomware Analysis\nhttps://www.sentinelone.com/labs/new-version-of-apostle-ransomware-reemerges-in-targeted-attack-on-higher-education\n3. Python ransomware script targets ESXi server for encryption\ud83d\ude43\nhttps://news.sophos.com/en-us/2021/10/05/python-ransomware-script-targets-esxi-server-for-encryption\n\nexploit\n1. Sample exploits for Zephyr CVE-2021-3625\nhttps://github.com/szymonh/zephyr_cve-2021-3625\n2. PHP 7.0-8.0 disable_functions bypass 0-day PoC [user_filter]\nhttps://github.com/mm0r1/exploits/tree/master/php-filter-bypass\n\nOffensive security\n1. Drone pentesting framework console\nhttps://github.com/dhondta/dronesploit\n2. Hunting for Citrix Netscaler API \ud83d\ude00Abuse:\nReconnaissance, SSO and Session Manipulation\nhttps://www.inversecos.com/2021/10/hunting-for-citrix-netscaler-api-abuse.html?m=1", "creation_timestamp": "2026-09-01T17:00:38.925999Z"}