{"uuid": "a92ac2f2-4403-488e-be9e-990a6da5eac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30128", "type": "seen", "source": "https://t.me/cissp/3085", "content": "Red Team Tactics:\n1. Red Team engagement platform with the goal of unifying offensive tools behind a simple UI\ud83d\ude0a\nhttps://github.com/KCarretto/paragon\n2. Bypass UAC by hijacking a DLL located in the Native Image Cache\nhttps://github.com/AzAgarampur/byeintegrity-uac#uacme\n\nMalware analysis:\n1. Ragnarok Ransomware\nhttps://labs.yarix.com/2021/04/malware-analysis-ragnarok-ransomware\n2. RotaJakiro: A secret backdoor with 0 VT detection\nhttps://blog.netlab.360.com/stealth_rotajakiro_backdoor_en\n\nexploit\nCVE-2021-30128:\nApache OFBiz has unsafe deserialization prior to 17.12.07 version (PoC)\nhttps://github.com/LioTree/CVE-2021-30128-EXP\n\nThreat Research:\n1. KDC Spoofing Vulnerability in F5 Big-IP (CVE-2021-23008)\ud83d\ude42\nhttps://www.silverfort.com/blog/silverfort-researchers-discover-kdc-spoofing-vulnerability-in-f5-big-ip-cve-2021-23008\n2. UNC2447 SOMBRAT/FIVEHANDS Ransomware:\ud83d\ude2d\nA Sophisticated Financial Threat\nhttps://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html\n\nCVE-2021-29921 - python stdlib \"ipaddress\" - Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF/RFI vulnerabilities. - \"ipaddress leading zeros in IPv4 address\" (PoC)\nhttps://sick.codes/sick-2021-014", "creation_timestamp": "2026-09-02T01:04:41.299863Z"}