{"vulnerability": "CVE-2021-31166", "sightings": [{"uuid": "d37cbcf8-1b37-4970-aa0d-7d6497de8676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "MISP/63ddead6-4b82-414c-ad8e-c516b950b446", "content": "", "creation_timestamp": "2021-10-25T22:32:43.000000Z"}, {"uuid": "58c5d68c-3de2-4b66-917f-b680059cb277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "717b4412-35e9-48e3-99c0-efb4e113218c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971499", "content": "", "creation_timestamp": "2024-12-24T20:30:13.750193Z"}, {"uuid": "01771d1c-b698-4b0c-b812-6f71342f4321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "2d3bb72b-d731-4ee7-b62c-e0a19e28f4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:37.000000Z"}, {"uuid": "d176f244-dad0-4c9c-817a-46547d135445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:30.000000Z"}, {"uuid": "c88ac1fb-6c4b-4a70-9a17-8054e6f5d8c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb", "content": "", "creation_timestamp": "2022-03-16T22:48:55.000000Z"}, {"uuid": "e91a7e6c-0c0b-4fa4-99b6-5314b0d9b256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:13:16.000000Z"}, {"uuid": "d6f8367c-a2a5-4fcd-adc8-16c99c78b82a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-31166", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cc656da8-bb7b-4267-8519-01fa39a58e99", "content": "", "creation_timestamp": "2026-02-02T12:27:53.454245Z"}, {"uuid": "d33bf17f-320f-4ff4-af28-dfb488eb79ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/Linux_Arabss/51", "content": "CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability\n\nhttps://github.com/0vercl0k/CVE-2021-31166", "creation_timestamp": "2021-09-27T00:05:24.000000Z"}, {"uuid": "43ab1746-0085-4058-b281-3eff61283766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/cKure/5565", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 CVE-2021-31166 Windows HTTP flaw also impacts WinRM servers.\n\nhttps://hackademicus.nl/cve-2021-31166-windows-http-flaw-also-impacts-winrm-servers/", "creation_timestamp": "2021-05-23T15:44:04.000000Z"}, {"uuid": "e9b8ff76-b5d3-48ed-90c9-55c7ca31d02b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1608", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-21907: exploitation with Powershell, Python, Ruby, NMAP and Metasploit.\nURL\uff1ahttps://github.com/mauricelambert/CVE-2021-31166", "creation_timestamp": "2022-03-07T19:50:10.000000Z"}, {"uuid": "ce29d71a-ad49-4fe1-81bf-3f8fcf19d363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/3502", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aPoC for CVE-2021-31166 and CVE-2022-21907\nURL\uff1ahttps://github.com/0xmaximus/Home-Demolisher\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-12-01T11:20:30.000000Z"}, {"uuid": "4dbf338c-e3b1-4cd0-af2f-ec63ab7fb29d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/cKure/5378", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability\n\nhttps://github.com/0vercl0k/CVE-2021-31166", "creation_timestamp": "2021-05-17T06:35:10.000000Z"}, {"uuid": "c0284aa0-ca2d-4f06-9a6a-d82e92d83cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/605", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aWindows HTTP\u534f\u8bae\u6808\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e CVE-2021-31166\nURL\uff1ahttps://github.com/antx-code/CVE-2021-31166", "creation_timestamp": "2021-09-27T05:59:45.000000Z"}, {"uuid": "61db731e-1157-4947-ad8a-e8f77b46ae22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/719", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aJust a simple CVE-2021-31166 exploit tool\nURL\uff1ahttps://github.com/ConMiko/CVE-2021-31166-exploit", "creation_timestamp": "2021-10-20T07:52:13.000000Z"}, {"uuid": "b8c4e81a-ce7f-48a0-870f-35bb3344e1e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1425", "content": "CVE-2022-21907\n\n\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435:\nPOC \u0434\u043b\u044f CVE-2022-21907: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435:\n- \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP.\n- \u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430 CVE-2021-31166.\n- \u042d\u0442\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e\u0441\u044c \u0432 CVE-2021-31166, \u0438 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442.\n\n\u0417\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442: \n- Windows\n\u2014 10 \u0432\u0435\u0440\u0441\u0438\u044f 1809 \u0434\u043b\u044f 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 1809 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 x64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 1809 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 ARM64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 21H1 \u0434\u043b\u044f 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 21H1 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 x64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 21H1 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 ARM64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 20H2 \u0434\u043b\u044f 32-\u0431\u0438\u0442\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 20H2 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 x64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 20H2 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 ARM64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 21H2 \u0434\u043b\u044f 32-\u0431\u0438\u0442\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 21H2 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 x64\n\u2014 10 \u0412\u0435\u0440\u0441\u0438\u044f 21H2 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 ARM64\n\u2014 11 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 x64\n\u2014 11 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 ARM64\n- Windows Server\n\u2014 2019\n\u2014 2019 (\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u044f\u0434\u0440\u0430)\n\u2014 2022\n\u2014 2022 (\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u044f\u0434\u0440\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430)\n\u2014 \u0432\u0435\u0440\u0441\u0438\u044f 20H2 (\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u044f\u0434\u0440\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430)\n\nhttps://github.com/michelep/CVE-2022-21907-Vulnerability-PoC\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-04-28T17:01:45.000000Z"}, {"uuid": "5f745b3e-970f-4f1b-aa5a-25f8ef4a1e0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/alexmakus/4090", "content": "\u0418 \u0434\u0430\u0432\u043d\u0435\u043d\u044c\u043a\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0431\u044b\u043b\u043e \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Window. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 HTTP Protocol Stack Windows IIS \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 Windows 10 \u0438 Windows Server. Microsoft \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0430\u043f\u0434\u0435\u0439\u0442 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0430\u043f\u0434\u0435\u0439\u0442\u0430. \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166\n\n\u0410 \u0442\u0443\u0442 \u0438 PoC \u0443\u0436\u0435 \u043f\u043e\u0434\u0432\u0435\u0437\u043b\u0438\n\nhttps://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/\n\n\u0422\u0432\u0438\u0442 \u0441 \u0430\u043d\u043e\u043d\u0441\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \nhttps://twitter.com/jimdinmn/status/1395071966487269376?s=21", "creation_timestamp": "2021-05-24T05:27:06.000000Z"}, {"uuid": "67073d73-f8e0-4190-922e-69063c8a14f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/33607", "content": "Expert released PoC exploit code for Windows CVE-2021-31166 bug\n\nhttps://ift.tt/3eQN6lt", "creation_timestamp": "2021-05-17T15:52:15.000000Z"}, {"uuid": "825285cc-775c-40bf-8d85-cf9e55ce6208", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/ctinow/33975", "content": "CVE-2021-31166 Windows HTTP flaw also impacts WinRM servers\n\nhttps://ift.tt/3hNtG2Q", "creation_timestamp": "2021-05-23T15:32:55.000000Z"}, {"uuid": "16b19ec6-ac94-455e-a31b-bc8ccbc4b65f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/arpsyndicate/1119", "content": "#ExploitObserverAlert\n\nCVE-2021-31166\n\nDESCRIPTION: Exploit Observer has 51 entries related to CVE-2021-31166. HTTP Protocol Stack Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.972590000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-04T05:04:36.000000Z"}, {"uuid": "b49b0065-52cc-4e76-8b48-b284f8ef40af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/arpsyndicate/214", "content": "#ExploitObserverAlert\n\nCVE-2021-31166\n\nDESCRIPTION: Exploit Observer has 49 entries related to CVE-2021-31166. HTTP Protocol Stack Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.972300000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T05:44:16.000000Z"}, {"uuid": "7c295d3f-edbf-49e0-b704-024d63f1662c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "Telegram/mFYo1C3k7q9W0yt710Al7YJNUPL9ENyuwuWwvi5xbyICpHw", "content": "", "creation_timestamp": "2024-07-07T08:52:09.000000Z"}, {"uuid": "388e25cb-dbce-465a-9f70-e095c25acff8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/218", "content": "Simple Serv-U CVE-2021-35211 #poc\nhttps://github.com/NattiSamson/Serv-U-CVE-2021-35211\n\nCVE-2021-40346 integer overflow enables http smuggling\nhttps://github.com/donky16/CVE-2021-40346-POC\n\nPOC for CVE-2021-31166: Windows HTTP\nhttps://github.com/antx-code/CVE-2021-31166\n\nOffensive RPC #poc\nhttps://github.com/sensepost/offensive-rpc\n\nSimple Serv-U CVE-2021-35211 #poc\nhttps://github.com/5gstudent/CVE-2021-22005-\n\nios-nehelper-wifi-info-0day #exploit\nhttps://github.com/illusionofchaos/ios-nehelper-wifi-info-0day\nhttps://github.com/illusionofchaos/ios-nehelper-enum-apps-0day\n\n#poc for CVE-2021-3129 (Laravel)\nhttps://github.com/knqyf263/CVE-2021-3129", "creation_timestamp": "2021-10-01T18:29:21.000000Z"}, {"uuid": "97bf4bbe-719d-4068-b61f-f0b9a1bffacf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "Telegram/wD2220v0o3d-1bukkXF_tqfTdXEUiA9USIqpuUXZ1dpsFQ", "content": "", "creation_timestamp": "2021-05-20T04:33:15.000000Z"}, {"uuid": "11b79b91-4778-409b-a4ea-8258a3334ff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/1720", "content": "\u200b\u200b\u041d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043c\u0435\u0441\u044f\u0447\u043d\u044b\u0439 \u0430\u043f\u0434\u0435\u0439\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u043c, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-31166, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043e\u0446\u0435\u043d\u0438\u043b\u0438 \u0432 9,8 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 CVSS.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0441\u0442\u0435\u043a\u0435 HTTP Microsoft IIS \u0438 \u043f\u0440\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438, \u043a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u044f\u0434\u0440\u0435 \u041e\u0421.\n\nMicrosoft \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0447\u0435\u0440\u0432\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c IIS.\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043b\u0435\u043a\u0441 \u0421\u0443\u0448\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b Proof of Concept \u0434\u043b\u044f CVE-2021-31166, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0434\u043e \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0432 \u0440\u0443\u043a\u0430\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u0432\u0441\u0435\u0433\u043e \u043d\u0438\u0447\u0435\u0433\u043e.\n\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0435\u0441\u043b\u0438 \u0443 \u0432\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0435 Microsoft IIS - \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435\u0441\u044c, \u043d\u0435\u0447\u0435\u0433\u043e \u0447\u0435\u0440\u0432\u0435\u0439 \u043f\u043b\u043e\u0434\u0438\u0442\u044c.", "creation_timestamp": "2021-05-17T15:24:28.000000Z"}, {"uuid": "30f900b9-2c30-47fb-a4c9-c3a66b37b535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1208", "content": "CVE-2021-31166: A Wormable Code Execution Bug in HTTP.sys https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys", "creation_timestamp": "2026-08-03T10:10:20.640076Z"}, {"uuid": "0f580e0d-c30a-4aef-ad5d-9281792c285c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/haccking/99319", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438\n\n1. Qnap \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Roon Server\nhttps://xakep.ru/2021/05/18/roon-server-0day/\n\n2. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows IIS\nhttps://xakep.ru/2021/05/18/cve-2021-31166/\n\n3. CISA \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u0442 \u0430\u0442\u0430\u043a \u043d\u0430 SolarWinds \u0438 Active Directory/M365\nhttps://www.securitylab.ru/news/520299.php\n\n4. \u00ab\u0412\u0430\u043a\u0446\u0438\u043d\u043e\u0439\u00bb \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0443\u0441\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u0440\u0443\u0441\u0441\u043a\u0430\u044f \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0430 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u044b\nhttps://www.securitylab.ru/news/520295.php", "creation_timestamp": "2021-05-19T06:03:13.000000Z"}, {"uuid": "a5e73cdd-91fd-45eb-8534-57abaff1b382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/451", "content": "CVE-2021-31166 HTTP\u5354\u8b70\u68e7\u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-31166_HTTP%E5%8D%94%E8%AD%B0%E6%A3%A7%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-18T01:34:59.000000Z"}, {"uuid": "e2c36236-4afd-4542-b59f-6ab80d6b1939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/HackerOne/3005", "content": "HTTP Protocol Stack Remote Code Execution Vulnerability\n\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-CVE-2021-31166", "creation_timestamp": "2021-05-15T14:00:18.000000Z"}, {"uuid": "64981576-8ffd-462b-a2ba-e92e95eb81a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/3007", "content": "CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability\n\nhttps://github.com/0vercl0k/CVE-2021-31166", "creation_timestamp": "2021-05-17T12:23:36.000000Z"}, {"uuid": "f093b758-5f5b-4231-9e00-865bfa5e1933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/HackerOne/3043", "content": "CVE-2021-31166: A Wormable Code Execution Bug in HTTP.sys\n https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys", "creation_timestamp": "2021-06-15T11:15:30.000000Z"}, {"uuid": "f7e39159-4b5c-4a5f-bfe3-c438e4cfb74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/thehackernews/1212", "content": "Patch Tuesday (May 2021)\n\nMicrosoft has released the latest Windows updates to patch a dozen newly discovered vulnerabilities, one of the most critical of which is a wormable RCE (CVE-2021-31166) in the HTTP protocol stack.\nRead details - https://thehackernews.com/2021/05/latest-microsoft-windows-updates-patch.html", "creation_timestamp": "2021-05-12T13:59:45.000000Z"}, {"uuid": "079b6412-7f5f-44f9-961f-d11ae013e51a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/xakep_ru/10768", "content": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows IIS\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Windows IIS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u043e\u043c \u0447\u0435\u0440\u0432\u044f, \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0440\u0430\u043d\u0435\u0435 \u0432 \u044d\u0442\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435.\n\nhttps://xakep.ru/2021/05/18/cve-2021-31166/", "creation_timestamp": "2021-05-18T10:30:13.000000Z"}, {"uuid": "9d0c0bc6-2c3f-45ce-9230-14ae398ae888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/xakep_ru/10795", "content": "\u0411\u0430\u0433 \u0441 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u043e\u043c \u0447\u0435\u0440\u0432\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 WinRM\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0442\u0435\u043a\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP \u0432 Internet Information Services (IIS), \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0440\u0430\u043d\u0435\u0435 \u0432 \u044d\u0442\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f Windows 10 \u0438 Server, \u0441 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u043e\u0439 WinRM (Windows Remote Management).\n\nhttps://xakep.ru/2021/05/24/cve-2021-31166-winrm/", "creation_timestamp": "2021-05-24T12:35:10.000000Z"}, {"uuid": "b6eff8b2-3949-424b-997c-6827cd5f11a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/BlueRedTeam/1759", "content": "#Blue_Team\n1. Hermetic Wiper Malware Detection Rules\nhttps://github.com/stripesoc/detections/tree/main/hermeticwiper\n2. CVE-2021-31166 Detection Rules\nhttps://github.com/mvlnetdev/CVE-2021-31166-detection-rules\n\n@BlueRedTeam", "creation_timestamp": "2022-02-27T08:54:01.000000Z"}, {"uuid": "ca84ff4e-9d53-4b43-adc9-3402cd296a18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/2516", "content": "#CVE-2022\nPoC for CVE-2021-31166 and CVE-2022-21907\n\nhttps://github.com/0xmaximus/Home-Demolisher\n\n@BlueRedTeam", "creation_timestamp": "2022-12-10T17:07:01.000000Z"}, {"uuid": "d893a9a1-1cd9-44f3-a5ae-9f59af832ce1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/haccking/6301", "content": "#\u041d\u043e\u0432\u043e\u0441\u0442\u0438\n\n1. Qnap \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Roon Server\nhttps://xakep.ru/2021/05/18/roon-server-0day/\n\n2. \u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows IIS\nhttps://xakep.ru/2021/05/18/cve-2021-31166/\n\n3. CISA \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u0442 \u0430\u0442\u0430\u043a \u043d\u0430 SolarWinds \u0438 Active Directory/M365\nhttps://www.securitylab.ru/news/520299.php\n\n4. \u00ab\u0412\u0430\u043a\u0446\u0438\u043d\u043e\u0439\u00bb \u043f\u0440\u043e\u0442\u0438\u0432 \u0440\u0443\u0441\u0441\u043a\u0438\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u0440\u0443\u0441\u0441\u043a\u0430\u044f \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0430 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u044b\nhttps://www.securitylab.ru/news/520295.php", "creation_timestamp": "2022-06-07T11:35:37.000000Z"}, {"uuid": "0fb3af44-138d-49ca-b69c-39e2daed795a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3388", "content": "HTTP Protocol Stack RCE Vulnerability (PoC for CVE-2021-31166)\nhttps://github.com/0vercl0k/CVE-2021-31166", "creation_timestamp": "2021-06-12T21:45:55.000000Z"}, {"uuid": "fcc441a4-d598-443b-b1c4-2536672d9187", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3506", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (may 1-31)\nCVE-2021-31166 - HTTP Stack RCE\nhttps://t.me/cybersecuritytechnologies/3388\nCVE-2021-21551 -Dell BIOS Driver PE\nhttps://t.me/cybersecuritytechnologies/3293\nCVE-2021-30747 -Covert channel in Apple M1\nhttps://t.me/cybersecuritytechnologies/3472\nCVE-2021-22204 -DjVu vuln\nhttps://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800\nCVE-2021-28482 -MS Exchange RCE\nhttps://t.me/cybersecuritytechnologies/3286\nCVE-2021-21974 -VMware\u00a0ESXi heap-overflow\nhttps://t.me/cybersecuritytechnologies/3460\nCVE-2021-29447 -WordPress XXE\nhttps://t.me/cybersecuritytechnologies/3142\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-32471 -ACE in TuringMachine\nhttps://t.me/cybersecuritytechnologies/3364\nCVE-2021-3490 -Linux Kernel eBPF\nhttps://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e", "creation_timestamp": "2024-09-28T16:48:46.000000Z"}, {"uuid": "24e37117-6e53-4935-b293-cb0bbbe05a29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5500", "content": "#Blue_Team_Techniques\n1. Hermetic Wiper Malware Detection Rules\nhttps://github.com/stripesoc/detections/tree/main/hermeticwiper\n2. CVE-2021-31166 Detection Rules\nhttps://github.com/mvlnetdev/CVE-2021-31166-detection-rules", "creation_timestamp": "2022-02-27T13:45:01.000000Z"}, {"uuid": "9f3e1d09-5eaf-487c-a267-199603815529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/Linux_Arabs/44", "content": "CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability\n\nhttps://github.com/0vercl0k/CVE-2021-31166", "creation_timestamp": "2024-11-02T22:51:59.000000Z"}, {"uuid": "0ae88af4-9234-4c25-b29d-1a22cbc90f91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1208", "content": "CVE-2021-31166: A Wormable Code Execution Bug in HTTP.sys https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys", "creation_timestamp": "2026-08-04T00:00:42.779663Z"}, {"uuid": "de82549f-feb7-46ab-9542-b31a49d197c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1290", "content": "CVE-2021-31166: RCE in Microsoft HTTP.sys https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2021-31166-rce-in-microsoft-httpsys/", "creation_timestamp": "2026-08-04T00:00:43.583405Z"}, {"uuid": "153d3c57-f0e9-4a2a-b04b-d3044621d71e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1290", "content": "CVE-2021-31166: RCE in Microsoft HTTP.sys https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2021-31166-rce-in-microsoft-httpsys/", "creation_timestamp": "2026-08-03T09:02:14.523477Z"}, {"uuid": "2ca14ad2-3522-4e5e-9103-bca4468041f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "Telegram/SUR3ptYxT9eUOv99X5kdleCOKfF4oT98lcIErh5LuBwpouA", "content": "", "creation_timestamp": "2026-08-16T19:00:06.408392Z"}, {"uuid": "377b379e-4cd8-4fcc-aa5b-5fc69fe7eb28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "Telegram/SUR3ptYxT9eUOv99X5kdleCOKfF4oT98lcIErh5LuBwpouA", "content": "", "creation_timestamp": "2026-08-17T00:00:09.009616Z"}, {"uuid": "23a6c5de-17eb-46ef-8f76-692a1c9f386b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8de1af71-a8f4-44c9-b019-d727b1ec3a03", "content": "", "creation_timestamp": "2026-06-19T12:47:19.680471Z"}, {"uuid": "e66b0d70-f953-4594-83ff-069d64c36b77", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c1c8f8ef-2bd0-487e-afaf-eb3a159bcc53", "content": "", "creation_timestamp": "2026-06-23T14:05:17.476393Z"}, {"uuid": "22287642-9694-40c2-8e95-45f2a16e80b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "Telegram/2Gt6hllKg5INBk3NmQpKCh-efxsx8DUsAJjTr0s-70w3NYk", "content": "", "creation_timestamp": "2026-08-27T12:00:07.559687Z"}, {"uuid": "39dfc48d-00ba-4def-b637-e7cdedcdae46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/shmelovod/92", "content": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows IIS\n\nhttps://xakep.ru/2021/05/18/cve-2021-31166/", "creation_timestamp": "2026-07-17T12:00:05.761431Z"}, {"uuid": "6ddf30a4-0b8f-4b85-9044-b1d071efe46d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/shmelovod/92", "content": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows IIS\n\nhttps://xakep.ru/2021/05/18/cve-2021-31166/", "creation_timestamp": "2026-07-18T00:00:32.138815Z"}, {"uuid": "7f497256-2421-4aeb-bac2-fc39e23e1e22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "Telegram/2Gt6hllKg5INBk3NmQpKCh-efxsx8DUsAJjTr0s-70w3NYk", "content": "", "creation_timestamp": "2026-08-28T00:00:51.317078Z"}, {"uuid": "a2ece2d0-2e1d-4368-a12a-50322f9ce095", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "Telegram/2Gt6hllKg5INBk3NmQpKCh-efxsx8DUsAJjTr0s-70w3NYk", "content": "", "creation_timestamp": "2026-08-29T00:00:28.537066Z"}, {"uuid": "9c2e5eb1-25f7-4407-a946-2fef8acef661", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/reverseame/1208", "content": "CVE-2021-31166: A Wormable Code Execution Bug in HTTP.sys https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys", "creation_timestamp": "2026-07-29T12:02:57.854705Z"}, {"uuid": "1034e333-4775-4456-a2c3-40d9bdd639a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/reverseame/1290", "content": "CVE-2021-31166: RCE in Microsoft HTTP.sys https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2021-31166-rce-in-microsoft-httpsys/", "creation_timestamp": "2026-07-29T12:02:57.172160Z"}, {"uuid": "071177bf-3c71-4740-8a22-466fd20ab8f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/reverseame/1208", "content": "CVE-2021-31166: A Wormable Code Execution Bug in HTTP.sys https://www.zerodayinitiative.com/blog/2021/5/17/cve-2021-31166-a-wormable-code-execution-bug-in-httpsys", "creation_timestamp": "2026-07-30T00:02:47.587126Z"}, {"uuid": "9f382a00-cf75-49c4-aef8-ced153a19bdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/reverseame/1290", "content": "CVE-2021-31166: RCE in Microsoft HTTP.sys https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2021-31166-rce-in-microsoft-httpsys/", "creation_timestamp": "2026-07-30T00:02:46.608170Z"}, {"uuid": "082fe55a-3be4-4a9d-888c-e2446a088f94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/cissp/3201", "content": "Malware analysis\n1. Newly observed PHP-based skimmer shows ongoing Magecart Group 12 activity\nhttps://blog.malwarebytes.com/cybercrime/2021/05/newly-observed-php-based-skimmer-shows-ongoing-magecart-group-12-activity\n2. Malicious Rust Macro for VSCode\nhttps://github.com/lucky/bad_actor_poc\n\nexploit\nCVE-2021-27651:\nPega Infinity Password Reset (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-27651\n\nThreat Research\n1. Pentesting ISP 101. How I hacked & fixed My ISP\nhttps://infosecwriteups.com/pentesting-isp-101-how-i-hacked-fixed-my-isp-643e9201f7e9\n2. Auth Bypass in https-nearbydevices-pa-googleapis-com\nhttps://feed.bugs.xdavidhu.me/bugs/0004\n\nRed Team Tactics\n1. A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors\nhttps://github.com/optiv/Dent#techniques\n2. Remote Potato - From Domain User to Enterprise Admin\nhttps://pentestlab.blog/2021/05/04/remote-potato-from-domain-user-to-enterprise-admin/amp/?__twitter_impression=true\n\nWindows/x64 - Inject All Processes with Meterpreter Reverse Shell\nhttps://github.com/boku7/winx64-InjectAllProcessesMeterpreter-Shellcode\n\nHTTP Protocol Stack RCE Vulnerability\n(PoC for CVE-2021-31166)\nhttps://github.com/0vercl0k/CVE-2021-31166\n\nHYNTROSPECT Fuzzer\nhttps://github.com/googleprojectzero/Hyntrospect", "creation_timestamp": "2026-09-01T17:00:50.378156Z"}, {"uuid": "833dd64e-fc90-422f-8bc2-3316d7d2a3b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/cissp/3172", "content": "Patch Tuesday (May 2021)\n\nMicrosoft has released the latest Windows updates to patch a dozen newly discovered vulnerabilities, one of the most critical of which is a wormable RCE (CVE-2021-31166) in the HTTP protocol stack.\nRead details - https://thehackernews.com/2021/05/latest-microsoft-windows-updates-patch.html", "creation_timestamp": "2026-09-01T17:00:50.592449Z"}, {"uuid": "dcbdaca1-a2b2-48c1-8965-a8aed1d8983e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/9637", "content": "Black Hat Ethical Hacking\nWindows PoC Exploit Released for Wormable RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127 \nReading Time: 1 Minute\nA researcher has released\u00a0a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).\nMicrosoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday\u00a0update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.\n\nAccording to a tweet from Microsoft\u2019s Justin Campbell, the vulnerability was found by @_mxms\u00a0and @fzzyhd1.\nFortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9\n\n\u2014 Justin Campbell (@metr0) May 13, 2021\nSee Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching\u201cIn most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,\u201d Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.\n\n\u201cWith a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,\u201d McAfee\u2019s Steve Povolny said in an analysis\u00a0of the flaw at the time.\n\nPovolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is \u201cfairly limited,\u201d he said. That\u2019s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren\u2019t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. \u201cWhen it\u2019s done, it moves it into the Request structure; but it doesn\u2019t NULLout the local list,\u201d he explained. \u201cThe issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.\u201d\nSee Also: Offensive Security Tool: EyeWitness This isn\u2019t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it\u2019s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.\nI've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.475243Z"}, {"uuid": "f2c1c00d-d8b4-4d26-bd61-ce37a3f4971b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/24365", "content": "Black Hat Ethical Hacking\nHacked sites push TeamViewer using fake expired certificate alert\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159 \nReading Time: 1 Minute\nThreat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.\nInternet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.\n\nThe message shown on the malicious certificate expiration error pages reads: \u201cDetected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.\u201d\n\nAs Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png \n<figcaptionMalicious page hosted on hacked IIS server \nSee Also: Complete Offensive Security and Ethical Hacking Course\nThe payload dropped on infected systems is TVRAT\u00a0(aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.\n\nOnce deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.\n\nAfter being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.\n\nTVRAT first surfaced in 2013\u00a0when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png \n<figcaptionTeamViewer\u00a0installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.\n\nFor instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.\n\nMicrosoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.\n\nThere hasn\u2019t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would\u2019ve updated and companies don\u2019t commonly use the latest Window Server versions.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp \ud83d\udd25\ud83d\udd25 pic.twitter.com/yzgUs2CQO5\n\n\u2014 Axel Souchet (@0vercl0k) May 16, 2021\nHowever, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.\n\nThe most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted\u00a0Microsoft IIS web servers\u00a0according to an August report from Israeli security firm Sygnia.\n\nIn their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]", "creation_timestamp": "2026-09-01T20:02:21.915711Z"}, {"uuid": "d779ff38-f317-498d-b907-84cb6d212ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:43.843538Z"}, {"uuid": "aaea8771-e9ee-4224-a000-0453a9ec76f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/9288", "content": "Exploit Collector\nCVE-2021-31166 - Proof Of Concept For CVE-2021-31166, A Remote HTTP.sys Use-After-Free Triggered Remotely\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.668682Z"}, {"uuid": "cb9214ae-a61b-4450-803c-1c971b7a2230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8312", "content": "includes the fix for CVE-2021-31207, which made its debut in the 2021 Pwn2Own competition,\u201d he said.\n\nThe bug tracked as CVE-2021-31207 is only rated as \u201cmoderate,\u201d but the \u201csecurity feature-bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published,\u201d Goettl explained. \u201cAt that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.\u201d\n\nThere two other publicly disclosed vulnerabilities resolved by Microsoft this month that exist in Common Utilities, found in the NNI open-source toolkit (CVE-2021-31200), and in .NET and Visual Studio (CVE-2021-31204).\n\n\u201cCommon Utilities and .NET and Visual Studio are less likely to be targeted, but due to the public disclosures they should not be ignored for long,\u201d Goettl added. Other Notable Microsoft Security Patches for May 2021As for the other patches in the update that stood out to the research community, ZDI\u2019s Childs highlighted a Windows wireless networking information-disclosure bug, tracked as CVE-2020-24587.\n\n\u201cThe ZDI doesn\u2019t normally highlight info disclosure bugs, but this one has the potential to be pretty damaging,\u201d Childs said. \u201cThis patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It\u2019s not clear what the range on such an attack would be, but you should assume some proximity is needed. You\u2019ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.\u201d Windows Graphics, SharePoint Server PatchesA trio of local privilege escalation flaws \u2013 two in the Windows Graphics Component (CVE-2021-31188, CVE-2021-31170) and one in SharePoint Server (CVE-2021-28474) \u2013 caught Breen\u2019s eye.\n\nAs for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.\n\n\u201cThis kind of vulnerability is often used by attackers after they have already gained a foothold through an initial infection vector, like phishing or via another exploit like the RCE in HTTP.sys (CVE-2021-31166),\u201d Breen noted via email. \u201cThe attackers are looking to increase their privileges so they can move laterally across a network or gain access to other accounts that may have access to more sensitive information.\u201d\n\nMeanwhile, the SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.\n\n\u201cAs this is post-authentication, it\u2019s likely to be used as part of post-exploitation and lateral movement phases of an attack, rather than the initial-infection vector,\u201d Breen said. \u201cAttackers could gain access to sensitive documents or even replace real documents with weaponized versions, enabling the compromise of more user devices across the organization\u2019s network.\u201d Microsoft Exchange Server PatchesMicrosoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws (CVE-2021-31198, RCE; CVE-2021-31207, spoofing; CVE-2021-31209, security bypass; and CVE-2021-31195, RCE), are all rated important or moderate.\n\n\u201cCVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server\u00a0vulnerabilities that [were] patched in an out-of-band release back in March,\u201d Satnam Narang, staff research engineer with Tenable, told Threatpost. \u201cWhile none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible.\u201d\n\nAnd finally, Ivanti\u2019s Goettl noted that several Microsoft products have reached end-of-life and won\u2019t be getting support going forward.\n\n\u201cThis month marks the final update for several Windows 10 and Server [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.957684Z"}, {"uuid": "e56a53e3-530a-4f9d-9c2e-aa2f509569c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/vulns/383", "content": "\u0418 \u0434\u0430\u0432\u043d\u0435\u043d\u044c\u043a\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0431\u044b\u043b\u043e \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Window. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 HTTP Protocol Stack Windows IIS \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 Windows 10 \u0438 Windows Server. Microsoft \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0430\u043f\u0434\u0435\u0439\u0442 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0430\u043f\u0434\u0435\u0439\u0442\u0430. \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166\n\n\u0410 \u0442\u0443\u0442 \u0438 PoC \u0443\u0436\u0435 \u043f\u043e\u0434\u0432\u0435\u0437\u043b\u0438\n\nhttps://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/\n\n\u0422\u0432\u0438\u0442 \u0441 \u0430\u043d\u043e\u043d\u0441\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \nhttps://twitter.com/jimdinmn/status/1395071966487269376?s=21", "creation_timestamp": "2026-09-01T20:02:51.055038Z"}, {"uuid": "0265feac-16c5-43b4-88b7-4a735fe0591c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/24365", "content": "Black Hat Ethical Hacking\nHacked sites push TeamViewer using fake expired certificate alert\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159 \nReading Time: 1 Minute\nThreat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.\nInternet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.\n\nThe message shown on the malicious certificate expiration error pages reads: \u201cDetected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.\u201d\n\nAs Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png \n<figcaptionMalicious page hosted on hacked IIS server \nSee Also: Complete Offensive Security and Ethical Hacking Course\nThe payload dropped on infected systems is TVRAT\u00a0(aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.\n\nOnce deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.\n\nAfter being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.\n\nTVRAT first surfaced in 2013\u00a0when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png \n<figcaptionTeamViewer\u00a0installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.\n\nFor instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.\n\nMicrosoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.\n\nThere hasn\u2019t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would\u2019ve updated and companies don\u2019t commonly use the latest Window Server versions.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp \ud83d\udd25\ud83d\udd25 pic.twitter.com/yzgUs2CQO5\n\n\u2014 Axel Souchet (@0vercl0k) May 16, 2021\nHowever, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.\n\nThe most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted\u00a0Microsoft IIS web servers\u00a0according to an August report from Israeli security firm Sygnia.\n\nIn their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]", "creation_timestamp": "2026-09-02T01:02:50.595934Z"}, {"uuid": "449ec1cc-3c32-47bb-91bf-95e6cdb9d841", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8312", "content": "includes the fix for CVE-2021-31207, which made its debut in the 2021 Pwn2Own competition,\u201d he said.\n\nThe bug tracked as CVE-2021-31207 is only rated as \u201cmoderate,\u201d but the \u201csecurity feature-bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published,\u201d Goettl explained. \u201cAt that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.\u201d\n\nThere two other publicly disclosed vulnerabilities resolved by Microsoft this month that exist in Common Utilities, found in the NNI open-source toolkit (CVE-2021-31200), and in .NET and Visual Studio (CVE-2021-31204).\n\n\u201cCommon Utilities and .NET and Visual Studio are less likely to be targeted, but due to the public disclosures they should not be ignored for long,\u201d Goettl added. Other Notable Microsoft Security Patches for May 2021As for the other patches in the update that stood out to the research community, ZDI\u2019s Childs highlighted a Windows wireless networking information-disclosure bug, tracked as CVE-2020-24587.\n\n\u201cThe ZDI doesn\u2019t normally highlight info disclosure bugs, but this one has the potential to be pretty damaging,\u201d Childs said. \u201cThis patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It\u2019s not clear what the range on such an attack would be, but you should assume some proximity is needed. You\u2019ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.\u201d Windows Graphics, SharePoint Server PatchesA trio of local privilege escalation flaws \u2013 two in the Windows Graphics Component (CVE-2021-31188, CVE-2021-31170) and one in SharePoint Server (CVE-2021-28474) \u2013 caught Breen\u2019s eye.\n\nAs for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.\n\n\u201cThis kind of vulnerability is often used by attackers after they have already gained a foothold through an initial infection vector, like phishing or via another exploit like the RCE in HTTP.sys (CVE-2021-31166),\u201d Breen noted via email. \u201cThe attackers are looking to increase their privileges so they can move laterally across a network or gain access to other accounts that may have access to more sensitive information.\u201d\n\nMeanwhile, the SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.\n\n\u201cAs this is post-authentication, it\u2019s likely to be used as part of post-exploitation and lateral movement phases of an attack, rather than the initial-infection vector,\u201d Breen said. \u201cAttackers could gain access to sensitive documents or even replace real documents with weaponized versions, enabling the compromise of more user devices across the organization\u2019s network.\u201d Microsoft Exchange Server PatchesMicrosoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws (CVE-2021-31198, RCE; CVE-2021-31207, spoofing; CVE-2021-31209, security bypass; and CVE-2021-31195, RCE), are all rated important or moderate.\n\n\u201cCVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server\u00a0vulnerabilities that [were] patched in an out-of-band release back in March,\u201d Satnam Narang, staff research engineer with Tenable, told Threatpost. \u201cWhile none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible.\u201d\n\nAnd finally, Ivanti\u2019s Goettl noted that several Microsoft products have reached end-of-life and won\u2019t be getting support going forward.\n\n\u201cThis month marks the final update for several Windows 10 and Server [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:18.499437Z"}, {"uuid": "a7abb628-959d-4091-9f6f-6ba561e1d581", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/9288", "content": "Exploit Collector\nCVE-2021-31166 - Proof Of Concept For CVE-2021-31166, A Remote HTTP.sys Use-After-Free Triggered Remotely\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:18.236798Z"}, {"uuid": "678c8027-53b9-4939-bb37-4600ff2eb7f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/9637", "content": "Black Hat Ethical Hacking\nWindows PoC Exploit Released for Wormable RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127 \nReading Time: 1 Minute\nA researcher has released\u00a0a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).\nMicrosoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday\u00a0update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.\n\nAccording to a tweet from Microsoft\u2019s Justin Campbell, the vulnerability was found by @_mxms\u00a0and @fzzyhd1.\nFortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9\n\n\u2014 Justin Campbell (@metr0) May 13, 2021\nSee Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching\u201cIn most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,\u201d Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.\n\n\u201cWith a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,\u201d McAfee\u2019s Steve Povolny said in an analysis\u00a0of the flaw at the time.\n\nPovolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is \u201cfairly limited,\u201d he said. That\u2019s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren\u2019t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. \u201cWhen it\u2019s done, it moves it into the Request structure; but it doesn\u2019t NULLout the local list,\u201d he explained. \u201cThe issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.\u201d\nSee Also: Offensive Security Tool: EyeWitness This isn\u2019t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it\u2019s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.\nI've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:18.050303Z"}, {"uuid": "a8334565-c4f0-492a-8e1a-15b734bd7393", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:19.289189Z"}, {"uuid": "9a077da0-16fb-4b86-93cc-a235eec4bf0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/vulns/383", "content": "\u0418 \u0434\u0430\u0432\u043d\u0435\u043d\u044c\u043a\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0431\u044b\u043b\u043e \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Window. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 HTTP Protocol Stack Windows IIS \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 Windows 10 \u0438 Windows Server. Microsoft \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0430\u043f\u0434\u0435\u0439\u0442 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0430\u043f\u0434\u0435\u0439\u0442\u0430. \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166\n\n\u0410 \u0442\u0443\u0442 \u0438 PoC \u0443\u0436\u0435 \u043f\u043e\u0434\u0432\u0435\u0437\u043b\u0438\n\nhttps://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/\n\n\u0422\u0432\u0438\u0442 \u0441 \u0430\u043d\u043e\u043d\u0441\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \nhttps://twitter.com/jimdinmn/status/1395071966487269376?s=21", "creation_timestamp": "2026-09-02T01:03:26.772452Z"}, {"uuid": "12e839f0-7c2e-4edd-be1a-35ed59327ea9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/cissp/3201", "content": "Malware analysis\n1. Newly observed PHP-based skimmer shows ongoing Magecart Group 12 activity\nhttps://blog.malwarebytes.com/cybercrime/2021/05/newly-observed-php-based-skimmer-shows-ongoing-magecart-group-12-activity\n2. Malicious Rust Macro for VSCode\nhttps://github.com/lucky/bad_actor_poc\n\nexploit\nCVE-2021-27651:\nPega Infinity Password Reset (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-27651\n\nThreat Research\n1. Pentesting ISP 101. How I hacked & fixed My ISP\nhttps://infosecwriteups.com/pentesting-isp-101-how-i-hacked-fixed-my-isp-643e9201f7e9\n2. Auth Bypass in https-nearbydevices-pa-googleapis-com\nhttps://feed.bugs.xdavidhu.me/bugs/0004\n\nRed Team Tactics\n1. A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors\nhttps://github.com/optiv/Dent#techniques\n2. Remote Potato - From Domain User to Enterprise Admin\nhttps://pentestlab.blog/2021/05/04/remote-potato-from-domain-user-to-enterprise-admin/amp/?__twitter_impression=true\n\nWindows/x64 - Inject All Processes with Meterpreter Reverse Shell\nhttps://github.com/boku7/winx64-InjectAllProcessesMeterpreter-Shellcode\n\nHTTP Protocol Stack RCE Vulnerability\n(PoC for CVE-2021-31166)\nhttps://github.com/0vercl0k/CVE-2021-31166\n\nHYNTROSPECT Fuzzer\nhttps://github.com/googleprojectzero/Hyntrospect", "creation_timestamp": "2026-09-02T01:04:39.225917Z"}, {"uuid": "c31a30f5-cd06-4e1e-942a-67af42369235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/cissp/3172", "content": "Patch Tuesday (May 2021)\n\nMicrosoft has released the latest Windows updates to patch a dozen newly discovered vulnerabilities, one of the most critical of which is a wormable RCE (CVE-2021-31166) in the HTTP protocol stack.\nRead details - https://thehackernews.com/2021/05/latest-microsoft-windows-updates-patch.html", "creation_timestamp": "2026-09-02T01:04:39.578273Z"}, {"uuid": "2e304e0e-44cb-434c-bee6-c9d1e34169d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24365", "content": "Black Hat Ethical Hacking\nHacked sites push TeamViewer using fake expired certificate alert\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159 \nReading Time: 1 Minute\nThreat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.\nInternet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.\n\nThe message shown on the malicious certificate expiration error pages reads: \u201cDetected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.\u201d\n\nAs Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png \n<figcaptionMalicious page hosted on hacked IIS server \nSee Also: Complete Offensive Security and Ethical Hacking Course\nThe payload dropped on infected systems is TVRAT\u00a0(aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.\n\nOnce deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.\n\nAfter being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.\n\nTVRAT first surfaced in 2013\u00a0when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png \n<figcaptionTeamViewer\u00a0installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.\n\nFor instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.\n\nMicrosoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.\n\nThere hasn\u2019t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would\u2019ve updated and companies don\u2019t commonly use the latest Window Server versions.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp \ud83d\udd25\ud83d\udd25 pic.twitter.com/yzgUs2CQO5\n\n\u2014 Axel Souchet (@0vercl0k) May 16, 2021\nHowever, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.\n\nThe most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted\u00a0Microsoft IIS web servers\u00a0according to an August report from Israeli security firm Sygnia.\n\nIn their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]", "creation_timestamp": "2026-09-07T14:00:04.764193Z"}, {"uuid": "9a2ddb7e-b762-48cf-b53f-930a1c612499", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24365", "content": "Black Hat Ethical Hacking\nHacked sites push TeamViewer using fake expired certificate alert\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159 \nReading Time: 1 Minute\nThreat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.\nInternet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.\n\nThe message shown on the malicious certificate expiration error pages reads: \u201cDetected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.\u201d\n\nAs Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png \n<figcaptionMalicious page hosted on hacked IIS server \nSee Also: Complete Offensive Security and Ethical Hacking Course\nThe payload dropped on infected systems is TVRAT\u00a0(aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.\n\nOnce deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.\n\nAfter being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.\n\nTVRAT first surfaced in 2013\u00a0when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png \n<figcaptionTeamViewer\u00a0installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.\n\nFor instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.\n\nMicrosoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.\n\nThere hasn\u2019t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would\u2019ve updated and companies don\u2019t commonly use the latest Window Server versions.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp \ud83d\udd25\ud83d\udd25 pic.twitter.com/yzgUs2CQO5\n\n\u2014 Axel Souchet (@0vercl0k) May 16, 2021\nHowever, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.\n\nThe most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted\u00a0Microsoft IIS web servers\u00a0according to an August report from Israeli security firm Sygnia.\n\nIn their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]", "creation_timestamp": "2026-09-08T00:00:43.642400Z"}, {"uuid": "50b781df-67b5-44d7-bd33-390575a449fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/9288", "content": "Exploit Collector\nCVE-2021-31166 - Proof Of Concept For CVE-2021-31166, A Remote HTTP.sys Use-After-Free Triggered Remotely\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T06:00:04.663442Z"}, {"uuid": "d748a247-ce32-4672-84e8-1155de198345", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/9637", "content": "Black Hat Ethical Hacking\nWindows PoC Exploit Released for Wormable RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127 \nReading Time: 1 Minute\nA researcher has released\u00a0a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).\nMicrosoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday\u00a0update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.\n\nAccording to a tweet from Microsoft\u2019s Justin Campbell, the vulnerability was found by @_mxms\u00a0and @fzzyhd1.\nFortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9\n\n\u2014 Justin Campbell (@metr0) May 13, 2021\nSee Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching\u201cIn most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,\u201d Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.\n\n\u201cWith a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,\u201d McAfee\u2019s Steve Povolny said in an analysis\u00a0of the flaw at the time.\n\nPovolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is \u201cfairly limited,\u201d he said. That\u2019s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren\u2019t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. \u201cWhen it\u2019s done, it moves it into the Request structure; but it doesn\u2019t NULLout the local list,\u201d he explained. \u201cThe issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.\u201d\nSee Also: Offensive Security Tool: EyeWitness This isn\u2019t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it\u2019s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.\nI've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T06:00:04.847308Z"}, {"uuid": "e7eed883-55df-4238-ba70-c1b3056bb4c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Max\", \"Stefan Blair\", \"Axel Souchet\", \"Maurice LAMBERT \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits CVE-2021-31166, a UAF bug in http.sys\\n          when parsing specially crafted Accept-Encoding headers\\n          that was patched by Microsoft in May 2021, on vulnerable\\n          IIS servers. Successful exploitation will result in\\n          the target computer BSOD'ing before subsequently rebooting.\\n          Note that the target IIS server may or may not come back up,\\n          this depends on the target's settings as to whether IIS\\n          is configured to start on reboot.\", \"disclosure_date\": \"2021-05-11\", \"fullname\": \"auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166\", \"is_install_path\": true, \"mod_time\": \"2022-10-01 17:54:59 +0000\", \"name\": \"Windows IIS HTTP Protocol Stack DOS\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"screen-effects\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/auxiliary/dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"dos/windows/http/http_sys_accept_encoding_dos_cve_2021_31166\", \"references\": [\"CVE-2021-31166\", \"URL-https://nvd.nist.gov/vuln/detail/CVE-2021-31166\", \"URL-https://github.com/mauricelambert/CVE-2021-31166\", \"URL-https://twitter.com/metr0/status/1392631376592076805\", \"URL-https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31166\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:08.605281Z"}, {"uuid": "51dc22ad-aa83-4d7e-b180-2639a8d4a4ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/vulns/383", "content": "\u0418 \u0434\u0430\u0432\u043d\u0435\u043d\u044c\u043a\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0431\u044b\u043b\u043e \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Window. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 HTTP Protocol Stack Windows IIS \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 Windows 10 \u0438 Windows Server. Microsoft \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0430\u043f\u0434\u0435\u0439\u0442 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0430\u043f\u0434\u0435\u0439\u0442\u0430. \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166\n\n\u0410 \u0442\u0443\u0442 \u0438 PoC \u0443\u0436\u0435 \u043f\u043e\u0434\u0432\u0435\u0437\u043b\u0438\n\nhttps://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/\n\n\u0422\u0432\u0438\u0442 \u0441 \u0430\u043d\u043e\u043d\u0441\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \nhttps://twitter.com/jimdinmn/status/1395071966487269376?s=21", "creation_timestamp": "2026-09-08T19:00:06.025728Z"}, {"uuid": "e6fdd762-0e8b-457d-b023-6a6e096de826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T07:00:05.062071Z"}, {"uuid": "70bb3ddd-aac7-4388-b657-00e29d2a458c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8312", "content": "includes the fix for CVE-2021-31207, which made its debut in the 2021 Pwn2Own competition,\u201d he said.\n\nThe bug tracked as CVE-2021-31207 is only rated as \u201cmoderate,\u201d but the \u201csecurity feature-bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published,\u201d Goettl explained. \u201cAt that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.\u201d\n\nThere two other publicly disclosed vulnerabilities resolved by Microsoft this month that exist in Common Utilities, found in the NNI open-source toolkit (CVE-2021-31200), and in .NET and Visual Studio (CVE-2021-31204).\n\n\u201cCommon Utilities and .NET and Visual Studio are less likely to be targeted, but due to the public disclosures they should not be ignored for long,\u201d Goettl added. Other Notable Microsoft Security Patches for May 2021As for the other patches in the update that stood out to the research community, ZDI\u2019s Childs highlighted a Windows wireless networking information-disclosure bug, tracked as CVE-2020-24587.\n\n\u201cThe ZDI doesn\u2019t normally highlight info disclosure bugs, but this one has the potential to be pretty damaging,\u201d Childs said. \u201cThis patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It\u2019s not clear what the range on such an attack would be, but you should assume some proximity is needed. You\u2019ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.\u201d Windows Graphics, SharePoint Server PatchesA trio of local privilege escalation flaws \u2013 two in the Windows Graphics Component (CVE-2021-31188, CVE-2021-31170) and one in SharePoint Server (CVE-2021-28474) \u2013 caught Breen\u2019s eye.\n\nAs for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.\n\n\u201cThis kind of vulnerability is often used by attackers after they have already gained a foothold through an initial infection vector, like phishing or via another exploit like the RCE in HTTP.sys (CVE-2021-31166),\u201d Breen noted via email. \u201cThe attackers are looking to increase their privileges so they can move laterally across a network or gain access to other accounts that may have access to more sensitive information.\u201d\n\nMeanwhile, the SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.\n\n\u201cAs this is post-authentication, it\u2019s likely to be used as part of post-exploitation and lateral movement phases of an attack, rather than the initial-infection vector,\u201d Breen said. \u201cAttackers could gain access to sensitive documents or even replace real documents with weaponized versions, enabling the compromise of more user devices across the organization\u2019s network.\u201d Microsoft Exchange Server PatchesMicrosoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws (CVE-2021-31198, RCE; CVE-2021-31207, spoofing; CVE-2021-31209, security bypass; and CVE-2021-31195, RCE), are all rated important or moderate.\n\n\u201cCVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server\u00a0vulnerabilities that [were] patched in an out-of-band release back in March,\u201d Satnam Narang, staff research engineer with Tenable, told Threatpost. \u201cWhile none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible.\u201d\n\nAnd finally, Ivanti\u2019s Goettl noted that several Microsoft products have reached end-of-life and won\u2019t be getting support going forward.\n\n\u201cThis month marks the final update for several Windows 10 and Server [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T07:00:05.761245Z"}, {"uuid": "a3e98eb5-b80e-4548-b1ad-abd3e176eacf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8312", "content": "includes the fix for CVE-2021-31207, which made its debut in the 2021 Pwn2Own competition,\u201d he said.\n\nThe bug tracked as CVE-2021-31207 is only rated as \u201cmoderate,\u201d but the \u201csecurity feature-bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published,\u201d Goettl explained. \u201cAt that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.\u201d\n\nThere two other publicly disclosed vulnerabilities resolved by Microsoft this month that exist in Common Utilities, found in the NNI open-source toolkit (CVE-2021-31200), and in .NET and Visual Studio (CVE-2021-31204).\n\n\u201cCommon Utilities and .NET and Visual Studio are less likely to be targeted, but due to the public disclosures they should not be ignored for long,\u201d Goettl added. Other Notable Microsoft Security Patches for May 2021As for the other patches in the update that stood out to the research community, ZDI\u2019s Childs highlighted a Windows wireless networking information-disclosure bug, tracked as CVE-2020-24587.\n\n\u201cThe ZDI doesn\u2019t normally highlight info disclosure bugs, but this one has the potential to be pretty damaging,\u201d Childs said. \u201cThis patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system. It\u2019s not clear what the range on such an attack would be, but you should assume some proximity is needed. You\u2019ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.\u201d Windows Graphics, SharePoint Server PatchesA trio of local privilege escalation flaws \u2013 two in the Windows Graphics Component (CVE-2021-31188, CVE-2021-31170) and one in SharePoint Server (CVE-2021-28474) \u2013 caught Breen\u2019s eye.\n\nAs for the first two, he noted they could be chained with another bug, such as the wormable bug listed above, to become highly dangerous and allow for WannaCry-style attacks.\n\n\u201cThis kind of vulnerability is often used by attackers after they have already gained a foothold through an initial infection vector, like phishing or via another exploit like the RCE in HTTP.sys (CVE-2021-31166),\u201d Breen noted via email. \u201cThe attackers are looking to increase their privileges so they can move laterally across a network or gain access to other accounts that may have access to more sensitive information.\u201d\n\nMeanwhile, the SharePoint bug allows an authenticated attacker to run code on remote SharePoint Servers.\n\n\u201cAs this is post-authentication, it\u2019s likely to be used as part of post-exploitation and lateral movement phases of an attack, rather than the initial-infection vector,\u201d Breen said. \u201cAttackers could gain access to sensitive documents or even replace real documents with weaponized versions, enabling the compromise of more user devices across the organization\u2019s network.\u201d Microsoft Exchange Server PatchesMicrosoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws (CVE-2021-31198, RCE; CVE-2021-31207, spoofing; CVE-2021-31209, security bypass; and CVE-2021-31195, RCE), are all rated important or moderate.\n\n\u201cCVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server\u00a0vulnerabilities that [were] patched in an out-of-band release back in March,\u201d Satnam Narang, staff research engineer with Tenable, told Threatpost. \u201cWhile none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible.\u201d\n\nAnd finally, Ivanti\u2019s Goettl noted that several Microsoft products have reached end-of-life and won\u2019t be getting support going forward.\n\n\u201cThis month marks the final update for several Windows 10 and Server [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:38.974790Z"}, {"uuid": "448ea8e1-b346-459f-8095-ceab4030ee5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/vulns/383", "content": "\u0418 \u0434\u0430\u0432\u043d\u0435\u043d\u044c\u043a\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435 \u0431\u044b\u043b\u043e \u0445\u043e\u0440\u043e\u0448\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Window. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 HTTP Protocol Stack Windows IIS \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 Windows 10 \u0438 Windows Server. Microsoft \u0443\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0430\u043f\u0434\u0435\u0439\u0442 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0430\u043f\u0434\u0435\u0439\u0442\u0430. \n\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166\n\n\u0410 \u0442\u0443\u0442 \u0438 PoC \u0443\u0436\u0435 \u043f\u043e\u0434\u0432\u0435\u0437\u043b\u0438\n\nhttps://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/\n\n\u0422\u0432\u0438\u0442 \u0441 \u0430\u043d\u043e\u043d\u0441\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \nhttps://twitter.com/jimdinmn/status/1395071966487269376?s=21", "creation_timestamp": "2026-09-09T00:00:28.271364Z"}, {"uuid": "b18191b2-813f-42a1-ae25-acb7f7e83445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/hacking_Attack/8310", "content": "Black Hat Ethical Hacking\nWormable Windows Bug Opens Door to DoS, RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Wormable Windows Bug Opens Door to DoS, RCEPost Views: 89 \nReading Time: 2 Minutes\nMicrosoft\u2019s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities, including a\u00a0patch for a concerning wormable vulnerability found in the Windows OS.\nThe good news is that none of the vulnerabilities are being actively exploited in the wild, according to Microsoft, though three are listed as publicly known. The fixes\u00a0address security flaws across Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server. Besides the four critical bugs, 50 are rated \u201cimportant\u201d and one is moderate in severity. Critical Microsoft Security Patches for May 2021The critical bugs in this month\u2019s Patch Tuesday release are:\n\n* CVE-2021-31166: A wormable HTTP protocol-stack issue in Windows 10 and some versions of Windows Server allowing remote code-execution (RCE)\n* CVE-2021-26419: A scripting-engine memory corruption vulnerability in Internet Explorer 11 and 9 allowing RCE\n* CVE-2021-31194: An RCE bug in the Microsoft Windows Object Linking and Embedding (OLE) Automation\n* CVE-2021-28476: An RCE vulnerability in Microsoft Windows Hyper-V CVE-2021-31166 \u2013 WormableThis most concerning critical bug for researchers is an HTTP protocol-stack issue that would allow RCE with kernel privileges or a denial-of-service (DoS) attack. The HTTP protocol stack enables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS).\n\n\u201cIf exploited, this vulnerability could enable an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP protocol stack (http.sys) to process packets and ultimately, execute arbitrary code, and take control of the affected system,\u201d Eric Feldman, cybersecurity researcher with Automox, wrote in an analysis.\nSee Also: Lemon Duck Cryptojacking Botnet Changes Up Tactics Worse, Microsoft noted that the bug is wormable, so that it could be used to self-replicate across the internal network and affect internal services that may not have been exposed.\n\n\u201cThe vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated DoS (Blue Screen of Death) for affected products,\u201d Steve Povolny, head of advanced threat research and principle engineer at McAfee, said via email. \u201cWhile this vulnerability has the potential to lead to code execution in the Windows kernel, this type of weaponization is a much higher bar for exploitation. However, if RCE can be achieved, cybercriminals would likely have the capability to create a worm, leading to self-propagation of the vulnerability across networks and the internet.\u201d\n\n\u201cFor ransomware operators, this kind of vulnerability is a prime target for exploitation,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cWormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it\u2019s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.\u201d\n\nDustin Childs, researcher with Trend Micro\u2019s Zero Day Initiative (ZDI), noted in a blog, \u201cBefore you pass this aside, Windows 10 can also be configured as a web server, so it [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:38.305721Z"}, {"uuid": "b941c2c2-8031-48c9-abe1-2d26f05ed2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/9288", "content": "Exploit Collector\nCVE-2021-31166 - Proof Of Concept For CVE-2021-31166, A Remote HTTP.sys Use-After-Free Triggered Remotely\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:39.579066Z"}, {"uuid": "bdaf5dd1-ab6c-4070-a729-940489a0ff70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/9637", "content": "Black Hat Ethical Hacking\nWindows PoC Exploit Released for Wormable RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows PoC Exploit Released for Wormable RCEPost Views: 127 \nReading Time: 1 Minute\nA researcher has released\u00a0a proof-of-concept (PoC) exploit for CVE-2021-31166, a use-after-free, highly critical vulnerability in the HTTP protocol stack (http.sys) that could lead to wormable remote code execution (RCE).\nMicrosoft discovered the flaw internally, releasing a patch in its May 11 Patch Tuesday\u00a0update. This was the most severe bug in that batch: an http.sysissue that requires neither user authentication nor user interaction to exploit. An exploit would allow RCE with kernel privileges or a denial-of-service (DoS) attack.\n\nAccording to a tweet from Microsoft\u2019s Justin Campbell, the vulnerability was found by @_mxms\u00a0and @fzzyhd1.\nFortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation. https://t.co/0ru9BQMaJ9\n\n\u2014 Justin Campbell (@metr0) May 13, 2021\nSee Also: Microsoft, Google Clouds Hijacked for Gobs of Phishing http.sysenables Windows and applications to communicate with other devices; it can be run standalone or in conjunction with Internet Information Services (IIS). Microsoft Advises Priority Patching\u201cIn most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets,\u201d Microsoft explained in its advisory. Given that the vulnerability is wormable, Microsoft recommends prioritizing the patching of affected servers.\n\n\u201cWith a CVSS score of 9.8, the vulnerability announced has the potential to be both directly impactful and is also exceptionally simple to exploit, leading to a remote and unauthenticated denial-of-service (Blue Screen of Death) for affected products,\u201d McAfee\u2019s Steve Povolny said in an analysis\u00a0of the flaw at the time.\n\nPovolny explained that the problem lies in how Windows improperly tracks pointers while processing objects in network packets containing HTTP requests. The vulnerability only affects the latest versions of Windows 10 and Windows Server, meaning that the exposure for internet-facing enterprise servers is \u201cfairly limited,\u201d he said. That\u2019s because many of these systems run Long Term Servicing Channel (LTSC) versions, such as Windows Server 2016 and 2019, which aren\u2019t susceptible to this flaw. Public Exploit for Wormable Security BugResearcher Axel Souchet, who used to work for Microsoft, published the PoC to GitHub, noting that the bug happens in http!UlpParseContentCoding, where the function has a local LIST_ENTRYand appends an item to it. \u201cWhen it\u2019s done, it moves it into the Request structure; but it doesn\u2019t NULLout the local list,\u201d he explained. \u201cThe issue with that is that an attacker can trigger a code path that frees every [entry] of the local list, leaving them dangling in the Request object.\u201d\nSee Also: Offensive Security Tool: EyeWitness This isn\u2019t the first PoC exploit for CVE-2021-31166 that Souchet has released, but this is the first wormable one. Over the weekend, he released a PoC that only locked the impacted Windows system as long as it\u2019s running an IIS server. That initial exploit shows how an attacker can leverage the flaw to cause DoS on a targeted system by sending it specially crafted packets.\nI've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp https://s.w.org/images/core/emoji/13.0.1/72x72/1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:39.823083Z"}, {"uuid": "cf87ef64-2328-4f40-a197-69cbc2ea38b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "seen", "source": "https://t.me/cissp/3172", "content": "Patch Tuesday (May 2021)\n\nMicrosoft has released the latest Windows updates to patch a dozen newly discovered vulnerabilities, one of the most critical of which is a wormable RCE (CVE-2021-31166) in the HTTP protocol stack.\nRead details - https://thehackernews.com/2021/05/latest-microsoft-windows-updates-patch.html", "creation_timestamp": "2026-09-11T06:00:04.765426Z"}, {"uuid": "8a3341ad-52b8-45df-9a65-5c996170e1b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31166", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3201", "content": "Malware analysis\n1. Newly observed PHP-based skimmer shows ongoing Magecart Group 12 activity\nhttps://blog.malwarebytes.com/cybercrime/2021/05/newly-observed-php-based-skimmer-shows-ongoing-magecart-group-12-activity\n2. Malicious Rust Macro for VSCode\nhttps://github.com/lucky/bad_actor_poc\n\nexploit\nCVE-2021-27651:\nPega Infinity Password Reset (PoC)\nhttps://github.com/Vulnmachines/CVE-2021-27651\n\nThreat Research\n1. Pentesting ISP 101. How I hacked & fixed My ISP\nhttps://infosecwriteups.com/pentesting-isp-101-how-i-hacked-fixed-my-isp-643e9201f7e9\n2. Auth Bypass in https-nearbydevices-pa-googleapis-com\nhttps://feed.bugs.xdavidhu.me/bugs/0004\n\nRed Team Tactics\n1. A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors\nhttps://github.com/optiv/Dent#techniques\n2. Remote Potato - From Domain User to Enterprise Admin\nhttps://pentestlab.blog/2021/05/04/remote-potato-from-domain-user-to-enterprise-admin/amp/?__twitter_impression=true\n\nWindows/x64 - Inject All Processes with Meterpreter Reverse Shell\nhttps://github.com/boku7/winx64-InjectAllProcessesMeterpreter-Shellcode\n\nHTTP Protocol Stack RCE Vulnerability\n(PoC for CVE-2021-31166)\nhttps://github.com/0vercl0k/CVE-2021-31166\n\nHYNTROSPECT Fuzzer\nhttps://github.com/googleprojectzero/Hyntrospect", "creation_timestamp": "2026-09-11T06:00:05.253695Z"}]}