{"vulnerability": "CVE-2023-1585", "sightings": [{"uuid": "40bb3088-a647-43a9-b12f-ae4c817879a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1585", "type": "published-proof-of-concept", "source": "https://t.me/codeby_sec/7361", "content": "\u200bAvast Anti-Virus CVE-2023-1585 CVE-2023-1587 Privileged file operation abuse: \u0440\u0430\u0437\u0431\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0410\u0432\u0442\u043e\u0440 \u043d\u0435 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0442\u0438\u043f\u0430 Privileged file operation abuse, \u0442.\u043a. \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u0441\u0438\u043b\u0438\u044f \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0432\u043d\u044f\u0442\u044c\u0441\u044f \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0443 \u043a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u043d\u043e \u043d\u0435 \u0432 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437). \u0412 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043c\u043e\u0439 \u0432\u0437\u0433\u043b\u044f\u0434 \u0443\u043f\u0430\u043b \u043d\u0430 Avast, \u043f\u043e\u0441\u043b\u0435 \u0431\u0435\u0433\u043b\u043e\u0432\u043e\u0433\u043e \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0433\u043b\u0430\u0437\u0430 \u0437\u0430\u0446\u0435\u043f\u0438\u043b\u0438\u0441\u044c \u0437\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u041f\u043e\u0440\u0435\u0441\u0435\u0440\u0432\u0438\u0447 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0431\u044b\u043b\u0438 \u043d\u0430\u0439\u0434\u0435\u043d\u044b \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0442 rack911labs \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 SafeBreach. \u041c\u043e\u0435\u0439 \u0446\u0435\u043b\u044c\u044e \u044f\u0432\u043b\u044f\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043e\u0442 SYSTEM \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0431\u044c\u044e\u0437\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432. \u041a\u043e\u043d\u0435\u0447\u043d\u043e \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b \u0432\u0441\u044e \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0435\u0440\u0447\u0430, \u043d\u043e \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0433\u043b\u0430\u0437\u0430 \u043a\u0440\u0430\u0441\u043d\u0435\u044e\u0442, \u0440\u0443\u043a\u0438 \u0434\u0435\u043b\u0430\u044e\u0442. \u041d\u0438\u0436\u0435 \u044f \u0432\u044b \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0435\u0442\u0435 \u043a\u0430\u043a\u0438\u0435 \u0448\u0430\u0433\u0438 \u044f \u0434\u0435\u043b\u0430\u043b, \u0447\u0442\u043e\u0431\u044b \u0434\u043e\u0439\u0442\u0438 \u0434\u043e \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e POC. \u041f\u0440\u0438\u044f\u0442\u043d\u043e\u0433\u043e \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0447\u0442\u0435\u043d\u0438\u044f)\n\n\ud83d\udccc \u0427\u0438\u0442\u0430\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e\n\n#antivirus #vulnerability #poc", "creation_timestamp": "2023-05-07T09:17:10.000000Z"}, {"uuid": "db8d9b4c-a498-4032-84ae-e09d5fe6636a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1585", "type": "published-proof-of-concept", "source": "Telegram/_Dqexw-quc2Fy3CcgHXVDSvC-8HsD1wrDejj4pIYUBDrHZs", "content": "", "creation_timestamp": "2023-05-22T14:55:22.000000Z"}, {"uuid": "9d8ae1fb-3d8e-4435-bbe4-7dabfd51c7fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1585", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/1467", "content": "CVE-2023-1585 and CVE-2023-1587\n\u0421\u043c\u0435\u0448\u043d\u043e\u0435)))\nAvast Anti-Virus privileged arbitrary file create on virus quarantine\nreadme\n*\nPOC exploit\n\n#avast #LPE", "creation_timestamp": "2023-04-27T06:10:24.000000Z"}, {"uuid": "cfcf970d-0294-4f2b-8fab-f87de0ade966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1585", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/2898", "content": "Tools - Hackers Factory\n\n\u200b\u200bknife \n\nA #BurpSuite plug-in, the main purpose is to make some small improvements to Burp to make it more convenient to use. It's like using a knife to make a small carving on Burp, hence the name \"knife\".\n\nhttps://github.com/bit4woo/knife\n\n#infosec #pentesting #bugbounty\n\n\u200b\u200bAwesome One-liner Bug Bounty\n\nA collection of awesome one-liner scripts especially for bug bounty tips.\n\nhttps://github.com/dwisiswant0/awesome-oneliner-bugbounty\n\n#infosec #pentesting #bugbounty\n\n\u200b\u200bKubeStalk\n\nKubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9.\n\nhttps://github.com/redhuntlabs/kubestalk\n\n#cybersecurity #infosec\n\n\u200b\u200bKubestroyer\n\nA Golang exploitation tool that aims to take advantage of Kubernetes clusters misconfigurations. The tool is scanning known Kubernetes ports that can be exposed as well as exploiting them.\n\nhttps://github.com/Rolix44/Kubestroyer\n\n#infosec #pentesting #cybersecurity\n\n\u200b\u200bPortEx\n\nA Java library for static malware analysis of Portable Executable files. Its focus is on PE malformation robustness, and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications.\n\nhttps://github.com/struppigel/PortEx\n\n#malware #cybersecurity #infosec\n\n\u200b\u200bClairvoyance\n\nObtain GraphQL API schema even if the introspection is disabled.\n\nhttps://github.com/nikitastupin/clairvoyance\n\n#infosec #pentesting #bugbounty\n\n\u200b\u200bauditpolCIS\n\nCIS Benchmark testing of Windows SIEM configuration\n\nThis is an application for testing the configuration of Windows Audit Policy settings against the CIS Benchmark recommended settings.\n\nhttps://github.com/SevenStones/auditpolCIS\n\n#cybersecurity #infosec\n\n\u200b\u200buncover\n\nA go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with automation in mind, so you can query it and utilize the results with your current pipeline tools.\n\nhttps://github.com/projectdiscovery/uncover\n\n#OSINT #recon #bugbounty\n\n\u200b\u200bAwesome GPT + Security\n\nA curated list of awesome security tools, experimental case or other interesting things with LLM or GPT.\n\nhttps://github.com/cckuailong/awesome-gpt-security\n\n#cybersecurity #infosec #pentesting\n\n\u200b\u200bKingOfBugBounty\n\nOur main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters.\n\nhttps://github.com/KingOfBugbounty/KingOfBugBountyTips\n\n#infosec #cybersecurity #bugbounty\n\n\u200b\u200bGhostTrack\n\nUseful tool to track location or mobile number, so this tool can be called osint or also information gathering.\n\nhttps://github.com/HunxByts/GhostTrack\n\n#OSINT #cybersecurity #infosec\n\n\u200b\u200bdploot\n\ndploot is Python rewrite of SharpDPAPI written un C# by Harmj0y, which is itself a port of DPAPI from Mimikatz by gentilkiwi. It implements all the DPAPI logic of these tools, but this time it is usable with a python interpreter and from a Linux environment.\n\nhttps://github.com/zblurx/dploot\n\n#infosec #pentesting #redteam\n\n\u200b\u200bBlockOpenHandle\n\nBlock any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process, with that you can avoid remote memory scanners.\n\nhttps://github.com/TheD1rkMtr/BlockOpenHandle\n\n#cybersecurity #infosec\n\nCVE-2023-1585 & CVE-2023-1587\n\nAvast Anti-Virus privileged arbitrary file create on virus quarantine (CVE-2023-1585 and CVE-2023-1587).\n\nhttps://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2023-1585%20%26%20CVE-2023-1587/\n\nDetails:\nhttps://the-deniss.github.io/posts/2023/04/26/avast-privileged-arbitrary-file-create-on-quarantine.html\n\n#exploit #cybersecurity #infosec\n\nhttps://t.me/dilagrafie\nhttps://t.me/HackerFactory", "creation_timestamp": "2023-04-27T18:41:57.000000Z"}, {"uuid": "a84ea381-c2b1-4744-8cf7-f3f6e4507800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1585", "type": "seen", "source": "https://t.me/cibsecurity/62480", "content": "\u203c CVE-2023-1585 \u203c\n\nAvast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary file/directory deletion. The issue was fixed with Avast and AVG Antivirus version 22.11 and virus definitions from 14 February 2023 or later.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-19T22:30:24.000000Z"}, {"uuid": "0edafd96-16fb-4c6c-9503-c1feb38d3d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-1585", "type": "published-proof-of-concept", "source": "https://t.me/LearnExploit/4993", "content": "CVE-2023-1585 & CVE-2023-1587\n\nAvast Anti-Virus privileged arbitrary file create on virus quarantine\n\nGithub\n\n#Cve \n\u2014\u2014\u2014\u2014\u2014\u2014\u200c\n0Day.Today\n@LearnExploit\n@Tech_Army", "creation_timestamp": "2023-05-20T00:26:21.000000Z"}]}