Week of December 18, 2023

A red teamer documents their process of evading EDR detection for a Meterpreter payload by applying XOR encryption and storing the encrypted shellcode in the .data section to reduce static signatures. The technique was tested against Sophos XDR Intercept and Microsoft Defender for Endpoint on Windows 11, aiming to run the payload with minimal alerts. The article is part one of a series, focusing on theoretical foundations and initial evasion attempts.

CVE-2023-5594 is an improper certificate validation vulnerability in ESET security products' secure traffic scanning feature. The flaw allows acceptance of intermediate certificates signed with weak MD5 or SHA1 algorithms, enabling man-in-the-middle attacks. This undermines TLS/SSL inspection, potentially exposing encrypted traffic to interception.

CVE-2023-32728 is a medium-severity vulnerability in Zabbix Agent 2 where the smart.disk.get item key fails to sanitize parameters before passing them to a shell command, potentially allowing remote code execution. The flaw requires network access, high attack complexity, low privileges, and user interaction. It affects multiple versions of Zabbix Agent 2.