UNDERCODE COMMUNITY
2.68K subscribers
1.23K photos
31 videos
2.65K files
80.4K links
πŸ¦‘ Undercode Cyber World!
@UndercodeCommunity


1️⃣ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2️⃣ Cyber & Tech NEWS:
@Undercode_News

3️⃣ CVE @Daily_CVE

✨ Web & Services:
β†’ Undercode.help
Download Telegram
This media is not supported in your browser
VIEW IN TELEGRAM
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Beautify and Chineseize-Make MP3 under Linux by UNDERCODE :
t.me/UndercodeTesting
Many friends who like music will try to make MP3 on a computer with CD, of course Linux users You can also make your own MP3, which is not a patent of Windows / Mac. This time I will introduce two Linux programs for making MP3.

My favorite is Grip written in GTK +.

Grip is not actually an MP3 encoder or a CD Track program. It just provides a simple and easy-to-use graphical interface, so that you do n’t have to use commands to make MP3s. As for CD ripper (catch CD Track program), Grip supports cdparanoia and cdda2wav. Looking at the MP3 encoder, it supports bladeenc, lame, l3enc, xingmp3enc, mp3encode, gogo, etc., which is quite beneficial! The author uses cdparanoia and bladeenc.

The following are some URLs of CD ripper / MP3 encoder:


CD ripper
Β· cdparanoia
http://www.xiph.org/paranoia
Β· cdda2wav
ftp://ftp.gwdg.de/pub/linux../misc/cdda2wav

MP3 encoder
Β· BladeEnc
http://bladeenc.mp3.no
Β· LAME
http://www.sulaco.org/mp3
Β· gogo
http://homepage1.nifty.com/herumi/gogo_e.html

You can choose one of the CD ripper and MP3 encoder, and Grip can only be used after installation. If you are using rpm, I suggest you use cdparanoia / cdda2wav + gogo, their RPM can be downloaded from the following URL:
cdparanoia RPM
http://rpmfind.net/linux/RPM/redhat...9.6-2.i386. html
cdda2wav RPM
http://rpmfind.net/linux/RPM/redhat...1.8-2.i386.html
gogo RPM
http://www.aial.hiroshima-u.ac.jp/~...2.35- 1.i386.rpm

If you are using Debian / Corel / Storm linux, you can choose to use the two Debian packages cdparanoia / cdda2wav, but because of copyright issues, Debian does not have the MP3 Encoder package.

After you have installed CD ripper and MP3 Encoder, you can use Grip to make MP3. Grip's website is: http://www.nostatic.org/grip
You can download its RPM package at "http://www.nostatic.org/grip/grip-2.94-1.i386.rpm", while the Debian package It is grip, you can use apt-get to download and install.
Enter the execution command grip, you can see the main program screen of Grip. First, we need to set up the CD ripper and MP3 encoder used. Click the Config page, then select Rip, and select the installed CD Ripper in Ripper. Then select MP3 from Config and select an installed MP3 encoder in the Encoder column. Then you can put your beloved Audio CD into the optical drive, and then you can see that the form in Tracks has been automatically updated. If you have time, you can click on the "pencil" button below to give CDs and Tracks proper names. In the form, we need to press the right button of the mouse to select the song. After selecting it, select the Rip page and press Rip + Encode, then the selected Tracks will be MP3. Grip can also grab a part of the track, select Rip partial track, press Play, write down the sector at the beginning and end of the part, and enter into Start sector and End sector respectively. When the process is complete, the finished MP3s are in the mp3 directory in the home director, which is ~ / mp3 /.

KDE Department: Krabber

Krabber is another frontend for CD Ripper and MP3 Encoder. Krabber is developed with QT and KDE library, so only KDE users can use it. This is a major disadvantage of Krabber ... (I have never used KDE, so I installed KDE). Krabber supports cdparanoia, 8hz-mp3, lame, encode, bladeenc, l3enc, mp3enc, xingmp3enc, but Krabber can automatically detect whether the system has the required elements. It needs mpg123 to play MP3. The settings of Krabber are similar to Grip, format selects the installed MP3 encoder, the first cell in Generic Options selects your input device, such as / dev / hdc (CDROM drive), etc. One of Krabber's features that Grip does not have is to adjust CPU resources so that you can record MP3s while working. Krabber is fairly easy to use, just follow its four steps:
select a song, select a directory, file name, and execute.
Krabber website: http://krabber.automatix.de
KDE website: http://www.kde.org

WRITTEN BY UNDERCODE
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
This media is not supported in your browser
VIEW IN TELEGRAM
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘A list of useful payloads and bypass for Web Application Security and Pentest/CTF
fb.com/UndercodeTesting

πŸ¦‘FEATURES :

Methodology and Resources
Active Directory Attack.md
Cloud - AWS Pentest.md
Cloud - Azure Pentest.md
Cobalt Strike - Cheatsheet.md
Linux - Persistence.md
Linux - Privilege Escalation.md
Metasploit - Cheatsheet.md
Methodology and enumeration.md
Network Pivoting Techniques.md
Network Discovery.md
Reverse Shell Cheatsheet.md
Subdomains Enumeration.md
Windows - Download and Execute.md
Windows - Mimikatz.md
Windows - Persistence.md
Windows - Post Exploitation Koadic.md
Windows - Privilege Escalation.md
Windows - Using credentials.md
CVE Exploits

πŸ¦‘ DOWNLOAD :
https://github.com/swisskyrepo/PayloadsAllTheThings


▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
This media is not supported in your browser
VIEW IN TELEGRAM
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘FRESH PREMIUM PROXIES :
instagram.com/undercodetesting

103.209.65.12 6666 1 hour ago
3752 ms 8% (68) in India - Valsad Elite -
113.254.104.207 80 1 hour ago
851 ms 2% (73) hk Hong Kong - Central Elite -
115.223.2.114 80 1 hour ago
1268 ms 50% (48) cn China - Wuhan Elite -
186.229.25.18 8080 1 hour ago
3966 ms 30% (75) br Brazil - Rio de Janeiro Elite -
190.210.8.93 8080 1 hour ago
3592 ms 7% (66) ar Argentina - Buenos Aires Elite -
191.241.34.222 8089 1 hour ago
3945 ms 25% (33) br Brazil - Caucaia Elite -
203.218.82.122 8080 1 hour ago
766 ms 44% (50) hk Hong Kong - Central Elite -
223.68.190.130 8181 1 hour ago
2639 ms 39% (60) cn China - Yangzhou Elite -
43.224.8.14 6666 1 hour ago
3591 ms 8% (75) in India - Vadodara Elite -
47.89.193.30 8118 1 hour ago
147 ms 2% (70) us United States - San Mateo Elite -
149.28.180.233 8081 1 hour ago
1607 ms 79% (19) us United States Elite -
167.99.166.194 8081 1 hour ago
1356 ms 6% (91) us United States - Santa Clara Elite -


170.254.150.166 80 1 hour ago
2523 ms 59% (46) br Brazil Elite -
167.71.198.204 8080 1 hour ago
1810 ms 84% (50) us United States Elite -
181.118.167.104 80 1 hour ago
721 ms 98% (43) cl Chile - Santiago Elite -
182.23.81.82 3128 1 hour ago
3245 ms 19% (72) id Indonesia - Jakarta Elite -
185.10.166.130 8080 1 hour ago
4166 ms 20% (66) gb United Kingdom - London Elite -
103.141.180.130 8080 1 hour ago
3554 ms 16% (66) id Indonesia Elite -
103.216.82.199 6666 1 hour ago
3984 ms 9% (83) in India - Ahmedabad Elite -
118.25.35.202 9999 1 hour ago
2175 ms 34% (60) cn China Elite -
122.233.234.32 8118 1 hour ago
2756 ms 36% (50) cn China Elite -
123.252.173.162 80 1 hour ago
4373 ms 20% (68) in India Elite -
134.249.141.148 80 1 hour ago
3517 ms 21% (74) ua Ukraine - Lviv Elite -
140.227.238.18 1000 1 hour ago
2500 ms 20% (66) jp Japan Elite -
35.222.208.56 3128 1 hour ago
762 ms 80% (50) us United States Elite -
36.55.230.146 8888 1 hour ago
2511 ms 20% (80) jp Japan - Kanazawa Elite -
31.131.67.14 8080 1 hour ago
3489 ms 15% (68) ru Russia - Moscow Elite -
52.161.188.148 80 1 hour ago
332 ms 100% (16) us United States Elite -
52.163.87.222 8080 1 hour ago
1253 ms 88% (16) sg Singapore Elite -
78.46.40.154 8118 1 hour ago
1190 ms 16% (75) de Germany - Nuremberg Elite -
79.137.123.252 3131 1 hour ago
774 ms 8% (76) fr France Elite -
79.137.44.85 3129 1 hour ago
2379 ms 65% (67) es Spain - Madrid Elite -
82.119.170.106 8080 1 hour ago
882 ms 85% (53) de Germany - Berlin Elite -
85.90.215.111 3128 1 hour ago
3012 ms 27% (65) ua Ukraine - Kharkiv Elite -
84.42.247.101 3128 1 hour ago
3790 ms 25% (68) cz Czech Republic - Prague Elite -

@uNDERCODEtESTING
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
This media is not supported in your browser
VIEW IN TELEGRAM
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘updated Weaponized web shell
pinterest.com/Undercode_Testing

πŸ¦‘FEATURES :

Shell access to the target
SQL console pivoting on the target
HTTP/HTTPS proxy to browse through the target
Upload and download files
Spawn reverse and direct TCP shells
Audit remote target security
Port scan pivoting on target
Mount the remote filesystem
Bruteforce SQL accounts pivoting on the target

πŸ¦‘π•€β„•π•Šπ•‹π”Έπ•ƒπ•ƒπ•€π•Šπ”Έπ•‹π•€π•†β„• & β„π•Œβ„• :

1) git clone https://github.com/epinna/weevely3.git

2) cd weevely3

3) Make sure that the python package manager and yaml libraries are installed

4) $ sudo apt-get install -y python3 python3-pip curl

5) $ cd weevely3/

6) $ sudo pip3 install -r requirements.txt --upgrade

πŸ¦‘ OS X

OS X
OS X requires Python3 to be installed in the system. Follow the following commands to install manually gnureadline Python package.

$ sudo pip3 install gnureadline
$ cd weevely3/
$ sudo pip3 install -r requirements.txt --upgrade

@uNDERCODEtESTING
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
This media is not supported in your browser
VIEW IN TELEGRAM
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘2020 EXPLOIT VERIFIED BY UNDERCODERS :

# Exploit Title: webERP 4.15.1 - Unauthenticated Backup File Access
# Date: 2020-05-01
# Author: Besim ALTINOK
# Software Link: https://sourceforge.net/projects/web-erp/
# Version: v4.15.1
# Tested on: Xampp
# Credit: Δ°smail BOZKURT

--------------------------------------------------------------------------
About Software:

webERP is a complete web-based accounting and business management system
that requires only a web-browser and pdf reader to use. It has a wide range
of features suitable for many businesses particularly distributed
businesses in wholesale, distribution, and manufacturing.

-------------------------------------------------------
PoC Unauthenticated Backup File Access
---------------------------------------------

1- This file generates new Backup File:
http://localhost/webERP/BackUpDatabase.php
2- Someone can download the backup file from:
--
http://localhost/webERP/companies/weberp/Backup_2020-05-01-16-55-35.sql.gz


@UndercodeTesting
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
This media is not supported in your browser
VIEW IN TELEGRAM
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Real-world examples of process injections in action
DoublePulsar tut :
t.me/UndercodeTesting

πŸ¦‘π•ƒπ”Όπ•‹'π•Š π•Šπ•‹π”Έβ„π•‹ :


> An analysis of the kernel mode payload of the famous DoublePulsar code by F-Secure revealed that it utilizes a form of DLL injection to load a DLL into a target process (in this case, lsass.exe) using an Asynchronous Procedure Call (APC). It did not utilize the standard Windows API commands such as LoadLibrary and did not write the DLL to disk, making it stealthier.

1) Cobalt Strike
Cobalt Strike is a penetration testing software that was designed to execute targeted attacks and emulate post-exploitations actions of advanced threat actors through a listener called a beacon.

2) Cobalt Strike commands such as keylogger, screenshot and so on were designed to be injected into another process for it to work. The listener is injected into a specific process (a personal favorite is explorer.exe because the process is always running in a GUI environment) and the keystroke logger will monitor all keystrokes via the infected process. It then reports them to the beacon console without writing to disk. This only stops when the process terminates or the keystroke logger job is terminated by the user.

3) Lazarus Group
The Lazarus Group (also known as β€œHidden Cobra”) is a threat group headquartered in North Korea whose malicious activities span across multiple years, as far back as 2009. Since 2016, the group has been conducting β€œFASTCash” attacks β€” stealing money from ATMs from target banks in Africa and Asia. The target bank’s network is compromised and a malware known as Trojan.Fashcash is deployed on the network.

> An analysis of the malware reveals that malicious Advanced Interactive eXecutive (β€œAIX”) executable files are injected into legitimate processes on the payment application servers used in handling ATM transactions. The executable allows the group to monitor, intercept and generate responses to fraudulent transaction requests using fake ISO 8583 (standard used for financial transaction messaging) messages. This allows attempts to withdraw cash via an ATM to be successful.

5) APT41
APT41 is a threat group headquartered in China and known for carrying out Chinese state-sponsored espionage campaigns dating as far back as 2012.

> The group is known for its software supply chain attacks, where TTPs developed from accessing video game production environments are utilized. These TTPs are used to compromise software companies and malicious codes are injected into software updates distributed to victim organizations.

4) WINTERLOVE is a backdoor used by the group to load and execute remote code in a running process (e.g., iexplorer.exe) and can be used to enumerate system files and directories.

5) Mitigation/prevention
DLL injection is not necessarily a bad technique as many applications use it for legitimate purposes such as your Antivirus/Endpoint Detection and Response (β€œEDR”)7 solutions which inject their own codes/agents into running processes in order to monitor the process and detect abnormal activities. Therefore, making it hard to detect especially since it runs under a legitimate process.

6) Behavior analysis
This method can be achieved by configuring your EDRs to detect cross-process events such as injection of code into a running process, duplicate processes running, remote threads and so on.

7) EDRs work by gathering, monitoring and analyzing endpoint activities/events. This gives the security team the necessary visibility to carry out further analysis, detection, investigation and mitigation into advanced cyber threats across all endpoints running an EDR.

As part of their response capabilities, EDRs can be configured to block certain types of process injection, depending on the behavior that occurs during the injection process.

@UndercodeTesting
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ¦‘ PAID PDF COLLECTIONS