Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
AhRat Malware Strikes Again with Trojanized Screen Recording App
AhRat Malware Strikes Again with Trojanized Screen Recording AppPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
ESET malware researchers have made a disturbing discovery—a new remote access trojan (RAT) lurking within an Android screen recording app available on the Google Play Store. Initially added to the store in September 2021, the app named ‘iRecorder – Screen Recorder’ fell victim to a malicious update released nearly a year later in August 2022.
https://www.bleepstatic.com/images/news/u/1109292/2023/iRecorder_Google_Play.jpg iRecorder entry in Google Play (ESET)
Cleverly leveraging its name, the app successfully requested permissions to record audio and access files on infected devices, cleverly aligning with the expected functionalities of a legitimate screen recording tool. Unfortunately, this led to over 50,000 installations of the app on the Google Play Store, leaving users vulnerable to malware infections.
Following ESET’s notification about the app’s malicious behavior, the Google Play security team promptly removed it from the store. However, it is crucial to note that the iRecorder app may still be found on alternative and unofficial Android markets. Additionally, it’s worth mentioning that while the iRecorder developer offers other applications on Google Play, those do not contain any malicious code.
The malware in question, known as AhRat, is an Android RAT based on the open-source AhMyth RAT. AhRat exhibits a broad range of capabilities, including location tracking of infected devices, stealing call logs, contacts, and text messages, sending SMS messages, capturing images, and recording background audio.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses
Upon closer examination, ESET researchers found that the malicious screen recording app utilized only a subset of AhRat’s capabilities. Its primary purpose was to create and extract ambient sound recordings, along with stealing files with specific extensions—indicative of potential espionage activities.
This isn’t the first instance of AhMyth-based Android malware infiltrating the Google Play store. In 2019, ESET exposed another AhMyth-trojanized app that managed to deceive Google’s app-vetting process twice by posing as a radio streaming app.
Trending: Maximizing IDOR Detection with Burp Suite’s Autorize Trending: Recon Tool: Dome While the AhMyth RAT has been previously associated with Transparent Tribe (also known as APT36)—a cyberespionage group employing sophisticated social engineering techniques to target government and military organizations in South Asia—there is currently no evidence linking the present samples to any specific group or known advanced persistent threat (APT) actor.
Trending: Hackers Exploit Critical WordPress Plugin Vulnerability Within Hours of Public PoC Release Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-12-1-300x150.png BlackCat Ransomware Evades Security Software with Signed Malicious Windows Kernel DriversMay 23, 2023
* https://www.blackhatethicalh[...]
AhRat Malware Strikes Again with Trojanized Screen Recording App
AhRat Malware Strikes Again with Trojanized Screen Recording AppPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes
ESET malware researchers have made a disturbing discovery—a new remote access trojan (RAT) lurking within an Android screen recording app available on the Google Play Store. Initially added to the store in September 2021, the app named ‘iRecorder – Screen Recorder’ fell victim to a malicious update released nearly a year later in August 2022.
https://www.bleepstatic.com/images/news/u/1109292/2023/iRecorder_Google_Play.jpg iRecorder entry in Google Play (ESET)
Cleverly leveraging its name, the app successfully requested permissions to record audio and access files on infected devices, cleverly aligning with the expected functionalities of a legitimate screen recording tool. Unfortunately, this led to over 50,000 installations of the app on the Google Play Store, leaving users vulnerable to malware infections.
Following ESET’s notification about the app’s malicious behavior, the Google Play security team promptly removed it from the store. However, it is crucial to note that the iRecorder app may still be found on alternative and unofficial Android markets. Additionally, it’s worth mentioning that while the iRecorder developer offers other applications on Google Play, those do not contain any malicious code.
The malware in question, known as AhRat, is an Android RAT based on the open-source AhMyth RAT. AhRat exhibits a broad range of capabilities, including location tracking of infected devices, stealing call logs, contacts, and text messages, sending SMS messages, capturing images, and recording background audio.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses
Upon closer examination, ESET researchers found that the malicious screen recording app utilized only a subset of AhRat’s capabilities. Its primary purpose was to create and extract ambient sound recordings, along with stealing files with specific extensions—indicative of potential espionage activities.
This isn’t the first instance of AhMyth-based Android malware infiltrating the Google Play store. In 2019, ESET exposed another AhMyth-trojanized app that managed to deceive Google’s app-vetting process twice by posing as a radio streaming app.
Trending: Maximizing IDOR Detection with Burp Suite’s Autorize Trending: Recon Tool: Dome While the AhMyth RAT has been previously associated with Transparent Tribe (also known as APT36)—a cyberespionage group employing sophisticated social engineering techniques to target government and military organizations in South Asia—there is currently no evidence linking the present samples to any specific group or known advanced persistent threat (APT) actor.
Trending: Hackers Exploit Critical WordPress Plugin Vulnerability Within Hours of Public PoC Release Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-12-1-300x150.png BlackCat Ransomware Evades Security Software with Signed Malicious Windows Kernel DriversMay 23, 2023
* https://www.blackhatethicalh[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking AhRat Malware Strikes Again with Trojanized Screen Recording App AhRat Malware Strikes Again with Trojanized Screen Recording AppPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png…
acking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-11-1-300x150.png BrutePrint Attack: Researchers Unveil New Technique to Bypass Smartphone Fingerprint AuthenticationMay 22, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-10-1-300x150.png WordPress Websites at Risk – Hackers Exploit Critical Flaw in Essential Addons for ElementorMay 19, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-9-1-300x150.png The Alarming Rise of Malicious Extensions in Microsoft’s VSCode MarketplaceMay 18, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post AhRat Malware Strikes Again with Trojanized Screen Recording App first appeared on Black Hat Ethical Hacking.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-10-1-300x150.png WordPress Websites at Risk – Hackers Exploit Critical Flaw in Essential Addons for ElementorMay 19, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/05/Images-for-the-News-posts-9-1-300x150.png The Alarming Rise of Malicious Extensions in Microsoft’s VSCode MarketplaceMay 18, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post AhRat Malware Strikes Again with Trojanized Screen Recording App first appeared on Black Hat Ethical Hacking.
Kali Linux Tutorials
How to Use Ettercap to Intercept and Sniff Passwords
For man-in-the-middle attacks, Ettercap is a complete suite. It includes live connection sniffing, real-time content filtering, and other intriguing techniques.
It has many network and host analysis features and supports active and passive protocol dissection.
For the attack, we need two machines. The first one is Kali Linux, the other one is Windows, and the Wireshark tool.
In this attack, we’ll see the traffic moving through a Windows computer and a user entering a username and password on a non-secure website.
* Firstly, check the IP address of the attacker’s machine using the command ifconfig in the terminal and the IP address of the victim’s machine using the command ipconfig in the command prompt.
* In my case, the IP address of my Windows (victim’s) machine is 192.168.148.29.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-1-1024x469.png
* Now we will open Ettercap on the attacker’s machine and set the primary interface to eth0.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-2.png
* After clicking the checkbox, unified sniffing starts on its own, and by selecting the opting host list on the top of the interface, we can see all the hosts connected with us. We can also see the IP address of the victim’s machine. i.e, 192.168.148.29.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-5-1024x504.png
* We have to set the IP address of the victim machine as Target 1 and the IP address of the server machine as Target 2.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-7-1024x493.png
* Using the option Targets, then Current Target, we can see both Targets.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-1024x424.png
* Now on the terminal in the attacker’s machine, we type the command cat /proc/sys/net/ipv4/ip_forward. If it shows 0 as a result, then we have to change it with a 1 using the echo command because, On a Linux system, IP forwarding is enabled when the file /proc/sys/net/ipv4/ip_forward contains a 1 and disabled when it contains a 0.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-4-1024x705.png
* Now we will open Wireshark on the attacker’s machine with the capture interface eth0
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-3.png
* Now in the ettercap, we have to select the MITM menu after that, Arp Poisoning, and choose the option of Sniff remote connections.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-6-1024x411.png
* After enabling Sniff Remote Connections, we can see the arp requests in the wireshark.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-11-1024x440.png
* We log in on the victim’s machine using the username and password. I am using a testing site, i.e, vulnweb.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-9-1024x415.png
* Here we will enter the username and password; I entered “ethical empire” as a username and “youtube channel” as a password.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-10-1024x413.png
* Now on the attacker’s machine in ettercap, we can see the username and password we entered on that testing website on the victim’s machine.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/Screenshot-2023-05-11-115744-1024x496.png
* As I pressed the login button twice on the victim’s machine login page, it showed two responses here.
Please consider following and supporting us to stay updated with the latest info
How to Use Ettercap to Intercept and Sniff Passwords
For man-in-the-middle attacks, Ettercap is a complete suite. It includes live connection sniffing, real-time content filtering, and other intriguing techniques.
It has many network and host analysis features and supports active and passive protocol dissection.
For the attack, we need two machines. The first one is Kali Linux, the other one is Windows, and the Wireshark tool.
In this attack, we’ll see the traffic moving through a Windows computer and a user entering a username and password on a non-secure website.
* Firstly, check the IP address of the attacker’s machine using the command ifconfig in the terminal and the IP address of the victim’s machine using the command ipconfig in the command prompt.
* In my case, the IP address of my Windows (victim’s) machine is 192.168.148.29.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-1-1024x469.png
* Now we will open Ettercap on the attacker’s machine and set the primary interface to eth0.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-2.png
* After clicking the checkbox, unified sniffing starts on its own, and by selecting the opting host list on the top of the interface, we can see all the hosts connected with us. We can also see the IP address of the victim’s machine. i.e, 192.168.148.29.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-5-1024x504.png
* We have to set the IP address of the victim machine as Target 1 and the IP address of the server machine as Target 2.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-7-1024x493.png
* Using the option Targets, then Current Target, we can see both Targets.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-1024x424.png
* Now on the terminal in the attacker’s machine, we type the command cat /proc/sys/net/ipv4/ip_forward. If it shows 0 as a result, then we have to change it with a 1 using the echo command because, On a Linux system, IP forwarding is enabled when the file /proc/sys/net/ipv4/ip_forward contains a 1 and disabled when it contains a 0.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-4-1024x705.png
* Now we will open Wireshark on the attacker’s machine with the capture interface eth0
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-3.png
* Now in the ettercap, we have to select the MITM menu after that, Arp Poisoning, and choose the option of Sniff remote connections.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-6-1024x411.png
* After enabling Sniff Remote Connections, we can see the arp requests in the wireshark.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-11-1024x440.png
* We log in on the victim’s machine using the username and password. I am using a testing site, i.e, vulnweb.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-9-1024x415.png
* Here we will enter the username and password; I entered “ethical empire” as a username and “youtube channel” as a password.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/image-10-1024x413.png
* Now on the attacker’s machine in ettercap, we can see the username and password we entered on that testing website on the victim’s machine.
https://kalilinuxtutorials.com/wp-content/uploads/2023/05/Screenshot-2023-05-11-115744-1024x496.png
* As I pressed the login button twice on the victim’s machine login page, it showed two responses here.
Please consider following and supporting us to stay updated with the latest info
Kali Linux Tutorials
How to Use Ettercap to Intercept and Sniff Passwords
For man-in-the-middle attacks, Ettercap is a complete suite. It includes live connection sniffing, real-time content filtering, and other intriguing techniques.
The opening token distribution of FLOKI
https://www.reddit.com/r/Pentesting/comments/13qir3l/the_opening_token_distribution_of_floki/
<!-- SC_OFF -->https://linktr.ee/flokieth <!-- SC_ON --> submitted by /u/Kenfoxx (https://www.reddit.com/user/Kenfoxx)
[link] (https://www.reddit.com/r/Pentesting/comments/13qir3l/the_opening_token_distribution_of_floki/) [comments] (https://www.reddit.com/r/Pentesting/comments/13qir3l/the_opening_token_distribution_of_floki/)
https://www.reddit.com/r/Pentesting/comments/13qir3l/the_opening_token_distribution_of_floki/
<!-- SC_OFF -->https://linktr.ee/flokieth <!-- SC_ON --> submitted by /u/Kenfoxx (https://www.reddit.com/user/Kenfoxx)
[link] (https://www.reddit.com/r/Pentesting/comments/13qir3l/the_opening_token_distribution_of_floki/) [comments] (https://www.reddit.com/r/Pentesting/comments/13qir3l/the_opening_token_distribution_of_floki/)
Hacking on Medium
How may your file uploads get hacked?
https://cdn-images-1.medium.com/max/962/0*pNs55tIWxtHS0bOO.png
Shared from Danubius IT Solutions’ tech blog.
Continue reading on Medium »
How may your file uploads get hacked?
https://cdn-images-1.medium.com/max/962/0*pNs55tIWxtHS0bOO.png
Shared from Danubius IT Solutions’ tech blog.
Continue reading on Medium »
Medium
How may your file uploads get hacked?
Shared from Danubius IT Solutions’ tech blog.
Hacking on Medium
CVE-2023-2859: Stored HTML injection in folderName affecting Admin in TeamPass < 3.0.9
https://cdn-images-1.medium.com/max/1082/1*QFP10FO635S92Fk6XYmz1Q.png
Hi,
Continue reading on Medium »
CVE-2023-2859: Stored HTML injection in folderName affecting Admin in TeamPass < 3.0.9
https://cdn-images-1.medium.com/max/1082/1*QFP10FO635S92Fk6XYmz1Q.png
Hi,
Continue reading on Medium »
Medium
CVE-2023-2859: Stored HTML injection in folderName affecting Admin in TeamPass < 3.0.9
Hi,
Hacking on Medium
Programming: Unleashing the Power of Digital Creation
Introduction:
In today’s interconnected world, programming has become a fundamental skill that empowers individuals to shape the digital…
Continue reading on Medium »
Programming: Unleashing the Power of Digital Creation
Introduction:
In today’s interconnected world, programming has become a fundamental skill that empowers individuals to shape the digital…
Continue reading on Medium »
Medium
Programming: Unleashing the Power of Digital Creation
Introduction: In today’s interconnected world, programming has become a fundamental skill that empowers individuals to shape the digital…
Hacking on Medium
[HTB] Armageddon靶機 Write-Up
https://cdn-images-1.medium.com/max/770/1*3pYZ0pxeXDgDaMSKvUCYgA.png
Hack The Box Armageddon machine Write-Up
Continue reading on Medium »
[HTB] Armageddon靶機 Write-Up
https://cdn-images-1.medium.com/max/770/1*3pYZ0pxeXDgDaMSKvUCYgA.png
Hack The Box Armageddon machine Write-Up
Continue reading on Medium »
Medium
[HTB] Armageddon靶機 Write-Up
Hack The Box Armageddon machine Write-Up
Jsfinder - Fetches JavaScript Files Quickly And Comprehensively
https://www.kitploit.com/2023/05/jsfinder-fetches-javascript-files.html
https://www.kitploit.com/2023/05/jsfinder-fetches-javascript-files.html
jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file (e.g., src, href, data-main, etc.) and extracts the URLs of the files to a text file. The tool is designed to be simple to use, and it supports reading URLs from a file or from standard input. jsFinder is useful for web developers and security professionals who want to find and analyze the JavaScript files used by a web application. By analyzing the JavaScript files, it's possible to understand the functionality of the application and detect any security vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) or sensitive information (https://www.kitploit.com/search/label/Sensitive%20Information) leakage.
Features Reading URLs from a file or from stdin using command line (https://www.kitploit.com/search/label/Command%20Line) arguments. Running multiple HTTP GET requests concurrently to each URL. Limiting the concurrency of HTTP GET requests using a flag. Using a regular expression to search for JavaScript files in the response body of the HTTP GET requests. Writing the found JavaScript files to a file specified in the command line arguments or to a default file named "output.txt". Printing informative messages to the console indicating the status of the program's execution and the output file's location. Allowing the program to run in verbose or silent mode using a flag. Installation jsfinder requires Go 1.20 to install successfully.Run the following command to get the repo : go install -v github.com/kacakb/jsfinder@latest Usage To see which flags you can use with the tool, use the -h flag. jsfinder -h Flag Description -l Specifies the filename to read URLs from. -c Specifies the maximum number of concurrent requests to be made. The default value is 20. -s Runs the program in silent mode. If this flag is not set, the program runs in verbose mode. -o Specifies the filename to write found URLs to. The default filename is output.txt. -read Reads URLs from stdin instead of a file specified by the -l flag. Demo I
Features Reading URLs from a file or from stdin using command line (https://www.kitploit.com/search/label/Command%20Line) arguments. Running multiple HTTP GET requests concurrently to each URL. Limiting the concurrency of HTTP GET requests using a flag. Using a regular expression to search for JavaScript files in the response body of the HTTP GET requests. Writing the found JavaScript files to a file specified in the command line arguments or to a default file named "output.txt". Printing informative messages to the console indicating the status of the program's execution and the output file's location. Allowing the program to run in verbose or silent mode using a flag. Installation jsfinder requires Go 1.20 to install successfully.Run the following command to get the repo : go install -v github.com/kacakb/jsfinder@latest Usage To see which flags you can use with the tool, use the -h flag. jsfinder -h Flag Description -l Specifies the filename to read URLs from. -c Specifies the maximum number of concurrent requests to be made. The default value is 20. -s Runs the program in silent mode. If this flag is not set, the program runs in verbose mode. -o Specifies the filename to write found URLs to. The default filename is output.txt. -read Reads URLs from stdin instead of a file specified by the -l flag. Demo I
If you want to read from stdin and run the program in silent mode, use this command: cat list.txt| jsfinder -read -s -o js.txt II
If you want to read from a file, you should specify it with the -l flag and use this command: jsfinder -l list.txt -s -o js.txt You can also specify the concurrency with the -c flag.The default value is 20. If you want to read from a file, you should specify it with the -l flag and use this command: jsfinder -l list.txt -c 50 -s -o js.txt TODOs Adding new features Improving performance Adding a cookie (https://www.kitploit.com/search/label/Cookie) flag Reading regex from a file Integrating the kacak (https://github.com/kacakb/kacak) tool (coming soon) Screenshot
Contact If you have any questions, feedback or collaboration (https://www.kitploit.com/search/label/Collaboration) suggestions related to this project, please feel free to contact me via:e-mail (mailto:kacakbatuhan@protonmail.com)
Download Jsfinder (https://github.com/kacakb/jsfinder)
Download Jsfinder (https://github.com/kacakb/jsfinder)