Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Windows MSHTML zero-day exploits shared on hacking forums
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101
Reading Time: 2 Minutes
Threat actors are sharing Windows MSHTML zero-day (CVE-2021-40444) tutorials and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.
Last Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim’s computer remotely.
Even though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.
These mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.
However, researchers have been able to modify the exploit not to use ActiveX, effectively bypassing Microsoft’s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.
While they soon reproduced the exploits, modified them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.
Unfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.
Starting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.
https://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg
Defending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.
For example, you can see below Microsoft Defender blocking the exploit as ‘Trojan:Win32/CplLoader.a’ and ‘TrojanDownloader:HTML/Donoff.SA’ detections.
https://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg
___________________________
@hacking_Attack
@Hacking_Video
Windows MSHTML zero-day exploits shared on hacking forums
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101
Reading Time: 2 Minutes
Threat actors are sharing Windows MSHTML zero-day (CVE-2021-40444) tutorials and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.
Last Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim’s computer remotely.
Even though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.
These mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.
However, researchers have been able to modify the exploit not to use ActiveX, effectively bypassing Microsoft’s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.
While they soon reproduced the exploits, modified them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.
Unfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.
Starting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.
https://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg
Defending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.
For example, you can see below Microsoft Defender blocking the exploit as ‘Trojan:Win32/CplLoader.a’ and ‘TrojanDownloader:HTML/Donoff.SA’ detections.
https://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Windows MSHTML zero-day exploits shared on hacking forums https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101 Reading…
e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these steps:
1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled to properly create the Registry file.
Alternatively, you can download the registry file from here.
3. Reboot your computer to apply the new configuration.
Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.
You can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.
See Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.
CVE-2021-40444 is so bad🤦♂️ pic.twitter.com/3Gu9ahwmHd
— jq0904 (@jq0904) September 10, 2021
Since this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:
1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key:
For Word documents, navigate to these keys:
* HKEY_CLASSES_ROOT.docx\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
* HKEY_CLASSES_ROOT.doc\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
* HKEY_CLASSES_ROOT.docm\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
For rich text files (RTF), navigate to this key:
* HKEY_CLASSES_ROOT.rtf\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
2. Export a copy of the Registry key as a backup.
3. Now double-click Name and in the Edit String dialog box, delete the Value Data.
4. Click OK, See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ HackerWord document and RTF file previews are now disabled in Windows Explorer.
To enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.
While these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.
Until Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project’s Confluence server hacked to mine Monero5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]
___________________________
@hacking_Attack
@Hacking_Video
1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled to properly create the Registry file.
Alternatively, you can download the registry file from here.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"1001"=dword:00000003
"1004"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1001"=dword:00000003
"1004"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a UAC prompt is displayed, click on the Yes button to import the Registry entries.3. Reboot your computer to apply the new configuration.
Once you reboot your computer, ActiveX controls will be disabled in Internet Explorer.
You can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.
See Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.
CVE-2021-40444 is so bad🤦♂️ pic.twitter.com/3Gu9ahwmHd
— jq0904 (@jq0904) September 10, 2021
Since this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:
1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key:
For Word documents, navigate to these keys:
* HKEY_CLASSES_ROOT.docx\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
* HKEY_CLASSES_ROOT.doc\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
* HKEY_CLASSES_ROOT.docm\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
For rich text files (RTF), navigate to this key:
* HKEY_CLASSES_ROOT.rtf\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}
2. Export a copy of the Registry key as a backup.
3. Now double-click Name and in the Edit String dialog box, delete the Value Data.
4. Click OK, See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ HackerWord document and RTF file previews are now disabled in Windows Explorer.
To enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.
While these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.
Until Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project’s Confluence server hacked to mine Monero5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]
___________________________
@hacking_Attack
@Hacking_Video
Twitter
jq0904
CVE-2021-40444 is so bad🤦♂️
Hacking Articles Tips Tricks Videos Tutorials
e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these…
630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange ‘ProxyToken’ Bug Allows Email Snooping2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/F5-Big-IP-e1619725870974-90x90.jpg F5 Bug Could Lead to Complete System Takeover2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Windows MSHTML zero-day exploits shared on hacking forums first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_plugin_vuln-90x90.jpg Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ransomware-cpu-90x90.jpg LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Windows-Abstract-90x90.jpg Microsoft Exchange ‘ProxyToken’ Bug Allows Email Snooping2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/F5-Big-IP-e1619725870974-90x90.jpg F5 Bug Could Lead to Complete System Takeover2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Windows MSHTML zero-day exploits shared on hacking forums first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
I was forced to download AnyDesk at work.
Hi guys, I was forced to download AnyDesk for my new workplace since they wanted to help me set up. I’ve watched the whole process from start to finish and so far they’ve only downloaded the new version of MS office (mine was really old), LastPass, Outlook, Clickup and setting up my work email basically. They would require me to leave AnyDesk on and they mentioned that they would be tracking my work email, etc. They also mentioned that they won’t be able to track my browsing activities (for personal use) when I disconnect them from my AnyDesk. I just wanted to know if anyone has a similar experience with AnyDesk and is it safe?
PS. Is this procedure/behaviour normal in companies or should I be seriously concerned?
submitted by /u/bunny_doge
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
I was forced to download AnyDesk at work.
Hi guys, I was forced to download AnyDesk for my new workplace since they wanted to help me set up. I’ve watched the whole process from start to finish and so far they’ve only downloaded the new version of MS office (mine was really old), LastPass, Outlook, Clickup and setting up my work email basically. They would require me to leave AnyDesk on and they mentioned that they would be tracking my work email, etc. They also mentioned that they won’t be able to track my browsing activities (for personal use) when I disconnect them from my AnyDesk. I just wanted to know if anyone has a similar experience with AnyDesk and is it safe?
PS. Is this procedure/behaviour normal in companies or should I be seriously concerned?
submitted by /u/bunny_doge
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
I was forced to download AnyDesk at work.
Hi guys, I was forced to download AnyDesk for my new workplace since they wanted to help me set up. I’ve watched the whole process from start to...
hacking: security in practice
Is there any way to crack a WiFi password through Windows without monitor mode/packet injection? I tried a program called routerscan but when I try and run the attack it loops “associating with ap.... association failed”.
Do I need a monitor mode/packet injection network adapter to use it or does it just not work?
submitted by /u/Chesquikk
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Is there any way to crack a WiFi password through Windows without monitor mode/packet injection? I tried a program called routerscan but when I try and run the attack it loops “associating with ap.... association failed”.
Do I need a monitor mode/packet injection network adapter to use it or does it just not work?
submitted by /u/Chesquikk
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Is there any way to crack a WiFi password through Windows without...
Do I need a monitor mode/packet injection network adapter to use it or does it just not work?
Reflected XSS on Byjus(My first bug)
Around a year back, schools had started to implement an online mode of learning.Continue reading on Medium »
Read more...
Around a year back, schools had started to implement an online mode of learning.Continue reading on Medium »
Read more...
Reflected XSS on Byjus(My first bug)
https://medium.com/@krishinbusiness/reflected-xss-on-byjus-my-first-bug-a5bbab098748?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@krishinbusiness/reflected-xss-on-byjus-my-first-bug-a5bbab098748?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Reflected XSS on Byjus(My first bug)
Around a year back, schools had started to implement an online mode of learning. I had to complete my chemistry assignment and was too lazy…
Around a year back, schools had started to implement an online mode of learning.Continue reading on Medium » (https://medium.com/@krishinbusiness/reflected-xss-on-byjus-my-first-bug-a5bbab098748?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Reflected XSS on Byjus(My first bug)
Around a year back, schools had started to implement an online mode of learning. I had to complete my chemistry assignment and was too lazy…
Why Blackhats Are Becoming Whitehats
https://medium.com/immunefi/why-blackhats-are-becoming-whitehats-3f3233ea6538?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/immunefi/why-blackhats-are-becoming-whitehats-3f3233ea6538?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Why Blackhats Are Becoming Whitehats
More and more blackhats in DeFi hacking are turning whitehat, and the reason why is simple: whitehats become heroes for responsibly…