Black Hat Ethical Hacking
REvil ransomware shuts down again after Tor sites were hijacked

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png REvil ransomware shuts down again after Tor sites were hijackedPost Views: 120
Reading Time: 1 Minute
The REvil ransomware operation has likely shut down once again after an unknown person hijacked their Tor payment portal and data leak blog.
The Tor sites went offline earlier today, with a threat actor affiliated with the REvil operation posting to the XSS hacking forum that someone hijacked the gang’s domains.

The thread was first discovered by Recorded Future’s Dmitry Smilyanets, and states that an unknown person hijacked the Tor hidden services (onion domains) with the same private keys as REvil’s Tor sites and likely has backups of the sites.

“But since we have today at 17.10 from 12:00 Moscow time, someone brought up the hidden-services of a landing and a blog with the same keys as ours, my fears were confirmed. The third party has backups with onion service keys,” a threat actor known as ‘0_neday’ posted to the hacking forum.

The threat actor went on to say that they found no signs of compromise to their servers but will be shutting down the operation.
See Also: Complete Offensive Security and Ethical Hacking Course
The threat actor then told affiliates to contact him for campaign decryption keys via Tox, likely so affiliates could continue extorting their victims and provide a decryptor if a ransom is paid.
https://www.bleepstatic.com/images/news/ransomware/r/revil/tor-servers-hijack/forum-post-1.jpg
REvil likely shut down for goodAfter REvil conducted a massive attack on companies through a zero-day vulnerability in the Kaseya MSP platform, the REvil operation suddenly shut down, and their public-facing representative, Unknown, disappeared.

After Unknown did not return, the rest of the REvil operators launched the operation and websites again in September using backups.

Since then, the ransomware operation has been struggling to recruit users, going as far as to increase affiliate’s commissions to 90% to entice other threat actors to work with them.

With this latest mishap, the operation in its current forum will likely be gone for good.

However, no good thing lasts forever when it comes to ransomware, and we will like[...]

___________________________
@hacking_Attack
@Hacking_Video

ly see them rebrand as a new operation shortly.
See Also: Offensive Security Tool: Dalfox However, some IP and domain evidence attributes this extension to the Pbot campaign, which has been active since at least 2018.

This case is yet another reminder of the importance of choosing your browser extensions wisely and installing only the necessary ones.

In this case, AllBlock has excellent user reviews because its functionality as an adblocker has been properly implemented. Nonetheless, it introduces deception risks and confuses shoppers.
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/abstract_mysterysnail-90x90.jpg Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/apple-iphone-hacking-90x90.jpg Emergency Apple iOS 15.0.2 update fixes zero-day used in attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Linux-1280x720-1-90x90.jpg FontOnLake malware infects Linux systems1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/excel-header-90x90.jpg Microsoft is disabling Excel 4.0 macros by default to protect users1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-1-90x90.jpg Twitch source code and creator payouts part of massive leak2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Apache-web-server-90x90.png Apache fixes actively exploited zero-day vulnerability, patch now2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/security-breach-freepik-90x90.jpg Encrypted & Fileless Malware Sees Big Growth2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Digital-Wallet-90x90.jpg MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed2 weeks ago
The post REvil ransomware shuts down again after Tor sites were hijacked first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Support Board 3.3.4 Arbitrary File Deletion to Remote Code Execution
https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi. In this writeup, i will show you a bug that i found. Allowing an Authenticated user to delete any file in the system in the Support…Continue reading on Medium » (https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Support Board 3.3.4 Arbitrary File Deletion to Remote Code Execution

Hi. In this writeup, i will show you a bug that i found. Allowing an Authenticated user to delete any file in the system in the Support…Continue reading on Medium »
Read more...

hacking: security in practice
Guide | Securely Wipe Disks and Delete Files

https://external-preview.redd.it/37yA2D28Hk9xNQEzioU9CSRiyE4ZOo8SqHcd3t0IP-Y.jpg?width=640&crop=smart&auto=webp&s=dbce974366d15b1ff9370e5c8b1233a2cddea413 submitted by /u/_brainfuck
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Support Board 3.3.4 Arbitrary File Deletion to Remote Code Execution

https://cdn-images-1.medium.com/max/1920/1*7qnTFndidibiN2_GeWeL-g.png
Hi. In this writeup, i will show you a bug that i found. Allowing an Authenticated user to delete any file in the system in the Support…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

[FREE COURSE] Burp Suite Unfiltered - Go from a Beginner to Advanced!
https://www.reddit.com/r/Pentesting/comments/qalkv3/free_course_burp_suite_unfiltered_go_from_a/

submitted by /u/theoffhacker779 (https://www.reddit.com/user/theoffhacker779)
[link] (https://www.reddit.com/r/FreeITCourses/comments/qaljft/free_burp_suite_unfiltered_go_from_a_beginner_to/) [comments] (https://www.reddit.com/r/Pentesting/comments/qalkv3/free_course_burp_suite_unfiltered_go_from_a/)

___________________________
@hacking_Attack
@Hacking_Video

Facebook account takeover due to a wide platform bug in ajaxpipe responses
https://bountyget.medium.com/facebook-account-takeover-due-to-a-wide-platform-bug-in-ajaxpipe-responses-951649fe9046?source=rss------bug_bounty-5

This bug could allow a malicious user to steal the access_token/code of a first party Facebook application and use it to takeover the…Continue reading on Medium » (https://bountyget.medium.com/facebook-account-takeover-due-to-a-wide-platform-bug-in-ajaxpipe-responses-951649fe9046?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ImpulsiveDLLHijack - C# Based Tool Which Automates The Process Of Discovering And Exploiting DLL Hijacks In Target Binaries

https://blogger.googleusercontent.com/img/a/AVvXsEj2Uj3bSaeJROw2MVmH2_APvD6EetFh4dj9miT-yA5_YexB3p0Ruy-SPP2oxxKWlSkUctIm8A46OKIsAE9Yp8XqyVDMOeP636s_a4KyMb1D5vvyZvAn3g_BBYyt-nsg69-hy4ZsHhfFrN66I3V86SWSKwMV03TILzuBXy0Y0-lihymmMGZElDkk--91DA=w640-h216 C# based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's. 1. Methodological Approach :The tool basically acts on automating following stages performed for DLL Hijacking:

* Discovery - Finding Potentially Vulnerable DLL Hijack paths
* Exploitation - Confirming whether the Confirmatory DLL was been loaded from the Hijacked path leading to a confirmation of 100% exploitable DLL Hijack!

Discovery Methodology :

* Provide Target binary path to ImpulsiveDLLHijack.exe
* Automation of ProcMon along with the execution of Target binary to find Potentially Vulnerable DLL Hijackable paths.

Exploitation Methodology :

*
Parse Potentially Vulnerable DLL Hijack paths from CSV generated automatically via ProcMon.

*
Copy the Confirmatory DLL (as per the PE architecture) to the hijack paths one by one and execute the Target Binary for predefined time period simultaneously.

*
As the DLL hijacking process is in progress following are the outputs which can be gathered from the Hijack Scenario:

* The Confirmatory DLL present on the potentially vulnerable Hijackable Path is loaded by the Target Binary we get following output on the console stating that the DLL Hijack was successful - DLL Hijack Successful -> DLLName: | DLL Hijack Successful -> [Entry Point Not Found - Manual Analysis Required!]: DLL Hijack Successful -> [Entry Point Not Found]: DLL Hijack Successful (if the Hijack was successful)
* DLL Hijack Unuccessful (if the Hijack was unsuccessful)
* DLL Hijack Successful [Entry Point Not Found - Manual Analysis Required] (if the Entry point was not found but can be successful after manual analysis)
* DLL Hijack Successful [Entry Point Not Found] (if the hijack was successful even after the entry point was not fo[...]

___________________________
@hacking_Attack
@Hacking_Video

und)
* Copy: Access to Path is Denied (Access denied)
**These Confirmed DLL Hijackable paths can later be weaponized during a Red Team Engagement to load a Malicious DLL Implant via a legitimate executable (such as OneDrive,Firefox,MSEdge,"Bring your own LOLBINs" etc.) and bypass State of the art EDR's as most of them fail to detect DLL Hijacking as assessed by George Karantzas and Constantinos Patsakis as mentioned in there research paper: https://arxiv.org/abs/2108.10422 2. Prerequisites:* Procmon.exe -> https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
* Custom Confirmatory DLL's :
* These are DLL files which assist the tool to get the confirmation whether the DLL's are been successfully loaded from the identified hijack path
* Compiled from the MalDLL project provided above (or use the precompiled binaries if you trust me!)
* 32Bit dll name should be: maldll32.dll
* 64Bit dll name should be: maldll64.dll
* Install NuGet Package:** PeNet** -> https://www.nuget.org/packages/PeNet/ (Prereq while compiling the ImpulsiveDLLHijack project)
Note: i & ii prerequisites should be placed in the ImpulsiveDLLHijacks.exe's directory itself.

*
Build and Setup Information:

*
ImpulsiveDLLHijack

* Clone the repository in Visual Studio
* Once project is loaded in Visual Studio go to "Project" --> "Manage NuGet packages" --> Browse for packages and install "PeNet" -> https://www.nuget.org/packages/PeNet/
* Build the project!
* The ImpulsiveDLLHijack.exe will be inside the bin directory.

*
And for Confirmatory DLL's:

* Clone the repository in Visual Studio
* Build the project with x86 and x64
* Rename x86 release as maldll32.dll and x64 release as maldll64.dll

*
Setup: Copy the Confirmatory DLL's (maldll32 & maldll64) in the ImpulsiveDLLHijack.exe directory & then execute ImpulsiveDLLHijack.exe :)) 3. Usage:https://blogger.googleusercontent.com/img/a/AVvXsEj2Uj3bSaeJROw2MVmH2_APvD6EetFh4dj9miT-yA5_YexB3p0Ruy-SPP2oxxKWlSkUctIm8A46OKIsAE9Yp8XqyVDMOeP636s_a4KyMb1D5vvyZvAn3g_BBYyt-nsg69-hy4ZsHhfFrN66I3V86SWSKwMV03TILzuBXy0Y0-lihymmMGZElDkk--91DA=w640-h216 4. Examples:*
Target Executable: OneDrive.exe

*
Stage: Discovery https://blogger.googleusercontent.com/img/a/AVvXsEgROofjnuOjtPVIT9ClV6OZLPXl78UvlDVT-r9xHX91zBbc7gjikRuNrcrIihqinVhd7Yw3DppwTS5-06mqscYIWWzGW5Eeuq19SQLvS3FA-oXsEJWlicUk8okCRxHFDt_JfhG55Vwlo0jMnISo-gq16nenLFZM38ovTT0nJ7ZJ1J9lHUSfqu8AGdt5nA=w640-h428 *
Stage: Exploitation

* Successful DLL Hijacks: https://blogger.googleusercontent.com/img/a/AVvXsEi7s554C2pqkfXHomo7kP8KoJr6FZNeUwz0oWJwzkjQDhsb5hXxUlyvbRaOJxRz6hSSGn1RsCsB-HcdayX1B1XrGDH168BKTAI7YQus6hbNPkRai5xK1xXzUL5E04taLcuszeg2vBdkq0Aj0OII3bAMAMx6PZz-oev_hZV3lxkFcX4triiyG1nF1SphlA=w640-h370 * Unsuccessful DLL Hijacks: https://blogger.googleusercontent.com/img/a/AVvXsEjb_McwjxCsmRUmjpmFH9txwSYqr765FPZJcSDqm7GzZ7my08czhNkzm_kKojgw6bxZ5k3yWHmpVWmW_TuIvw5ySceoii2C6T8qVEALkikITuLFOYr1RJ2S-Gla3jwvu0wLS-gyvd9-nwO_74PLSWGUb546S94aJxDFX7ME2RRswvEuBcwT9dIaVZMA0A=w640-h130 * DLL is not loaded as the entry point is not identical! Manual Analysis might make it a successful DLL Hijack :) https://blogger.googleusercontent.com/img/a/AVvXsEhdv0sAunu9ZBiNpavTjdmkIVNz-CTMfrku6FrKHbsNtA-M-YJ_6AqknlB5aC81QTBfDwhCLEM_lZsNdxAjD3uoZkvgkB97hELCM5bzcTHro5JAHgkmKehLZN3mWKl2RS8vw8ihzZSt8MHgsQj_iVai_rGMCvBc19XZJg6354wxekP6KaXVL03cC0zi0Q=w640-h142 * DLL Hijack successful even after unidentical entry point! https://blogger.googleusercontent.com/img/a/AVvXsEgOCphsKKcwfPH44FUXd_Bi4fVS5asmh-acfQWUfp6Wt_9X2JrGqC9UEuGLWronUL92l4Jj4kSLJvbD2Zea8aveSFFq6RjZNWJTYdKsxaEaJ9A5Xiz6kIgt6rkBdp3oK5V2rPQmopFPFie-mLgFMdVqOg2pmnZPbzfnZg_Oh3sU41C-DUFOh6GwluJH-A=w640-h126 *
Stage: Final Results and Logs

* C:\DLLLogs\output_logs.txt: https://blogger.googleusercontent.com/img/a/AVvXsEhFLbBXIN1rpIrp3wQysRWPfXplQVxLYvpzXvanRA8fKsZXgkrUf_vk3MkEdMOTm2J3_Q0ZW9iaKxedA3V1lfHpvi9rKEBJlUfk2R_r17B7o3mf2slJdUp-eGDPeFBEipDV[...]

___________________________
@hacking_Attack
@Hacking_Video

E3QFJdGcdeZPLI_sFUhP3B3zU3f9vnZhN2OWfxrXeM0JKJIuDTMpIEQbVw=w640-h294 Thankyou, Feedback would be greatly appreciated! - knight! Download ImpulsiveDLLHijack

___________________________
@hacking_Attack
@Hacking_Video

Facebook account takeover due to a wide platform bug in ajaxpipe responses

This bug could allow a malicious user to steal the access_token/code of a first party Facebook application and use it to takeover the…Continue reading on Medium »
Read more...

ImpulsiveDLLHijack - C# Based Tool Which Automates The Process Of Discovering And Exploiting DLL Hijacks In Target Binaries
http://www.kitploit.com/2021/10/impulsivedllhijack-c-based-tool-which.html

___________________________
@hacking_Attack
@Hacking_Video

C# based tool which automates the process of discovering and exploiting (https://www.kitploit.com/search/label/Exploiting) DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations (https://www.kitploit.com/search/label/Operations) to evade EDR's.
1. Methodological Approach :
The tool basically acts on automating following stages performed for DLL Hijacking:Discovery - Finding Potentially Vulnerable DLL Hijack pathsExploitation - Confirming whether the Confirmatory DLL was been loaded from the Hijacked path leading to a confirmation of 100% exploitable DLL Hijack!Discovery Methodology :Provide Target binary path to ImpulsiveDLLHijack.exeAutomation of ProcMon along with the execution of Target binary to find Potentially Vulnerable DLL Hijackable paths.Exploitation Methodology :Parse Potentially Vulnerable DLL Hijack paths from CSV generated automatically via ProcMon.Copy the Confirmatory DLL (as per the PE architecture) to the hijack paths one by one and execute the Target Binary for predefined time period simultaneously.As the DLL hijacking process is in progress following are the outputs which can be gathered from the Hijack Scenario:The Confirmatory DLL present on the potentially vulnerable Hijackable Path is loaded by the Target Binary we get following output on the console stating that the DLL Hijack was successful - DLL Hijack Successful -> DLLName: | The Confirmatory DLL present on the potentially vulnerable Hijackable Path is not loaded by the Target Binary we get following output on the console stating that the DLL Hijack was unsuccessful - DLL Hijack Unsuccessful -> Entry Point Not Found Scenarios:The Confirmatory DLL present on the potentially vulnerable Hijackable Path is not loaded by the Target Binary as the Entry Point of the DLL is different from our default entry point "DllMain" throwing an error - "Entry Point Not Found", we get following output on the console stating that the DLL Hijack was hijackable if the entry point was correct -> DLL Hijack Successful -> [Entry Point Not Found - Manual Analysis Required!]: The Confirmatory DLL present on the potentially vulnerable Hijackable Path is executed by the Target Binary even after the Entry Point of the DLL is different from our default entry point "DllMain" throwing an error "Entry Point Not Found", we get following output on the console stating that the DLL Hijack was success even after the entry point was not correct -> DLL Hijack Successful -> [Entry Point Not Found]: Note: The "Entry Point not found" Error is been handled by the code programmatically no need to close the MsgBox manually :) # Rather this would crash the code further****Once the DLL Hijacking process is completed for every Potentially Vulnerable DLL Hijack path we get the final output on the console as well as in a text file (C:\DLLLogs\output_logs.txt) in the following format: --> DLL Hijack Successful (if the Hijack was successful) --> DLL Hijack Unuccessful (if the Hijack was unsuccessful) --> DLL Hijack Successful [Entry Point Not Found - Manual Analysis Required] (if the Entry point was not found but can be successful after manual analysis) --> DLL Hijack Successful [Entry Point Not Found] (if the hijack was successful even after the entry point was not found) --> Copy: Access to Path is Denied (Access denied)**These Confirmed DLL Hijackable paths can later be weaponized during a Red Team Engagement (https://www.kitploit.com/search/label/Red%20Team%20Engagement) to load a Malicious DLL Implant via a legitimate executable (such as OneDrive,Firefox,MSEdge,"Bring your own LOLBINs" etc.) and bypass State of the art EDR's as most of them fail to detect DLL Hijacking as assessed by George Karantzas and Constantinos Patsakis as mentioned in there research paper: https://arxiv.org/abs/2108.10422
2. Prerequisites:

___________________________
@hacking_Attack
@Hacking_Video