Exploit Collector
Backdoor.Win32.Jokerdoor Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Fantador Insecure Password Storage

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Backdoor.Win32.Fantador malware suffers from an insecure password storage vulnerability.

MD5 | b5dd0e3572fe7f9a68928b65d4d56edd

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/a1d045151c809535a308311931588fd0_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Fantador
Vulnerability: Insecure Password Storage
Description: The malware has an FTP component that can be enabled. The credentials are stored in cleartext in a file named "Fantasy.ini".
Type: PE32
MD5: a1d045151c809535a308311931588fd0
Vuln ID: MVID-2021-0439
Disclosure: 12/31/2021

Exploit/PoC:
Fantasy.ini

[FTP Server]
Address=0.0.0.0
User Name=admin
FileName=
PASSWORD=abc123
[Set]
ListenPort=21
TimeFlash=0
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Skrat Insecure Password Storage

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.SilentSpy.10 Authentication Bypass / Command Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
BeyondTrust Remote Support 6.0 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A Beginner's Story on How a Cheapo Standard Issue Router was hacked.

https://external-preview.redd.it/_CsD7AGlKnk5Io6F_gUST8bQkkyzh7C3k9HnRYXh2XE.jpg?width=320&crop=smart&auto=webp&s=f8f240909aee07069e7a87b04618457de572ff43 submitted by /u/secnigma
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
GitHub - synacker/daggy: Daggy - Data Aggregation Utility and C/C++ developer library for data streams catching

submitted by /u/synacker
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RPC Firewall - Stopping Lateral Movement via the RPC Firewall

https://blogger.googleusercontent.com/img/a/AVvXsEgyJQR_YPejfXMdrIM0M5D5bgEI1Fbqpqepa5w-6VmVa2x1wS91vZZT9UzZ8XioCQVOghII8P_M04H0InXGoOlREM2I7RvbDkWxI3AtQGlST-RXtNJDOSEBYsbVI7QFeHR1KqSJAoZ8tjQtIoIlhyY21Q0Xj1JpaJzQSYZFPQiAgmwZNoR4xKkKaokhow=w640-h286 I Need More InformationCheck out our RPC Firewall blog post to gain better understanding of RPC, RPC attacks and the solution: the RPC Firewall. For any questions, issues, or simlpy to shout out - we would love to hear from you! Contact us at support@zeronetworks.com Why should I care?RPC is the underlying mechanism which is used for numerous lateral movement techniques, reconnaisense, relay attacks, or simply to exploit vulnerable RPC services.

DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC... well, you get the idea :) What is it used for?ResearchInstall the RPC Firewall and configure it to audit all remote RPC calls. Once executing any remote attack tools, you will see which RPC UUIDs and Opnums were called remotely. Remote RPC Attacks DetectionWhen the RPC Firewall is configured to audit, it write events to the Windows Event Log.

Forward this log to your SIEM, and use it to create baselines of remote RPC traffic for your servers.

Once an abnormal RPC call is audited, use it to trigger an alert for your SOC team. Remote RPC Attacks ProtectionThe RPC Firewall can be configured to block & audit only potentially malicious RPC calls. All other RPC calls are not audited to reduce noise and improve performance.

Once a potentially malicious RPC call is detected, it is blocked and audited. This could be used to alert your SOC team, while keeping your servers protected. What are the RPC Firewall Components?It is made up from 3 components:

1. RpcFwManager.exe - In charge of managing the RPC Firewall.
2. RpcFirewall.dll - Injected DLL which performs the audit & filtering of RPC calls.
3. RpcMessages.dll - A common library for sharing functions, and logic that writes data into Windows Event Viewer. How to use?Installing / UninstallingInstallation simply drops the RPC Firewall DLLs into the %SystemRoot%\System32, and configures the RPCFWP application log for the Event Viewer. RpcFwManager.exe /installUninstalling does the opposite. RpcFwManager.exe /uninstallProtecting Process(es)The RpcFwManager tried to inject the rpcFirewall.dll only to processes which have the RPCRT4.DLL loaded into them.

Once the rpcFirewall.dll is loaded, it verifies that the host process has a valid RPC interface, and is listening for remote connections.

Otherwise, the rpcFirewall.dll unloaded itself from the target process.

If the process is a valid RPC server, the rpcFirewall starts to audit & monitor incoming RPC calls, according to the configuration file.

To protect a single process by pid: RpcFwManager.exe /pid To protect a single process by name: RpcFwManager.exe /process To protect all process, simply leave the or parametes blank. RpcFwManager.exe /process
RpcFwManager.exe /pidUnprotecting ProcessesTo disable the RPC Firewall, either uninstall it, or use the unprotect parameter: RpcFwManager.exe /unprotectThis will unload the rpcFirewall.dll from all processes. ConfigurationThe rpcFwManager.exe looks for a RpcFw.conf file, in the same directory of the executable. This file uses the following configuration options:

* uuid -> match a specific uuid
* opnum -> match a RPC opnum
* addr -> match a remote IP address
* action -> can be either allow or block (default allow)
* audit -> true or false, controls [...]

___________________________
@hacking_Attack
@Hacking_Video

whether events are written to the RPCFWP log (default false)
* verbose -> when true, outputs debug informaiton for specific RPC calls (default false)

The configuration order is important, as the first match determines the outcome of the RPC call.

For example, the following configuration will protect a DC from a DCSync attack by disabling the MS-DRSR UUID from non-domain machines. Also, notice that audit is enabled only for blocked MS-DRSR attempts, which could alert your SOC to a potential attack! uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr:Whenever the configuration changes, you need to notify the rpcFirewall.dll via the update command: RpcFwManager.exe /updateCan I Contribute?Yes! Don't be shy to do a pull request. I want RPC Firewall to do more things!We want this also! please reach out to us with any thoughts, ideas or issues you are having: support@zeronetworks.com Is there a License?For more details see LICENSE. Download Rpcfirewall

___________________________
@hacking_Attack
@Hacking_Video

RPC Firewall - Stopping Lateral Movement via the RPC Firewall
http://www.kitploit.com/2022/01/rpc-firewall-stopping-lateral-movement.html

___________________________
@hacking_Attack
@Hacking_Video

Why should I care?RPC is the underlying mechanism which is used for numerous lateral movement techniques, reconnaisense, relay attacks, or simply to exploit vulnerable (https://www.kitploit.com/search/label/Vulnerable) RPC services.DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC... well, you get the idea :)What is it used for?ResearchInstall the RPC Firewall (https://www.kitploit.com/search/label/Firewall) and configure it to audit all remote RPC calls. Once executing any remote attack tools, you will see which RPC UUIDs and Opnums were called remotely.Remote RPC Attacks DetectionWhen the RPC Firewall is configured to audit, it write events to the Windows Event Log.Forward this log to your SIEM, and use it to create baselines of remote RPC traffic (https://www.kitploit.com/search/label/Traffic) for your servers.Once an abnormal RPC call is audited, use it to trigger an alert for your SOC team.Remote RPC Attacks ProtectionThe RPC Firewall can be configured to block & audit only potentially malicious RPC calls. All other RPC calls are not audited to reduce noise and improve performance.Once a potentially malicious RPC call is detected, it is blocked and audited. This could be used to alert your SOC team, while keeping your servers protected.What are the RPC Firewall Components?It is made up from 3 components:RpcFwManager.exe - In charge of managing the RPC Firewall.RpcFirewall.dll - Injected DLL which performs the audit & filtering of RPC calls.RpcMessages.dll - A common library (https://www.kitploit.com/search/label/Library) for sharing functions, and logic that writes data into Windows Event Viewer.How to use?Installing / UninstallingInstallation simply drops the RPC Firewall DLLs into the %SystemRoot%\System32, and configures the RPCFWP application log for the Event Viewer.RpcFwManager.exe /installUninstalling does the opposite.RpcFwManager.exe /uninstallProtecting Process(es)The RpcFwManager tried to inject the rpcFirewall.dll only to processes which have the RPCRT4.DLL loaded into them.Once the rpcFirewall.dll is loaded, it verifies that the host process has a valid RPC interface, and is listening for remote connections.Otherwise, the rpcFirewall.dll unloaded itself from the target process.If the process is a valid RPC server, the rpcFirewall starts to audit & monitor incoming RPC calls, according to the configuration file.To protect a single process by pid: ">RpcFwManager.exe /pid To protect a single process by name: ">RpcFwManager.exe /process To protect all process, simply leave the or parametes blank.RpcFwManager.exe /process
RpcFwManager.exe /pidUnprotecting ProcessesTo disable the RPC Firewall, either uninstall it, or use the unprotect parameter:RpcFwManager.exe /unprotectThis will unload the rpcFirewall.dll from all processes.ConfigurationThe rpcFwManager.exe looks for a RpcFw.conf file, in the same directory (https://www.kitploit.com/search/label/Directory) of the executable. This file uses the following configuration options:uuid -> match a specific uuidopnum -> match a RPC opnumaddr -> match a remote IP addressaction -> can be either allow or block (default allow)audit -> true or false, controls whether events are written to the RPCFWP log (default false)verbose -> when true, outputs debug informaiton for specific RPC calls (default false)The configuration order is important, as the first match determines the outcome of the RPC call.For example, the following configuration will protect a DC from a DCSync attack by disabling the MS-DRSR UUID from non-domain machines. Also, notice that audit is enabled only for blocked MS-DRSR attempts, which could alert your SOC to a potential attack! action:allow uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 action:block audit:true ">uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow

___________________________
@hacking_Attack
@Hacking_Video

uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow
uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 action:block audit:trueWhenever the configuration changes, you need to notify the rpcFirewall.dll via the update command:RpcFwManager.exe /updateCan I Contribute?Yes! Don't be shy to do a pull request.I want RPC Firewall to do more things!We want this also! please reach out to us with any thoughts, ideas or issues you are having: support@zeronetworks.com (mailto:support@zeronetworks.com)Is there a License?For more details see LICENSE (https://github.com/zeronetworks/rpcfirewall/blob/master/LICENSE).

Download Rpcfirewall (https://github.com/zeronetworks/rpcfirewall)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Pathr.ai Reaffirms Position as Privacy-Centric Solution for Retailers with Spatial Intelligence Platform

Pathr.ai’s Spatial Intelligence technology is used to improve business outcomes in a variety of retail use cases.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CISOs Plan What to Buy With Funds From the Infrastructure Bill

CISOs welcome the cybersecurity funding allocated under the Infrastructure Investment and Jobs Act, but say it’s not perfect because it doesn't address a key issue: people.