Exploit Collector
Backdoor.Win32.Prorat.lkt Weak Hardcoded Password

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Cozmoslabs Profile Builder 3.6.1 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Spy.Win32.Zbot.aawo.Zeus-Builder Insecure Permissions

https://4.bp.blogspot.com/-our8kmhncnY/WWlvTk7Dk6I/AAAAAAAAINs/ofoeVvTLCzkScTt1I86TmBZptlym-DdFACLcBGAs/s1600/h42.png
Trojan-Spy.Win32.Zbot.aawo.Zeus-Builder malware suffers from an insecure permissions vulnerability.

MD5 | 5aafa4416fba494363a7c9a67af2db69

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/fe0dacbc953d4301232b386fcb3afc23.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Spy.Win32.Zbot.aawo.Zeus-Builder
Vulnerability: Insecure Permissions
Description: ZeuS Builder saves PE files to the c drive with insecure permissions granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: fe0dacbc953d4301232b386fcb3afc23
Vuln ID: MVID-2022-0493
Disclosure: 02/16/2022

Exploit/PoC:
ZeuS Builder

Config and loader building

Loading config from file 'C:\Users\Victim\Desktop\config2.txt'...
Loading succeeded!
Building bot file...
botnet=test
timer_config=120000ms, 60000ms
timer_logs=120000ms, 60000ms
timer_stats=120000ms, 60000ms
url_config=http://192.168.1.100/web/cfg_test.bin
url_compip=http://myip.ru
encryption_key=OK
Build succeeded!

C:\>cacls ldr_test.exe
C:\ldr_test.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir ldr_test.exe
Volume in drive C has no label.

Directory of C:\

02/14/2022 03:19 AM 61,440 ldr_test.exe
1 File(s) 61,440 bytes
0 Dir(s) 26,621,710,336 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Email-Worm.Win32.Lama Insecure Permissions

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Email-Worm.Win32.Lama malware suffers from an insecure permissions vulnerability.

MD5 | c16e24add4f39bde883261c028c4fc03

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/1c255ef6fd44877700867f94a59875d2.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Email-Worm.Win32.Lama
Vulnerability: Insecure Permissions
Description: The malware writes a ".BAT" file with insecure permissions under c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 1c255ef6fd44877700867f94a59875d2
Vuln ID: MVID-2022-0491
Disclosure: 02/16/2022

Exploit/PoC:
C:\>cacls "Alma Destructora.bat"
C:\Alma Destructora.bat BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir "Alma Destructora.bat"
Volume in drive C has no label.

Directory of C:\

02/10/2022 12:37 AM 48 Alma Destructora.bat
1 File(s) 48 bytes
0 Dir(s) 26,840,838,144 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Spyware discussion

I'd like to talk about Pegasus and spyware in general. If spyware exists, it can infect any mobile device and there is nothing that can be done to prevent that. Pegasus proved that.

Anyone who has access to Pegasus can access your phone. This means they can read my Signal messages saved in plain text, export my 2FA tokens, steal my cryptocurrency private keys, access my password manager. I think it's reasonable to assume that Pegasus is not the only software that is able to go around Apple's and Google's security measures, which makes it even scarier.

If all of that's true, how come people still recommend using password managers on mobile, setting up 2FA? What about activists and journalists who use apps like Signal? Am I missing something?

submitted by /u/k3rn3t
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Books on digital forensics?

Does anyone know any FICTION books about digital forensics etc? :)

submitted by /u/FranciscoBlackmore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
How To Get The User Manuals Of Popular Xiaomi Products

1. IntroductionXiaomi is a Chinese electronics company headquartered in Beijing. It was founded by Lei Jun, who is currently its CEO and co-founder on April 6, 2010. With a market value of $45 billion and over 70 million devices sold in 2015, Xiaomi is the world’s 3rd largest smartphone manufacturer.

The brand has an avid fan following, which makes it an instant hit with customers all over the world. They have recently entered the Indian market with the launch of Redmi Note 4G. The device has got a positive response from its fans and critics alike.

The Chinese manufacturer is also planning to release other products in India, such as Xiaomi Mi 4i, Mi Band and more. However, the company’s latest venture into India has been halted due to an ongoing legal battle between Ericsson and Micromax over a patent infringement case. 2. The popular Xiaomi products and their user manualsXiaomi products and their user manuals are available in several languages, including English, Chinese, German, Spanish and Portuguese and they can all be found online at manualsnet.com. They have an open development platform, with more than 200 million active users, in which they will give you full support.

3. Xiaomi’s popularity and reputation on the Internet are growing rapidly. The main reason is that they sell  products at very low prices, but the quality is still very good.

For example, Xiaomi Mi4 phone sells for only $320 USD on Alibaba, but its configuration is very high end: 4G LTE network connection (2100/1800/2600 MHz), 13-megapixel camera, Android 4.4 KitKat operating system, etc.

As a leader in the Chinese smartphone market, Xiaomi is constantly developing new technologies and products to improve their phones. For example, they launched the latest Redmi Note 3 with very good configuration (2 GB RAM + 16 GB ROM) at $119 USD on Alibaba. If you are looking for a good smartphone that has a high quality but low price, then this is the right place for you. 3. Get the user manuals of popular Xiaomi products!We offer a quick and easy way to find the user manuals you need for your audio, video, camera or home appliance. Download user manuals from many brands such as Samsung, Sony, Panasonic, Philips, Canon, Braun and more.

You can even download a manual for a product that is not made by the manufacturer.

Most manuals sites also have a large selection of PDF user manuals, owner’s manuals and installation guides. Download these documents to your computer or print them out at home. They are constantly adding new content so check back often for the latest information about your favourite brands and products.

It’s very easy to find exactly what you need by using our search feature. Just enter the brand name or model number of your product into the search box and we will provide a list of matching documents. Click on any of the titles in that list to open it and start reading.

You can also use a handy site map to find a specific document or type of document on any site quickly and easily. 4. Where can you find the user manual?You can find the user manual for your product in two places. If you bought your product from a local dealer, you should have been given a copy of the user manual at the time of purchase.

The user manual is also available on manuals website. Just enter the brand name or model number of your product into the search box and they will provide a list of matching documents. Click on any of the titles in that list to open it and start reading. 5. Where can you find the serial number?The serial number is located on the underside of your product. If you can’t find it, look for a white label with black text that will be located somewhere on the machine.

The serial number is located[...]

___________________________
@hacking_Attack
@Hacking_Video

on the underside of your product. If you can’t find it, look for a white label with black text that will be located somewhere on the machine. ConclusionI hope that this guide is more helpful to you. I also hope that you will never have to use it, but I know that accidents happen and sometimes things need to be fixed. If you do have to use this guide, please take care and use caution.

I also hope that you have the skills to fix it, or at least the ability to get it fixed by someone who does. I have been in situations where I had to use this guide and my fix was not pretty. However, I got it working again and all is well. If you have any questions or comments please feel free to leave them below.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How a Saudi woman’s iPhone revealed hacking around the world

https://cdn-images-1.medium.com/max/600/0*OOeXQ2irL9bnE_h5.JPG
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Issue with Bug Bounties in Crypto

https://cdn-images-1.medium.com/max/600/1*x_50jny8k5_zsIQzg0JvoQ.jpeg
We’ve all heard of the lucrative stories of people striking it rich in bug bounty platforms like HackerOne and Bugcrowd. While those are…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Article of the Day: Hacking and Proxy Warfare

https://cdn-images-1.medium.com/max/688/1*KMquwH5HE7PeZvB6Bg4l4w.jpeg
HACKERS FOR HIRE: PROXY WARFARE IN THE CYBER REALM — Modern War Institute, William Akoto, 1/31/22

Continue reading on Hybrid Analyst »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Njsscan - A Semantic Aware SAST Tool That Can Find Insecure Code Patterns In Your Node.js Applications

___________________________
@hacking_Attack
@Hacking_Video

Njsscan - A Semantic Aware SAST Tool That Can Find Insecure Code Patterns In Your Node.js Applications
http://www.kitploit.com/2022/02/njsscan-semantic-aware-sast-tool-that.html

___________________________
@hacking_Attack
@Hacking_Video

njsscan is a static application testing (SAST) tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast (https://github.com/ajinabraham/libsast) and syntax-aware semantic code pattern search tool semgrep (https://github.com/returntocorp/semgrep).
Installation pip install njsscan Requires Python 3.6+ and supports only Mac and Linux Command Line Options $ njsscan
usage: njsscan [-h] [--json] [--sarif] [--sonarqube] [--html] [-o OUTPUT] [-c CONFIG] [--missing-controls] [-w] [-v] [path ...]

positional arguments:
path Path can be file(s) or directories with source code

optional arguments:
-h, --help show this help message and exit
--json set output format as JSON
--sarif set output format as SARIF 2.1.0
--sonarqube set output format compatible with SonarQube
--html set output format as HTML
-o OUTPUT, --output OUTPUT
output filename to save the result
-c CONFIG, --config CONFIG
Location to .njsscan config file
--missing-controls enable missing security controls check
-w, --exit-warning non zero exit code on warning
-v, --version show njsscan ve rsion Example Usage Cross Site Scripting Vulnerability. │ ├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤ │ SEVERITY │ ERROR │ ├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤ │ FILES │ ╒════════════════╤═══════════════════════════════════════════════╕ │ │ │ │ File │ test.js │ │ │ │ ├────────────────┼───────────────────────────────────────────────┤ │ │ │ │ Match Position │ 5 - 46 │ │ │ │ ├────────────────┼───────────────────────────────────────────────┤ │ │ │ │ Line Number(s) │ 7: 8 │ │ │ │ ├────────────────┼───────────────────────────────────────────────┤ │ │ │ │ Match String │ const { name } = req.query; │ │ │ │ │ │ res.send(' Hello :' + name + "") │ │ │ │ ╘════════════════╧═══════════════════════════════════════════════╛ │ ╘═════════════╧═══════════════════════════════════════════════════════════════════════════════════════════════╛">$ njsscan test.js
- Pattern Match ████████████████████████ ;████████████████████████████████████ 1
- Semantic Grep ███████████████████████████ 160

njsscan: v0.1.9 | Ajin Abraham | opensecurity.in
╒═════════════╤═══════════════════════════════════════════════════ 552;═══════════════════════════════════════════╕
│ RULE ID │ express_xss │
├─────────────┼─────────────────────────────────────────────────────────────── ────────────────────────────────┤
│ OWASP │ A1: Injection │
├─────────────┼──────────────────────────────────────────────────────────────────────────^ 72;────────────────────┤
│ CWE │ CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') │
├─────────────┼──────────────────────────────────────────────────────────────────────────────────────& #9472;────────┤

___________________________
@hacking_Attack
@Hacking_Video

│ DESCRIPTION │ Untrusted User Input in Response will result in Reflected Cross Site Scripting Vulnerability. │
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│ SEVERITY │ ERROR │
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│ FILES │ ╒═══════_ 52;════════╤═══════════════════════════════════════════════╕ │
│ │ │ File │ test.js │ │
│ │ ├────────────────┼───────────────────────────────────^ 72;───────────┤ │
│ │ │ Match Position │ 5 - 46 │ │
│ │ ├────────────────┼───────────────────────────────────────────────┤ │
│ │ │ Line Number(s) │ 7: 8 │ │
│ │ ├& #9472;───────────────┼───────────────────────────────────────────────┤ │
│ │ │ Match String │ const { name } = req.query; │ │
│ │ │ │ res.send(' Hello :' + name + "") │ │
│ │ ╘════════════════╧════λ 2;══════════════════════════════════════════╛ │
╘═════════════╧══════════════════════════════════════════════════════════════════════════════ 552;════════════════╛ nodejsscan SAST nodejsscan, built on top of njsscan provides a full fledged vulnerability management (https://www.kitploit.com/search/label/Vulnerability%20Management) user interface along with other nifty integrations.

___________________________
@hacking_Attack
@Hacking_Video

See nodejsscan (https://github.com/ajinabraham/nodejsscan) Python API >> from njsscan.njsscan import NJSScan >>> node_source = '/node_source/true_positives/sqli_node.js' >>> scanner = NJSScan([node_source], json=True, check_controls=False) >>> scanner.scan() { 'templates': {}, 'nodejs': { 'node_sqli_injection': { 'files': [{ 'file_path': '/node_source/true_positives/sqli_node.js', 'match_position': (1, 24), 'match_lines': (4, 11), 'match_string': 'var employeeId = req.foo;\n\nvar sql = "SELECT * FROM trn_employee WHERE employee_id = " + employeeId;\n\n\n\nconnection.query(sql, function (error, results, fields) {\n\n if (error) {\n\n throw error;\n\n }\n\n console.log(results);' }], 'metadata': { 'owasp': 'A1: Injection', 'cwe': "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", 'description': 'Untrusted input concatinated with raw SQL query can result in SQL Injection.', 'severity': 'ERROR' } } }, 'errors': [] }">>>> from njsscan.njsscan import NJSScan
>>> node_source = '/node_source/true_positives/sqli_node.js'
>>> scanner = NJSScan([node_source], json=True, check_controls=False)
>>> scanner.scan()
{
'templates': {},
'nodejs': {
'node_sqli_injection': {
'files': [{
'file_path': '/node_source/true_positives/sqli_node.js',
'match_position': (1, 24),
'match_lines': (4, 11),
'match_string': 'var employeeId = req.foo;\n\nvar sql = "SELECT * FROM trn_employee WHERE employee_id = " + employeeId;\n\n\n\nconnection.query(sql, function (error, results, fields) {\n\n if (error) {\n\n throw error;\n\n }\n\n console.log(results);'
}],
'metadata': {
'owasp': 'A1: Injection',
'cwe': "CWE-89: Improper Neutralization of Special Element s used in an SQL Command ('SQL Injection')",
'description': 'Untrusted input concatinated with raw SQL query can result in SQL Injection.',
'severity': 'ERROR'
}
}
},
'errors': []
} Configure njsscan A .njsscan file in the root of the source code directory allows you to configure njsscan. You can also use a custom .njsscan file using --config argument. ---
- nodejs-extensions:
- .js

template-extensions:
- .new
- .hbs
- ''

ignore-filenames:
- skip.js

ignore-paths:
- __MACOSX
- skip_dir
- node_modules

ignore-extensions:
- .jsx

ignore-rules:
- regex_injection_dos
- pug_jade_template

severity-filter:
- WARNING
- ERROR Suppress Findings You can suppress findings from javascript source files by adding the comment // njsscan-ignore: rule_id1, rule_id2 to the line that trigger the findings. Example: app.get('/some/redirect', function (req, res) {
var target = req.param("target");
res.redirect(target); // njsscan-ignore: express_open_redirect
}); CI/CD Integrations You can enable njsscan in your CI/CD or DevSecOps pipelines. Github Action Add the following to the file .github/workflows/njsscan.yml. name: njsscan
on:
push:
branches: [ master, main ]
pull_request:
branches: [ master, main ]
jobs:
njsscan:
runs-on: ubuntu-latest
name: njsscan check
steps:
- name: Checkout the code
uses: actions/checkout@v2
- name: nodejsscan scan
id: njsscan
uses: ajinabraham/njsscan-action@master
with:
args: '.' Example: dvna with njsscan github action (https://github.com/ajinabraham/dvna/actions?query=workflow%3Anjsscan) Github Code Scanning Integration Add the following to the file .github/workflows/njsscan_sarif.yml. name: njsscan sarif
on:
push:
branches: [ master, main ]

___________________________
@hacking_Attack
@Hacking_Video

Top 10 API Bugs — Where To Find Them
https://aaryanapex.medium.com/top-10-api-bugs-where-to-find-them-5dac338b3d73?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video