Hacking Articles Tips Tricks Videos Tutorials

BuilderRevengeRAT XML Injection

Exploit Collector
BuilderRevengeRAT XML Injection

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
BuilderRevengeRAT malware suffers from an XML injection vulnerability.

MD5 | 29ec86aeac2c390d44e806785065a972

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/531d8b4ac8f7eb827d62424169321b2b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderRevengeRAT - (Revenge-RAT v0.3)
Vulnerability: XML External Entity Injection
Description: The malware listens on TCP port 333. There is a Config.xml file used by the RAT builder to specify port, notification, webcam etc. The XML parser used by the RAT is vulnerable to XML Injection, this can allow local file exfiltration to a remote attacker server and or Geo location disclosure of the RAT builder.
Family: Revenge
Type: PE32
MD5: 531d8b4ac8f7eb827d62424169321b2b
Vuln ID: MVID-2022-0521
Disclosure: 03/17/2022

Exploit/PoC:
1) python -m http.server (Port 8000)

2) "payload.dtd"

%all;

3) "Config.xml"

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 19:28

2 views19:28

BuilderTorCTPHPRAT.b Cross Site Scripting

Exploit Collector
BuilderTorCTPHPRAT.b Cross Site Scripting

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
BuilderTorCTPHPRAT.b malware suffers from a cross site scripting vulnerability.

MD5 | bd1d93d18137fa1f7db396fd903a7d52

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/838f67d7a4b6824ec59892057aab3bb7_C.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: BuilderTorCTPHPRAT.b
Vulnerability: Remote Persistent XSS
Family: TorCTPHPRAT
Type: WebUI
MD5: 838f67d7a4b6824ec59892057aab3bb7 (Webremote TorCT Client.exe)
MD5: dc40fa699cfce01802213dbbd0cbe37e (SlaveOnline.php)
Vuln ID: MVID-2022-0520
Disclosure: 03/17/2022
Description: The TorCT client malwares web-panel allows unauthenticated users to write data to the Slaves.txt file. There is no secure coding practice or filtering of input or sanitization of output. Third-party attackers who can reach the server can make HTTP Post requests writing arbitrary JS code into the Slaves.txt file. The XSS payload will execute client side code in the security context of the currently logged on user anytime the WebUI is accessed. This can result in data modification, theft or GEO location disclosure of the user accessing the TorCT WebUI.

"SlaveOnline.php" code snippet:

$fn= $_GET['online'];
$ip = $_SERVER['REMOTE_ADDR'];
$extrainfo = $_GET['info'];
$emptystring = "";

function visitor_country() {
$ip = $_SERVER["REMOTE_ADDR"];
if(filter_var(@$_SERVER['HTTP_X_FORWARDED_FOR'], FILTER_VALIDATE_IP))
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
if(filter_var(@$_SERVER['HTTP_CLIENT_IP'], FILTER_VALIDATE_IP))
$ip = $_SERVER['HTTP_CLIENT_IP'];
$derp = @json_decode(file_get_contents("http://www.geoplugin.net/json.gp?ip=" . $ip));
$result1=$derp ->geoplugin_countryCode;
$result2=$derp ->geoplugin_countryName;
$result = "[".$result1."] - ".$result2;
return $result;
}

$countryname = visitor_country();
if ($extrainfo == "") { $extrainfo = "||||";}
$extrainfo = $extrainfo."|||||";
$file = file_get_contents('./Slaves.txt', False);
$write = $countryname."|".$_SERVER['REMOTE_ADDR'] . "|" .$extrainfo. "+" ;
echo $file;

etc...

Exploit/PoC:
curl "http://TorCTPHPRAT_SERVER_IP/New_TorCT_6_22_1_6/UPLOAD%20%20(New%20PHP%20FILES)/SlaveOnline.php?online=1&info=%3Cscript%3Ealert('malvuln')%3C/script%3E"
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 19:28

Dark Reading: Attacks/Breaches
Stopping Russian Cyberattacks at Their Source

Step up training with cybersecurity drills, teach how to avoid social engineering traps, share open source monitoring tools, and make multifactor authentication the default.

2 views19:40

Source

2 views19:40

Dark Reading: Attacks/Breaches
Glasswall Launches Freemium Version of its Desktop Content Disarm and Reconstruction App

Glasswall technology offers proactive protection from file-based cybersecurity threats.

___________________________
@hacking_Attack
@Hacking_Video

Glasswall Launches Freemium Version of its Desktop Content Disarm and Reconstruction App

Glasswall technology offers proactive protection from file-based cybersecurity threats.

2 viewsedited 19:40

2 views19:40

2 views19:40

Dark Reading: Attacks/Breaches
Titaniam Announces Completion of Product Suite

The Titaniam Suite includes ransomware and extortion defense capabilities in the form of five products.

___________________________
@hacking_Attack
@Hacking_Video

Titaniam Announces Completion of Product Suite

The Titaniam Suite includes ransomware and extortion defense capabilities in the form of five products.

2 viewsedited 19:40

2 views19:40

Dark Reading: Attacks/Breaches
Cloudflare Announces API Gateway

Organizations can secure, manage, and monitor all of their APIs in one easy-to-use dashboard.

___________________________
@hacking_Attack
@Hacking_Video

Cloudflare Announces API Gateway

Organizations can secure, manage, and monitor all of their APIs in one easy-to-use dashboard.

2 viewsedited 19:40

Dark Reading: Attacks/Breaches
Nok Nok Labs Unveils S3 Authentication Suite

Enhancements include support for OpenID Connect as an integration mechanism.

___________________________
@hacking_Attack
@Hacking_Video

Nok Nok Labs Unveils S3 Authentication Suite

Enhancements include support for OpenID Connect as an integration mechanism.

3 viewsedited 19:40

4 views19:40

Dark Reading: Attacks/Breaches
Firefly Announces Release of ValidIaC Open Source Solution

___________________________
@hacking_Attack
@Hacking_Video

Firefly Announces Release of ValidIaC Open Source Solution

6 viewsedited 19:40

Question about curl/wget and phishing sites

Question about curl/wget and phishing sites
https://www.reddit.com/r/Pentesting/comments/tgiww4/question_about_curlwget_and_phishing_sites/

I have a question for anyone who might know and be kind enough to answer. Like most people, I receive phishing emails and I (usually) know that that is what they are. I'm wondering how dangerous it is, if at all, to use curl and/or wget to access those sites and try to find out what they're attempting to do to me. I made such an attempt with one site, assuming that curl would only send a GET request to the http server, and that wget would just look for links and download them, and perhaps I could learn about the modus operandi of such sites (and also inform the web hoster of the malicious activity). I also assumed that any exploit would target javascript and that neither curl nor wget can execute that. I found that curl and wget requests both resulted in a process being created in the background that lasted about 30 seconds or so. I was never able to determine what process it was. Wget downloaded a highly obfuscated script using the HTML tag. I know that it was probably foolish to do this experiment but now that I've done it I'm wondering what the dangers might be. I was surprised that a background process was created because I have never seen that with curl or wget but I admit that I don't have a lot of experience with them. I ran a virus scan and looked at rkhunter and both found nothing of interest. Needless to say I didn't run this experiment from root! No need to scold me for having done this -- I should have asked someone first or researched it better, I know. I would just like to know what the risks are of examining phishing sites in this way, and what the background process might have been. OS: Ubuntu 20.04 LTS. Thanks in advance! submitted by /u/Metataphysika (https://www.reddit.com/user/Metataphysika)
[link] (https://www.reddit.com/r/Pentesting/comments/tgiww4/question_about_curlwget_and_phishing_sites/) [comments] (https://www.reddit.com/r/Pentesting/comments/tgiww4/question_about_curlwget_and_phishing_sites/)

___________________________
@hacking_Attack
@Hacking_Video

I have a question for anyone who might know and be kind enough to answer. Like most people, I receive phishing emails and I (usually) know that...

6 viewsedited 20:39

Mip22 - An Advanced Phishing Tool

The program is made for educational purposes only for to see how the phishing method works. Any unnecessary use of the program is prohibited and the manufacturer has no responsibility for any illegal use by anyone. Use the tool at your own risk and avoid any sloppy actions. Installation Instructions Installation on Gnu / Linux OS. On terminal sudo su git clone git://github.com/makdosx/mip22.git chmod -R 777 mip22 cd mip22 bash mip22.sh Installation on Android OS. On Termux git clone git://github.com/makdosx/mip22.git chmod -R 777 mip22 cd mip22 bash mip22.sh Feautures and Properties. Mip22 is a modern and advanced cyber security program for computers with Gnu / Linux operating system and mobile phones and tablets with android operating system, for educational purposes. Details Automatic method Manual Method Tunnels Setup Email Services Vpn instructions Sound Efects (only for pc) Automatic method Easy to use via terminal. Automatic cloned services. It has 69 ready cloned electronic services, including social networks, e-mails, cloud, multumedia etc etc. Manual Method Cloning services manually by cloning the service you want. Easy to use through browser service. Tunnels Setup It has 3 tunnels to promote these services from the local server to the internet. It has ready api for the installation of some tunnels. Email Services It has 3 well-known external email services found on the internet where you can visit to send an email. Vpn instructions It has various instructions fron vpn on Android OS. Sound Efects (only for pc) It has various effects such as music in the background. Download Mip22
Read more...

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 21:18

How Smart Cities could become Dark Cities

Hacking on Medium
How Smart Cities could become Dark Cities

https://cdn-images-1.medium.com/max/1920/0*2DByC4dZ1piWU40I.jpg
Here is a short and vulgarized exercice on how a “smart city” can become very stupid. All these elements are based on real-life situations…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Here is a short and vulgarized exercice on how a “smart city” can become very stupid. All these elements are based on real-life situations…

5 viewsedited 21:45