Hacking on Medium
Proving Grounds — DC-1

https://cdn-images-1.medium.com/max/600/1*MbbAxfr88Xl0gsBizvePdg.png
DC-1 (VulnHub: https://www.vulnhub.com/entry/dc-1,292/) is an easy box in Proving Grounds: Play. Bottom line up front — this box should be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to set ip address to a specific location in my own city?

I want to set my device's ip address location to a specific neighborhood. So whenever I log in on social media it shows activity being done from that location. I have the GPS location for the area I want to show my IP address of if that helps.

anyone get any idea how to do it?

submitted by /u/Physical-Mushroom-76
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

[Bug Bounty] Sql Injection and Bypass Sql Login
https://medium.com/@ryuukhagetsu/bug-bounty-sql-injection-and-bypass-sql-login-8759b222e70c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi Semuanya bagaimana kabarnya ?, semoga dalam keadaan baik baik saja. Kali ini saya ingin membagikan tulisan saya mengenai bug bounty dan…Continue reading on Medium » (https://medium.com/@ryuukhagetsu/bug-bounty-sql-injection-and-bypass-sql-login-8759b222e70c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

[Bug Bounty] Sql Injection and Bypass Sql Login

Hi Semuanya bagaimana kabarnya ?, semoga dalam keadaan baik baik saja. Kali ini saya ingin membagikan tulisan saya mengenai bug bounty dan…Continue reading on Medium »
Read more...

Hacking on Medium
Best Hackers Online — Hire a Crypto Hacker

https://cdn-images-1.medium.com/max/880/1*RbEJcLgHib3G-fVMSHegGw.jpeg
Best Hackers Online — Hire A Crypto Hacker To Recover Stolen Funds

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2022-30525, Zyxel critical RCE vulnerability : Zyxel fixed Firewall Unauthenticated Remote Command Injection.

https://external-preview.redd.it/08j3lnTCIqlRcyrKj_HOp6N-XegG1xIuurXwNaF7v7U.jpg?width=640&crop=smart&auto=webp&s=a93b8a0dae40ce2c8b7fefeda7584ed149da1865 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Getting started

What’s a good way to get into hacking? Just curious

submitted by /u/Minimum-Sir-2747
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
BPFdoor: Stealthy Linux malware bypasses firewalls for remote access

BPFdoor: Stealthy Linux malware bypasses firewalls for remote accessPost Views: 6
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes
A recently discovered backdoor malware called BPFdoor has been stealthily targeting Linux and Solaris systems without being noticed for more than five years.
BPFdoor is a Linux/Unix backdoor that allows threat actors to remotely connect to a Linux shell to gain complete access to a compromised device.

The malware does not need to open ports, it can’t be stopped by firewalls, and can respond to commands from any IP address on the web, making it the ideal tool for corporate espionage and persistent attacks. Parsing ‘magic’ packetsBPFdoor is a passive backdoor, meaning that it can listen on one or more ports for incoming packets from one or more hosts, that attackers can use to send commands remotely to the compromised network.

The malware uses a Berkeley Packet Filter (the BPF in the backdoor’s name) sniffer, that works at the network layer interface being able to see all network traffic and send send packets to any destination.

Because of its positioning at such a low level, BPF does not abide by any firewall rules.

It has versions for Linux and Solaris SPARC systems but it could be ported to BSD as well, BleepingComputer learned from Craig Rowland, the founder of Sandfly Security, a company that offers an agentless solution to protect Linux systems.

Security researcher Kevin Beaumont, who published a blog post on BPFdoor, told BleepingComputer that the operators use a “magic” password to control the implant’s actions.

BPFdoor parses only ICMP, UDP, and TCP packets, checking them for a specific data value, and also a password for the latter two types of packets.

What makes BPFDoor stand out is that it can can monitor any port for the magic packet, even if those ports are used by other legitimate services, such as webservers, FTP, or SSH.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png If the TCP and UDP packets have the right “magic” data and a correct password, the backdoor springs into action executing a supported command, such as setting up a bind or reverse shell.
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoor_firewall-redirect-diagram.jpg
Bypassing the local firewallRowland notes in a comprehensive technical report on BPFdoor that the malware employs some clever anti-evasion tactics:

* Resides in system memory and deploys anti-forensics action (wipes the process environment, albeit unsuccessfully as it leaves it empty)
* Loads a Berkeley Packet Filter (BPF) sniffer allowing it to work in fro[...]

___________________________
@hacking_Attack
@Hacking_Video

nt of any locally running firewalls to see packets
* Modifies ‘iptables’ rules when receiving a relevant packet to allow attacker communication through the local firewall
* Masquerades the binary under a name similar to a common Linux system daemon
* Renames and runs itself as /dev/shm/kdmtmpflush
* Changes the date of the binary (timestomping) to October 30, 2008, before deleting it

Rowland believes an explanation for timestomping, as an anti-forensics technique in this case, could be that the attacker may try to protect the binary in case its deletion fails.

The researcher says that the purpose of the fake date could be to hide the malware from a search looking for new files on the system.

Changing firewall rules is of particular importance because it allows attackers to communicate with the backdoor via traffic that firewalls can’t flag as suspicious.

Rowland explains that when the infected host receives a special BPFdoor packet, the malware “will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port.”
“For instance, the implant can redirect all traffic from the attacker using TCP port 443 (encrypted web) to the shell. Externally, the traffic will look like TLS/SSL traffic but in fact the attacker is interacting with a remote root shell on the system” – Craig Rowland, Sandfly Security
To clarify even more, Rowland says that for a local shell, the malware modifies the ‘iptables’ configuration to redirect all traffic coming from the attacker through a legitimate port to a port range defined in the malware.

This way, the attacker can choose a connection over any port because it would be routed to the shell behind the firewall.
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoor_redirect_CraigRowland.jpg
Commands and detectionAnother technical analysis on BPFdoor from Tristan Pourcelot of threat intelligence and incident response company ExaTrack, notes that the malware comes with several hardcoded names that match command strings inside relevant packets:

* justtryit, justrobot, and justforfun to establish a bind shell on ports 42391 through 42491
* socket or sockettcp to set up a reverse shell to an IP address present in the packet

Part of BPFdoor’s techniques to evade detection is to rename the binary to appear as a normal Linux daemon using the choices below: /sbin/udevd -d/sbin/mingetty /dev/tty7/usr/sbin/console-kit-daemon --no-daemonhald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
dbus-daemon --system
hald-runner
pickup -l -t fifo -u avahi-daemon: chroot helper/sbin/auditd -n
/usr/lib/systemd/systemd-journald Pourcelot says that the threat actor updated BPFdoor regularly, improving each release with different names for commands, processes, or files.

For instance, newer variants of the implant switched from using command keywords to MD5 hashes, likely in an attempt to avoid trivial detection.

There are at least 21 versions of BPFdoor currently detected on the Virus Total scanning platform, the earliest ones submitted in August 2018.

While the detection rate for this implant improved, especially after Beaumont, Rowland, and Pourcelot published their findings, the malware went virtually invisible for a long time.

One BPFdoor variant for Solaris from 2019 went undetected until at least this May 7. Today, 28 antivirus engines flag it as malicious.
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoorSolarisDetection.jpg
___________________________
@hacking_Attack
@Hacking_Video

for an extended period.

This could be explained by the fact that malware monitoring technology is not as common in Linux environments as in Windows. Also, “vendors have significantly less visibility,” Beaumont told BleepingComputer.

Craig Rowland agrees that this is a big problem. Even if there is monitoring in place, people don’t know what to look for or use the wrong approach to find Linux malware.

The researcher told us that some administrators use cryptographic hashes to scan the system for malware or malicious files. This doesn’t work well because the smallest change in the file results in a new hash.
“Plus then EDR [Endpoint Detection and Response] wants to load agents all over and agents break Linux so they are often not a good choice. So people fly naked with Linux often and stuff like this happens” – Craig Rowland, referring particularly to older Linux systems
Rowland says that hunting for BPFdoor is easy, at least for the Linux version he analyzed, since its tactics clearly show that they “are just malicious out of the box.”
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoor_SandflyDetection.jpg
Made in China?The researchers BleepingComputer talked to about BPFdoor did not attribute the malware to any threat actor. But in a yearly report on cyberthreats, researchers from PricewaterhouseCoopers (PwC) note that they found the BPFdoor implant during an incident response engagement.

PwC attributed the intrusion to a China-based actor they track as Red Menshen (formerly Red Dev 18), who has been using BPFdoor on “telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors.”

During the investigations, PwC researchers discovered that in the post-exploitation stage of their attacks Red Menshen used custom variants of the Mangzamel backdoor and the Gh0st remote access tool (RAT) along with open-source tools like Mimikatz (to extract credentials) and Metasploit penetration testing suite, for lateral movement on Windows systems.
“We also identified that the threat actor sends commands to BPFDoor victims via Virtual Private Servers (VPSs) hosted at a well-known provider, and that these VPSs, in turn, are administered via compromised routers based in Taiwan, which the threat actor uses as VPN tunnels” – PwC
The researchers note that Red Menshen’s activity is taking place within a nine-hour time interval, between 01:00 and 10:00 UTC, which may align with local working hours.
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-exploit-90x90.jpg Actively Exploited Zero-Day Bug Patched by Microsoft24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/maxresdefault-90x90.jpg UK government blocked four times as many cyber-scams in 20212 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-azure-cloud-90x90.jpg Microsoft releases fixes for Azure flaw allowing RCE attacks3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/f5-big-ip-hacking-90x90.jpg Exploits created for critical F5 BIG-IP flaw, install patch immediately4 [...]

___________________________
@hacking_Attack
@Hacking_Video

days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Fileless-Malware-660x400-1-90x90.jpg Attackers Use Event Logs to Hide Fileless Malware7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/poison-1481596_1920-90x90.jpg Zero-day bug in uClibc library could leave IoT devices vulnerable to DNS poisoning attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1ed10a11bb45c273cebc7b8cb492979249bcdcec-90x90.png Security bug in VMWare Workspace ONE could allow access to internal, cloud networks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1614322146_pexels-kevin-ku-577585-scaled-90x90.jpg Open source ‘Package Analysis’ tool finds malicious npm, PyPI packages2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/supply-chain-attack-90x90.jpg Socket: New tool uses a new, proactive defense against OSS supply chain attacks2 weeks ago
The post BPFdoor: Stealthy Linux malware bypasses firewalls for remote access first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AWS billing budget 설정하기

https://cdn-images-1.medium.com/max/600/1*8JkNfIpLf3-vzB0ustZskA.png
요금폭탄을 피하는 방법

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Transfer Zelle Paypal Bank Cashapp Bank WU Cloned cc and atm Earn Gov funds free

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video