Hacking Articles
Domain Persistence: DSRM

In this post, we are going to discuss one more Mitre Attack Technique for Tactic ID TA0003 which is used by various of APTs & threat Actors for creating a permanent backdoor in the domain controller. We will check how to use Directory Services Restore Mode (DSRM) for conducting a

The post Domain Persistence: DSRM appeared first on Hacking Articles.

Deep Web
Deep Web Art

Does anyone know of any famous paintings or pieces of art that have gone missing and then have shown up on the deep web? I’m very interested in art and I was watching a documentary about stealing paintings and was wondering where they go after they get stolen because it’s not like they can just sell the paintings on the open web... that would be way to much attention and they would obviously get caught.

So if anyone knows where they go please let me know I’m very couriers!!

submitted by /u/Monkeyhank420
[link] [comments]

Deep Web
Chinese 2015 OPM Leak

Referring to the Chinese hack of 2015 on the OPM, I heard it was leaked somewhere on the deep web. I am trying to get this information for a college project, this is not cheating as my professor said that we are allowed to use whatever open-source resources that we want. Does anyone know where I can find some info or the leak itself?

submitted by /u/Nalsooner12
[link] [comments]

Exploit Collector
Trojan.Win32.Bayrob.dtrg Insecure Permissions

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Trojan.Win32.Bayrob.dtrg malware suffers from an insecure permissions vulnerability.

MD5 | 54c14723e1fed89a332e168edb0e7669

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/2f3f0e9be7edb73e545fc49b5a78b4f0.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Bayrob.dtrg
Vulnerability: Insecure Permissions
Description: Bayrob.dtrg creates an insecure dir named "mnfqzckna0dkc" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 2f3f0e9be7edb73e545fc49b5a78b4f0
Vuln ID: MVID-2021-0175
Dropped files: fuwa2hvojto7lyc1nnmuov.exe, k2fyqvt.exe, pnhky9c.exe, stivbgcekgrl, oljlgxh, nxqdc3kf
Disclosure: 04/17/2021

Exploit/PoC:
C:\>cacls mnfqzckna0dkc
C:\mnfqzckna0dkc BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir /a mnfqzckna0dkc
Volume in drive C has no label.

Directory of C:\mnfqzckna0dkc

04/12/2021 08:27 PM 205,824 fuwa2hvojto7lyc1nnmuov.exe
04/12/2021 08:27 PM 205,824 k2fyqvt.exe
04/12/2021 08:27 PM 0 nxqdc3kf
04/12/2021 08:28 PM 4 oljlgxh
04/12/2021 08:27 PM 205,824 pnhky9c.exe
04/12/2021 08:27 PM 10 stivbgcekgrl
6 File(s) 617,486 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Trojan.Win32.Agentb.iofv Insecure Permissions

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
Trojan.Win32.Agentb.iofv malware suffers from an insecure permissions vulnerability.

MD5 | f1d4908479b404b3600bb16933d6ba56

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/d4ac133a9df0c627f899bb6039d04215.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Agentb.iofv
Vulnerability: Insecure Permissions
Description: Agentb.iofv creates an insecure dir named "drivr" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges
Type: PE32
MD5: d4ac133a9df0c627f899bb6039d04215
Vuln ID: MVID-2021-0172
Dropped files: hostloader.exe
Disclosure: 04/17/2021

Exploit/PoC:
C:\>cacls drivr
C:\drivr BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C

C:\>dir /a drivr
Volume in drive C has no label.

Directory of C:\drivr

06/14/2012 06:21 PM 293,376 hostloader.exe
1 File(s) 293,376 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Trojan.Win32.NanoBot.onh Insecure Permissions

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Trojan.Win32.NanoBot.onh malware suffers from an insecure permissions vulnerability.

MD5 | 547ee0ff71365297633d647614914aa7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/9fff4c02274c0162880844f27ff91407.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan.Win32.NanoBot.onh
Vulnerability: Insecure Permissions
Description: NanoBot.onh creates an insecure dir named "AppData" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges. In this case the dropped file "amsiproxy.bat" is actually an PE32 executable as indicated by the presence of MZ header field and binary data.
Type: PE32
MD5: 9fff4c02274c0162880844f27ff91407
Vuln ID: MVID-2021-0173
Dropped files: amsiproxy.bat (PE32)
Disclosure: 04/17/2021

Exploit/PoC:
C:\>cacls AppData
C:\AppData BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\AppData\Register-CimProvider>dir
Volume in drive C has no label.

Directory of C:\AppData\Register-CimProvider

04/15/2021 10:50 PM 1,101,316 amsiproxy.bat
1 File(s) 1,101,316 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
xscreensaver Raw Socket Leak

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
xscreensaver suffers from a raw socket leak vulnerability. Proof of concept exploit demonstrates running tcpdump via this issue.

MD5 | 48106b83c9aba927ebf03a5ccbadc196

Download
Source:packetstormsecurity.com

Exploit Collector
Trojan-Dropper.Win32.Agent.bjtzcp Insecure Permissions

https://3.bp.blogspot.com/-Q0zmt52Iz_s/WWlvCi1SqRI/AAAAAAAAIKo/56GGQ_7zLBsvaLtYw9wmjI_Jb6z2oza2QCLcBGAs/s1600/h129.png Trojan-Dropper.Win32.Agent.bjtzcp malware suffers from an insecure permissions vulnerability.

MD5 | ebf9feb12cbe5962ffa0a0a27208784fDownload Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/2992b86d03c3922ed45fa09ef105f018.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Agent.bjtzcp
Vulnerability: Insecure Permissions
Description: Agent.bjtzcp creates an insecure dir named "Isrimss2018" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 2992b86d03c3922ed45fa09ef105f018
Vuln ID: MVID-2021-0174
Disclosure: 04/17/2021

Exploit/PoC:
C:\>cacls Isrimss2018
C:\Isrimss2018 BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir Isrimss2018
Volume in drive C has no label.

Directory of C:\Isrimss2018

12/30/2017 02:13 PM 108,544 Copia.mdb
12/12/2017 07:45 PM 112,640 DatosP.mdb
12/30/2017 02:13 PM 102,400 DatosPatron.mdb
01/20/2015 11:58 PM 37,888 Doc1F.doc
01/20/2015 11:59 PM 37,376 Doc1M.doc
01/20/2015 11:44 PM 37,888 Doc2F.doc
01/20/2015 11:45 PM 36,864 Doc2M.doc
01/21/2015 12:06 AM 37,376 Doc3F.doc
01/21/2015 12:06 AM 36,352 Doc3M.doc
01/21/2015 12:03 AM 37,376 Doc4F.doc
01/21/2015 12:04 AM 36,864 Doc4M.doc
01/25/2015 11:19 PM 46,080 Doc5F.doc
01/20/2015 11:53 PM 38,400 Doc5M.doc
01/20/2015 11:36 PM 45,056 Doc6F.doc
01/24/2015 01:23 AM 38,400 Doc6M.doc
01/20/2015 11:40 PM 37,376 Doc7F.doc
01/20/2015 11:39 PM 38,400 Doc7M.doc
01/20/2015 11:47 PM 36,864 Doc8F.doc
01/20/2015 11:48 PM 36,352 Doc8M.doc
01/20/2015 11:50 PM 37,888 Doc9F.doc
01/20/2015 11:51 PM 36,864 Doc9M.doc
03/30/2005 11:03 PM 766 impuicon.ico
01/26/2018 07:33 PM 7,551,939 ISRIMSS2018_2.CAB
02/07/2018 10:08 PM 3,821,568 ISRIMSS2018_2.exe
12/26/2015 02:18 PM 71,168 MANUALITO.doc
03/26/1999 12:00 AM 141,824 setup.exe
01/27/2018 11:44 AM 7,446 SETUP.LST
27 File(s) 12,607,959 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). Source:packets[...]