Exploit Collector
SnipCommand 0.1.0 Cross Site Scripting / Code Execution

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
SnipCommand version 0.1.0 suffers from a cross site scripting vulnerability that can lead to remote code execution.

MD5 | 34dc1fa9d8c9fea6965bfb141eda50dc

Download
# Exploit Title: SnipCommand 0.1.0 XSS to RCE
# Exploit Author: TaurusOmar
# Twitter:@TaurusOmar
# HomePage:taurusomar.com
# Date: May 4th, 2021
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
# Risk: High (8.8)
# Vendor Homepage: https://github.com/gurayyarar/SnipCommand
# Version: 0.1.0
# Tested on: Windows, Linux, MacOs

# Software Description:
Open source command snippets manager for organize and copy fast.
It helps you create, organize and store your commands (Excel formulas, Sql Queries, Terminal commands, etc.) with dynamic parameters for quick copy to it. Describe your commands with dynamic parameters also support documentation about your snippets. You can select or specify your dynamic values using with selectbox/inputbox for ready to paste the workspace. You can organize with tags.
# Vulnerability Description:
The software allows you to store payloads in the form of files or as titles in their dynamic values, once the malicious code is entered, the payload will be executed immediately.
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
the remote attacker to get remote execution on the computer.

#Proof video
https://imgur.com/a/I2reH1M
# Payload: exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Floder.gqe Insecure Permissions

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
Backdoor.Win32.Floder.gqe malware suffers from an insecure permissions vulnerability.

MD5 | 7a96c300f8bf1d4f77f000871c8fcc6c

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/0629e3b2ab8a973a3e37e4e97cb9cfea.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Floder.gqe
Vulnerability: Insecure Permissions
Description: The malware creates an hidden insecure dir named "RECYCLER" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 0629e3b2ab8a973a3e37e4e97cb9cfea
Vuln ID: MVID-2021-0200
Dropped files: zaberg.exe, Desktop.ini
Disclosure: 05/04/2021

Exploit/PoC:
C:\>cacls RECYCLER
C:\RECYCLER BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir /a RECYCLER
Volume in drive C has no label.

Directory of C:\RECYCLER

05/01/2021 11:11 PM S-1-5-21-0243556031-888888379-781863308-1830
0 File(s) 0 bytes
3 Dir(s) 7,337,779,200 bytes free

C:\>cd \RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830

C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830>dir /a
Volume in drive C has no label.

Directory of C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830

05/01/2021 11:11 PM 63 Desktop.ini
06/17/2012 02:46 AM 24,064 zaberg.exe
2 File(s) 24,127 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
XSS made easy for testers, developers and managers

https://cdn-images-1.medium.com/max/2600/1*FKamZM1_6f3gkK2QOjEAxA.png
Let’s explore XSS but in a way that everyone can understand

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hardware Hacking : Getting UART Shells

https://external-preview.redd.it/rlyfVMyiNTtOaMMfAMksBrOiNlf-vFng_Xy8v8tI34Q.jpg?width=640&crop=smart&auto=webp&s=7d97f3035c8ccb23bb5dcd778b16864a9cfc38af submitted by /u/admiralarjun
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Cross-site scripting via Open redirect
https://sank-dahal.medium.com/cross-site-scripting-via-open-redirect-a941dbbfda8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Heya guys, I am Sankk a 15 years old teen kid from Nepal. I am trying to dig into the infosec community to become a so-called “Security…Continue reading on Medium » (https://sank-dahal.medium.com/cross-site-scripting-via-open-redirect-a941dbbfda8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
New Crypto-Stealer ‘Panda’ Spread via Discord

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg New Crypto-Stealer ‘Panda’ Spread via DiscordPost Views: 52
Reading Time: 1 Minute
PandaStealer is delivered in rigged Excel files masquerading as business quotes, bent on stealing victims’ cryptocurrency and other info.
Yet another new information stealer – Panda Stealer – is being spread through a worldwide spam campaign.

On Tuesday, Trend Micro researchers said that they first spotted the new stealer in April. The most recent wave of the spam campaign has had the biggest impact in Australia, Germany, Japan and the U.S.

The spam emails are masquerading as business-quote requests to lure victims into clicking on booby-trapped Excel files. The researchers found 264 files similar to Panda Stealer on VirusTotal, with some of them being shared by threat actors on Discord.

That’s not surprising, given recent trends: Cisco’s Talos cybersecurity team recently found that threat actors have infiltrated workflow and collaboration tools like Slack and Discord to slip past security and deliver info-stealers, remote-access trojans (RATs) and other malware.That’s not surprising, given recent trends: Cisco’s Talos cybersecurity team recently found that threat actors have infiltrated workflow and collaboration tools like Slack and Discord to slip past security and deliver info-stealers, remote-access trojans (RATs) and other malware.
See Also: Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs … Or Maybe Collaborating on More of the SameThen again, threat actors could also be using Discord to share the Panda Stealer build with each other, Trend Micro suggested.

Once Panda gets cozy, it tries to hoover up details such as private keys and past transactions from cryptocurrency wallets, including Bytecoin (BCN), Dash (DASH), Ethereum (ETH) and Litecoin (LTC). Beyond stealing wallets, it can also filch credentials from applications, including NordVPN, Telegram, Discord and Steam. Panda can also take screenshots of the infected computer and swipe data from browsers, including cookies and passwords.

The researchers discovered two ways that the spam infects victims: In one infection chain, an .XLSM attachment contains macros that download a loader, which executes the main stealer. In another infection chain, an .XLS attachment containing an Excel formula triggers a PowerShell command to access paste.ee, a Pastebin alternative that in turn accesses a second encrypted PowerShell command. The image below shows an Excel formula accessing a paste.ee URL via PowerShell command: https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05162552/panda-stealer-figure-2-300x147.png See Also: Offensive Security Tool: SSHPry2.0 All in the Stealer FamilyPanda Stealer is a tweak of the malware Collector Stealer, also known as DC Stealer, which has been found selling on an underground forum and via Telegram for as little as $12. It’s advertised as a “top-end information stealer” and has a Russian interface.

A threat actor called NCP, also known as su1c1de, has actually cracked Collector Stealer. The cracked stealer and Panda Stealer behave similarly, but they don’t share the same command-and-control (C2) URLs, build tags or execution folders. But both exfiltrate information like cookies, login data and web data from a compromised computer, storing them in an SQLite3 database.

The cracked Collector Stealer is freely available online, meaning that it’s easy to get it, tweak it and let it rip.

“Cybercriminal groups and script kiddies alike can use it to create their own customized version of the stealer and C2[...]

___________________________
@hacking_Attack
@Hacking_Video

panel,” Trend Micro researchers said. “Threat actors may also augment their malware campaigns with specific features from Collector Stealer.” Fileless Distribution Covers the ScentBesides cribbing from Collector Stealer, Panda Stealer has borrowed from another piece of malware: Namely, it uses the same fileless distribution method as the “Fair” variant of Phobos ransomware to slip past detection. In other words, it runs in memory after initial infection, instead of storing files on the hard drive.

Dimiter Andonov, senior principal reverse engineer for Mandiant, told Threatpost in an email on Tuesday that the use of the fileless technique is a hallmark of advanced malware techniques. See Also: Hacking Stories: Xbox UndergroundPanda drops files in targeted systems’ Temp folders, storing stolen information under randomized file names. Then, it exfiltrates the stolen data and sends it to a C2 server. When analyzing that C2 server, researchers were led to a login page for “熊猫Stealer,” which translates to “Panda Stealer,” though they found more domains that share that same login page. The image below shows other login pages called “熊猫Stealer:” https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05163239/panda-stealer-figure-5-300x150.png Researchers found 14 victims listed on the logs for one of those servers. They also found an IP address that they think the threat actor was using: It was hosted on a virtual private server (VPS) rented from Shock Hosting that had been compromised for testing purposes. After researchers reported their find to Shock Hosting, it suspended the server.
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-1-90x90.png Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/HPE-corp-logo-90x90.jpg Hewlett Packard Enterprise Plugs Critical Bug in Edge Platform Tool2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-90x90.png Chinese hackers targeting Russian nuclear submarine design firm with PortDoor malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/F5-Big-IP-e1619725870974-90x90.jpg F5 Big-IP Vulnerable to Security-Bypass Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Google-Chrome-Browser-1-90x90.jpg Google Chrome V8 Bug Allows Remote Code-Execution1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/apple_logo_store-90x90.jpg Apple Patches Zero-Day MacOS Bug That Can Bypass Anti-Malware Defenses1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/nvidia-90x90.jpg Nvidia Warns: Severe Security Bugs in GPU Driver, vGPU Software1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Telegram_Messagees-90x90.jpg Telegram Platform Abused in ‘ToxicEye’ Malware Campaigns1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-1-4-90x90.png Mount Locker Ransomware Aggressively Changes Up Tactics2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-11-90x90.png Pulse Secure Critical Zero-Day Security Bug Under Active Exploit2 weeks ago
The post New Crypto-Stealer ‘Panda’ Spread via Discord first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video