Exploit Collector
Backdoor.Win32.Floder.gqe Insecure Permissions

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
Backdoor.Win32.Floder.gqe malware suffers from an insecure permissions vulnerability.

MD5 | 7a96c300f8bf1d4f77f000871c8fcc6c

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/0629e3b2ab8a973a3e37e4e97cb9cfea.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Floder.gqe
Vulnerability: Insecure Permissions
Description: The malware creates an hidden insecure dir named "RECYCLER" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 0629e3b2ab8a973a3e37e4e97cb9cfea
Vuln ID: MVID-2021-0200
Dropped files: zaberg.exe, Desktop.ini
Disclosure: 05/04/2021

Exploit/PoC:
C:\>cacls RECYCLER
C:\RECYCLER BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir /a RECYCLER
Volume in drive C has no label.

Directory of C:\RECYCLER

05/01/2021 11:11 PM S-1-5-21-0243556031-888888379-781863308-1830
0 File(s) 0 bytes
3 Dir(s) 7,337,779,200 bytes free

C:\>cd \RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830

C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830>dir /a
Volume in drive C has no label.

Directory of C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830

05/01/2021 11:11 PM 63 Desktop.ini
06/17/2012 02:46 AM 24,064 zaberg.exe
2 File(s) 24,127 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
XSS made easy for testers, developers and managers

https://cdn-images-1.medium.com/max/2600/1*FKamZM1_6f3gkK2QOjEAxA.png
Let’s explore XSS but in a way that everyone can understand

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hardware Hacking : Getting UART Shells

https://external-preview.redd.it/rlyfVMyiNTtOaMMfAMksBrOiNlf-vFng_Xy8v8tI34Q.jpg?width=640&crop=smart&auto=webp&s=7d97f3035c8ccb23bb5dcd778b16864a9cfc38af submitted by /u/admiralarjun
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Cross-site scripting via Open redirect
https://sank-dahal.medium.com/cross-site-scripting-via-open-redirect-a941dbbfda8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Heya guys, I am Sankk a 15 years old teen kid from Nepal. I am trying to dig into the infosec community to become a so-called “Security…Continue reading on Medium » (https://sank-dahal.medium.com/cross-site-scripting-via-open-redirect-a941dbbfda8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
New Crypto-Stealer ‘Panda’ Spread via Discord

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg New Crypto-Stealer ‘Panda’ Spread via DiscordPost Views: 52
Reading Time: 1 Minute
PandaStealer is delivered in rigged Excel files masquerading as business quotes, bent on stealing victims’ cryptocurrency and other info.
Yet another new information stealer – Panda Stealer – is being spread through a worldwide spam campaign.

On Tuesday, Trend Micro researchers said that they first spotted the new stealer in April. The most recent wave of the spam campaign has had the biggest impact in Australia, Germany, Japan and the U.S.

The spam emails are masquerading as business-quote requests to lure victims into clicking on booby-trapped Excel files. The researchers found 264 files similar to Panda Stealer on VirusTotal, with some of them being shared by threat actors on Discord.

That’s not surprising, given recent trends: Cisco’s Talos cybersecurity team recently found that threat actors have infiltrated workflow and collaboration tools like Slack and Discord to slip past security and deliver info-stealers, remote-access trojans (RATs) and other malware.That’s not surprising, given recent trends: Cisco’s Talos cybersecurity team recently found that threat actors have infiltrated workflow and collaboration tools like Slack and Discord to slip past security and deliver info-stealers, remote-access trojans (RATs) and other malware.
See Also: Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs … Or Maybe Collaborating on More of the SameThen again, threat actors could also be using Discord to share the Panda Stealer build with each other, Trend Micro suggested.

Once Panda gets cozy, it tries to hoover up details such as private keys and past transactions from cryptocurrency wallets, including Bytecoin (BCN), Dash (DASH), Ethereum (ETH) and Litecoin (LTC). Beyond stealing wallets, it can also filch credentials from applications, including NordVPN, Telegram, Discord and Steam. Panda can also take screenshots of the infected computer and swipe data from browsers, including cookies and passwords.

The researchers discovered two ways that the spam infects victims: In one infection chain, an .XLSM attachment contains macros that download a loader, which executes the main stealer. In another infection chain, an .XLS attachment containing an Excel formula triggers a PowerShell command to access paste.ee, a Pastebin alternative that in turn accesses a second encrypted PowerShell command. The image below shows an Excel formula accessing a paste.ee URL via PowerShell command: https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05162552/panda-stealer-figure-2-300x147.png See Also: Offensive Security Tool: SSHPry2.0 All in the Stealer FamilyPanda Stealer is a tweak of the malware Collector Stealer, also known as DC Stealer, which has been found selling on an underground forum and via Telegram for as little as $12. It’s advertised as a “top-end information stealer” and has a Russian interface.

A threat actor called NCP, also known as su1c1de, has actually cracked Collector Stealer. The cracked stealer and Panda Stealer behave similarly, but they don’t share the same command-and-control (C2) URLs, build tags or execution folders. But both exfiltrate information like cookies, login data and web data from a compromised computer, storing them in an SQLite3 database.

The cracked Collector Stealer is freely available online, meaning that it’s easy to get it, tweak it and let it rip.

“Cybercriminal groups and script kiddies alike can use it to create their own customized version of the stealer and C2[...]

___________________________
@hacking_Attack
@Hacking_Video

panel,” Trend Micro researchers said. “Threat actors may also augment their malware campaigns with specific features from Collector Stealer.” Fileless Distribution Covers the ScentBesides cribbing from Collector Stealer, Panda Stealer has borrowed from another piece of malware: Namely, it uses the same fileless distribution method as the “Fair” variant of Phobos ransomware to slip past detection. In other words, it runs in memory after initial infection, instead of storing files on the hard drive.

Dimiter Andonov, senior principal reverse engineer for Mandiant, told Threatpost in an email on Tuesday that the use of the fileless technique is a hallmark of advanced malware techniques. See Also: Hacking Stories: Xbox UndergroundPanda drops files in targeted systems’ Temp folders, storing stolen information under randomized file names. Then, it exfiltrates the stolen data and sends it to a C2 server. When analyzing that C2 server, researchers were led to a login page for “熊猫Stealer,” which translates to “Panda Stealer,” though they found more domains that share that same login page. The image below shows other login pages called “熊猫Stealer:” https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05163239/panda-stealer-figure-5-300x150.png Researchers found 14 victims listed on the logs for one of those servers. They also found an IP address that they think the threat actor was using: It was hosted on a virtual private server (VPS) rented from Shock Hosting that had been compromised for testing purposes. After researchers reported their find to Shock Hosting, it suspended the server.
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-1-90x90.png Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/HPE-corp-logo-90x90.jpg Hewlett Packard Enterprise Plugs Critical Bug in Edge Platform Tool2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-90x90.png Chinese hackers targeting Russian nuclear submarine design firm with PortDoor malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/F5-Big-IP-e1619725870974-90x90.jpg F5 Big-IP Vulnerable to Security-Bypass Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Google-Chrome-Browser-1-90x90.jpg Google Chrome V8 Bug Allows Remote Code-Execution1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/apple_logo_store-90x90.jpg Apple Patches Zero-Day MacOS Bug That Can Bypass Anti-Malware Defenses1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/nvidia-90x90.jpg Nvidia Warns: Severe Security Bugs in GPU Driver, vGPU Software1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Telegram_Messagees-90x90.jpg Telegram Platform Abused in ‘ToxicEye’ Malware Campaigns1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-1-4-90x90.png Mount Locker Ransomware Aggressively Changes Up Tactics2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-11-90x90.png Pulse Secure Critical Zero-Day Security Bug Under Active Exploit2 weeks ago
The post New Crypto-Stealer ‘Panda’ Spread via Discord first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Brute Forcing with Proxies

Hi,

Is there a GitHub Instagram brute force program that uses TOR or other proxies to change IPs while brute forcing? I tried many, but none of them worked...

Thanks in advance,

MrMoon

submitted by /u/MrMoonPiano
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Priv2Admin - Exploitation Paths Allowing You To (Mis)Use The Windows Privileges To Elevate Your Rights Within The OS
http://www.kitploit.com/2021/05/priv2admin-exploitation-paths-allowing.html

___________________________
@hacking_Attack
@Hacking_Video