Black Hat Ethical Hacking
New Crypto-Stealer ‘Panda’ Spread via Discord

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg New Crypto-Stealer ‘Panda’ Spread via DiscordPost Views: 52
Reading Time: 1 Minute
PandaStealer is delivered in rigged Excel files masquerading as business quotes, bent on stealing victims’ cryptocurrency and other info.
Yet another new information stealer – Panda Stealer – is being spread through a worldwide spam campaign.

On Tuesday, Trend Micro researchers said that they first spotted the new stealer in April. The most recent wave of the spam campaign has had the biggest impact in Australia, Germany, Japan and the U.S.

The spam emails are masquerading as business-quote requests to lure victims into clicking on booby-trapped Excel files. The researchers found 264 files similar to Panda Stealer on VirusTotal, with some of them being shared by threat actors on Discord.

That’s not surprising, given recent trends: Cisco’s Talos cybersecurity team recently found that threat actors have infiltrated workflow and collaboration tools like Slack and Discord to slip past security and deliver info-stealers, remote-access trojans (RATs) and other malware.That’s not surprising, given recent trends: Cisco’s Talos cybersecurity team recently found that threat actors have infiltrated workflow and collaboration tools like Slack and Discord to slip past security and deliver info-stealers, remote-access trojans (RATs) and other malware.
See Also: Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs … Or Maybe Collaborating on More of the SameThen again, threat actors could also be using Discord to share the Panda Stealer build with each other, Trend Micro suggested.

Once Panda gets cozy, it tries to hoover up details such as private keys and past transactions from cryptocurrency wallets, including Bytecoin (BCN), Dash (DASH), Ethereum (ETH) and Litecoin (LTC). Beyond stealing wallets, it can also filch credentials from applications, including NordVPN, Telegram, Discord and Steam. Panda can also take screenshots of the infected computer and swipe data from browsers, including cookies and passwords.

The researchers discovered two ways that the spam infects victims: In one infection chain, an .XLSM attachment contains macros that download a loader, which executes the main stealer. In another infection chain, an .XLS attachment containing an Excel formula triggers a PowerShell command to access paste.ee, a Pastebin alternative that in turn accesses a second encrypted PowerShell command. The image below shows an Excel formula accessing a paste.ee URL via PowerShell command: https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05162552/panda-stealer-figure-2-300x147.png See Also: Offensive Security Tool: SSHPry2.0 All in the Stealer FamilyPanda Stealer is a tweak of the malware Collector Stealer, also known as DC Stealer, which has been found selling on an underground forum and via Telegram for as little as $12. It’s advertised as a “top-end information stealer” and has a Russian interface.

A threat actor called NCP, also known as su1c1de, has actually cracked Collector Stealer. The cracked stealer and Panda Stealer behave similarly, but they don’t share the same command-and-control (C2) URLs, build tags or execution folders. But both exfiltrate information like cookies, login data and web data from a compromised computer, storing them in an SQLite3 database.

The cracked Collector Stealer is freely available online, meaning that it’s easy to get it, tweak it and let it rip.

“Cybercriminal groups and script kiddies alike can use it to create their own customized version of the stealer and C2[...]

___________________________
@hacking_Attack
@Hacking_Video

panel,” Trend Micro researchers said. “Threat actors may also augment their malware campaigns with specific features from Collector Stealer.” Fileless Distribution Covers the ScentBesides cribbing from Collector Stealer, Panda Stealer has borrowed from another piece of malware: Namely, it uses the same fileless distribution method as the “Fair” variant of Phobos ransomware to slip past detection. In other words, it runs in memory after initial infection, instead of storing files on the hard drive.

Dimiter Andonov, senior principal reverse engineer for Mandiant, told Threatpost in an email on Tuesday that the use of the fileless technique is a hallmark of advanced malware techniques. See Also: Hacking Stories: Xbox UndergroundPanda drops files in targeted systems’ Temp folders, storing stolen information under randomized file names. Then, it exfiltrates the stolen data and sends it to a C2 server. When analyzing that C2 server, researchers were led to a login page for “熊猫Stealer,” which translates to “Panda Stealer,” though they found more domains that share that same login page. The image below shows other login pages called “熊猫Stealer:” https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05163239/panda-stealer-figure-5-300x150.png Researchers found 14 victims listed on the logs for one of those servers. They also found an IP address that they think the threat actor was using: It was hosted on a virtual private server (VPS) rented from Shock Hosting that had been compromised for testing purposes. After researchers reported their find to Shock Hosting, it suspended the server.
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-1-90x90.png Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/HPE-corp-logo-90x90.jpg Hewlett Packard Enterprise Plugs Critical Bug in Edge Platform Tool2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled-design-90x90.png Chinese hackers targeting Russian nuclear submarine design firm with PortDoor malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/F5-Big-IP-e1619725870974-90x90.jpg F5 Big-IP Vulnerable to Security-Bypass Bug6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Google-Chrome-Browser-1-90x90.jpg Google Chrome V8 Bug Allows Remote Code-Execution1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/apple_logo_store-90x90.jpg Apple Patches Zero-Day MacOS Bug That Can Bypass Anti-Malware Defenses1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/nvidia-90x90.jpg Nvidia Warns: Severe Security Bugs in GPU Driver, vGPU Software1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Telegram_Messagees-90x90.jpg Telegram Platform Abused in ‘ToxicEye’ Malware Campaigns1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-1-4-90x90.png Mount Locker Ransomware Aggressively Changes Up Tactics2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-11-90x90.png Pulse Secure Critical Zero-Day Security Bug Under Active Exploit2 weeks ago
The post New Crypto-Stealer ‘Panda’ Spread via Discord first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Brute Forcing with Proxies

Hi,

Is there a GitHub Instagram brute force program that uses TOR or other proxies to change IPs while brute forcing? I tried many, but none of them worked...

Thanks in advance,

MrMoon

submitted by /u/MrMoonPiano
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Priv2Admin - Exploitation Paths Allowing You To (Mis)Use The Windows Privileges To Elevate Your Rights Within The OS
http://www.kitploit.com/2021/05/priv2admin-exploitation-paths-allowing.html

___________________________
@hacking_Attack
@Hacking_Video

The idea is to "translate" Windows OS privileges to a path leading to: administrator, integrity and/or confidentiality threat, availability threat, just a mess. Privileges are listed and explained at: https://docs.microsoft.com/en-us/windows/win32/secauthz/privilege-constants
If the goal can be achieved multiple ways, the priority is Using built-in commands Using PowerShell (only if a working script exists) Using non-OS tools Using any other method You can check your own privileges with whoami /priv. Disabled privileges are as good as enabled ones. The only important thing is if you have the privilege on the list or not. Note 1: Whenever the attack path ends with a token creation, you can assume the next step is to create new process using such token and then take control over OS. Note 2:
a. For calling NtQuerySystemInformation()/ZwQuerySystemInformation() directly, you can find required privileges here (https://github.com/gtworek/Priv2Admin/blob/master/NtQuerySystemInformation.md).
b. For NtSetSystemInformation()/ZwSetSystemInformation() required privileges are listed here here (https://github.com/gtworek/Priv2Admin/blob/master/NtSetSystemInformation.md). Note 3: I am focusing on the OS only. If a privilege works in AD but not in the OS itself, I am describing it as not used in the OS. It would be nice if someone digs deeper into AD-oriented scenarios. Feel free to contribute and/or discuss presented ideas. Privilege Impact Tool Execution path Remarks SeAssignPrimaryToken Admin 3rd party tool "It would allow a user to impersonate tokens and privesc to nt system using tools such as potato.exe, rottenpotato.exe and juicypotato.exe" Thank you Aurélien Chalot (https://twitter.com/Defte_) for the update. I will try to re-phrase it to something more recipe-like soon. SeAudit Threat 3rd party tool Write events to the Security event log to fool auditing or to overwrite old events. Writing own events is possible with Authz Report Security Event API. SeBackup Admin 3rd party tool 1. Backup the HKLM\SAM and HKLM\SYSTEM registry hives
2. Extract the local accounts hashes from the SAM database
3. Pass-the-Hash as a member of the local Administrators group

Alternatively, can be used to read sensitive files. For more information, refer to the SeBackupPrivilege file. SeChangeNotify None - - Privilege held by everyone. Revoking it may make the OS (Windows Server 2019) unbootable. SeCreateGlobal ? ? ? SeCreatePagefile None Built-in commands Create hiberfil.sys, read it offline, look for sensitive data. Requires offline access, which leads to admin rights anyway. SeCreatePermanent ? ? ? SeCreateSymbolicLink ? ? ? SeCreateToken Admin 3rd party tool Create arbitrary token including local admin rights with NtCreateToken. SeDebug Admin PowerShell Duplicate the lsass.exe token. Script to be found at FuzzySecurity (https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Conjure-LSASS.ps1) SeDelegateSession-
UserImpersonate ? ? ? Privilege name broken to make the column narrow. SeEnableDelegation None - - The privilege is not used in the Windows OS. SeImpersonate Admin 3rd party tool Tools from the Potato family (potato.exe, rottenpotato.exe and juicypotato.exe), RogueWinRM, etc. Similarly to SeAssignPrimaryToken, allows by design to create a process under the security context of another user (using a handle to a token of said user).

Multiple tools and techniques may be used to obtain the required token. SeIncreaseBasePriority Availability Built-in commands start /realtime SomeCpuIntensiveApp.exe May be more interesting on servers. SeIncreaseQuota Availability 3rd party tool Change cpu, memory, and cache limits to some values making the OS unbootable. - Quotas are not checked in the safe mode, which makes repair relatively easy.

___________________________
@hacking_Attack
@Hacking_Video

Alternatively, the privilege may be used to unload security-related drivers with ftlMC builtin command. i.e.: fltMC sysmondrv 1. The szkg64 vulnerability (https://www.kitploit.com/search/label/Vulnerability) is listed as CVE-2018-15732 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15732)
2. The szkg64 exploit code (https://www.greyhathacker.net/?p=1025) was created by Parvez Anwar (https://twitter.com/parvezghh) SeLockMemory Availability 3rd party tool Starve System memory partition by moving pages. PoC published by Walied Assar (@waleedassar) (https://twitter.com/waleedassar/status/1296689615139676160) SeMachineAccount None - - The privilege is not used in the Windows OS. SeManageVolume Admin 3rd party tool 1. Enable the privilege in the token
2. Create handle to \.\C: with SYNCHRONIZE | FILE_TRAVERSE
3. Send the FSCTL_SD_GLOBAL_CHANGE to replace S-1-5-32-544 with S-1-5-32-545
4. Overwrite utilman.exe etc. FSCTL_SD_GLOBAL_CHANGE can be made with this piece of code (https://github.com/gtworek/PSBits/blob/master/Misc/FSCTL_SD_GLOBAL_CHANGE.c). SeProfileSingleProcess None - - The privilege is checked before changing (and in very limited set of commands, before querying) parameters of Prefetch, SuperFetch, and ReadyBoost. The impact may be adjusted, as the real effect is not known. SeRelabel Threat 3rd party tool Modification of system files by a legitimate administrator? See: MIC documentation (https://docs.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control)

Integrity labels are infrequently used and work only on top of standard ACLs. Two main scenarios include:
- protection against attacks using exploitable applications such as browsers, PDF readers etc.
- protection of OS files.

Attacks with SeRelabel must obey access rules defined by ACLs, which makes them significantly less useful in practice. SeRemoteShutdown Availability Built-in commands shutdown /s /f /m \\server1 /d P:5:19 The privilege is verified when shutdown/restart request comes from the network. 127.0.0.1 scenario to be investigated. SeReserveProcessor None - - It looks like the privilege is no longer used and it appeared only in a couple of versions of winnt.h. You can see it listed i.e. in the source code published by Microsoft here (https://code.msdn.microsoft.com/Effective-access-rights-dd5b13a8/sourcecode?fileId=58676&pathId=767997020). SeRestore Admin PowerShell 1. Launch PowerShell/ISE with the SeRestore privilege present.
2. Enable the privilege with Enable-SeRestorePrivilege (https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1)).
3. Rename utilman.exe to utilman.old
4. Rename cmd.exe to utilman.exe
5. Lock the console and press Win+U Attack may be detected by some AV software.

Alternative method relies on replacing service binaries stored in "Program Files" using the same privilege. SeSecurity Threat Built-in commands - Clear Security event log: wevtutil cl Security

- Shrink the Security log to 20MB to make events flushed soon: wevtutil sl Security /ms:0

- Read Security event log to have knowledge about processes, access and actions of other users within the system.

- Knowing what is logged to act under the radar.

- Knowing what is logged to generate large number of events effectively purging old ones without leaving obvious evidence of cleaning. SeShutdown Availability Built-in commands shutdown.exe /s /f /t 1 Allows to call most of NtPowerInformation() levels. To be investigated. SeSyncAgent None - - The privilege is not used in the Windows OS. SeSystemEnvironment Unknown 3rd party tool The privilege permits to use NtSetSystemEnvironmentValue, NtModifyDriverEntry and some other syscalls to manipulate UEFI variables. - Firmware environment variables were commonly used on non-Intel platforms in the past, and now slowly return to UEFI world.

___________________________
@hacking_Attack
@Hacking_Video

- The area is highly undocumented.
- The potential may be huge (i.e. breaking Secure Boot) but raising the impact level requires at least PoC. SeSystemProfile ? ? ? SeSystemtime Threat Built-in commands cmd.exe /c date 01-01-01
cmd.exe /c time 00:00 The privilege allows to change the system time, potentially leading to audit trail integrity issues, as events will be stored with wrong date/time.
- Be careful with date/time formats. Use always-safe values if not sure.
- Sometimes the name of the privilege uses uppercase "T" and is referred as SeSystemTime. SeTakeOwnership Admin Built-in commands 1. takeown.exe /f "%windir%\system32"
2. icalcs.exe "%windir%\system32" /grant "%username%":F
3. Rename cmd.exe to utilman.exe
4. Lock the console and press Win+U Attack may be detected by some AV software.

Alternative method relies on replacing service binaries stored in "Program Files" using the same privilege. SeTcb Admin 3rd party tool Manipulate tokens to have local admin rights included. Sample code+exe creating arbitrary tokens to be found at PsBits (https://github.com/gtworek/PSBits/tree/master/VirtualAccounts). SeTimeZone Mess Built-in commands Change the timezone. tzutil /s "Chatham Islands Standard Time" SeTrustedCredManAccess ? ? ? SeUndock None - - The privilege is enabled when undocking, but never observed it checked to grant/deny access. In practice it means it is actually unused and cannot lead to any escalation. SeUnsolicitedInput None - - The privilege is not used in the Windows OS. Credits:
Aurélien Chalot (https://twitter.com/Defte_) - initial information about SeAssignPrimaryToken. vletoux (https://github.com/vletoux) - SeLoadDriver issue reporting. Walied Assar (https://twitter.com/waleedassar) - DoS with SeLockMemoryPrivilege and NtManagePartition() Qazeer (https://github.com/Qazeer) - SeBackupPrivilege exploitation (https://www.kitploit.com/search/label/Exploitation) details.

Download Priv2Admin (https://github.com/gtworek/Priv2Admin)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
OverRide : Binary Exploitation And Reverse-Engineering

OverRide is a explore disassembly, binary exploitation & reverse-engineering through 10 little challenges. In the folder for each level you will find: flag – password for next level README.md – how to find password source.c – the reverse engineered binary dissasembly_notes.md – notes on asm See the subject for more details. Getting Started First download from 42 OverRide.iso. Virtual Machine setup On […]

The post OverRide : Binary Exploitation And Reverse-Engineering appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Preventing MITM Attacks with VPN and HTTPS Everywhere — for everyone

https://cdn-images-1.medium.com/max/960/1*MZ69ynG90kkTY2UwqymB2A.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
New 21Nails Exim bugs expose millions of email servers to hacking

https://cdn-images-1.medium.com/max/766/1*-NeInUs7n97DDg18wN8vjA.jpeg
The maintainers of Exim have released patches to address as many as 21 security vulnerabilities in its software which could allow…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
MONITORING YOUR CHILD

Before I gave birth to my boys (13 years old twin), I dreaded raising a child, not because I didn’t like children but because I was scared…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack The Box — Worker: Walkthrough (without Metasploit)

https://cdn-images-1.medium.com/max/600/1*PSXrfjQHeBrYL-SqawSYhg.png
Hack The Box — Worker: Walkthrough (without Metasploit) | Windows Medium Level | svn | azure devops | roguepotato | virtual host routing

Continue reading on Medium »

Hacking on Medium
Making a Trojan file for Mac OS

https://cdn-images-1.medium.com/max/770/1*8w7jAKeDvii03BYXXbT2XQ.jpeg
Although Trojan Horses aren’t as popular on Mac OS as they are on Windows, that doesn’t mean Mac users aren’t vulnerable to these types of…

Continue reading on InfoSec Write-ups »