Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cybersecurity Prologue- III
https://cdn-images-1.medium.com/max/2600/0*Vihc8WMR9sysTNyP
Chapter one- “Core Security Principles’’ “cryptography” and “Cyber Attacks” in cybersecurity will amaze you
Continue reading on Bootcamp »
Cybersecurity Prologue- III
https://cdn-images-1.medium.com/max/2600/0*Vihc8WMR9sysTNyP
Chapter one- “Core Security Principles’’ “cryptography” and “Cyber Attacks” in cybersecurity will amaze you
Continue reading on Bootcamp »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
New Python malware backdoors VMware ESXi servers for remote access
New Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.
The new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.
They believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi’s OpenSLP service.
While the malware is technically capable of targeting Linux and Unix systems, too, Juniper’s analysts found multiple indications it was designed for attacks against ESXi.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside “/etc/rc.local.d/local.sh,” one of the few ESXi files that survive between reboots and is executed at startup.
Usually, that file is empty, apart from some advisory comments and an exit statement.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png
<figcaptionAdditional lines added on ESXi file (Juniper Networks)
One of those lines launches a Python script saved as “/store/packages/vmtools.py,” in a directory that stores VM disk images, logs, and more.
The script’s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.
“While the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,” explains Juniper Networks’ report.
“The name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.”
“The file begins with a VMware copyright consistent with publicly available examples and is taken character-for-character from an existing Python file provided by VMware.”
This script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.
The reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.
One of the threat actors’ actions observed by Juniper’s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.
Because the file used for setting this new configuration, “/etc/vmware/rhttpproxy/endpoints.conf,” is also backed up and restored after reboot, any modifications on it are persistent.
Trending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt MitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the “local.sh” file.
All configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]
New Python malware backdoors VMware ESXi servers for remote access
New Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.
The new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.
They believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi’s OpenSLP service.
While the malware is technically capable of targeting Linux and Unix systems, too, Juniper’s analysts found multiple indications it was designed for attacks against ESXi.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside “/etc/rc.local.d/local.sh,” one of the few ESXi files that survive between reboots and is executed at startup.
Usually, that file is empty, apart from some advisory comments and an exit statement.
https://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png
<figcaptionAdditional lines added on ESXi file (Juniper Networks)
One of those lines launches a Python script saved as “/store/packages/vmtools.py,” in a directory that stores VM disk images, logs, and more.
The script’s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.
“While the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,” explains Juniper Networks’ report.
“The name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.”
“The file begins with a VMware copyright consistent with publicly available examples and is taken character-for-character from an existing Python file provided by VMware.”
This script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.
The reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.
One of the threat actors’ actions observed by Juniper’s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.
Because the file used for setting this new configuration, “/etc/vmware/rhttpproxy/endpoints.conf,” is also backed up and restored after reboot, any modifications on it are persistent.
Trending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt MitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the “local.sh” file.
All configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking New Python malware backdoors VMware ESXi servers for remote access New Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png…
settings.
Finally, admins should restrict all incoming network connections to trusted hosts, and available security updates that address exploits used for initial compromise should be applied as soon as possible.
Trending: Kali Linux 2022.4 – New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/1-300x150.png JSON syntax hack allowed SQL injection payloads to be smuggled past WAFsDecember 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-21-300x150.png Cisco discloses high-severity IP phone bug with exploit codeDecember 9, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-20-300x150.png New Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesDecember 8, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-19-300x150.png Samsung Galaxy S22 hacked twice on first day of Pwn2Own TorontoDecember 7, 2022
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post New Python malware backdoors VMware ESXi servers for remote access first appeared on Black Hat Ethical Hacking.
Finally, admins should restrict all incoming network connections to trusted hosts, and available security updates that address exploits used for initial compromise should be applied as soon as possible.
Trending: Kali Linux 2022.4 – New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/1-300x150.png JSON syntax hack allowed SQL injection payloads to be smuggled past WAFsDecember 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-21-300x150.png Cisco discloses high-severity IP phone bug with exploit codeDecember 9, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-20-300x150.png New Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesDecember 8, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-19-300x150.png Samsung Galaxy S22 hacked twice on first day of Pwn2Own TorontoDecember 7, 2022
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post New Python malware backdoors VMware ESXi servers for remote access first appeared on Black Hat Ethical Hacking.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
View Private Tiktoks
Does anybody know an exploit to view the TikTok’s of private users? Thanks for any help!
[link] [comments]
View Private Tiktoks
Does anybody know an exploit to view the TikTok’s of private users? Thanks for any help!
[link] [comments]
certs and skills for pentester?
https://www.reddit.com/r/Pentesting/comments/zks7km/certs_and_skills_for_pentester/
<!-- SC_OFF -->I have sec+ and ceh, anything else I should learn and obtain ? <!-- SC_ON --> submitted by /u/Entire-Flight-8938 (https://www.reddit.com/user/Entire-Flight-8938)
[link] (https://www.reddit.com/r/Pentesting/comments/zks7km/certs_and_skills_for_pentester/) [comments] (https://www.reddit.com/r/Pentesting/comments/zks7km/certs_and_skills_for_pentester/)
https://www.reddit.com/r/Pentesting/comments/zks7km/certs_and_skills_for_pentester/
<!-- SC_OFF -->I have sec+ and ceh, anything else I should learn and obtain ? <!-- SC_ON --> submitted by /u/Entire-Flight-8938 (https://www.reddit.com/user/Entire-Flight-8938)
[link] (https://www.reddit.com/r/Pentesting/comments/zks7km/certs_and_skills_for_pentester/) [comments] (https://www.reddit.com/r/Pentesting/comments/zks7km/certs_and_skills_for_pentester/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Scscanner : Tool To Read Website Status Code Response From The Lists
Scscanner is tool to read website status code response from the lists. This tool have ability to filter only spesific status code, and save the result to a file.
Feature
* Slight dependency. This tool only need curl to be installed
* Multi-processing. Scanning will be more faster with multi-processing
* Filter status code. If you want only spesific status code (ex: 200) from the list, this tool will help you
Usage
┌──(miku㉿nakano)-[~/scscanner]
└─$ bash scscanner.sh
scscanner – Massive Status
Code Scanner Codename : EVA02
Example: bash scscanner.sh -l domain.txt -t 30 options:
-l Files contain lists of domain.
-t Adjust multi process. Default is 15
-f Filter status code.
-o Save to file.
-h Print this Help.
Adjust multi-process
bash scscanner.sh -l domain.txt -t 30
Using status code filter
bash scscanner.sh -l domain.txt -f 200
Using status code filter and save to file.
bash scscanner.sh -l domain.txt -f 200 -o result.txt
Screenshot
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgL8M4YCEGp0q-SNXkQZvEioyZ7l0QZs-MtrC9QqBbPtqjfQ8YLMxqhGMZ6axCy0nIS_ByQKFd0dSm5342Mw8mzn5IvHcJozmFYvOdLm8QzL0ZIT-R64noUmuSyU9UibFjXEjs7t4UJixE__XBLTQ0XU1CZuoX-_qYCJiAa9_YcKBbWRumwZ_oZCz_I/s708/scscanner.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-WsZE5OjxkBx212AR1j52C4gYdL9Ho4uGM2RrEn1WtQO3luOxWNpoR-Q3mHt7bEYSbgJHm2afjqaI8_Sb_zYoninC1cM-Yxohz4GBnF6NdnfS0iZIXPpqM4g0PAgBqjD7miphIj1ZdE9RZaUfRY5BhD35CwW9yQBCsxRk3JAE72DEu7kbA8_P5HBe/s708/scscanner1.png
To Do List
* Add multi-processing
* Add filter status code options
* Add save to file options
* Get title from page
Feel free to contribute if you want to improve this tools.
Click Here To Download
Scscanner : Tool To Read Website Status Code Response From The Lists
Scscanner is tool to read website status code response from the lists. This tool have ability to filter only spesific status code, and save the result to a file.
Feature
* Slight dependency. This tool only need curl to be installed
* Multi-processing. Scanning will be more faster with multi-processing
* Filter status code. If you want only spesific status code (ex: 200) from the list, this tool will help you
Usage
┌──(miku㉿nakano)-[~/scscanner]
└─$ bash scscanner.sh
scscanner – Massive Status
Code Scanner Codename : EVA02
Example: bash scscanner.sh -l domain.txt -t 30 options:
-l Files contain lists of domain.
-t Adjust multi process. Default is 15
-f Filter status code.
-o Save to file.
-h Print this Help.
Adjust multi-process
bash scscanner.sh -l domain.txt -t 30
Using status code filter
bash scscanner.sh -l domain.txt -f 200
Using status code filter and save to file.
bash scscanner.sh -l domain.txt -f 200 -o result.txt
Screenshot
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgL8M4YCEGp0q-SNXkQZvEioyZ7l0QZs-MtrC9QqBbPtqjfQ8YLMxqhGMZ6axCy0nIS_ByQKFd0dSm5342Mw8mzn5IvHcJozmFYvOdLm8QzL0ZIT-R64noUmuSyU9UibFjXEjs7t4UJixE__XBLTQ0XU1CZuoX-_qYCJiAa9_YcKBbWRumwZ_oZCz_I/s708/scscanner.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi-WsZE5OjxkBx212AR1j52C4gYdL9Ho4uGM2RrEn1WtQO3luOxWNpoR-Q3mHt7bEYSbgJHm2afjqaI8_Sb_zYoninC1cM-Yxohz4GBnF6NdnfS0iZIXPpqM4g0PAgBqjD7miphIj1ZdE9RZaUfRY5BhD35CwW9yQBCsxRk3JAE72DEu7kbA8_P5HBe/s708/scscanner1.png
To Do List
* Add multi-processing
* Add filter status code options
* Add save to file options
* Get title from page
Feel free to contribute if you want to improve this tools.
Click Here To Download
Hacking server using SSTI
These days we mostly witness website with more of dynamic content than the static content. There are several ways to achieve the mentioned…Continue reading on Medium »
Read more...
These days we mostly witness website with more of dynamic content than the static content. There are several ways to achieve the mentioned…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Solución — OhSINT [THM]
https://cdn-images-1.medium.com/max/612/1*uPx3VU6eZZo-kNDPgRFIgQ.png
Este CTF es muy distinto a los que venimos haciendo, ya que se enfoca en la recolección de información y no en obtener acceso a un…
Continue reading on Medium »
Solución — OhSINT [THM]
https://cdn-images-1.medium.com/max/612/1*uPx3VU6eZZo-kNDPgRFIgQ.png
Este CTF es muy distinto a los que venimos haciendo, ya que se enfoca en la recolección de información y no en obtener acceso a un…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Simplified Hacking - Criando Phishing de Websites e de Emails
https://cdn-images-1.medium.com/max/800/1*XOLDhVMP1dOgB33Uu9ynlA.jpeg
Quando navegamos pela internet, é muito comum encontrarmos diversos tipos de ameaças referentes a segurança de nossos dados, não é a toa…
Continue reading on Medium »
Simplified Hacking - Criando Phishing de Websites e de Emails
https://cdn-images-1.medium.com/max/800/1*XOLDhVMP1dOgB33Uu9ynlA.jpeg
Quando navegamos pela internet, é muito comum encontrarmos diversos tipos de ameaças referentes a segurança de nossos dados, não é a toa…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
HACKING Jeff [TryHackMe]: CTF CHALLENGE
https://cdn-images-1.medium.com/max/941/1*nyO6zJUybTfFnysx8zbo_g.png
Howdy, Player! Monday is a terrific day to hack into a web server. Today, a friend has set up a simple web server that has two hidden…
Continue reading on Medium »
HACKING Jeff [TryHackMe]: CTF CHALLENGE
https://cdn-images-1.medium.com/max/941/1*nyO6zJUybTfFnysx8zbo_g.png
Howdy, Player! Monday is a terrific day to hack into a web server. Today, a friend has set up a simple web server that has two hidden…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Find Out a WhatsApp Cheater
https://cdn-images-1.medium.com/max/1080/1*kdDm0ZVTEopUjdYsZOSHxQ.jpeg
Is your spouse acting weird lately? Do you find yourself lying in bed at night and doubting his fidelity or catching glimpses of WhatsApp…
Continue reading on Medium »
Find Out a WhatsApp Cheater
https://cdn-images-1.medium.com/max/1080/1*kdDm0ZVTEopUjdYsZOSHxQ.jpeg
Is your spouse acting weird lately? Do you find yourself lying in bed at night and doubting his fidelity or catching glimpses of WhatsApp…
Continue reading on Medium »
Codecepticon - .NET Application That Allows You To Obfuscate C#, VBA/VB6 (Macros), And PowerShell Source Code
http://www.kitploit.com/2022/12/codecepticon-net-application-that.html
http://www.kitploit.com/2022/12/codecepticon-net-application-that.html