Ubisoft send 2FA recovery code by email
🗣-d4v3-
Once someone has access to your email they can take away the 2FA anyways. So it's not really weird or smth
👤Axua247
🎖@malwr
🗣-d4v3-
Once someone has access to your email they can take away the 2FA anyways. So it's not really weird or smth
👤Axua247
🎖@malwr
Emotet file hashes, Compromised IP addresses and domains, and malicious powershell artifacts
While collecting malware samples on pastebin, my bot found an anonymous paste that contained a large amount of data relating to emotet.
It includes a section of file hashes, malicious IP addresses, compromised servers, compromised domains, and a few obfuscated powershell artifacts that look to either be post-exploitation or an alternative infection method.
File samples can be collected by simply using wget on a live compromised domain.
Here is a link to a reupload of the document:
https://pastebin.com/V6GGEPVA
🗣NovateI
🎖@malwr
While collecting malware samples on pastebin, my bot found an anonymous paste that contained a large amount of data relating to emotet.
It includes a section of file hashes, malicious IP addresses, compromised servers, compromised domains, and a few obfuscated powershell artifacts that look to either be post-exploitation or an alternative infection method.
File samples can be collected by simply using wget on a live compromised domain.
Here is a link to a reupload of the document:
https://pastebin.com/V6GGEPVA
🗣NovateI
🎖@malwr
Pastebin
Copy of An Emotet Report - Pastebin.com
Need to know how to setup a "Basic" Vulnerability Management program? Follow these steps to start 2020 off right in VM!
https://cyberpulse.tech/2020/01/21/create-a-basic-vulnerability-management-program/
🗣Siloras
🎖@malwr
https://cyberpulse.tech/2020/01/21/create-a-basic-vulnerability-management-program/
🗣Siloras
🎖@malwr
Cyberpulse
Create a basic Vulnerability Management program - Cyberpulse
Create a successful and modern Vulnerability Management program by following these phases. Plan, Design, and Execute the following steps to be secure!
Fake Company, Real Threats: Logs From a Smart Factory Honeypot - Security News
🗣_TM_dude
The most interesting part of this piece was the layout they used on their website to show the story.
It looks like it was running for several months, but didn't produce any revealing information. A few non-technical ransomware attacks. Simple stuff caused by poor security, which, I get it, it was mainly to show how weak security is a main point of entry. Not exactly revolutionary.
👤DegenerateJC
Disappointed. I wish the guy came from real APT group doing more sophisticated or unknown exploits. No PLC system were harmed or attempted.
👤thanoscsgo
I like the guy who acted like he was installing ransomware then renamed their files instead.
👤steezefries
🎖@malwr
🗣_TM_dude
The most interesting part of this piece was the layout they used on their website to show the story.
It looks like it was running for several months, but didn't produce any revealing information. A few non-technical ransomware attacks. Simple stuff caused by poor security, which, I get it, it was mainly to show how weak security is a main point of entry. Not exactly revolutionary.
👤DegenerateJC
Disappointed. I wish the guy came from real APT group doing more sophisticated or unknown exploits. No PLC system were harmed or attempted.
👤thanoscsgo
I like the guy who acted like he was installing ransomware then renamed their files instead.
👤steezefries
🎖@malwr
Trendmicro
Fake Company, Real Threats: Logs From a Smart Factory Honeypot
To determine threat actors' degree of knowledge in compromising a smart factory, we deployed our most elaborate honeypot to date. The incidents we observed show the kinds of attacks that can easily affect poorly secured manufacturing environments.
Problems with cracking a program with OllyDBG ( debugging )
Basically it's a game bot that used to be free to many players and now the owner of this bot ( who didn't even make this bot 100% himself ) made it VIP version and demands 20 bucks from everyone. I don't wanna pay for it and my new project is to crack it free.
So when i open the injector ( bot ) it opens a CMD and does some codes, 2 seconds later the CMD is gone and the bot launches. This was in the free version.. now after CMD vanishes, it opens a small window that says '' VIP IS REQUIRED '' and also opens a small image called '' splash screen '' and the image has a text '' VIP required '' at the same time it opens my google chrome and takes me to the '' VIP '' website.
How can i crack this? I've tried watching some videos about OllyDBG and changing the memory, but i can't find the memory for those things at all.
There are 3 DLL files ( 1 main DLL ) and the injector of course, what should i do? Are there easier ways to pass this than debugging?
EDIT: i've tried searching for certain texts in OllyDBG such as '' VIP '', '' free '', '' VIP is required '' and other stuff.. no luck. I have no idea how to find a memory to change or remove that '' VIP '' sign lol
EDIT 2: I tried opening the DLL file with '' JetBrains '' and copy the whole botting scripts and make my own bot but i couldn't find any scripts on the DLL files and it was full of codes, too complex :D.. even though the script on this small video game is pretty small lol
🗣BalkanRay
RE (reverse engineering) took me about seven years in IT and net sec to get into.
Between day zero year 1, and day 365 year 7 I...
- learned to write C
- learned to read / bang around assembly
- picked up OS and CPU specific knowledge
- learned many programming concepts
- several crash courses on RE
- 100s of hours with true wizards at this
- attended dozens of hack-a-thons
- finally ended up knowing several debugging tools enough when to use others.
Yes there is a 5 year old kid who likely blasts us all out of the park some where.
My point is, you need to try applying some staged learning here.
Crawl, walk, then run.
My first suggestion is to start getting a few methods of extracting strings and comments from the file.
👤eggumlaut
🎖@malwr
Basically it's a game bot that used to be free to many players and now the owner of this bot ( who didn't even make this bot 100% himself ) made it VIP version and demands 20 bucks from everyone. I don't wanna pay for it and my new project is to crack it free.
So when i open the injector ( bot ) it opens a CMD and does some codes, 2 seconds later the CMD is gone and the bot launches. This was in the free version.. now after CMD vanishes, it opens a small window that says '' VIP IS REQUIRED '' and also opens a small image called '' splash screen '' and the image has a text '' VIP required '' at the same time it opens my google chrome and takes me to the '' VIP '' website.
How can i crack this? I've tried watching some videos about OllyDBG and changing the memory, but i can't find the memory for those things at all.
There are 3 DLL files ( 1 main DLL ) and the injector of course, what should i do? Are there easier ways to pass this than debugging?
EDIT: i've tried searching for certain texts in OllyDBG such as '' VIP '', '' free '', '' VIP is required '' and other stuff.. no luck. I have no idea how to find a memory to change or remove that '' VIP '' sign lol
EDIT 2: I tried opening the DLL file with '' JetBrains '' and copy the whole botting scripts and make my own bot but i couldn't find any scripts on the DLL files and it was full of codes, too complex :D.. even though the script on this small video game is pretty small lol
🗣BalkanRay
RE (reverse engineering) took me about seven years in IT and net sec to get into.
Between day zero year 1, and day 365 year 7 I...
- learned to write C
- learned to read / bang around assembly
- picked up OS and CPU specific knowledge
- learned many programming concepts
- several crash courses on RE
- 100s of hours with true wizards at this
- attended dozens of hack-a-thons
- finally ended up knowing several debugging tools enough when to use others.
Yes there is a 5 year old kid who likely blasts us all out of the park some where.
My point is, you need to try applying some staged learning here.
Crawl, walk, then run.
My first suggestion is to start getting a few methods of extracting strings and comments from the file.
👤eggumlaut
🎖@malwr
reddit
Problems with cracking a program with OllyDBG ( debugging )
Basically it's a game bot that used to be free to many players and now the owner of this bot ( who didn't even make this bot 100% himself ) made...
Docker container that logs all DNS and new outbound TCP/UDP connections.
Finally got this Docker container ready that can log all DNS and new outbound TCP/UDP connections using a modified version of suricata, an open source intrusion detection system.
If you log DNS requests, this takes it one step further by matching your outbound traffic with DNS requests. This means that it can detect traffic that might be DoH (DNS over https).
Tested using a workstation running Ubuntu (host and container). Alpha software, so please don't use this on a production network. Happy to make modifications it if you have a use case that others will benefit from.
https://github.com/morsgiathatch/suricata\_edits/tree/master/DOCKER/syn\_detector
🗣1stOctet
🎖@malwr
Finally got this Docker container ready that can log all DNS and new outbound TCP/UDP connections using a modified version of suricata, an open source intrusion detection system.
If you log DNS requests, this takes it one step further by matching your outbound traffic with DNS requests. This means that it can detect traffic that might be DoH (DNS over https).
Tested using a workstation running Ubuntu (host and container). Alpha software, so please don't use this on a production network. Happy to make modifications it if you have a use case that others will benefit from.
https://github.com/morsgiathatch/suricata\_edits/tree/master/DOCKER/syn\_detector
🗣1stOctet
🎖@malwr
GitHub
suricata_edits/DOCKER/syn_detector at master · morsgiathatch/suricata_edits
Contribute to morsgiathatch/suricata_edits development by creating an account on GitHub.
SpecterOps Adversary Tactics: PowerShell course material:
https://github.com/specterops/at-ps
ℹ️ Just released (2 hours ago) ℹ️
🎖@malwr
https://github.com/specterops/at-ps
ℹ️ Just released (2 hours ago) ℹ️
🎖@malwr
GitHub
GitHub - SpecterOps/at-ps: Adversary Tactics - PowerShell Training
Adversary Tactics - PowerShell Training. Contribute to SpecterOps/at-ps development by creating an account on GitHub.
Cracking my first WPA2 password! (It’s my home network)
🗣Perellex_Music
Do you still need to collect I think it use to be 100K or 1M "good packets"?
👤drman769
Dictionary attack? What dictionary file did you use?
👤acousticcoupler
Use hashcat for GPU cracking with almost 12000 H/s speed ( GPU specific ) and it cracks passwords with more ease cause it doesn't even requires a wordlist , it creates of its own.
Good luck
👤Jidnyesh
🎖@malwr
🗣Perellex_Music
Do you still need to collect I think it use to be 100K or 1M "good packets"?
👤drman769
Dictionary attack? What dictionary file did you use?
👤acousticcoupler
Use hashcat for GPU cracking with almost 12000 H/s speed ( GPU specific ) and it cracks passwords with more ease cause it doesn't even requires a wordlist , it creates of its own.
Good luck
👤Jidnyesh
🎖@malwr
