Forwarded from Exploiting Crew (Pr1vAt3)
Exchdefender constantly checks the files within the directory C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth, a known directory to be used to host WebShells. The malware is specifically interested in the file “ExpiredPasswords.aspx” which was reported to be the name used to obscure the HyperShell backdoor used by APT34 (aka. OilRig). If the file exists, the malware immediately deletes it.
Our assessment is that this tool is used to “protect” the compromised Exchange Server by deleting potential WebShells so Prometei will remain the only malware using its resources.
Our assessment is that this tool is used to “protect” the compromised Exchange Server by deleting potential WebShells so Prometei will remain the only malware using its resources.
Forwarded from Exploiting Crew (Pr1vAt3)
SearchIndexer.exe:
SearchIndexer.exe is an open source Monero mining software (XMRig miner). It is executed with the content from “desktop.dat” file as a parameter, which contains the mining server and the username for the mining server:
prometei-blog-image-8
Content of Desktop.dat
Following the investigation, it appears that the user is “banned due to reports of botnet mining” from around March 2021, and it’s very likely that the attackers have changed the user already:
SearchIndexer.exe is an open source Monero mining software (XMRig miner). It is executed with the content from “desktop.dat” file as a parameter, which contains the mining server and the username for the mining server:
prometei-blog-image-8
Content of Desktop.dat
Following the investigation, it appears that the user is “banned due to reports of botnet mining” from around March 2021, and it’s very likely that the attackers have changed the user already:
Forwarded from Exploiting Crew (Pr1vAt3)
Netwalker.7z
The Netwalker.7z archive downloaded from the C2 178.21.164[.]68 is password protected, using the password “horhor123”. The content of the archive is saved under C:\Windows\dell, together with the other components of the bot. The archive contains the following files: Nethelper2.exe, Nethelper4.exe, Windrlver.exe, a few DLLs,a copy of RdpcIip.exe and a few DLLs used by the bot components
The Netwalker.7z archive downloaded from the C2 178.21.164[.]68 is password protected, using the password “horhor123”. The content of the archive is saved under C:\Windows\dell, together with the other components of the bot. The archive contains the following files: Nethelper2.exe, Nethelper4.exe, Windrlver.exe, a few DLLs,a copy of RdpcIip.exe and a few DLLs used by the bot components
Forwarded from Exploiting Crew (Pr1vAt3)
RdpcIip.exe:
RdcIip.exe (with a capital “I” instead of a lowercase “L”) is both downloaded directly by sqhost.exe and is also contained in the Netwalker.7z archive". It is a key component of the malware. It has huge (trust us, huge) functionality with different branches with the main purpose being to interact with other components of the malware and make them work all together.
RdpcIip is responsible for some of the most important functions of the malware - harvesting credentials (using another component called Miwalk.exe) and spreading across the network using the stolen credentials as well as using the SMB exploit EternalBlue and the RDP exploit BlueKeep.
RdcIip.exe (with a capital “I” instead of a lowercase “L”) is both downloaded directly by sqhost.exe and is also contained in the Netwalker.7z archive". It is a key component of the malware. It has huge (trust us, huge) functionality with different branches with the main purpose being to interact with other components of the malware and make them work all together.
RdpcIip is responsible for some of the most important functions of the malware - harvesting credentials (using another component called Miwalk.exe) and spreading across the network using the stolen credentials as well as using the SMB exploit EternalBlue and the RDP exploit BlueKeep.
🦑Crypto-bruteforce:
Overview of Features:
1. Mnemonic Generation and Verification:
- Generates random BIP39 mnemonic phrases.
- Verifies mnemonics for Ethereum, BNB, and Dogecoin wallets.
2. Standalone Execution:
- Comes with precompiled binaries for direct use without needing Python installed.
- Binaries are available for download in its GitHub releases.
3. Automatic Setup:
- Automatically installs Python and dependencies (Cryptofuzz, Colorthon, Requests) if missing.
- Configures the environment for script execution.
4. Open Source:
- Fully open-source and accessible via GitHub.
---
### Installation & Usage:
#### 1. Standalone Binary:
- Download the binary file:
[DumperMnemonic.zip](https://github.com/welugroup/cryptocurency_catcher/releases/download/t/DumperMnemonic.zip)
- Extract and run the program without needing Python installed.
#### 2. Run with Git and Python:
- Clone the repository:
#### 3. Install Python Libraries:
If you prefer manual installation:
Or install from the requirements file:
#### 4. Running the Script:
- After dependencies are set:
---
### Potential Uses:
1. Crypto Wallet Testing:
Generate and test mnemonic phrases for various blockchain networks.
2. Education and Learning:
Useful for understanding mnemonic creation, address derivation, and seed phrase management.
3. Exploration of Mnemonic Systems:
Analyze the security and randomness of generated mnemonics.
---
### GitHub Link:
Access the tool and documentation here:
[Dumper Mnemonic Repository](https://github.com/welugroup/cryptocurency_catcher)
Let me know if you'd like further assistance with setup or usage!
Overview of Features:
1. Mnemonic Generation and Verification:
- Generates random BIP39 mnemonic phrases.
- Verifies mnemonics for Ethereum, BNB, and Dogecoin wallets.
2. Standalone Execution:
- Comes with precompiled binaries for direct use without needing Python installed.
- Binaries are available for download in its GitHub releases.
3. Automatic Setup:
- Automatically installs Python and dependencies (Cryptofuzz, Colorthon, Requests) if missing.
- Configures the environment for script execution.
4. Open Source:
- Fully open-source and accessible via GitHub.
---
### Installation & Usage:
#### 1. Standalone Binary:
- Download the binary file:
[DumperMnemonic.zip](https://github.com/welugroup/cryptocurency_catcher/releases/download/t/DumperMnemonic.zip)
- Extract and run the program without needing Python installed.
#### 2. Run with Git and Python:
- Clone the repository:
git clone https://github.com/welugroup/cryptocurency_catcher
cd cryptocurency_catcher
python DumperMnemonic.py
#### 3. Install Python Libraries:
If you prefer manual installation:
pip install cryptofuzz
pip install colorthon
pip install requests
pip install requests-random-user-agent
Or install from the requirements file:
pip install -r requirements.txt
#### 4. Running the Script:
- After dependencies are set:
python DumperMnemonic.py
---
### Potential Uses:
1. Crypto Wallet Testing:
Generate and test mnemonic phrases for various blockchain networks.
2. Education and Learning:
Useful for understanding mnemonic creation, address derivation, and seed phrase management.
3. Exploration of Mnemonic Systems:
Analyze the security and randomness of generated mnemonics.
---
### GitHub Link:
Access the tool and documentation here:
[Dumper Mnemonic Repository](https://github.com/welugroup/cryptocurency_catcher)
Let me know if you'd like further assistance with setup or usage!
GitHub
GitHub - welugroup/cryptocurency_catcher: Crypto bruteforce tool, source code
Crypto bruteforce tool, source code. Contribute to welugroup/cryptocurency_catcher development by creating an account on GitHub.
Forwarded from Exploiting Crew (Pr1vAt3)
Breach Sites / Discovery Tools:
https://github.com/antonlindstrom/passpwn whatbreach h8mail hibp
https://github.com/hmaverickadams/breach-parse
https://github.com/KathanP19/BreachedDataScraper
https://github.com/ofarukcaki/dataleaks
https://github.com/xakepnz/BLUELAY https://github.com/jayyogesh/BaseQuery
https://github.com/artofscripting/PySearchBreachCompilation
https://github.com/chparmley/FB-Breach-Checker
https://github.com/FreiBj/data-breach-formatter
https://github.com/p4wnsolo/EmailPwnCheckerbot ( this is also a great Selenium example )
https://github.com/GihuMendes/breach-parse/blob/main/parser.sh ( parse COMB with simple Python )
https://github.com/SagarSRJ/Breach-Parser ( parse .csv )
https://github.com/davieking1/breachpearser ( parse COMB )
https://github.com/TheFern2/breach-parse.py/tree/main/breach_parse ( parse COMB - looks recent )
https://github.com/FreeZeroDays/breach-rip ( faster COMB parser )
https://github.com/alivirgo/read-a-password-file-huge-lists
https://github.com/martintjj/BreachCompilation ( tools in Breach Compilation - 4 yrs old )
https://github.com/jesusgoku/targz-search ( search .txt files within .tar.gz files )
https://github.com/antonlindstrom/passpwn whatbreach h8mail hibp
https://github.com/hmaverickadams/breach-parse
https://github.com/KathanP19/BreachedDataScraper
https://github.com/ofarukcaki/dataleaks
https://github.com/xakepnz/BLUELAY https://github.com/jayyogesh/BaseQuery
https://github.com/artofscripting/PySearchBreachCompilation
https://github.com/chparmley/FB-Breach-Checker
https://github.com/FreiBj/data-breach-formatter
https://github.com/p4wnsolo/EmailPwnCheckerbot ( this is also a great Selenium example )
https://github.com/GihuMendes/breach-parse/blob/main/parser.sh ( parse COMB with simple Python )
https://github.com/SagarSRJ/Breach-Parser ( parse .csv )
https://github.com/davieking1/breachpearser ( parse COMB )
https://github.com/TheFern2/breach-parse.py/tree/main/breach_parse ( parse COMB - looks recent )
https://github.com/FreeZeroDays/breach-rip ( faster COMB parser )
https://github.com/alivirgo/read-a-password-file-huge-lists
https://github.com/martintjj/BreachCompilation ( tools in Breach Compilation - 4 yrs old )
https://github.com/jesusgoku/targz-search ( search .txt files within .tar.gz files )
GitHub
GitHub - antonlindstrom/passpwn: See if your passwords in pass has been breached.
See if your passwords in pass has been breached. Contribute to antonlindstrom/passpwn development by creating an account on GitHub.
🦑ChatGPT Jailbreaking prompts, exploits and other fun stuff:
https://gist.github.com/jahtzee/5d02b310b1d39b047664bec20a9be17c
https://gist.github.com/jahtzee/5d02b310b1d39b047664bec20a9be17c
Gist
ChatGPT Jailbreaking prompts, exploits and other fun stuff
ChatGPT Jailbreaking prompts, exploits and other fun stuff - prompts.txt
Forwarded from Exploiting Crew (Pr1vAt3)
🦑Top password lists generated from leaks collected from different paste sites:
https://github.com/rndinfosecguy/pastePasswordLists
https://github.com/rndinfosecguy/pastePasswordLists
GitHub
GitHub - rndinfosecguy/pastePasswordLists: Top password lists generated from leaks collected from different paste sites
Top password lists generated from leaks collected from different paste sites - rndinfosecguy/pastePasswordLists
🌐 Common Networking Port Numbers:
1️⃣ Port 22 (SSH): Used for Secure Shell (SSH) connections, enabling secure access to remote servers.
2️⃣ Port 80 (HTTP): The standard port for unencrypted web traffic; used by HTTP protocols for web browsing.
3️⃣ Port 443 (HTTPS): Secure HTTP port, vital for encrypted web traffic, ensuring safe data transfer online.
4️⃣ Port 53 (DNS): Domain Name System port, used for translating domain names to IP addresses.
5️⃣ Port 25 (SMTP): Simple Mail Transfer Protocol, responsible for email transmission.
6️⃣ Port 1433 (SQL Server): Microsoft SQL Server communication port, essential for database interactions.
7️⃣ Port 3389 (RDP): Remote Desktop Protocol port, used for remote access to Windows servers.
8️⃣ Port 3306 (MySQL): Default port for MySQL database connections.
9️⃣ Port 123 (NTP): Network Time Protocol, used to synchronize time across systems.
Source: Linkedin
1️⃣ Port 22 (SSH): Used for Secure Shell (SSH) connections, enabling secure access to remote servers.
2️⃣ Port 80 (HTTP): The standard port for unencrypted web traffic; used by HTTP protocols for web browsing.
3️⃣ Port 443 (HTTPS): Secure HTTP port, vital for encrypted web traffic, ensuring safe data transfer online.
4️⃣ Port 53 (DNS): Domain Name System port, used for translating domain names to IP addresses.
5️⃣ Port 25 (SMTP): Simple Mail Transfer Protocol, responsible for email transmission.
6️⃣ Port 1433 (SQL Server): Microsoft SQL Server communication port, essential for database interactions.
7️⃣ Port 3389 (RDP): Remote Desktop Protocol port, used for remote access to Windows servers.
8️⃣ Port 3306 (MySQL): Default port for MySQL database connections.
9️⃣ Port 123 (NTP): Network Time Protocol, used to synchronize time across systems.
Source: Linkedin
Forwarded from Exploiting Crew (Pr1vAt3)
🦑Use or automate Telegram like a pro
Telegram Messenger CLI:
A command-line interface (CLI) for Telegram that allows interacting with the Telegram messaging platform directly from the terminal. It provides features like messaging, contact management, and integration with the Telegram API, making it a powerful tool for developers and automation enthusiasts.
---
### Key Features:
1. API Integration: Full access to Telegram's API and MTProto protocol.
2. Command-Line Interaction:
- Messaging.
- Managing contacts and chats.
- Forwarding and deleting messages.
3. Customization:
- Supports TAB completion and command history.
- Configurable paths for server keys and data files.
4. Cross-Platform Compatibility:
- Available for Linux, BSDs, macOS, and other Unix-like systems.
5. Extensibility:
- Python integration for scripting and automation.
---
### Installation:
#### Clone Repository:
#### Dependencies:
Install the required libraries:
- Ubuntu/Debian:
- Fedora:
- Arch Linux:
- macOS (Homebrew):
#### Build and Configure:
---
### Usage:
#### Basic Run:
#### Commands:
- Messaging:
- Contacts:
- Chats:
- Message Management:
#### Special Notes:
- Use TAB to auto-complete peer names and commands.
- Peer names:
- Users: Replace spaces with underscores (e.g.,
- Chats: Use the chat title, replacing spaces with underscores.
- Encrypted chats: Prefix with
---
### Upgrading:
When upgrading to version 1.0:
1. Binary moved to
2. Config directory updated to
3. Requires re-login due to database incompatibility.
4. Peer names now use
---
### GitHub Repository:
Find the full documentation, source code, and issue tracker here:
[Telegram CLI Repository](https://github.com/vysheng/tg)
---
This tool is ideal for automation, server-side Telegram management, and for developers looking to integrate Telegram functionality into their workflows. Let me know if you'd like further help with scripting or configuring Telegram CLI!
Telegram Messenger CLI:
A command-line interface (CLI) for Telegram that allows interacting with the Telegram messaging platform directly from the terminal. It provides features like messaging, contact management, and integration with the Telegram API, making it a powerful tool for developers and automation enthusiasts.
---
### Key Features:
1. API Integration: Full access to Telegram's API and MTProto protocol.
2. Command-Line Interaction:
- Messaging.
- Managing contacts and chats.
- Forwarding and deleting messages.
3. Customization:
- Supports TAB completion and command history.
- Configurable paths for server keys and data files.
4. Cross-Platform Compatibility:
- Available for Linux, BSDs, macOS, and other Unix-like systems.
5. Extensibility:
- Python integration for scripting and automation.
---
### Installation:
#### Clone Repository:
git clone --recursive https://github.com/vysheng/tg.git && cd tg
#### Dependencies:
Install the required libraries:
- Ubuntu/Debian:
sudo apt-get install libreadline-dev libconfig-dev libssl-dev lua5.2 liblua5.2-dev libevent-dev libjansson-dev libpython-dev make
- Fedora:
sudo dnf install lua-devel openssl-devel libconfig-devel readline-devel libevent-devel libjansson-devel python-devel
- Arch Linux:
yaourt -S telegram-cli-git
- macOS (Homebrew):
brew install libconfig readline lua python libevent jansson
export CFLAGS="-I/usr/local/include -I/usr/local/Cellar/readline/6.3.8/include"
export LDFLAGS="-L/usr/local/lib -L/usr/local/Cellar/readline/6.3.8/lib"
#### Build and Configure:
./configure
make
---
### Usage:
#### Basic Run:
bin/telegram-cli -k tg-server.pub
#### Commands:
- Messaging:
msg <peer> <Text>
fwd <user> <msg-seqno>
mark_read <peer>
- Contacts:
add_contact <phone-number> <first-name> <last-name>
rename_contact <user> <first-name> <last-name>
- Chats:
chat_with_peer <peer>
- Message Management:
delete_msg <msg-seqno>
restore_msg <msg-seqno>
#### Special Notes:
- Use TAB to auto-complete peer names and commands.
- Peer names:
- Users: Replace spaces with underscores (e.g.,
John_Doe).- Chats: Use the chat title, replacing spaces with underscores.
- Encrypted chats: Prefix with
! (e.g., !John_Doe).---
### Upgrading:
When upgrading to version 1.0:
1. Binary moved to
./bin and renamed to telegram-cli.2. Config directory updated to
${HOME}/.telegram-cli.3. Requires re-login due to database incompatibility.
4. Peer names now use
@ instead of #.---
### GitHub Repository:
Find the full documentation, source code, and issue tracker here:
[Telegram CLI Repository](https://github.com/vysheng/tg)
---
This tool is ideal for automation, server-side Telegram management, and for developers looking to integrate Telegram functionality into their workflows. Let me know if you'd like further help with scripting or configuring Telegram CLI!
GitHub
GitHub - vysheng/tg: telegram-cli
telegram-cli. Contribute to vysheng/tg development by creating an account on GitHub.
🦑 ExplorerPatcher Installation and Configuration Guide
ExplorerPatcher enhances the Windows desktop experience, bringing back classic features like the Windows 10 taskbar, Start menu, and Alt+Tab interface on Windows 11.
### How to Install ExplorerPatcher
1. Download the Installer:
- Visit the official source to download the latest version of the setup program.
- Choose the appropriate version:
-
-
2. Run the Installer:
- Double-click the setup file.
- Accept the User Account Control (UAC) prompt for elevation.
- The installer will automatically add the required files.
3. Access ExplorerPatcher Settings:
- Once installation is complete, right-click the taskbar and select "Properties" to open the configuration interface.
### Customizing ExplorerPatcher
1. Windows 10 Taskbar on Windows 11:
- Go to the "Taskbar" section.
- Change the Taskbar style to Windows 10 (ExplorerPatcher).
2. Windows 10 Start Menu:
- Navigate to the "Start menu" section.
- Change the Start menu style to Windows 10.
3. Windows 10 Alt+Tab Interface:
- Open the "Window switcher" section.
- Set the Window switcher (Alt+Tab) style to Windows 10.
4. Explore Additional Features:
- Browse through other sections to tweak additional settings, such as system tray behavior, network icons, or window snapping.
### Important Notes
- Make sure your antivirus is configured to allow ExplorerPatcher to avoid interruptions.
- Regularly check for updates to stay compatible with the latest Windows 11 versions.
Download:
https://github.com/valinet/ExplorerPatcher
ExplorerPatcher enhances the Windows desktop experience, bringing back classic features like the Windows 10 taskbar, Start menu, and Alt+Tab interface on Windows 11.
### How to Install ExplorerPatcher
1. Download the Installer:
- Visit the official source to download the latest version of the setup program.
- Choose the appropriate version:
-
ep_setup.exe for Intel or AMD processors.-
ep_setup_arm64.exe for Snapdragon processors.2. Run the Installer:
- Double-click the setup file.
- Accept the User Account Control (UAC) prompt for elevation.
- The installer will automatically add the required files.
3. Access ExplorerPatcher Settings:
- Once installation is complete, right-click the taskbar and select "Properties" to open the configuration interface.
### Customizing ExplorerPatcher
1. Windows 10 Taskbar on Windows 11:
- Go to the "Taskbar" section.
- Change the Taskbar style to Windows 10 (ExplorerPatcher).
2. Windows 10 Start Menu:
- Navigate to the "Start menu" section.
- Change the Start menu style to Windows 10.
3. Windows 10 Alt+Tab Interface:
- Open the "Window switcher" section.
- Set the Window switcher (Alt+Tab) style to Windows 10.
4. Explore Additional Features:
- Browse through other sections to tweak additional settings, such as system tray behavior, network icons, or window snapping.
### Important Notes
- Make sure your antivirus is configured to allow ExplorerPatcher to avoid interruptions.
- Regularly check for updates to stay compatible with the latest Windows 11 versions.
Download:
https://github.com/valinet/ExplorerPatcher
GitHub
GitHub - valinet/ExplorerPatcher: This project aims to enhance the working environment on Windows
This project aims to enhance the working environment on Windows - valinet/ExplorerPatcher
🦑Modular penetration testing platform that enables you to write, test, and execute exploit code.
HatSploit Framework:
Installing Python
Most Unix-like systems (e.g., Ubuntu or Debian) already include Python. If not, or if you need the latest version, follow these steps:
1. Update your package list:
2. Install Python 3 and pip:
- This ensures both Python 3 and
3. Verify the installation:
- These commands should output the installed versions of Python and pip.
---
### Installing HatSploit
1. Install HatSploit Framework via pip:
2. Verify the installation:
- To confirm that HatSploit is installed correctly, try running the framework:
- If the command launches the framework, the installation was successful.
---
### Additional Notes
- Make sure you have git installed on your system to allow
- If you encounter permission issues during the
Let me know if you need further assistance!
HatSploit Framework:
Installing Python
Most Unix-like systems (e.g., Ubuntu or Debian) already include Python. If not, or if you need the latest version, follow these steps:
1. Update your package list:
sudo apt-get update
2. Install Python 3 and pip:
sudo apt-get install -y python3 python3-pip
- This ensures both Python 3 and
pip, the Python package manager, are installed.3. Verify the installation:
python3 --version
pip3 --version
- These commands should output the installed versions of Python and pip.
---
### Installing HatSploit
1. Install HatSploit Framework via pip:
pip3 install git+https://github.com/EntySec/HatSploit
2. Verify the installation:
- To confirm that HatSploit is installed correctly, try running the framework:
hatsploit
- If the command launches the framework, the installation was successful.
---
### Additional Notes
- Make sure you have git installed on your system to allow
pip3 to clone the GitHub repository. If not, install it using:sudo apt-get install -y git
- If you encounter permission issues during the
pip3 install step, try adding --user to the command or use sudo.Let me know if you need further assistance!
GitHub
GitHub - EntySec/HatSploit: Modular penetration testing platform that enables you to write, test, and execute exploit code.
Modular penetration testing platform that enables you to write, test, and execute exploit code. - EntySec/HatSploit