exchange exploits

new discusion now active

ADS Polyglot!

ADS Shell execute hijacker


what is this?

1. Alternative Stream Injection (ADS) - Create hidden files in the target file

2. Shell Execute Hijack - Change the behavior of double-clicking a file

3. Support for two scripting engines: · JScript (first priority) · VBScript (backup and fallback)

4. Executable file attachment - Ability to add backdoor.exe as a stream


version 2


for malware development and red teaming

Books to better understand the kernel and the structure of the C++ language for writing drivers and exploiting kernel-side vulnerabilities

What is a Binary Tree?
A Binary Tree is a hierarchical data structure in which each node can have at most two children: a left child and a right child.

Each node contains data and two pointers (left and right).

The topmost node is called the Root, and nodes with no children are called Leaves.

It is widely used for fast searching, sorting, expression parsing, and representing hierarchical relationships.

Summary:
Queue and Deque are linear structures (like a line of people).

Binary Tree is a tree-like structure with parent-child relationships.

Difference between Binary Tree and Self-Balancing Binary Tree:

Regular Binary Tree:
Each node can have at most two children.

No mechanism to maintain height balance.

Can degenerate into a linked list in the worst case.

Time complexity: O(n) in worst case.

Self-Balancing Binary Tree:
Automatically maintains balance after insertions/deletions using rotations.
Height is always kept close to log(n).

Guaranteed O(log n) time for search, insert, and delete.
Popular types: AVL Tree and Red-Black Tree.

Summary: Use regular Binary Tree only for small or sorted data.

For large, random, or performance-critical data, always use Self-Balancing Binary Tree.

sample for self-balancing binary tree:

somethings in the way

دوستان نظرتون چیه دباره برگردیم سر توسعه این ربات و بیاریمش بالا ؟

♻️ The hacker robot has restarted. We are waiting for your support. 😊

🌐 USER :(t.me/Hacker_Leslie_bot?start)

How Do Mobile Phones Make Emergency Calls Without a SIM Card?

Mobile phones can make emergency calls (such as 112, 911, 999, etc.) even without a SIM card or active service.
This capability is mandatory under international standards (3GPP) and national laws.

How It Works:

1_ Emergency Call Mode (Limited Service Mode)
When you dial an emergency number, the phone automatically enters a special state. In this mode:
- Normal network registration and authentication processes are bypassed.
- The phone connects to any available cell tower with the strongest signal — even if it belongs to a different operator.
- Only emergency services are allowed.

2_ Role of IMSI and IMEI
- Without a SIM card, there is no IMSI.
- However, the device’s IMEI (hardware identifier) is always sent to the network.
- The network uses the IMEI to route the emergency call.

3_ Modern Networks (4G/5G)
Emergency calls can be handled through IMS (IP Multimedia Subsystem) using SIP protocol (VoLTE/VoNR), with fallback to older circuit-switched technology when necessary.

Practical Example Using AT Commands (for GSM modems)

import serial
import time

ser = serial.Serial('COM3', 115200, timeout=1)   # Change to your port

def send_at(cmd):
    ser.write((cmd + '\r\n').encode())
    time.sleep(1)
    print(ser.read_all().decode(errors='ignore'))

send_at('AT')           # Test connection
send_at('ATD112;')      # Dial emergency number 112
# send_at('ATD911;')    # For USA/Canada

Testing Tools

You can use tools like SSCOM, PuTTY, or minicom to send AT commands directly to the modem’s serial port.

OpenBTS and Lab Environments

OpenBTS is an open-source software that simulates a small GSM base station (BTS). It is commonly used in research and testing:
- It supports emergency calls.
- It uses SIP and Asterisk as backend.
- Useful for custom networks and rescue operations in areas without coverage.

Projects:

Vandor: https://github.com/batmanpriv/Vandor

ECHO: https://github.com/batmanpriv/ECHO

Had: https://github.com/batmanpriv/had

Telegram Reporter: https://github.com/esfelorm/Telegram-Reporter

Screen Locker: https://github.com/esfelorm/Screen-Locker

Modbus — The Deepest Industrial Protocol and Its Real Attacks

Modbus was introduced by Modicon in 1979 and is still one of the most widely used communication protocols in industrial control systems (ICS) in 2026. Its simplicity and reliability have made it the standard in most PLCs, RTUs, and industrial devices, despite its age.

---

Modbus Types

Modbus is implemented in four main modes:

1. Modbus RTU
- Compressed binary format
- Suitable for serial communication (RS-232 / RS-485)
- High speed and widely used in industrial environments
- Has CRC16 for integrity check

2. Modbus ASCII
- Text format (seven bits)
- Human-readable
- Slower than RTU and more used for debugging

3. Modbus TCP (the most common currently)
- TCP/IP-based version
- Uses port 502
- No CRC (because TCP has its own checksum)
- Suitable for Ethernet and IIoT networks

4. Modbus UDP
- Connectionless version
- Higher speed but no delivery guarantee
- Less commonly used

---

Detailed Structure of Modbus TCP Packet

Modbus TCP consists of two main parts:

1. MBAP Header (7 bytes)

- Transaction Identifier (2 bytes): To match request and response
- Protocol Identifier (2 bytes): Always 0x0000
- Length (2 bytes): Length of the next segment (Unit ID + PDU)
- Unit Identifier (1 byte): Slave address (usually 1)

2. PDU (Protocol Data Unit)

- Function Code (1 byte)

- Data (variable length)

A complete example of a Read Holding Registers (Function 03) packet:

Transaction ID : 00 01
Protocol ID    : 00 00
Length        : 00 06
Unit ID        : 01
Function Code   : 03
Starting Address: 00 00
Quantity       : 00 0A

---

Sensitive and Dangerous Function Codes

In order (function code, title, level, target)

01 / 02   | Read Coils / Discrete Inputs      | Medium    | Reconnaissance

03 / 04   | Read Holding / Input Registers   | High     | Data LeakageCommand Injection / Actuator Control

15 / 16    | Write Multiple Coils / Registers | Very High | Mass Control / Process Manipulation

08     | Diagnostics | High      | DoS, Device Reset

43 (0x2B)    | Encapsulated Interface Transport | Very High | Backdoor, Vendor-Specific RCE

---

Real and Famous Attacks on Modbus Protocol

- Stuxnet (2010): The first physical cyberattack in history. Used Modbus to change the frequency of uranium enrichment centrifuges.
- Industroyer / CrashOverride (2016): Attack on the Ukrainian power grid. Modbus TCP was used to control breakers and cause blackouts.
- Oldsmar Water Attack (2021): An attacker infiltrated the SCADA system of the city of Oldsmar, Florida via the Internet and used Modbus to greatly increase the amount of sodium hydroxide (caustic soda).
- Multiple attacks by APT groups (such as Sandworm and APT33) in 2023–2026, mainly using Write Function Codes (05, 06, 15, 16) to manipulate physical processes.

---

Actual Attack Techniques and Payloads

1. Reconnaissance (Function 03)

# Read first 100 registers
packet = b'\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x64'

2. Write Single Register (Function 06) — Direct Control

# Change the value of a register to the maximum (e.g. motor speed)
payload = struct.pack(">HH", 0x0000, 0xFFFF)   # Address 0, Value 65535

3. Mass Write (Function 16) — Control

# Write 20 registers with dangerous values
values ​​= [0xFFFF] * 20
payload = struct.pack(">HH", 0x0000, 20) + struct.pack(">" + "H"*20, *values)

4. DoS and Crash Payload
- Sending PDU with very large or zero Length Field
- Invalid Function Codes (0x80 to 0xFF)
- Very long Payloads (more than 250 bytes) can also be mentioned
- Rapid repetition of requests with the same Transaction ID

5. Replay Attack
Capturing packets and replaying them at the right time to cause physical disruption.

نسخه فارسی✅
-----

Modbus — عمیق‌ترین پروتکل صنعتی و حملات واقعی آن

Modbus در سال ۱۹۷۹ توسط شرکت Modicon معرفی شد و هنوز هم در سال ۲۰۲۶ یکی از پرکاربردترین پروتکل‌های ارتباطی در سیستم‌های کنترل صنعتی (ICS) است. سادگی و قابلیت اطمینان آن باعث شده که علی‌رغم قدیمی بودن، در اکثر PLC ها ، RTUها و دستگاه‌های صنعتی استفاده شود.

---
انواع Modbus

Modbus در چهار حالت اصلی پیاده‌سازی می‌شود:

1. Modbus RTU 
   - فرمت باینری فشرده 
   - مناسب ارتباط سریال (RS-232 / RS-485) 
   - سرعت بالا و پرکاربرد در محیط‌های صنعتی 
   - دارای CRC16 برای چک integrity

2. Modbus ASCII 
   - فرمت متنی (هفت‌بیت) 
   - قابل خواندن توسط انسان 
   - کندتر از RTU و بیشتر برای دیباگ استفاده می‌شود

3. Modbus TCP (رایج‌ترین در حال حاضر) 
   - نسخه مبتنی بر TCP/IP 
   - استفاده از پورت ۵02 
   - فاقد CRC (چون TCP خودش checksum دارد) 
   - مناسب شبکه‌های Ethernet و IIoT

4. Modbus UDP 
   - نسخه بدون اتصال (Connectionless) 
   - سرعت بالاتر اما بدون تضمین تحویل 
   - کمتر استفاده می‌شود

---

ساختار دقیق Modbus TCP Packet

Modbus TCP از دو بخش اصلی تشکیل شده است:

1. MBAP Header (7 بایت)

- Transaction Identifier (2 بایت): برای تطبیق درخواست و پاسخ
- Protocol Identifier (2 بایت): همیشه 0x0000
- Length (2 بایت): طول بخش بعدی (Unit ID + PDU)
- Unit Identifier (1 بایت): آدرس Slave (معمولاً 1)

2. PDU (Protocol Data Unit)

- Function Code (1 بایت)
- Data (طول متغیر)

مثال کامل یک پکت Read Holding Registers (Function 03):

Transaction ID : 00 01
Protocol ID    : 00 00
Length         : 00 06
Unit ID        : 01
Function Code  : 03
Starting Address: 00 00
Quantity       : 00 0A

---

Function Code های حساس و خطرناک

به ترتیب (function code ، عنوان ، سطح ، هدف)

01 / 02   | Read Coils / Discrete Inputs     | متوسط   | Reconnaissance              

03 / 04   | Read Holding / Input Registers   | بالا     | Data Leakage                    

05 / 06    | Write Single Coil / Register     | بسیار بالا | Command Injection / Actuator Control

15 / 16    | Write Multiple Coils / Registers | بسیار بالا | Mass Control / Process Manipulation

08     | Diagnostics | بالا     | DoS, Device Reset               

43 (0x2B)    | Encapsulated Interface Transport | بسیار بالا | Backdoor, Vendor-Specific RCE

---

حملات واقعی و معروف روی پروتکل Modbus

- Stuxnet (2010): اولین حمله سایبری فیزیکی تاریخ. از Modbus برای تغییر فرکانس سانتریفیوژهای غنی‌سازی اورانیوم استفاده کرد.
- Industroyer / CrashOverride (2016): حمله به شبکه برق اوکراین. از Modbus TCP برای کنترل Breakerها و ایجاد blackout استفاده شد.
- Oldsmar Water Attack (2021): مهاجم از طریق اینترنت به سیستم SCADA شهر Oldsmar فلوریدا نفوذ کرد و با Modbus مقدار سدیم هیدروکسید (سود سوزآور) را به شدت افزایش داد.
- حملات متعدد گروه‌های APT (مانند Sandworm و APT33) در سال‌های ۲۰۲۳–۲۰۲۶ که عمدتاً از Write Function Codeها (05, 06, 15, 16) برای دستکاری فرآیندهای فیزیکی استفاده کرده‌اند.

---

تکنیک‌های حمله و Payload های واقعی

1. Reconnaissance (Function 03)

# خواندن 100 رجیستر اول
packet = b'\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x64'

2. Write Single Register (Function 06) — کنترل مستقیم

# تغییر مقدار یک رجیستر به حداکثر (مثلا سرعت موتور)
payload = struct.pack(">HH", 0x0000, 0xFFFF)   # Address 0, Value 65535

3. Mass Write (Function 16) — کنترل

# نوشتن 20 رجیستر با مقادیر خطرناک
values = [0xFFFF] * 20
payload = struct.pack(">HH", 0x0000, 20) + struct.pack(">" + "H"*20, *values)

4. DoS و Crash Payload
- ارسال PDU با Length Field بسیار بزرگ یا صفر
- Function Code های نامعتبر (0x80 تا 0xFF)
- می توان به Payload های بسیار طولانی (بیش از ۲۵۰ بایت) هم اشاره کرد
- تکرار سریع درخواست‌ها با همان Transaction ID

5. Replay Attack
ضبط پکت‌ها و پخش مجدد آنها در زمان مناسب برای ایجاد اختلال فیزیکی.

A powerful Modbus fuzzer designed for penetration testing this protocol is currently under development and will be released on the channel by next week Additionally a GSM fuzzer will be uploaded to the channel within the next two weeks.