Reporter Laurent Oudot
We wanted to let you know that TEHTRI-Security will release many 0days
and offensive technologies during a new training called :
- "Hunting Web Attackers"
It will be proposed during HackInTheBox SecConf Malaysia 2010 in
October, in Kuala Lumpur.
The 0days will be disclosed under a NDA (for students only) and will
help at fighting back web attackers, as we already explained in the past
in China and in Singapore (SyScan).
As a teaser, this email contains one of our remote 0day exploits. We
also found 0days against Zeus, Eleonore, CrimePack, etc.
Our self-defense cyber-weapons will be disclosed during this training.
------ BEGIN Security Advisory ------
Vuln : TEHTRI-SA-2010-018
Tool : LuckySploit Exploit Pack
Title: Remote execution in LuckySploit
LuckySploit is a tool used by attackers to penetrate companies or
personal computers by abusing client-side vulnerabilities. This malware
exploitation kit is full of anti Microsoft technologies.
By auditing this Malware, TEHTRI-Security has found a pre-auth remote
exploit in the file /mod/to.php
By sending a specially crafted HTTP packet with a POST argument, it's
possible to simulate a configuration modification, and to inject PHP
code that will be able to be executed after.
Here is an example, where we modify the remote file "7.php" by adding
our own PHP code inside it (PoC anti kiddies: phpinfo() added).
POST sent to
With arguments :
Then you can access your new remote backdoor here :
This exploit is provided by TEHTRI-Security as a technical proof to show
that defenders who are under attack, might be able to strike back
against a group of evil intruders trying to commit cyber crimes against
them. But this should not be used out of legal field.
This might help at getting the identities of attackers, or at hacking
their workstations, or at destroying their tools and infrastructures
(anti-cyber-war & anti-cyber-spy technologies).
------ END Security Advisory ------
If you want to be sure to have your seat for this outstanding offensive
training, please do register as soon as possible (Technical Training
Track3 / TT3 - Hunting Web Attackers, 11-12 October ) :
See you soon at the awesome international conference HITBSecConf
Laurent OUDOT, CEO & Founder TEHTRI-Security
- BBC => http://www.bbc.co.uk/news/10349001
- Zdnet =>
- Btraq => http://seclists.org/bugtraq/2010/Jun/178
- HITB => http://conference.hackinthebox.org/hitbsecconf2010kul/