D-Link DNS-320L 'mydlinkBRionyg' Backdoor

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "D-Link DNS-320L 'mydlinkBRionyg' Backdoor", 'Description' = %q This module exploits two issues. The first issue is that there is a hard coded...

WDMyCloud 2.30.165 - Multiple Vulnerabilities

WDMyCloud 2.30.165 - Multiple Vulnerabilities WDMyCloud Multiple Vulnerabilities Vendor: Western Digital Product: WDMyCloud Version: = 2.30.165 Website: https://www.wdc.com/products/network-attached-storage.html / / / / / / / / / / / / / / / / / / / / / \ / // / // / / / / / / / // / / / /,///...

D-Link DNS-320 ShareCenter 1.06 - Backdoor Access

D-Link DNS-320 ShareCenter 1.06 - Backdoor Access DNS-320L ShareCenter Backdoor Vendor: D-Link Product: DNS-320L ShareCenter Version: = 1.06 -- Table of contents 00 - Introduction 00.1 Background 01 - Hard coded backdoor 01.1 - Vulnerable code analysis 01.2 -...

D-Link DNS-320 ShareCenter < 1.06 - Backdoor Access

DNS-320L ShareCenter Backdoor Vendor: D-Link Product: DNS-320L ShareCenter Version: = 1.06 -- Table of contents 00 - Introduction 00.1 Background 01 - Hard coded backdoor 01.1 - Vulnerable code analysis 01.2 - Remote exploitation 02 - Credit 03 - Proof of concept 04 - Solution 05 - Contact...

WDMyCloud < 2.30.165 - Multiple Vulnerabilities

WDMyCloud Multiple Vulnerabilities Vendor: Western Digital Product: WDMyCloud Version: = 2.30.165 Website: https://www.wdc.com/products/network-attached-storage.html / / / / / / / / / / / / / / / / / / / / / \ / // / // / / / / / / / // / / / /,/// // /// // GulfTech Research and Development...

Cloak - Backdoor In Any Python Script With Some Tricks

Cloak is an intelligent python backdoor framework. What it exactly does? Cloak generates a python payload via msfvenom and then intelligently injects it into the python script you specify. To evade basic detection, Cloak breaks the payload into several parts and places it in different places in t...

Default Password and Remote Command Execution Vulnerabilities in ANYSEC Security Gateway by ZTE NetWizard

The ANYSEC-M6100 is a standard 1U rack mount VPN security access gateway. Default password and remote command execution vulnerabilities exist in the ANYSEC security gateway of ZKNETWAY, which allow attackers to log in to the backend, construct specific code, remotely execute commands, write...

WordPress WP No External Links plugin <=4.3 - Backdoored

Backdoor code found by WordFence in WordPress WP No External Links plugin versions =4.3. Solution This plugin has been closed for new installs. Deactivate and delete the plugin...

WordPress Duplicate Page and Post plugin <=2.1.1 - Backdoored

Backdoor code found by WordFence team in WordPress Duplicate Page and Post plugin versions =2.1.1. Solution This plugin was closed on 2017 December 14 and is no longer available for download on WordPress plugin repository. Deactivate and delete the plugin...

WordPress Captcha Plugin < 4.4.5 Backdoor Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112155";...

PHP Web Stat 4.5.03 Backdoor Account

======================================================================== | Title : php web stat v4.5.03 Backdoor account vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 10 FranASSais V.Pro | Version : v4.5.03 | Vendor : http://wmscripti.com/ | Dork :...

Spoofed Emails from Supposedly Corporate Printer Vendors Install Backdoor

By Waqas Corporate printers and scanners related emails are quite common in This is a post from HackRead.com Read the original post: Spoofed Emails from Supposedly Corporate Printer Vendors Install Backdoor...

Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor Exploit

Exploit for linux platform in category remote exploits !/usr/bin/env python SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 Usage: ./fgtsshbackdoor.py import socket import select import sys import paramiko from paramiko.py3compat import u import base64 import hashlib import termios import t...

Netcore / Netis Routers - UDP Backdoor Exploit

Exploit for hardware platform in category remote exploits !/usr/bin/python -- coding: utf8 -- NETCORE / NETDIS UDP 53413 BACKDOOR https://netisscan.shadowserver.org/ http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/...

Hackers Targeting Servers Running Database Services for Mining Cryptocurrency

Security researchers have discovered multiple attack campaigns conducted by an established Chinese criminal group that operates worldwide, targeting database servers for mining cryptocurrencies, exfiltrating sensitive data and building a DDoS botnet. The researchers from security firm GuardiCore...

WordPress Captcha Plugin Backdoor

A backdoor vulnerability exists in WordPress Captcha plugin. Successful exploitation of this vulnerability allows remote attackers to change the effected site's content...

Hidden Backdoor Found In WordPress Captcha Plugin Affects Over 300,000 Sites

Buying popular plugins with a large user-base and using it for effortless malicious campaigns have become a new trend for bad actors. One such incident happened recently when the renowned developer BestWebSoft sold a popular Captcha WordPress plugin to an undisclosed buyer, who then modified the...

Travle aka PYLOT backdoor hits Russian-speaking targets

At the end of September, Palo Alto released a report on Unit42 activity where they - among other things – talked about PYLOT malware. We have been detecting attacks that have employed the use of this backdoor since at least 2015 and refer to it as Travle. Coincidentally, KL was recently involved ...

Cambium cnPilot r200/r201 Command Execution as 'root'

Cambium cnPilot r200/r201 device software versions 4.2.3-R4 to 4.3.3-R4, contain an undocumented, backdoor 'root' shell. This shell is accessible via a specific url, to any authenticated user. The module uses this shell to execute arbitrary system commands as 'root'. This module requires...

Operation Dragonfly Analysis Suggests Links to Earlier Attacks

ARCHIVED STORY Operation Dragonfly Analysis Suggests Links to Earlier Attacks By Trellix · December 17, 2017 On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017. This attack was effectively Dragonfly 2.0, an update to a...