StoneDrill Disk Wiping Malware Found Targeting European Industries

A new disk wiping malware has been uncovered targeting a petroleum company in Europe, which is quite similar to the mysterious disk wiper malware Shamoon that wiped data from 35,000 computers at Saudi Arabia's national oil company in 2012. Disk wiping malware has the ability to cripple any...

Root privilege backdoor vulnerability in DBL Technology GSM voice gateway

DBL Technology is a communication equipment manufacturer located in Shenzhen, China. Its main products include GSM voice gateway, IP telephony gateway, enterprise softswitch, etc., which are mostly used by telephony companies and VoIP service providers. A root privilege backdoor vulnerability...

Dahua backdoor Generation 2 and 3

I'm speechless, and almost don't know what I should write... I hardly can't believe what I have just found. I have just discovered to what I strongly believe is backdoor in Dahua DVR/NVR/IPC and possible all their clones. Since I am convinced this is a backdoor, I have my own policy to NOT notify...

New Fileless Malware Uses DNS Queries To Receive PowerShell Commands

It is no secret that cybercriminals are becoming dramatically more adept, innovative, and stealthy with each passing day. While new forms of cybercrime are on the rise, traditional activities seem to be shifting towards more clandestine techniques that involve the exploitation of standard system...

New Fileless Attack Using DNS Queries to Carry Out PowerShell Commands

A unique attack called DNSMessenger uses DNS queries to carry out malicious PowerShell commands on compromised computers, a method that researchers said makes it difficult to detect that a remote access Trojan is being dropped onto targeted systems. According to experts at Cisco’s security resear...

PHPCMS '/phpcms/modules/member/index.php' file upload vulnerability

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. A file upload vulnerability exists in PHPCMS...

File upload vulnerability in PHPCMS Content Publishing Management function module

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. There is a file upload vulnerability in the PHPCMS content publishing...

Malicious Debian Package Generator: kimi

Malicious Debian Package generator Script to generate malicious debian packages debain trojans. Kimi is a script which generates Malicious debian package for metasploit which consists of bash file. the bash file is deployed into “/usr/local/bin/” directory. Backdoor gets executed just when victim...

Fully Featured Backdoor – Telegram C&C: BrainDamage

A python based backdoor which uses Telegram as C&C server. Features Persistance USB spreading Port Scanner Router Finder Run shell commands Keylogger Insert keystrokes Record audio Webserver Screenshot logging Download files in the host Execute shutdown, restart, logoff, lock Send drive tree...

WePresent WiPG-1500 Backdoor Vulnerability

WePresent WiPG-1500 is a new gateway by AWIND, WiPG-1500 connects multi-platform devices Windows / Mac / Pad / Smartphone / AirPad for interactive presentations by supporting finger touch technology and virtual whiteboard. WePresent WiPG-1500 has a backdoor vulnerability. An attacker can connect ...

WePresent WiPG-1500 - Backdoor Account Vulnerability

Exploit for hardware platform in category remote exploits Exploit Title: CVE-2017-6351 - WePresent undocumented privileged manufacturer backdoor account Date: 27/02/2017 Exploit Author: Quentin Olagne Vendor Homepage: http://www.wepresentwifi.com/ or...

WePresent WiPG-1500 - Backdoor Account

WePresent WiPG-1500 - Backdoor Account Exploit Title: CVE-2017-6351 - WePresent undocumented privileged manufacturer backdoor account Date: 27/02/2017 Exploit Author: Quentin Olagne Vendor Homepage: http://www.wepresentwifi.com/ or http://www.awindinc.com/productswepresentwipg1500.html Software...

NETGEAR DGN2200v1v2v3v4 - dnslookup.cgi Remote Command Execution

NETGEAR DGN2200v1v2v3v4 - dnslookup.cgi Remote Command Execution !/usr/bin/python Provides access to default user account, privileges can be easily elevated by using either: - a kernel exploit ex. memodipper was tested and it worked - by executing /bin/bd suid backdoor present on SOME but not all...

Cisco Firepower Management Console 6.0 - Post Authentication UserAdd (CVE-2016-6433)

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability",...

NETGEAR DGN2200v1v2v3v4 - ping.cgi Remote Command Execution

NETGEAR DGN2200v1v2v3v4 - ping.cgi Remote Command Execution !/usr/bin/python Provides access to default user account, privileges can be easily elevated by using either: - a kernel exploit ex. memodipper was tested and it worked - by executing /bin/bd suid backdoor present on SOME but not all...

Netgear DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution

!/usr/bin/python Provides access to default user account, privileges can be easily elevated by using either: - a kernel exploit ex. memodipper was tested and it worked - by executing /bin/bd suid backdoor present on SOME but not all versions - by manipulating the httpd config files to trick the...

Generate Backdoor With msfvenom: TheFatRat

Generate Backdoor With msfvenom A tool to generate backdoor with msfvenom easily a part from metasploit framework. This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac. The malware, created with this tool also have an ability to...

TheFatRat v1.8 - Easy Tool For Generate Backdoor with Msfvenom

What is TheFatRat ?? An easy tool to generate backdoor with msfvenom a part from metasploit framework and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The...

Macro Malware Comes to macOS

Macro-based malware has crossed the divide between the Windows and Mac platforms. A cybercrime group whose command and control infrastructure resolves to an IP address geo-located in Russia is using a Word document laced with a malicious macro that executes solely on macOS. Following the same...

JUNG Smart Visu Server 1.0.8x Path Traversal / Backdoor Accounts

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Path Traversal, Backdoor accounts & KNX group address password bypass product: JUNG Smart Visu Server vulnerable version: Firmware v1.0.804/1.0.830/1.0.832 fixed version:...