azazel

Azazel V 0.1 Toda la tierra ha sido corrompida mediante las obras que fueron enseñadas por Azazel: a él atribuye todo pecado. -- 1 Enoc 2:8 Azazel es un rootkit de espacio de usuario basado en la técnica original LDPRELOAD del rootkit Jynx. Es más robusto y tiene características adicionales, y se...

postshell

PostShell PostShell es un shell de post-explotación que incluye tanto un shell bind como un shell de conexión inversa. Crea un TTY completamente interactivo que permite el control de trabajos. El tamaño del stub es de aproximadamente 14 kb y se puede compilar en cualquier sistema similar a Unix...

mimic

mimic mimic es una herramienta para ejecución encubierta en Linux x8664. ¿Qué es la "ejecución encubierta"? La ejecución encubierta es el arte de ocultar un proceso. En este caso, mimic oculta el proceso a plena vista. mimic puede lanzar cualquier programa y hacerlo parecer cualquier otro program...

libprocesshider

libprocesshider Nascondi un processo sotto Linux usando il preloader ld. Tutorial completo disponibile su https://sysdigcloud.com/hiding-linux-processes-for-fun-and-profit/ In breve, compila la libreria: gianluca@sid:/libprocesshider$ make gcc -Wall -fPIC -shared -o libprocesshider.so...

rootkit

Rootkit Linux Un semplice rootkit per kernel Linux scritto per divertimento, non per fare del male. Funzionalità Il rootkit può fare quanto segue: Concedere privilegi di root a un processo in spazio utente Nascondere un processo tramite PID Mostrare nuovamente un processo precedentemente nascosto...

Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group also known as Mustang Panda that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

EUVD-2008-5055

Malware in sbrugna...

EUVD-2000-1128

Malware in sbrugna...

EUVD-2018-11765

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2018-1121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a...

RHEL 6 : procps (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - procps-ng, procps: Local privilege escalation in top CVE-2018-1122 - procps-ng, procps is vulnerable to a...

RHEL 6 : procps-ng,_procps (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - procps-ng, procps: Local privilege escalation in top CVE-2018-1122 - procps-ng, procps is vulnerable to a...

RHEL 7 : procps-ng,_procps (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - procps-ng, procps: process hiding through race condition enumerating /proc CVE-2018-1121 - procps-ng befo...

Microsoft Launches Free Linux Forensics and Rootkit Malware Detection Service

Microsoft has announced a new free-to-use initiative aimed at uncovering forensic evidence of sabotage on Linux systems, including rootkits and intrusive malware that may otherwise go undetected. The cloud offering, dubbed Project Freta, is a snapshot-based memory forensic mechanism that aims to...

DEBIAN-CVE-2018-1121

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower...

CVE-2018-1121

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower...

CVE-2018-1121

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower...

Race condition

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower...