548 matches found
Researchers Uncover Windows Flaws Granting Hackers Rootkit-Like Powers
New research has found that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes. "When a user executes a function that has a path argument in Windows, the DOS path at which the...
VectorKernel - PoCs For Kernelmode Rootkit Techniques Research
PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support 64bit OS only. NOTE Some modules use ExAllocatePool2 API to allocate kernel pool memory. ExAllocatePool2 API is not supported in OSes older than Windows 10 Version 2004. If you want...
The vulnerability of the Dr.Web Anti-Rootkit API in software environments arises from the use of a fixed or uncontrolled search path for resources. This allows attackers to execute arbitrary code.
The vulnerability of the Dr.Web Anti-Rootkit API in software environments lies in the use of a fixed or uncontrolled search path for resources. Exploiting this vulnerability allows an attacker to execute arbitrary code...
PT-2024-2718 · Doctor Web · Dr.Web Anti-Rootkit Api
Name of the Vulnerable Software and Affected Versions: Dr.Web Anti-rootkit API affected versions not specified Description: The issue is related to the use of a fixed or uncontrolled path for resource search in the Dr.Web Anti-rootkit API module. Exploitation of this issue may allow an attacker t...
Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks
The notorious Lazarus Group actors exploited a recently patched privilege escalation flaw in the Windows Kernel as a zero-day to obtain kernel-level access and disable security software on compromised hosts. The vulnerability in question is CVE-2024-21338 CVSS score: 7.8, which can permit an...
New Linux Malware “Migo” Exploits Redis for Cryptojacking, Disables Security
By Deeba Ahmed Migo Malware Campaign: User-Mode Rootkit Hides Cryptojacking on Linux Systems. This is a post from HackRead.com Read the original post: New Linux Malware "Migo" Exploits Redis for Cryptojacking, Disables Security...
NullSection - An Anti-Reversing Tool That Applies A Technique That Overwrites The Section Header With Nullbytes
NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. Install git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Advantage When running nullsection on any ELF, it could ...
PT-2024-1704
Name of the Vulnerable Software and Affected Versions Windows 10 affected versions not specified Windows 11 affected versions not specified Description An elevation of privilege issue exists in the Windows kernel, specifically within the AppLocker driver appid.sys. The flaw stems from an exposed...
D3m0n1z3dShell - Demonized Shell Is An Advanced Tool For Persistence In Linux
Demonized Shell is an Advanced Tool for persistence in linux. Install git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.git cd D3m0n1z3dShell chmod +x demonizedshell.sh sudo ./demonizedshell.sh One-Liner Install Download D3m0n1z3dShell with all files: curl -L...
New Stealthy 'Krasue' Linux Trojan Targeting Telecom Firms in Thailand
A previously unknown Linux remote access trojan called Krasue has been observed targeting telecom companies in Thailand by threat actors to main covert access to victim networks at lease since 2021. Named after a nocturnal female spirit of Southeast Asian folklore, the malware is "able to conceal...
DynastyPersist - A Linux Persistence Tool!
A Linux persistence tool! A powerful and versatile Linux persistence script designed for various security assessment and testing scenarios. This script provides a collection of features that demonstrate different methods of achieving persistence on a Linux system. Features 1. SSH Key Generation:...
The Continued Evolution of the DarkGate Malware-as-a-Service
The Continued Evolution of the DarkGate Malware-as-a-Service By Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll and Vinoo Thomas · November 21, 2023 On September 2023, the Trellix Security Operations Center SOC successfully detected and stopped an attack against Musarubra, the holding...
Qubitstrike Targets Jupyter Notebooks with Crypto Mining and Rootkit Campaign
A threat actor, presumably from Tunisia, has been linked to a new campaign targeting exposed Jupyter Notebooks in a two-fold attempt to illicitly mine cryptocurrency and breach cloud environments. Dubbed Qubitstrike by Cado, the intrusion set utilizes Telegram API to exfiltrate cloud service...
NPM Typosquatting Attack Deploys r77 Rootkit via Legitimate Package
By Deeba Ahmed Another day, another NPM typosquatting attack. This is a post from HackRead.com Read the original post: NPM Typosquatting Attack Deploys r77 Rootkit via Legitimate Package...
Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack
A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality. The package in question is node-hide-console-windows, which mimics the legitimate npm package...
CVE-2023-4413
DISPUTED A vulnerability was found in rkhunter Rootkit Hunter 1.4.4/1.4.6. It has been classified as problematic. Affected is an unknown function of the file /var/log/rkhunter.log. The manipulation leads to sensitive information in log files. An attack has to be approached locally. The complexity...
CVE-2023-4413
Removed by vendor...
编号撤回
rkhunter Rootkit Hunter is rkhunter Rootkit Hunter open source a Unix-based tool. It can scan for Rootkit, backdoors and possible local vulnerability exploits. This CVE number has been withdrawn...
PT-2023-29124 · Rkhunter · Rkhunter
Name of the Vulnerable Software and Affected Versions: rkhunter versions 1.4.4 through 1.4.6 Description: A vulnerability was found in the rkhunter Rootkit Hunter. The issue affects an unknown function of the file /var/log/rkhunter.log, leading to sensitive information in log files. An attack mus...
Old exploit kits still kicking around in 2023
The year is 2023 and there still are some people using Internet Explorer on planet Earth. More shocking perhaps, is the fact there are still threat actors maintaining exploit kit infrastructure and dropping new malware. In this quick blog post, we review two well-known toolkits from the past,...