Trend Micro Deep Discovery Inspector 3.8/3.7 - Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: ==================== www.trendmicro.com Product: ========================================= Trend Micro Deep Discovery Inspector V3.8, 3.7 Deep Discovery Inspector is a network appliance that gives you...

Remote Code Execution in CCTV-DVR

来源链接： http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html This post is going to be a follow up from a research which dates back to December 2014, called "The Backoff POS Trojan operation". Back then, one of the key conclusions highlighted from the report is that fraudste...

百度 moplus SDK 后门 (WormHole 虫洞)

报告来源：趋势科技 目前，人们之所以称之为漏洞是基于 Moplus SDK 的访问权限控制以及应该如何限制这种访问的角度。因此，它虽然具有漏洞相关的概念而实际上是一个后门程序，如推送钓鱼网页，插入任意联系人，发送伪造短信，上传本地文件到远程服务器，未经用户授权安装任意应用到 Android 设备。而执行这些行为唯一的要求是该设备首先需要连接互联网。由于 Moplus SDK 已经被集成到众多的 Android 应用程序中，这就意味着有上亿的Android用户受到了影响。 图1.恶意软件使用的 Moplus SDK 来进行静默安装 通过 Moplus SDK 挖掘 Moplus...

Twittor - A fully featured backdoor that uses Twitter as a C&C server

A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one! Regist...

Researchers Outline New Italian RAT uWarrior

Details have come to light about a new remote access Trojan called uWarrior that arrives embedded in a rigged .RTF document. Researchers with Palo Alto Networks’ research division, Unit 42, described the malware and how it appears to have emanated from an “unknown actor of Italian origin,” in a...

Tunneling C&C Over DNS: dnscat2

This tool is designed to create a command-and-control C&C channel over the DNS protocol, which is an effective tunnel out of almost every network. dnscat2 comes in two parts: the client and the server. The client is designed to be run on a compromised machine. It’s written in C and has the minimu...

APT Group Embeds C&C Data on TechNet Pages

The so-called Deputy Dog APT group has surfaced again with a means of keeping its command and control servers under wraps that involves Microsoft’s TechNet online resources. New research published last week by Microsoft and FireEye revealed targeted attacks against organizations have been...

ICU Project ICU4C Library Vulnerabilities Patched

Multitudes of software packages that make use of the ICU Project C/C++ and Java libraries may need to update after a pair of memory-based vulnerabilities were discovered and subsequently patched. Version 55.1 of the ICU Project ICU4C library, released yesterday, addresses separate heap-based buff...

Volatile Cedar APT Group First Operating Out of Lebanon

An APT group with its sights on selective targets, most of those in Israel, has been using an elusive malware implant to steal data from groups with state and political interests. The gang, called Volatile Cedar by researchers at Check Point Software Systems, has been working since 2012 and could...

Malware Communication Analyzer: Malcom

Malcom is a tool designed to analyze a system’s network communication using graphical representations of network traffic, and cross-reference them with known malware sources. This comes handy when analyzing how certain malware species try to communicate with the outside world. Malcom can help you...

Maligno v2.0 - Metasploit Payload Server

Maligno is an open source penetration testing tool written in Python that serves Metasploit payloads. It generates shellcode with msfvenom and transmits it over HTTP or HTTPS. The shellcode is encrypted with AES and encoded prior to transmission. Maligno also comes with a client tool, which...

Collect DNS Records Passively: PassiveDNS

Collect DNS Records Passively A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring NSM and general digital forensics. PassiveDNS sniffs traffic from an interface or reads a pcap-file and outputs the DNS-server answers to a log file. PassiveDNS can...

New Backoff PoS Malware Identified in Several Attacks

A new breed of point-of-sale malware has been found in several recent attacks, and experts say that the tool, known as Backoff, has extensive data stealing and exfiltration capabilities, including keylogging, memory scraping and injection into running processes. The Backoff malware doesn’t...

QuasiBot - Webshell Manager aka HTTP Botnet

QuasiBot is a complex webshell manager written in PHP, which operate on web-based backdoors implemented by user himself. Using prepared php backdoors, quasiBot will work as C&C trying to communicate with each backdoor. Tool goes beyond average web-shell managers, since it delivers useful function...

Mayhem — A New Malware Targets Linux and FreeBSD Web Servers

Security researchers from Russian Internet giant Yandex have discovered a new piece of malware that is being used to target Linux and FreeBSD web servers in order to make them a part of the wide botnet, even without the need of any root privileges. Researchers dubbed the malware as Mayhem, a nast...

MySQL <= 5.0.20 COM_TABLE_DUMP Memory Leak/Remote BoF Exploit

No description provided by source. / April 21.st 2006 myexploit.c MySql COMTABLEDUMP Memory Leak & MySql remote B0f MySql = 5.0.20 MySql COMTABLEDUMP Memory Leak MySql = 4.x.x copyright 2006 Stefano Di Paola stefano.dipaolaatwisec.it GPL 2.0 Disclaimer: In no event shall the author be liable for...

Poison Ivy 2.3.2 C&C Server Buffer Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

MS Windows XP - WmiTraceMessageVa Integer Truncation Vulnerability PoC (MS11-011)

No description provided by source. / Exploit Title: MS11-011CVE-2011-0045: MS Windows XP WmiTraceMessageVa Integer Truncation Vulnerability PoC Date: 2011-03-01 Author: Nikita Tarakanov CISS Research Team Software Link: Version: prior to MS11-011 Tested on: Win XP SP3 CVE : CVE-2011-0045 Status :...

[SECURITY] Fedora 20 Update: mingw-icu-50.1.2-3.fc20

ICU is a set of C and C++ libraries that provides robust and full-featured Unicode and locale support. The library provides calendar support, conversions for many character sets, language sensitive collation, date and time formatting, support for many locales, message catalogs and resources,...

Xenotix xBOT - A Cross Platform PoC Bot that abuse certain Google Services to implement it's C&C

Xenotix xBOT is a proof of concept cross platform Linux, Windows, Mac bot written in Python that abuse certain Google Services to implement Command & Control Center for the botnet. The Google Apps Data API, Google Forms and Google Spreadsheet is abused to implement C2 for a bot network. The Googl...