8381 matches found
Threat Round Up for Oct 20 - Oct 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between October 20 and October 27. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...
Reptile - LKM Linux Rootkit
Reptile is a LKM rootkit for evil purposes. If you are searching stuff only for study purposes, see the demonstration codes. Features Give root to unprivileged users Hide files and directories Hide files contents Hide processes Hide himself Boot persistence Heaven's door - A ICMP/UDP port-knockin...
Infoblox NetMRI VM-AD30-5C6CE Factory Reset Persistence Vulnerability
Exploit for hardware platform in category remote exploits Title: Infoblox NetMRI Administration Shell Factory Reset Persistence Advisory ID: KL-001-2017-018 Publication Date: 2017.10.24 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-018.txt 1. Vulnerability Details...
Infoblox NetMRI VM-AD30-5C6CE Factory Reset Persistence
KL-001-2017-018 : Infoblox NetMRI Administration Shell Factory Reset Persistence Title: Infoblox NetMRI Administration Shell Factory Reset Persistence Advisory ID: KL-001-2017-018 Publication Date: 2017.10.24 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-018.txt 1...
Fileless Malware: A Hidden Threat
Malware is advancing at an unprecedented rate, with four new strains discovered every minute, Slate reported. This is already a lot for businesses to worry about and it doesn't even cover the other threats that haven't been detected. Many attackers have evolved their techniques to evade common...
NorkNork - Powershell Empire Persistence Finder
This script was designed to identify Powershell Empire persistence payloads on Windows systems. It currently supports checks for these persistence methods: Scheduled Tasks Auto-run WMI subscriptions Security Support provider Ease of Access Center backdoors Machine account password disable INSTALL...
UBUNTU-CVE-2017-12873
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...
Inside the Kronos malware – part 1
Recently, a researcher nicknamed MalwareTech famous from stopping the WannaCry ransomware got arrested for his alleged contribution to creating the Kronos banking malware. We are still not having a clear picture whether the allegations are true or not - but let's have a look at Kronos itself...
Oracle Linux 7 : tomcat (ELSA-2017-2247)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2247 advisory. - Resolves: rhbz1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism - Resolves: rhbz1441481 CVE-2017-5647 tomcat: Incorre...
Trickbot Trojan Malware Morphs, Now Targets U.S. Banks
The Trickbot banking Trojan is now targeting U.S. banks in new spam campaigns fueled by the prolific Necurs botnet. The malware has grown more potent with the introduction of a customized redirection method as part of its attacks. IBM X-Force and Flashpoint both recently spotted new Trickbot...
CHAOS Framework - Generate Payloads and Control Remote Machines
CHAOS Framework allows generate payloads and controls remote machines. DISCLAIMER The use of the CHAOS Framework is COMPLETE RESPONSIBILITY of the END-USER. Developer assumes NO liability and is NOT responsible for any misuse or damage caused by this program. FEATURES Windows Remote Control...
WinPayloads: Generate Undetectable Windows Payloads!
PenTestIT RSS Feed An older post of mine - MicroSploit dealt with generating backdoored documents for the Office platform. This post is about another open source framework, called WinPayloads which helps you create custom malicious payloads for the Microsoft Windows operating system. What is...
WMI Event Subscription Persistence
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'msf/core/post/windows/powershell' require 'msf/core/post/file' class MetasploitModule 'WMI Event Subscription Persistence',...
WMI Event Subscription Persistence Exploit
This Metasploit module will create a permanent WMI event subscription to achieve file-less persistence using one of five methods. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell'...
cc.autoapi.pucong:auto-flow-core-flow (>=2.0.0, <=2.0.9), cc.autoapi.pucong:auto-flow-persistence (>=2.0.0, <=2.0.9) +179 more potentially affected by CVE-2016-4000 via org.python:jython-standalone (>=2.5.2, <=2.7.1b2)
org.python:jython-standalone MAVEN version =2.5.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0, =1.0-m1, =1.0-m3, =0.2.13, =0.2.13, =1.0.0, =1.1.0 and more Source cves: CVE-2016-4000 Source advisory: MEND:CVE-2016-4000...
Dr0p1t Framework 1.3 - A Framework That Creates An Advanced FUD Dropper With Some Tricks
Have you ever heard about trojan droppers ? In short dropper is type of trojans that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks! Features Generated executable properties: The executable size is smaller compar...
Microsoft Machine Debug Manager (mdm) DLL Hijacking
Microsoft Machine Debug Manager mdm DLL side loading vulnerability Vulnerability: DLL Hijacking / DLL Side Loading Advisory URL: https://ipositivesecurity.com/2017/06/15/microsoft-machine-debug-manager-mdm-insecure-library-loading-allows-code-execution/ ------------------------ ABOUT...
CVE-2017-9868
In Mosquitto through 1.4.12, mosquitto.db aka the persistence file is world readable, which allows local users to obtain sensitive MQTT topic information...