xz-vulnerable-honeypot

xz-vulnerable-honeypot XZ バックドアを備えた SSH ハニーポット。CVE-2024-3094 TODO : バックドアや sshd をフックします。復号用の RSA 鍵を記録します。 メモ: https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504 https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01 https://github.com/hamarituc/xz-backdoor 警告...

xzwhy

xzwhy / / / / \ / /\ このプロジェクトは、XZ Utils に影響を与える CVE-2024-3094 に対する Kubernetes 対応の概念実証（POC）です。このエクスプロイトの由来と仕組みに関する優れた解説については、こちらの記事 を参照してください。 警告 ⚠⚠⚠ 以下のコマンドを実行すると、攻撃に対して非常に脆弱なアプリケーションがデプロイされる可能性があります。これらの手順を実行する場合は、エアギャップされたテスト環境で行うことをお勧めします。 ⚠⚠⚠ 手順 1: 脆弱なアプリケーションをデプロイする kubectl create -f...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094は、XZ圧縮ライブラリにバックドアを仕込み、認証を回避してリモートSSHアクセスを可能にするものです。これはLinuxシステムに影響を与える大規模なサプライチェーン攻撃であり、信頼されたオープンソースコンポーネントに潜むリスクを浮き彫りにしています。 XZバックドア: Linuxサーバーに到達するサプライチェーンの脅威 Mark Mallia 著 これは何か XZ圧縮ライブラリは、多くの最新Linuxディストリビューションの主要コンポーネントであり、巧妙なサプライチェーン攻撃の標的となりました。...

CVE-2024-3094-backdoor-env-container

CVE-2024-3094 SSH バックドア コンテナ環境 これは CVE-2024-3094 sshd バックドアインスタンスを実行する環境であり、次のエクスプロイトで動作します: https://github.com/amlweems/xzbot 実験 Docker でのテスト これはDockerコンテナではありません。この脆弱性環境をDockerで作ろうと試みましたが失敗しました: 1. https://github.com/lockness-Ko/xz-vulnerable-honeypot: この中では xzbot が動作しません。 2. Ubuntu VM ホスト上で...

zeek-spicy-facefish

FacefishRootkit このZeek+Spicyアナライザーは、以下の記事で説明されているFacefish LinuxルートキットC2を検出します： https://blog.netlab.360.com/sshstealerfacefishen/ https://blogs.juniper.net/en-us/threat-research/linux-servers-hijacked-to-implant-ssh-backdoor...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

MAL-2026-7023 Malicious code in dbzy-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0432a46ed92acb897826fc16d26cba900bd3d18f0de5baa7f2909a44d9ec625 The package advertises itself as a network debugging tool but its CLI and modules compose a remote-access toolkit. The dbzy-tools console entry calls...

MAL-2026-6548 Malicious code in ts-ankle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1695e2ffa9252abe1053fc13895a071bd87cb27eb009eeb2262aae1a27da4ea5 On npm install, [email protected] runs a postinstall hook node test.js that executes two hostile flows against the installer's machine without user...

MAL-2026-6524 Malicious code in ts-einkle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa992a8f9afcf95d3c0e35b6abc290ff565b450663f6d43511467cd370eefce8 [email protected] ships a comprehensive installer-side stealer in its main module peer-math.js. On require, syncSession runs a chain packProjectBundle,...

MAL-2026-6449 Malicious code in howdybase32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0eab759e668db62de0eaa10d1f5d32c689b00c7c3d6d2b1517439cc5df3e956 The package advertises itself as a fast, zero-dependency base32 encoder/decoder, but its only bin entry bin/hibase32.js silently invokes...

MAL-2026-6450 Malicious code in nizzybase32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8ad52e73a1c796a1dbe22501f4ef2d42f3ceea98cc259e1ceefb1a214cfa56 The CLI in bin/hibase32.js computes SHA256 of user input and, on one hardcoded magic digest...

MAL-2026-6194 Malicious code in portloop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c On default invocation e.g., npx portloop with no flags, the CLI runs in daemon+quiet+respawn mode and POSTs id, hostname, host, url, port, user to a...

Malicious code in logger-draft (npm)

Part of a multi-package malicious campaign by npm author toskypi, logger-draft is a companion package to eo-terminal in the same infostealer and remote access trojan RAT campaign. Both packages share the same actor, C2 infrastructure, and attack pattern, and are distributed together under a...

Malicious code in @solarcraft/observix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14c39608a172a624520f309b572b40636dc51563f85fe89dac968712490dd40f The package advertises itself as a zero-dependency colorized logger similar to pino-pretty, but dist/index.js does require'./logger' purely for its...

MAL-2026-3619 Malicious code in txwrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 72b4db77d156fffbfdf3253cda39d73180fda419676d356fdbc217130c289549 During importing, the remote code is downloaded. It then exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new...

Malicious code in txwrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 72b4db77d156fffbfdf3253cda39d73180fda419676d356fdbc217130c289549 During importing, the remote code is downloaded. It then exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new...

MAL-2026-3408 Malicious code in textwrap-ext (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 da4e8d5daae9a14e0ceb5a942afd308068957ec655cdd950b2b041934e9ec182 During installation, obfuscated code exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new authorized SSH key...

Malicious code in ts-lint-builds (npm)

big.js typosquat campaign - SSH backdoor implantation, credential and crypto wallet theft --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5b6d9da5acae076b81860b7c119f9b61dd48b9b5360e56b582fdae563f96d8 The package ts-lint-builds was found to contain malicious...

Malicious code in bjs-lint-builder (npm)

big.js typosquat campaign - SSH backdoor implantation, credential and crypto wallet theft --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de4578f36842f930e2a5e6a4129c10eb87bf1005fe8cbdf05ffb9fdc2fe43ad8 The package bjs-lint-builder was found to contain malicious...

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe. The Go module, github.com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, bu...