Hacker Notes

VOIDMAW

This is a new bypass technique for memory scanners. It is useful in hiding problematic code that will be flagged by the antivirus vendors. This is basically an improved version of Voidgate, but without all of the previous limitations. This technique is compatible with all C2 beacons, it handles multithreaded payloads and it can handle executables generated by tools such as pe_to_shellcode, thus allowing it to run virtually any non .NET executables.

Read More 🔗 @hackern0tes

🔴 New Threat Alert: BrazenBamboo, a well-resourced group, is exploiting an UNPATCHED zero-day #vulnerability in Fortinet's FortiClient for Windows to extract VPN credentials. Learn more: https://thehackernews.com/2024/11/warning-deepdata-malware-exploiting.html

CVE2CAPEC

This project allows you to manage get all new CVE with their CWE, CAPEC and MITRE ATT&CK Techniques. All CVE data are stored in database folder. CVE2CAPEC does not need to be run by yourself. In fact, github actions update the database every day at 00:05 UTC so you can get the new CVE with all their data in results/new_cves.jsonl.

https://github.com/Galeax/CVE2CAPEC 🔗 @hackern0tes

Nim-Shell Reverse shell that can bypass EDR and windows defender detection https://github.com/emrekybs/nim-shell 🔗 @hackern0tes

CVE-2024-43639 Windows KDC Proxy Remote Code Execution Vulnerability Read More about microsoft November 2024 patch Tuesday

Four Critical and Three Zero-Days Among 158 Vulnerabilities Patched

🔗 @hackern0tes

Breaking Down Earth Estries Persistent TTPs in Prolonged Cyber Operations By: Trend Micro

Earth Estries employs two distinct attack chains in their campaigns that have some common characteristics, such as the exploitation of vulnerabilities in systems like Microsoft Exchange servers and network adapter management tools. The first infection chain uses PsExec and tools such as Trillclient, Hemigate, and Crowdoor delivered via CAB files, while the second chain employs malware like Zingdoor and SnappyBee, delivered through cURL downloads. Earth Estries maintains persistence by continuously updating its tools and employs backdoors for lateral movement and credential theft. Data collection and exfiltration are performed using Trillclient, while tools like cURL are used for sending information to anonymized file-sharing services, employing proxies to hide backdoor traffic.

Read More 🔗 @hackern0tes

From HTTP to RCE - How to leave backdoor in IIS!

We want something like this: new, unusual and secretive enough that not every security trainee can chase you away from a compromised host. And such a solution was found. IIS Components As I have already said, Microsoft allows expanding the embedded functionality of its products. Before version 7.0, IIS had ISAPI Extensions and ISAPI Filters. These features are still available, but have been replaced by IIS Handler and IIS Module, respectively.

Read More 🔗@hackern0tes

Offset-free DSE bypass across Win10/11: utilising ntkrnlmp.pdb

A ROBUST DRIVER SIGNATURE ENFORCEMENT BYPASS METHOD ACROSS WINDOWS 11 AND 10 Abstract. This paper presents a consistent method for bypassing driver signature enforcement (DSE) across multiple Windows 11 and 10 versions. DSE is a critical security measure in the Windows operating system that restricts the load of kernel-mode drivers to the digitally signed, Microsoft-verified ones. Bring your own vulnerable driver attacks (BYOVD) are commonly used by malicious adversaries and legitimate red teams to subvert trust, install rootkits, or perform sophisticated attacks. Most DSE bypass methods exploit a vulnerable Windows driver, utilising kernel structure offsets that differ between Windows versions. It is of utmost criticality to ensure that the offsets are correct; if, during the exploitation, any kernel corruption occurs, the system will panic and display the blue screen of death (BSOD). The method presented eliminates the need for hardcoded kernel offsets, allowing red teams and their clients to benefit from the preserved system stability and scalability of the exploit.

Read More 🔗 @hackern0tes

Anatomy of an LLM RCE

In this post, we will demystify this risk by examining the anatomy of an LLM Remote Code Execution (RCE) vulnerability. We’ll start by understanding how large language models are capable of executing code, and then we’ll dive deep into a specific vulnerability we uncovered.

Read More 🔗 @hackern0tes

Dear subscribers as a motivation for us please share our channel posts with your friends ❤️ Thanks for your support 🔗 @hackern0tes

Woocommerce Support Ticket System Vulnerable to Unauthenticated Arbitrary File Upload and Deletion

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE IDs: CVE-2024-10625 CVE-2024-10626 CVE-2024-10627 Details: https://github.com/advisories/GHSA-qcjj-9353-w44w 🔗 @hackern0tes

Early Cascade Injection This is just a simple PoC implementation of the early cascade injection technique documented by the Outflank blog post. Blog: https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/ POC: https://github.com/Cracked5pider/earlycascade-injection Rust version: https://github.com/Teach2Breach/early_cascade_inj_rs

FaceDancer An exploitation tool aimed at creating hijackable, proxy-based DLLs. https://meterpreter.org/facedancer-an-exploitation-tool-aimed-at-creating-hijackable-proxy-based-dlls/ 🔗 @hackern0tes

Parrot Anafi Drone Reverse Engineering | HardBreak

In this example, we demonstrate how we reverse-engineered the communication between the Parrot Anafi consumer drone and its controller, which connect via Wi-Fi. The Parrot Anafi hosts its own Wi-Fi network, allowing either the controller or a phone running the Freeflight app to connect. Our goal was to understand the signals sent to the Anafi for initiating takeoff and landing sequences.

https://www.hardbreak.wiki/network-analysis/protocols/application-layer/proprietary-protocols/parrot-anafi-drone-reverse-engineering 🔗 @hackern0tes

Vulnhuntr: Autonomous AI Finds First 0-Day Vulnerabilities in Wild

Introduction Today, we introduce Vulnhuntr, a Python static code analyzer that leverages the power of large language models (LLMs) to find and explain complex, multistep vulnerabilities. Thanks to the capabilities of models like Claude 3.5, AI has now uncovered more than a dozen remotely exploitable 0-day vulnerabilities targeting open-source projects in the AI ecosystem with over 10,000 GitHub stars in just a few hours of running it. These discoveries include full-blown Remote Code Execution. If you’d like to get paid for using Vulnhuntr then head on over to https://huntr.com which is an AI bug bounty program helping secure the exploding open source AI ecosystem.

https://protectai.com/threat-research/vulnhuntr-first-0-day-vulnerabilities?hs_amp=tru 🔗 @hackern0tes

DogeRat A multifunctional Telegram based Android RAT without port forwarding. https://github.com/shivaya-dav/DogeRat 🔗 @hackern0tes

Zero-Day by AI Google Claims World First As AI Finds 0-Day Security Vulnerability. https://www.forbes.com/sites/daveywinder/2024/11/04/google-claims-world-first-as-ai-finds-0-day-security-vulnerability/ 🔗 @hackern0tes

A good cheat sheet for common enumeration and attack methods for Active Directory #AD #ActiveDirectory #RedTeam https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet 🔗 @hackern0tes

ESET APT Activity Report Q2 2024–Q3 2024 An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2024 and Q3 2024 https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2024-q3-2024/ 🔗 @hackern0tes