Sunday, August 30, 2020

Amnesia / Radiation Linux Botnet Targeting Remote Code Execution In CCTV DVR Samples


Reference
Amnesia / Radiation botnet samples targeting Remote Code Execution in CCTV DVR 







Download

             Other malware







Hashes


MD5SHA256SHA1
74bf554c4bc30d172cf1d73ac553d76606d30ba7c96dcaa87ac584c59748708205e813a4dffa7568c1befa52ae5f03743c40221177383da576b11a0b3f6b35d68a9cde74
5dd9056e5ab6a92e61822b6c04afd34610aa7b3863f34d340f960b89e64319186b6ffb5d2f86bf0da3f05e7dbc5d9653c865dd67853a24fd86ef74b05140827c1d5fd0bd
2b486466f4d3e30f7b22d0bc76cb68f9175fe89bbc8e44d45f4d86e0d96288e1e868524efa260ff07cb63194d04ea575ed62f6d1588bea33c20ababb42c02662d93d6015
3411bb2965f4c3d52c650aff04f48e521d8bc81acbba0fc56605f60f5a47743491d48dab43b97a40d4a7f6c21caca12a1e0281178b4a9d8dec74f50a7850867c87837435
34f915ac414e9aad2859217169f9a3aa2f9cd1d07c535aae41d5eed1f8851855b95b5b38fb6fe139b5f1ce43ed22df22d66f1e47c983a8d30ad7fd30cd08db8cd29a92b0
59e08f2ce1c3e55e2493baf36c1ad3c6327f24121d25ca818cf8414c1cc704c3004ae63a65a9128e283d64be03cdd42e90d45b81e9a97ddcc9911122f4e8fd439ccc8fa9
f4bc173bf80d922da4e755896af0db6137b2b33a8e344efcaca0abe56c6163ae64026ccef65278b232a9170ada1972affab32f8c3ce3a837e80a1d98ada41a5bf39b01e7
a253273e922ce93e2746a9791798e3fe3a595e7cc8e32071781e36bbbb680d8578ea307404ec07e3a78a030574da8f9699cfdec405f6a9f43d58b1856fce7ca3445395d3
335e322c56278e258e4d7b5e17ad98e64313af898c5e15a68616f8c40e8c7408f39e0996a9e4cc3e22e27e7aeb2f8d54504022707609a0fec9cbb21005cb0875be2a4726
93522e5f361a051f568bd1d74d901d3046ea20e3cf34d1d4cdfd797632c47396d9bdc568a75d550d208b91caa7d43a9be7fc96b2a92888572de2539f227c9a6625449f83
c86af536d87c1e5745e7d8c9f44fd25d4b0feb1dd459ade96297b361c69690ff69e97ca6ee5710c3dc6a030261ba69e06ef69a683913ae650634aedc40af8d595c45cb4f
90c7c5e257c95047dbf52bbfbe011fd64db9924decd3e578a6b7ed7476e499f8ed792202499b360204d6f5b807f881b81c3a9be6ae9300aaad00fb87d5407ed6e84ec80b
7c0528e54b086e5455ef92218ea23d035e6896b39c57d9609dc1285929b746b06e070886809692a4ac37f9e1b53b250c868abc912ff2fdcd733ff1da87e48e7d4c288a73
6405b42d2c7e42244ac73695bb7bfe6b64f03fff3ed6206337332a05ab9a84282f85a105432a3792e20711b920124707173aca65181c8da84e062c803a43a404ad49302d
6441157813de77d9849da5db9987d0bb6b2885a4f8c9d84e5dc49830abf7b1edbf1b458d8b9d2bafb680370106f93bc392dff9bdb31d3b9480d9e5f72a307715859dd094
614ea66b907314398cc14b3d2fdebe796b29b65c3886b6734df788cfc6628fbee4ce8921e3c0e8fc017e4dea2da0fd0bc7e71c42d391f9c69375505dbf3767ba967f9103
00fe3120a666a85b84500ded1af8fb61885dce73237c4d7b4d481460baffbd5694ab671197e8c285d53b551f893d6c09342ed67e08d16ab982a4012fcecdca060a5da46b
5477de039f7838dea20d3be1ae249fcb886136558ec806da5e70369ee22631bfb7fa06c27d16c987b6f6680423bc84b05b19202b45e5a58cadec8c2efa40fd924b64177d
91bf10249c5d98ea6ae11f17b6ef09708f57ec9dfba8cf181a723a6ac2f5a7f50b4550dd33a34637cf0f302c43fd0243682dab9ec3ff0b629cce4e16c9c74171dd2551d4
fb0a7e12d2861e8512a38a6cdef3ddf09351ee0364bdbb5b2ff7825699e1b1ee319b600ea0726fd9bb56d0bd6c6670cbc077c490bb22df9886475dc5bedfc6c032061024
9b7f5a1228fa66cbd35e75fb774fdc8e9c7a5239601a361b67b1aa3f19b462fd894402846f635550a1d63bee75eab0a2ae89bc6c5cc1818b3136a40961462327c3dececc
5b97d54dc5001eb7cf238292405070a6a010bf82e2c32cba896e04ec8dbff58e32eee9391f6986ab22c612165dad36a096d2194f5f3927de75605f6ca6110fe683383a01
642f523bb46c2e901416047dca1c5d4ead65c9937a376d9a53168e197d142eb27f04409432c387920c2ecfd7a0b941c8bbf667213a446bc9bc4a5a2e54e7391752e3a9b8
c617655312c573ecb01d292b320fff2eaeb480cf01696b7563580b77605558f9474c34d323b05e5e47bf43ff16b67d6ade102a6f35e08f18aa0c58358f5b22871eb0a45f
c8835a3d385162ae02bd4cb6c5ebac87b113ec41cc2fd9be9ac712410b9fd3854d7d5ad2dcaac33af2701102382d5815831eb9cf0dcd57a879c04830e54a3b85fe5d6229
1497740fa8920e4af6aa981a5b405937b13014435108b34bb7cbcef75c4ef00429b440a2adf22976c31a1645af5312528d6b90f0b88b1ad5dcc87d377e6a82dc6ac64211
5e925e315ff7a69c2f2cf1556423d5afb3d0d0e2144bd1ddd27843ef65a2fce382f6d590a8fee286fda49f807471154564fe900b3a2b030c28211404afa45703c6869dea
951ec487fb3fece58234677d7fe3e4dcbdefa773e3f09cdc409f03a09a3982f917a0cc656b306f0ece3dd1a2564a87720b03d9471522590530dd90ad30b2d235ec98b578
3e84998197fc25cbac57870e3cdeb2dec03b403d5de9778a2ec5949d869281f13976c2fc5b071e0f5f54277680c809020b9eb6d931dc6b226a913e89bb422f58228de0d0
c3a73d24df62057e299b6af183889e6bcb2382b818993ef6b8c738618cc74a39ecab243302e13fdddb02943d5ba794836a683ef6f7653e5ee64969cbbbe4403601ae9ded
d428f50a0f8cd57b0d8fe818ace6af20ce61dcfc3419ddef25e61b6d30da643a1213aa725d579221f7c2edef40ca2db39bd832256b94e43546dfb77532f6d70fcd1ce874
e1d6d4564b35bb19d2b85ca620d7b8f2d0bda184dfa31018fe999dfd9e1f99ca0ef502296c2cccf454dde30e5d3a9df9c1af00d3263893b5d23dbf38015fe3c6a92cefaf
e9502ae7b0048b9ea25dd7537818904ce7d6b3e1fba8cdf2f490031e8eb24cd515a30808cdd4aa15c2a41aa0016f80820e080ac0130ab3f7265df01b8397e4abd13c38cb
8eb34e1fb7dd9d9f0e1fef2803812759eb54dc959b3cc03fbd285cef9300c3cd2b7fe86b4adeb5ca7b098f90abb55b8a5310a99f0f8c92bfa2f8da87e60c645f2cae305a
ca0fc25ce066498031dc4ca3f72de4b8f23fecbb7386a2aa096819d857a48b853095a86c011d454da1fb8e862f2b45837f4d97eea294fc567b058b09cc915be56c2a80e1
5a2fcfff8d6aab9a0abe9ca97f6093edf6af2fa4f987df773d37d9bb44841a720817ce3817dbf1e983650b5af9295a16f4ddf49fbf23edb23f50be62637a4a688e352057
ed98e8fa385b39ca274e0de17b1007e6f7a737cb73802d54f7758afe4f9d0a7d2ea7fda4240904c0a79abae732605729a69d4c2b88bfe3a06245f8fbfb8abe5e9a894cec
320db5f1230fcfe0672c8515eb9ddcfcf7cf1e0d7756d1874630d0d697c3b0f3df0632500cff1845b6308b11059deb078d40dbf34a02dd43a81e5cdc58a0b11bfa9f5663
18d6af9211d0477f9251cf9524f898f3f97848514b63e9d655a5d554e62f9e102eb477c5767638eeec9efd5c6ad443d8b0e76be186fd609d5a8a33d59d16ffa3bdab1573

Related news
Posted by at No comments:

DarkFly Tool V4.0 | 500 Tools | Termux

More info
Posted by at No comments:

How To Build A "Burner Device" For DEF CON In One Easy Step

TL;DR: Don't build a burner device. Probably this is not the risk you are looking for.

Introduction

Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are we recommending this? Are we focusing on the right things?

What is a "burner device" used for?

For starters, the whole "burner device" concept is totally misunderstood, even within the ITSEC community. A "burner device" is used for non-attribution. You know, for example, you are a spy and you don't want the country where you live to know that you are communicating with someone else. I believe this is not the situation for most attendees at DEF CON. More info about the meaning of "burner" https://twitter.com/Viss/status/877400669669306369

Burner phone means it has a throwaway SIM card with a throwaway phone, used for one specific operation only. You don't use the "burner device" to log in to your e-mail account or to VPN to your work or home.
But let's forget this word misuse issue for a moment, and focus on the real problem.

The bad advice

The Internet is full of articles focusing on the wrong things, especially when it comes to "burner devices". Like how to build a burner laptop, without explaining why you need it or how to use it.
The problem with this approach is that people end up "burning" (lame wordplay, sorry) significant resources for building a secure "burner device". But people are not educated about how they should use these devices.

The threats

I believe the followings are some real threats which are higher when you travel:
1. The laptop getting lost or stolen.
2. The laptop getting inspected/copied at the border.

These two risks have nothing to do with DEF CON, this is true for every travel.

Some other risks which are usually mentioned when it comes to "burner devices" and DEF CON:
3. Device getting owned via physical access while in a hotel room.
4. Network traffic Man-in-the-middle attacked. Your password displayed on a Wall of Sheep. Or having fun with Shellshock with DHCP. Information leak of NTLM hashes or similar.
5. Pwning the device via some nasty things like WiFi/TCP/Bluetooth/LTE/3G/GSM stack. These are unicorn attacks.

6. Pwning your device by pwning a service on your device. Like leaving your upload.php file in the root folder you use at CTFs and Nginx is set to autostart. The author of this article cannot comment on this incident whether it happened in real life or is just an imaginary example. 

How to mitigate these risks? 

Laptop getting stolen/lost/inspected at the border?
1. Bring a cheap, empty device with you. Or set up a fake OS/fake account to log in if you really need your day-to-day laptop. This dummy account should not decrypt the real files in the real account.

Device getting owned while in a hotel room with physical access

1. Don't bring any device with you.
2. If you bring any, make it tamper-resistant. How to do that depends on your enemy, but you can start by using nail glitter and Full Disk Encryption. Tools like Do Not Disturb help. It also helps if your OS supports suspending DMA devices before the user logs in.
3. If you can't make the device tamper-resistant, use a device that has a good defense against physical attackers, like iOS.
4. Probably you are not that important anyway that anyone will spend time and resources on you. If they do, probably you will only make your life miserable with all the hardening, but still, get pwned.

Network traffic Man-in-the-middle attacked

1. Don't bring any device with you.
2. Use services that are protected against MiTM. Like TLS.
3. Update your OS to the latest and greatest versions. Not everyone at DEF CON has a 0dayz worth of 100K USD, and even the ones who have won't waste it on you. 
4. Use fail-safe VPN. Unfortunately, not many people talk about this or have proper solutions for the most popular operating systems.
5. For specific attacks like Responder, disable LLMNR, NBT-NS, WPAD, and IPv6 and use a non-work account on the machine. If you don't have the privileges to do so on your machine, you probably should not bring this device with you. Or ask your local IT to disable these services and set up a new account for you.

Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack

1. Don't bring any device with you.
2. If you bring any, do not use this device to log in to work, personal email, social media, etc.
3. Don't worry, these things don't happen very often. 

Pwning your device by pwning a service on your device

Just set up a firewall profile where all services are hidden from the outside. You rarely need any service accessible on your device at a hacker conference.

Conclusion

If you are still so afraid to go there, just don't go there. Watch the talks at home. But how is the hotel WiFi at a random place different from a hacker conference? Turns out, it is not much different, so you better spend time and resources on hardening your daily work devices for 365 days, instead of building a "burner device".

You probably need a "burner device" if you are a spy for a foreign government. Or you are the head of a criminal organization. Otherwise, you don't need a burner device. Maybe you need to bring a cheap replacement device.
Related articles
  1. Tools For Hacker
  2. Android Hack Tools Github
  3. Hacking Apps
  4. Hacking Tools Software
  5. Black Hat Hacker Tools
  6. Pentest Tools Android
  7. Hack Apps
  8. Pentest Tools Find Subdomains
  9. Pentest Tools Github
  10. Easy Hack Tools
  11. Hack Website Online Tool
  12. Pentest Tools List
  13. Hacking Tools Hardware
  14. Game Hacking
  15. Pentest Tools List
  16. Hacking Tools Windows 10
  17. Hack Tools For Games
  18. Pentest Tools Kali Linux
  19. Hacker Tools For Ios
  20. How To Make Hacking Tools
  21. Hacking Tools Online
  22. Blackhat Hacker Tools
  23. Hacking Tools 2020
  24. Beginner Hacker Tools
  25. Hacking Tools Github
  26. Hacking Tools 2020
  27. Usb Pentest Tools
  28. Hacker Tools Mac
  29. Tools 4 Hack
  30. Hacking Apps
  31. Growth Hacker Tools
  32. Hacking Tools For Windows Free Download
  33. Hacking Tools Windows 10
  34. Hacking Tools Usb
  35. Hacking Tools Online
  36. Hacking Tools For Kali Linux
  37. Hacking Tools For Mac
  38. Pentest Tools Windows
  39. Hack Tool Apk No Root
  40. Hacker Security Tools
  41. Usb Pentest Tools
  42. Underground Hacker Sites
  43. Hack Tool Apk No Root
  44. Pentest Tools Download
  45. Hacker Tools Github
  46. Pentest Tools Kali Linux
  47. Hacker Tools Apk Download
  48. Hacker Tools Free
  49. Hacker Tools Online
  50. Hacking Tools Usb
  51. Pentest Tools For Windows
  52. Nsa Hack Tools Download
  53. Pentest Recon Tools
  54. Hack Tools For Pc
  55. Hacking Tools Free Download
  56. Physical Pentest Tools
  57. Hacking Tools Kit
  58. Pentest Tools Apk
  59. Pentest Tools Kali Linux
  60. Nsa Hack Tools
  61. Hacking Tools Free Download
  62. Hacking Apps
  63. Hacking Tools Kit
  64. Hacker Tools Apk
  65. Hacking Tools
  66. Hacker Tools Apk
  67. Pentest Tools Kali Linux
  68. Bluetooth Hacking Tools Kali
  69. Hacker Tools Mac
  70. Free Pentest Tools For Windows
  71. Hacking Tools 2020
  72. Hacker Tools Free
  73. Game Hacking
  74. Pentest Tools Url Fuzzer
  75. Pentest Tools Port Scanner
  76. Hacking Tools For Pc
  77. Blackhat Hacker Tools
  78. Hacker Tools Free Download
  79. Hacker Tools 2020
  80. Wifi Hacker Tools For Windows
  81. Tools Used For Hacking
  82. Wifi Hacker Tools For Windows
  83. How To Install Pentest Tools In Ubuntu
  84. Hacker Tools Apk
  85. Hack Tools Pc
  86. Pentest Automation Tools
  87. Hacker Tools For Pc
  88. Nsa Hacker Tools
  89. Hacking Tools For Windows
  90. Termux Hacking Tools 2019
  91. What Are Hacking Tools
  92. Hacker Tools Github
  93. Hacking Tools Windows 10
  94. Underground Hacker Sites
  95. Hacker Tools
  96. Hack Tools For Mac
  97. Hacking Tools Software
  98. Wifi Hacker Tools For Windows
  99. Android Hack Tools Github
  100. Pentest Tools Url Fuzzer
  101. Hack Tools Download
  102. Computer Hacker
  103. Nsa Hack Tools Download
  104. Hacking Tools For Windows 7
  105. Hacking Tools Software
  106. Tools 4 Hack
  107. Hacking Tools
  108. Github Hacking Tools
  109. Hacker Tools Hardware
  110. Hacker Tools Apk Download
  111. Underground Hacker Sites
  112. Hacking Tools For Windows Free Download
  113. Ethical Hacker Tools
  114. Hack Tools Online
  115. Growth Hacker Tools
  116. Hacker Tools Github
  117. Pentest Tools Android
  118. Pentest Tools Windows
  119. Hacking Tools For Windows Free Download
  120. Physical Pentest Tools
  121. Game Hacking
  122. Hack Tools
  123. Android Hack Tools Github
  124. Pentest Tools Open Source
  125. Top Pentest Tools
  126. Pentest Tools Bluekeep
  127. Hacker Tool Kit
  128. Hack Tools
  129. Hacker Tools Github
  130. Hacker Tools Hardware
  131. Pentest Tools
  132. Hacker Tools Free Download
  133. Hacking Tools Windows 10
  134. Nsa Hack Tools
  135. Best Hacking Tools 2019
  136. Pentest Tools Android
  137. Hack Apps
  138. Hacker Tools For Ios
  139. Hack App
  140. Free Pentest Tools For Windows
  141. Hacking Tools Windows
  142. Hacking Tools For Games
  143. Hacking Tools For Pc
  144. Hack Tools For Mac
  145. Pentest Tools Github
  146. Hacking Tools For Kali Linux
  147. Hacking Tools Hardware
  148. Best Hacking Tools 2020
  149. Pentest Tools Find Subdomains
  150. Nsa Hack Tools
  151. Hack Tools For Mac
  152. Hack Website Online Tool
  153. Hacker Tools Apk Download
  154. Pentest Tools Subdomain
  155. Hacker Hardware Tools
  156. Pentest Tools Framework
  157. Hacking Tools For Pc
  158. Hack Apps
  159. Hacker Tools For Windows
  160. How To Hack
  161. Hacking Tools For Windows 7
  162. Pentest Tools Apk
  163. Hacker Search Tools
  164. Hacking Tools Windows 10
  165. Hack Tools Online
  166. Hacking Tools Name
  167. Hacker Tools Apk
  168. Hacker Tools For Windows
  169. Hacking Tools 2019
  170. Ethical Hacker Tools
  171. Hacks And Tools
  172. Black Hat Hacker Tools
  173. Hacker Tools 2020
  174. Hacker Tools Free Download
Posted by at No comments:

Saturday, August 29, 2020

Osintgram - A OSINT Tool On Instagram


Osintgram is a OSINT tool on Instagram.

Osintgram offers an interactive shell to perform analysis on Instagram account of any users by its nickname. You can get:
- addrs           Get all registered addressed by target photos
- captions        Get user's photos captions
- comments        Get total comments of target's posts
- followers       Get target followers
- followings      Get users followed by target
- hashtags        Get hashtags used by target
- info            Get target info
- likes           Get total likes of target's posts
- mediatype       Get user's posts type (photo or video)
- photodes        Get description of target's photos
- photos          Download user's photos in output folder
- propic          Download user's profile picture
- stories         Download user's stories  
- tagged          Get list of users tagged by target
- target          Set new target
- wcommented      Get a list of user who commented target's photos
You can find detailed commands usage here.
Latest version | CHANGELOG

Installation
  1. Fork/Clone/Download this repo
    git clone https://github.com/Datalux/Osintgram.git
  2. Navigate to the directory
    cd Osintgram
  3. Run pip3 install -r requirements.txt
  4. Create a subdirectory config
    mkdir config
  5. Create in config folder the file: username.conf and write your Instagram account username
  6. Create in config folder the file: pw.conf and write your Instagram account password
  7. Run the main.py script
    python3 main.py <target username>

Updating
Run git pull in Osintgram directory

Contributing
You can propose a feature request opening an issue or a pull request.

External library
Instagram API: https://github.com/ping/instagram_private_api




via KitPloit
This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

More information


Posted by at No comments:
Subscribe to: Posts (Atom)