KeePass abbiamo un problema..../KeePass we have a Problem

KeePass abbiamo un problema 

ITA:
Si dice che la curiosità uccida il gatto , per fortuna non è questo il caso.
In un momento di sana follia ho deciso di analizzare l'eseguibile "KeePass 2" , chi non lo usa per lavoro!?

Analizzando l'eseguibile con il tool open-source "Detect it Easy" ho scoperto che il tool utilizza un obfuscator in particolare "Eziriz .NET Reactor 6.X" nulla di entusiasmante finché non ho notato che la versione utilizzata da KeePass è crackata e distribuita dal noto store di Software crackati Dr. Far Far.
Il sito Dr. Far Far è noto anche perché in omaggio ai clienti regala malware a volontà.

Link to Detect it Easy:https://github.com/horsicq/Detect-It-Easy/

Thanks to everyone from the etetrnal n00b Marco Nappi aka Xaliom

KeePass we have a Problem

ENG:
It is said that curiosity kills the cat , fortunately this is not the case.
In a moment of healthy madness I decided to analyze the executable "KeePass 2" , who does not use it for work!?

Analyzing the executable with the open-source tool "Detect it Easy" I discovered that the tool uses an obfuscator in particular "Eziriz .NET Reactor 6.X" nothing exciting until I noticed that the version used by KeePass is cracked and distributed by the well-known Dr. Far Far cracked software store.

The Dr. Far Far site is also known because as a free gift to customers it gives away malware galore.

The executable used was downloaded from https://KeePass.info version 2.51

  
Link to Detect it Easy:https://github.com/horsicq/Detect-It-Easy/


Thanks to everyone from the etetrnal n00b Marco Nappi aka Xaliom

Commenti

Posta un commento

Post popolari in questo blog

Case of Study : Hide PowerUp.ps1 from MS Defender

Immagine
Hide PowerUp.ps1 from MS Defender PowerUp.ps1 is a well-known script among pentesters for escalating local privileges. However, since it is fairly old and quite popular, Microsoft Defender detects it as malicious. To use it, we need to either create a custom version of the script or obfuscate the one available online. In this guide, we will use a minimal obfuscation approach. By making small changes to the script, we can bypass Microsoft Defender’s detection and use the script without any issues. What We need A Windows VM with the AV Signatures Updated The PowerUp.ps1 Script ( here ) The Tool DefenderCheck made by matterpreter ( here ) Notepad Let's Start The first step is to disable Microsoft Defender temporarily so we can download the PowerUp.ps1 script without interference. After disabling Windows Defender, go to the GitHub page that contains the raw version of PowerUp.ps1. Copy the content and save it in Notepad with a .ps1 extension. Once you have downloaded both the PowerUp ...
Continua a leggere

Unveiling CVE-2024-44777, CVE-2024-44778, and CVE-2024-44779

Immagine
Unveiling CVE-2024-44777 , CVE-2024-44778 , and CVE-2024-44779 How Curiosity and Boredom Can Lead to Discovering Unknown Vulnerabilities In this discussion, I will focus on vTiger CRM 7.4.0, an older version of the CRM platform that, despite its age, remains an important research target.  I discovered a Reflected XSS vulnerability in this version, which is especially concerning since there is no public CVE associated with it.so many users are likely unaware of this security risk.
Continua a leggere

C++ Reverse Shell attempting obfuscation while dynamically loading API.

Immagine
 C++ Reverse Shell Attempting Obfuscation While Dynamically Loading Windows API This time, I wrote a Reverse Shell in C++, attempting to bypass AV by loading Windows APIs dynamically. Sadly, this time I could not use antiscan.me to test this Shell since that site is not working anymore. The Reverse Shell uses the following Windows API: LoadLibraryA GetProcAddress WSAStartup WSASocketA WSAConnectA CreateProcessA ExitProcess Every API has been loaded dynamically to try to bypass AV controls. Loading Windows API Dynamically: How to Read the Following Paragraph // Creating the signature of the function // Creating an instance of the function // Calling the function  LoadLibraryA Becomes loader using loader = HMODULE(__stdcall*)(LPCSTR); loader loader_a = reinterpret_cast<loader>((FARPROC)GetProcAddress(LoadLibraryA(x), "LoadLibraryA")); getter getter_a = reinterpret_cast<getter>((FARPROC)GetProcAddress(loade...
Continua a leggere