Andrei Scutariu

cybersecurity something

[Andrei Scutariu @xnand_]

🔥🔥🚒🚨

[SinSinology @SinSinology]

I'm super happy🥳to announce my Advanced .NET Exploitation Training a 4 day training course on teaching you how to exploit advanced .NET enterprise targets 🔥, bypass mitigations, chain bugs🐞🪲 and pop shellz. more information can be found below
https://t.co/biDIcQiFsr

[Andrei Scutariu @xnand_]

@bl4sty @shuffle2 yes and the response to that is the bash script in the screenshot. no guarantees that the response didn't change in content (lines commented based on IP?) though

[Andrei Scutariu @xnand_]

@bl4sty @shuffle2 Here's the server response to the request to /hash.php, zipped, psw: "xnand_"
I haven't analysed that bit as I then moved to dynamic analysis, but in case you guys want it...

https://t.co/VjNur38MNl

[Andrei Scutariu @xnand_]

@r0rt1z2 deceiving* lol 😂

[Andrei Scutariu @xnand_]

For anyone that has ran this PoC, consider your data stolen. This is what eventually runs on your host after a few stages. If you wanna analyse it, don't use a web browser or your IP will get blacklisted. #CVE_2023_35829 #backdoor

[Andrei Scutariu @xnand_]

@r0rt1z2 That server is conceiving. Send only the Host header and nothing else, like the malware would do. Also don't spam it or you'll get blacklisted. I used tor to change my IP and never used the browser

[ghostccamm @GhostCcamm]

@Dinosn This project is backdoored and fake. DO NOT RUN THIS POC!

For an example, here is their exploit for CVE-2023-20871: https://t.co/hK4YgMIXAw

That code looks very similar hmm....

[Andrei Scutariu @xnand_]

@mugundhanbalaji @domchell yes, that's the first stage which will do some initial persistence, mem deobfuscation and eventually run a wget command to the same domain to download and run the script in the screenshot

[Andrei Scutariu @xnand_]

Also check:
~/.bashrc
~/.ssh/authorized_keys
/tmp/.iCE-unix.pid

Remove ~/.local/kworker

Monitor traffic for https://t.co/9DbXRbjvzr, https://t.co/CKKVXzBfmf and IP 81.4.109.16

Monitor processes with name [kworker/8:3]

[Manish Kishan Tanwar @IndiShell1046]

I published the writeup of
"Exploiting Hibernate Injection (HQL) in "Order by" Clause (Oracle database)" which we found during an assessment.
https://t.co/6yQQmkIEQq

Special Thanks to: @irsdl sir and @NomanRiffat bhai ji

#injection #websecurity #bugbountytips #Pentesting

[Andrei Scutariu @xnand_]

@Evil_Mog CSV injection ftw

[JUMPSEC LABS @JumpsecLabs]

We've put out some guidance around securing AD environments from certificate abuse.

https://t.co/GtNUhv4z7R

[JUMPSEC LABS @JumpsecLabs]

#PrintNightmare #0Day

[Alisa Esage Шевченко @alisaesage]

☀️ Summer Solstice philanthropy: I am making this mini-class available for free!

4 hours of deeply systematical theory & practice introduction on hypervisor vulns and how to find them, taught by a specialist researcher, bug hunter and pwner 🔥

How to claim your seat, thread 👉🏻

[JUMPSEC LABS @JumpsecLabs]

Detecting known DLL hijacking and named pipe token impersonation attacks with Sysmon https://t.co/zaCERBG3ys #sysmon #blueteam #privesc #detection

[JUMPSEC LABS @JumpsecLabs]

Advisory CVE-2020-13769 – Ivanti Unified Endpoint Manager SQL injection https://t.co/ViP2ZH2M8o #ivanti #landesk #cve #sqli

[JUMPSEC LABS @JumpsecLabs]

Advisory CVE-2020-13774 – Ivanti Unified Endpoint Manager authenticated RCE via file upload https://t.co/Qtux51SyMr #ivanti #landesk #rce #cve

[JUMPSEC LABS @JumpsecLabs]

The new blog post by @_batsec_ is now live. Say goodbye to your event logs 😉

https://t.co/R4rHqUzlih

#RedTeam #PenTest #Hacking #BlueTeam #WhereAreMyLogs

[JUMPSEC LABS @JumpsecLabs]

SHAD0W, covert modular C2 framework
https://t.co/RAqbR3sz18
#C2 #redteam #infosec

[Andrei Scutariu @xnand_]

@johnregehr oh, right, i'll try it. Thank you 😁