Wednesday, 31 May 2023

Amnesia / Radiation Linux Botnet Targeting Remote Code Execution In CCTV DVR Samples



Amnesia / Radiation botnet samples 






 Malware Inventory (work in progress)
Links updated: Jan 20, 2023

Hashes


MD5SHA256SHA1
74bf554c4bc30d172cf1d73ac553d76606d30ba7c96dcaa87ac584c59748708205e813a4dffa7568c1befa52ae5f03743c40221177383da576b11a0b3f6b35d68a9cde74
5dd9056e5ab6a92e61822b6c04afd34610aa7b3863f34d340f960b89e64319186b6ffb5d2f86bf0da3f05e7dbc5d9653c865dd67853a24fd86ef74b05140827c1d5fd0bd
2b486466f4d3e30f7b22d0bc76cb68f9175fe89bbc8e44d45f4d86e0d96288e1e868524efa260ff07cb63194d04ea575ed62f6d1588bea33c20ababb42c02662d93d6015
3411bb2965f4c3d52c650aff04f48e521d8bc81acbba0fc56605f60f5a47743491d48dab43b97a40d4a7f6c21caca12a1e0281178b4a9d8dec74f50a7850867c87837435
34f915ac414e9aad2859217169f9a3aa2f9cd1d07c535aae41d5eed1f8851855b95b5b38fb6fe139b5f1ce43ed22df22d66f1e47c983a8d30ad7fd30cd08db8cd29a92b0
59e08f2ce1c3e55e2493baf36c1ad3c6327f24121d25ca818cf8414c1cc704c3004ae63a65a9128e283d64be03cdd42e90d45b81e9a97ddcc9911122f4e8fd439ccc8fa9
f4bc173bf80d922da4e755896af0db6137b2b33a8e344efcaca0abe56c6163ae64026ccef65278b232a9170ada1972affab32f8c3ce3a837e80a1d98ada41a5bf39b01e7
a253273e922ce93e2746a9791798e3fe3a595e7cc8e32071781e36bbbb680d8578ea307404ec07e3a78a030574da8f9699cfdec405f6a9f43d58b1856fce7ca3445395d3
335e322c56278e258e4d7b5e17ad98e64313af898c5e15a68616f8c40e8c7408f39e0996a9e4cc3e22e27e7aeb2f8d54504022707609a0fec9cbb21005cb0875be2a4726
93522e5f361a051f568bd1d74d901d3046ea20e3cf34d1d4cdfd797632c47396d9bdc568a75d550d208b91caa7d43a9be7fc96b2a92888572de2539f227c9a6625449f83
c86af536d87c1e5745e7d8c9f44fd25d4b0feb1dd459ade96297b361c69690ff69e97ca6ee5710c3dc6a030261ba69e06ef69a683913ae650634aedc40af8d595c45cb4f
90c7c5e257c95047dbf52bbfbe011fd64db9924decd3e578a6b7ed7476e499f8ed792202499b360204d6f5b807f881b81c3a9be6ae9300aaad00fb87d5407ed6e84ec80b
7c0528e54b086e5455ef92218ea23d035e6896b39c57d9609dc1285929b746b06e070886809692a4ac37f9e1b53b250c868abc912ff2fdcd733ff1da87e48e7d4c288a73
6405b42d2c7e42244ac73695bb7bfe6b64f03fff3ed6206337332a05ab9a84282f85a105432a3792e20711b920124707173aca65181c8da84e062c803a43a404ad49302d
6441157813de77d9849da5db9987d0bb6b2885a4f8c9d84e5dc49830abf7b1edbf1b458d8b9d2bafb680370106f93bc392dff9bdb31d3b9480d9e5f72a307715859dd094
614ea66b907314398cc14b3d2fdebe796b29b65c3886b6734df788cfc6628fbee4ce8921e3c0e8fc017e4dea2da0fd0bc7e71c42d391f9c69375505dbf3767ba967f9103
00fe3120a666a85b84500ded1af8fb61885dce73237c4d7b4d481460baffbd5694ab671197e8c285d53b551f893d6c09342ed67e08d16ab982a4012fcecdca060a5da46b
5477de039f7838dea20d3be1ae249fcb886136558ec806da5e70369ee22631bfb7fa06c27d16c987b6f6680423bc84b05b19202b45e5a58cadec8c2efa40fd924b64177d
91bf10249c5d98ea6ae11f17b6ef09708f57ec9dfba8cf181a723a6ac2f5a7f50b4550dd33a34637cf0f302c43fd0243682dab9ec3ff0b629cce4e16c9c74171dd2551d4
fb0a7e12d2861e8512a38a6cdef3ddf09351ee0364bdbb5b2ff7825699e1b1ee319b600ea0726fd9bb56d0bd6c6670cbc077c490bb22df9886475dc5bedfc6c032061024
9b7f5a1228fa66cbd35e75fb774fdc8e9c7a5239601a361b67b1aa3f19b462fd894402846f635550a1d63bee75eab0a2ae89bc6c5cc1818b3136a40961462327c3dececc
5b97d54dc5001eb7cf238292405070a6a010bf82e2c32cba896e04ec8dbff58e32eee9391f6986ab22c612165dad36a096d2194f5f3927de75605f6ca6110fe683383a01
642f523bb46c2e901416047dca1c5d4ead65c9937a376d9a53168e197d142eb27f04409432c387920c2ecfd7a0b941c8bbf667213a446bc9bc4a5a2e54e7391752e3a9b8
c617655312c573ecb01d292b320fff2eaeb480cf01696b7563580b77605558f9474c34d323b05e5e47bf43ff16b67d6ade102a6f35e08f18aa0c58358f5b22871eb0a45f
c8835a3d385162ae02bd4cb6c5ebac87b113ec41cc2fd9be9ac712410b9fd3854d7d5ad2dcaac33af2701102382d5815831eb9cf0dcd57a879c04830e54a3b85fe5d6229
1497740fa8920e4af6aa981a5b405937b13014435108b34bb7cbcef75c4ef00429b440a2adf22976c31a1645af5312528d6b90f0b88b1ad5dcc87d377e6a82dc6ac64211
5e925e315ff7a69c2f2cf1556423d5afb3d0d0e2144bd1ddd27843ef65a2fce382f6d590a8fee286fda49f807471154564fe900b3a2b030c28211404afa45703c6869dea
951ec487fb3fece58234677d7fe3e4dcbdefa773e3f09cdc409f03a09a3982f917a0cc656b306f0ece3dd1a2564a87720b03d9471522590530dd90ad30b2d235ec98b578
3e84998197fc25cbac57870e3cdeb2dec03b403d5de9778a2ec5949d869281f13976c2fc5b071e0f5f54277680c809020b9eb6d931dc6b226a913e89bb422f58228de0d0
c3a73d24df62057e299b6af183889e6bcb2382b818993ef6b8c738618cc74a39ecab243302e13fdddb02943d5ba794836a683ef6f7653e5ee64969cbbbe4403601ae9ded
d428f50a0f8cd57b0d8fe818ace6af20ce61dcfc3419ddef25e61b6d30da643a1213aa725d579221f7c2edef40ca2db39bd832256b94e43546dfb77532f6d70fcd1ce874
e1d6d4564b35bb19d2b85ca620d7b8f2d0bda184dfa31018fe999dfd9e1f99ca0ef502296c2cccf454dde30e5d3a9df9c1af00d3263893b5d23dbf38015fe3c6a92cefaf
e9502ae7b0048b9ea25dd7537818904ce7d6b3e1fba8cdf2f490031e8eb24cd515a30808cdd4aa15c2a41aa0016f80820e080ac0130ab3f7265df01b8397e4abd13c38cb
8eb34e1fb7dd9d9f0e1fef2803812759eb54dc959b3cc03fbd285cef9300c3cd2b7fe86b4adeb5ca7b098f90abb55b8a5310a99f0f8c92bfa2f8da87e60c645f2cae305a
ca0fc25ce066498031dc4ca3f72de4b8f23fecbb7386a2aa096819d857a48b853095a86c011d454da1fb8e862f2b45837f4d97eea294fc567b058b09cc915be56c2a80e1
5a2fcfff8d6aab9a0abe9ca97f6093edf6af2fa4f987df773d37d9bb44841a720817ce3817dbf1e983650b5af9295a16f4ddf49fbf23edb23f50be62637a4a688e352057
ed98e8fa385b39ca274e0de17b1007e6f7a737cb73802d54f7758afe4f9d0a7d2ea7fda4240904c0a79abae732605729a69d4c2b88bfe3a06245f8fbfb8abe5e9a894cec
320db5f1230fcfe0672c8515eb9ddcfcf7cf1e0d7756d1874630d0d697c3b0f3df0632500cff1845b6308b11059deb078d40dbf34a02dd43a81e5cdc58a0b11bfa9f5663
18d6af9211d0477f9251cf9524f898f3f97848514b63e9d655a5d554e62f9e102eb477c5767638eeec9efd5c6ad443d8b0e76be186fd609d5a8a33d59d16ffa3bdab1573

More info


Read More :- "Amnesia / Radiation Linux Botnet Targeting Remote Code Execution In CCTV DVR Samples"

Exploit-Me


"Exploit-Me is a suite of Firefox web application security testing tools designed to be lightweight and easy to use. The Exploit-Me series was originally introduced at the SecTor conference in Toronto. The slides for the presentation are available for download. Along with this SecTor is making the audio of the talk available." read more...



Website: http://securitycompass.com/exploitme.shtml

Continue reading

  1. Pentest Tools Bluekeep
  2. Pentest Tools Port Scanner
  3. Pentest Tools Open Source
  4. Hackers Toolbox
  5. Pentest Tools For Android
  6. Hacker Tools List
  7. Pentest Tools Find Subdomains
  8. Hacking Tools Windows 10
  9. Hack App
  10. Hacker Tools Windows
  11. Hacking App
  12. World No 1 Hacker Software
  13. Physical Pentest Tools
  14. Pentest Tools Windows
  15. Nsa Hacker Tools
  16. Hacking Tools Hardware
  17. Hacking Apps
  18. Hackrf Tools
  19. Hack Tools Mac
  20. Pentest Tools For Ubuntu
  21. Hack Tools Online
  22. Hacker Techniques Tools And Incident Handling
  23. Pentest Tools Tcp Port Scanner
  24. Hacking Tools Github
  25. Hacker Tools 2020
  26. Hack Tools
  27. Growth Hacker Tools
  28. What Are Hacking Tools
  29. Pentest Tools For Android
  30. Pentest Tools Framework
  31. Hack Tools For Mac
  32. Hacker Tools Free Download
  33. Hacking Tools Download
  34. Kik Hack Tools
  35. Hack Tools For Games
  36. Hacking Tools For Windows
  37. Pentest Tools Website
  38. Hack Website Online Tool
  39. Hacker Tools Apk
  40. Hacker Tools For Mac
  41. Hacker Tools For Mac
  42. Black Hat Hacker Tools
  43. Hacker Tools For Ios
  44. Hacker
  45. Hacker Tools Linux
  46. What Are Hacking Tools
  47. Pentest Tools Port Scanner
  48. What Are Hacking Tools
  49. Hacker Tool Kit
  50. Pentest Tools Website
  51. Hacking Tools Download
  52. Hacker Tools Free
  53. Pentest Tools Open Source
  54. Hackers Toolbox
  55. Android Hack Tools Github
  56. New Hack Tools
  57. Free Pentest Tools For Windows
  58. Hacking Tools Github
  59. Hacker Search Tools
  60. Hacking Tools Online
  61. Hack Tool Apk
  62. Pentest Tools Bluekeep
  63. Hack Rom Tools
  64. Hacking Tools Free Download
  65. Pentest Tools Online
  66. Pentest Recon Tools
  67. Hacking Tools Name
  68. Pentest Reporting Tools
  69. Hack Tools For Pc
  70. Hacker Tools Software
  71. Hacker Tools Apk
  72. Hacker Tools 2020
  73. Pentest Tools Github
  74. Pentest Tools Kali Linux
  75. Hack App
  76. Pentest Tools For Android
  77. Tools For Hacker
  78. Hack Tools Pc
  79. Pentest Recon Tools
  80. Hacker Tools 2019
  81. Pentest Tools Tcp Port Scanner
  82. Pentest Tools Website Vulnerability
  83. Hack Tools For Windows
  84. Hacker Tool Kit
  85. Pentest Box Tools Download
  86. Hacking Tools Hardware
  87. Hacker Tools For Ios
  88. Hacker Tools Apk
  89. Pentest Tools Download
  90. Pentest Tools Nmap
  91. Hacking Tools For Pc
  92. Pentest Automation Tools
  93. Hak5 Tools
  94. Hack Tools Mac
  95. Kik Hack Tools
  96. World No 1 Hacker Software
  97. Hacker Tools Linux
  98. Hacks And Tools
  99. Hacking Tools Pc
  100. Beginner Hacker Tools
  101. How To Make Hacking Tools
  102. Hacker Tool Kit
  103. Hacking Tools Windows 10
  104. Game Hacking
  105. Hacking Tools Free Download
  106. Hack Tools For Pc
  107. Easy Hack Tools
  108. Hacker Tools Apk
  109. What Are Hacking Tools
  110. Best Hacking Tools 2019
  111. Pentest Recon Tools
  112. Hacking Tools For Windows
  113. Pentest Tools Subdomain
  114. Install Pentest Tools Ubuntu
  115. Hacker Tools Apk Download
  116. Pentest Box Tools Download
  117. Hacking Tools Pc
  118. Hacking Tools Github
  119. Pentest Tools Framework
  120. Pentest Tools Free
  121. Hacker Tools Windows
  122. Pentest Tools Find Subdomains
  123. Pentest Tools Find Subdomains
  124. Hacking Tools Name
  125. Pentest Tools Find Subdomains
  126. Best Hacking Tools 2019
  127. Hack Tools For Mac
  128. Bluetooth Hacking Tools Kali
  129. Android Hack Tools Github
  130. Hacking Tools For Games
  131. Top Pentest Tools
  132. Hacker Tools Software
  133. Hacking Tools 2019
  134. Hacking Tools For Kali Linux
  135. Hacking Tools For Kali Linux
  136. Hack Tools For Mac
  137. Hacker Tools Free
  138. Hacking Tools Github
  139. Hacker Tools Apk
  140. Pentest Tools Open Source
  141. Game Hacking
  142. Hacking Tools Online
  143. Hacker Tools Apk Download
  144. Hacker Tools 2020
  145. Hack Website Online Tool
  146. Pentest Tools For Windows
  147. Termux Hacking Tools 2019
Read More :- "Exploit-Me"

DSploit

DSploit

After playing with the applications installed on the Pwn Pad, I found that the most important application (at least for me) was missing from the pre-installed apps. Namely, DSploit. Although DSploit has tons of features, I really liked the multiprotocol password sniffing (same as dsniff) and the session hijacking functionality.

The DSploit APK in the Play Store was not working for me, but the latest nightly on http://dsploit.net worked like a charm.

Most features require that you and your target uses the same WiFi network, and that's it. It can be Open, WEP, WPA/WPA2 Personal. On all of these networks, DSploit will sniff the passwords - because of the active attacks. E.g. a lot of email clients still use IMAP with clear text passwords, or some webmails, etc. 

First, DSploit lists the AP and the known devices on the network. In this case, I chose one victim client.


In the following submenu, there are tons of options, but the best features are in the MITM section. 


Stealthiness warning: in some cases, I received the following popup on the victim Windows:


This is what we have under the MITM submenu:


Password sniffing

For example, let's start with the Password Sniffer. It is the same as EvilAP and DSniff in my previous post. With the same results for the popular Hungarian webmail with the default secure login checkbox turned off. Don't forget, this is not an Open WiFi network, but one with WPA2 protection!


Session hijack

Now let's assume that the victim is very security-aware and he checks the secure login checkbox. Another cause can be that the victim already logged in, long before we started to attack. The session hijacking function is similar to the Firesheep tool, but it works with every website where the session cookies are sent in clear text, and there is no need for any additional support.

In a session hijacking attack (also called "sidejacking"), after the victim browser sends the authentication cookies in clear text, DSploit copies these cookies into its own browser, and opens the website with the same cookies, which results in successful login most of the time. Let's see session hijacking in action!

Here, we can see that the session cookies have been sniffed from the air:


Let's select that session, and be amazed that we logged into the user's webmail session.




Redirect traffic

This feature can be used both for fun or profit. For fun, you can redirect all the victim traffic to http://www.kittenwar.com/. For-profit, you can redirect your victim to phishing pages.


Replace images, videos

I think this is just for fun here. Endless Rick Rolling possibilities.


Script injection

This is mostly for profit. client-side injection, drive-by-exploits, endless possibilities.

Custom filter

If you are familiar with ettercap, this has similar functionalities (but dumber), with string or regex replacements. E.g. you can replace the news, stock prices, which pizza the victim ordered, etc. If you know more fun stuff here, please leave a comment (only HTTP scenario - e.g. attacking Facebook won't work).

Additional fun (not in DSploit) - SSLStrip 

From the MITM section of DSploit, I really miss the SSLStrip functionality. Luckily, it is built into the Pwn Pad. With the help of SSLStrip, we can remove the references to HTTPS links in the clear text HTTP traffic, and replace those with HTTP. So even if the user checks the secure login checkbox at freemail.hu, the password will be sent in clear text - thus it can be sniffed with DSniff.

HTML source on the client-side without SSLstrip:


HTML source on the client-side with SSL strip:


With EvilAP, SSLStrip, and DSniff, the password can be stolen. No hacking skillz needed.

Lessons learned here

If you are a website operator where you allow your users to login, always:
  1. Use HTTPS with a trusted certificate, and redirect all unencrypted traffic to HTTPS ASAP
  2. Mark the session cookies with the secure flag
  3. Use HSTS to prevent SSLStrip attacks
If you are a user:
  1. Don't trust sites with your confidential data if the above points are not fixed. Choose a more secure alternative
  2. Use HTTPS everywhere plugin
  3. For improved security, use VPN
Because hacking has never been so easy before.
And last but not least, if you like the DSploit project, don't forget to donate them!

Read more


  1. Hack Tools For Games
  2. Pentest Tools Windows
  3. Hack Website Online Tool
  4. Kik Hack Tools
  5. Best Pentesting Tools 2018
  6. Best Pentesting Tools 2018
  7. Pentest Tools Subdomain
  8. Hacking App
  9. Pentest Tools Alternative
  10. Hacking Tools For Windows
  11. Hacking Tools Usb
  12. How To Make Hacking Tools
  13. Hacker Tools Free Download
  14. Hacker Tools Apk
  15. Hacking Tools Pc
  16. Best Hacking Tools 2019
  17. Hacking Tools 2020
  18. Best Pentesting Tools 2018
  19. Hacking Tools Download
  20. Pentest Tools For Android
  21. Top Pentest Tools
  22. Hack App
  23. Hacker Tools Apk
  24. Hacking Tools For Windows
  25. Bluetooth Hacking Tools Kali
  26. Pentest Tools Open Source
  27. Hack Tools
  28. Pentest Tools Find Subdomains
  29. Hack Tools For Mac
  30. Pentest Tools For Android
  31. Hacker Techniques Tools And Incident Handling
  32. Hacking Tools 2020
  33. Install Pentest Tools Ubuntu
  34. Hackrf Tools
  35. Hacking Tools Free Download
  36. Hacker Tools Mac
  37. Hacking Tools 2019
  38. Hacking Tools Windows 10
  39. Pentest Tools For Windows
  40. Pentest Tools Url Fuzzer
  41. Hackers Toolbox
  42. Pentest Tools Port Scanner
  43. Hacker Techniques Tools And Incident Handling
  44. Pentest Tools For Mac
  45. Hacking Tools For Windows 7
  46. Android Hack Tools Github
  47. Hacker Tools Windows
  48. Hacking Tools For Pc
  49. Pentest Tools Free
  50. Hacker Tools 2019
  51. Easy Hack Tools
  52. Pentest Tools Alternative
  53. Hacker Tools Linux
  54. Hacker Tools For Pc
  55. Kik Hack Tools
  56. New Hacker Tools
  57. Hacking Tools And Software
  58. Pentest Tools Kali Linux
  59. Physical Pentest Tools
  60. Pentest Tools Framework
  61. Hacking Tools
  62. Hack Rom Tools
  63. Hacking Tools For Beginners
  64. Termux Hacking Tools 2019
  65. Hack Tools For Mac
  66. Pentest Tools Url Fuzzer
  67. Pentest Tools Online
  68. Computer Hacker
  69. Pentest Recon Tools
  70. Pentest Tools Tcp Port Scanner
  71. Beginner Hacker Tools
  72. Pentest Tools For Windows
  73. Hacker Tools 2020
  74. Hacking Tools Pc
  75. Hacking Tools 2020
  76. Hacker Tools Hardware
  77. Hacking Tools Mac
  78. Android Hack Tools Github
  79. Hack Website Online Tool
  80. Hack Apps
  81. Hacking Tools Windows 10
  82. Hacking Tools For Pc
  83. Hacking App
  84. Pentest Tools Nmap
  85. Black Hat Hacker Tools
  86. Pentest Tools Online
  87. Hacking Tools Hardware
  88. Pentest Tools For Windows
  89. Hackrf Tools
  90. Hacking Tools For Kali Linux
  91. Hacking Apps
  92. Bluetooth Hacking Tools Kali
  93. Hacker Tools Hardware
  94. Hacker Tools Online
  95. Hacker Tools
  96. Pentest Tools Download
  97. Hacking Tools Usb
  98. Android Hack Tools Github
  99. Hacker Search Tools
  100. Hacker Tools Software
  101. Pentest Tools For Android
  102. Pentest Tools Bluekeep
  103. Best Pentesting Tools 2018
  104. Hacking Tools Github
  105. Pentest Tools Bluekeep
  106. Hacking Tools Name
  107. Bluetooth Hacking Tools Kali
  108. Pentest Tools
  109. Pentest Tools Open Source
  110. Pentest Tools Linux
  111. Hacker Tools Software
  112. Hacker Tools Free
  113. Wifi Hacker Tools For Windows
  114. Pentest Tools Kali Linux
  115. Hack Tools Pc
  116. Game Hacking
  117. Hacking Tools Windows
  118. Pentest Tools
  119. Hack Tools For Games
  120. Pentest Tools Subdomain
  121. Hack And Tools
  122. Pentest Tools For Mac
  123. Hacker Tools Github
  124. Hacker Tools For Ios
  125. Hacker Tools 2019
  126. Hack Tools For Mac
  127. Pentest Tools Linux
  128. Pentest Tools For Mac
  129. Hacker Tools Github
  130. Hack Rom Tools
Read More :- "DSploit"