Помоги Боту Маше жить комфортнее

Бот Маша, это бот Sys-Adm.in сообщества, который занимается модерацией, раздачей кармы и антиспамом. сервер на котором живет Маша, уже не справляется с текущей нагрузкой и нам нужно немного добавить мощностей с Вашей помощью. Помоги Маше быть и чувствовать себя комфортно.

Помимо всего прочего соседями бота являются боты которые созданы так же сообществом @chat_prettier_bot, @GroupWelcoModer_bot, @forum_poster_bot, @Get_Telegram_ID_bot помогая Маше, ты помогаешь целому семейству ботов выполняющих полезные задачи.

Сбор пожертвований здесь:

https://sobe.ru/na/bot_masha_will_live

Или здесь:

https://lab.sys-adm.in/

How I was able to reveal page admin of almost any page on Facebook

https://medium.com/pentesternepal/how-i-was-able-to-reveal-page-admin-of-almost-any-page-on-facebook-5a8d68253e0c

MS AD SAM Name impersonation

….
During the November security update cycle, Microsoft released a patch for two new vulnerabilities, CVE-2021-42287 and CVE-2021-42278. Both vulnerabilities are described as a ‘Windows Active Directory domain service privilege escalation vulnerability’.
 
A few weeks later, on December 12, 2021, a proof-of-concept tool leveraging these vulnerabilities was publicly disclosed.
 
When combining these two vulnerabilities, an attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that hasn’t applied these new updates. This escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain
…

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/sam-name-impersonation/ba-p/3042699

DarkWatchman: A new evolution in fileless techniques.

https://www.prevailion.com/darkwatchman-new-fileness-techniques/

Attackers test “CAB-less 40444” exploit in a dry run

An updated exploit takes a circuitous route to trigger a Word document into delivering an infection without using macros

https://news.sophos.com/en-us/2021/12/21/attackers-test-cab-less-40444-exploit-in-a-dry-run/

The Continued Evolution of Abcbot

A new version of a malicious shell noscript targeting insecure cloud instances running under Cloud Service Providers such as Tencent, Baidu and Alibaba Cloud has recently been discovered. The shell noscript prepares the target host for additional compromise over SSH, kills off processes from competing threat actors and persists itself, before downloading an additional ELF executable used to connect to a botnet as part of a campaign dubbed by 360Netlab as “Abcbot”.

https://www.cadosecurity.com/the-continued-evolution-of-abcbot/

VMware critical warns

https://www.vmware.com/security/advisories/VMSA-2021-0028.html

Azure App Service Linux source repository exposure

https://msrc-blog.microsoft.com/2021/12/22/azure-app-service-linux-source-repository-exposure/

Apache’s other product: Critical bugs in ‘httpd’ web server, patch now!

https://nakedsecurity.sophos.com/2021/12/21/apaches-other-product-critical-bugs-in-httpd-web-server-patch-now/

MS Teams: 1 feature, 4 vulnerabilities

https://positive.security/blog/ms-teams-1-feature-4-vulns

~
Threat Report: Echelon Malware Detected in Mobile Chat Forums

https://www.safeguardcyber.com/blog/echelon-malware-crypto-wallet-stealer-malware

~
Log4j Java Vulnerabilities for Legacy vGPU Software License Server

https://enterprise-support.nvidia.com/s/article/Log4j-Java-Vulnerability-CVE-2021-44228-for-vGPU-Legacy-License-Server

~
Elastic Security uncovers BLISTER malware campaign

https://www.elastic.co/blog/elastic-security-uncovers-blister-malware-campaign

Обновлен инструмент для установки GVM

- Есть возможность ставить GVM 20
- Есть возможность ставить GVM 21
- Есть возможность обновлять GVM 20 > GVM 21

Все тесты проведены на Ubuntu 20.04.3 LTS

https://github.com/m0zgen/install-gvm21

macOS Big Sur Gatekeeper bypass

Available for: macOS Big Sur
Impact: A malicious application may bypass Gatekeeper checks
Denoscription: This issue was addressed with improved checks.

https://objective-see.com/blog/blog_0x6A.html

December 2021 Web Server Survey

Web servers December vulnerabilities/impacts:

https://news.netcraft.com/archives/2021/12/22/december-2021-web-server-survey.html

 
BLD Project Service - Configurations for Browsers, Devices, Routers

Hey, today I created GitHub wiki page with simple denoscriptions of steps for BLD Configuring on/in your Browsers and Devices:

DoH/Dot
• Google Chrome
• Mozilla Firefox
• Brave
• Edge
• Android (with Private DNS feature version 9+)
• iOS/MacOS
• Standard IP DNS service
• Details on official repo

What is BLD Service - Free & Fast Service from Sys-Admin for prevention - tracking, advertising, malicious and etc..

Details
• General README.md
• Wiki page
• Current BLD official site lab.sys-adm.in site
 

QNAP NAS devices hit in surge of ech0raix ransomware attacks

https://www.bleepingcomputer.com/news/security/qnap-nas-devices-hit-in-surge-of-ech0raix-ransomware-attacks/

A Deep Dive into DoubleFeature, Equation Group’s Post-Exploitation Dashboard

https://research.checkpoint.com/2021/a-deep-dive-into-doublefeature-equation-groups-post-exploitation-dashboard/

Practical bruteforce of military grade AES-1024

https://rc3.world/2021/public_fahrplan#3c5f6844-cdc8-5a1a-a342-d93b43546a82

Flagpro: The new malware used by BlackTech

https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech