Hackercool Magazine March 2024

Edition 7 Issue 3 Hello readers, Welcome to the third issue of year 2024. The temperature is getting hot and so does Black Hat Hacking. Lame poetry aside, let’s see what you will learn in our latest Issue. We start this Issue with a Black Hat Hacking scenario named “Hacki ng MSSQL servers”. MSSQL servers are one of the most widely used database software around the world. Black Hat Hackers have been compromising MSSQL servers since long time may be since 2016. However, it is not vulnerabilities they are exploiting. Why are hackers making MSSQL their targets? MSSQL is installed on a Windows machine and compromising it can give them access to the underlying Windows system. The second reason being that it is easy to hack them. Next, you will…

On 2nd April 2020, security researchers uncovered a Black Hat Hacking campaign that targeted MS-SQL servers to deploy backdoors, cryptominers and other RATs. This campaign was active since May 2018. In July 2023, another hacker group that operates Mallox ransomware exploited MS-SQL servers to compromise their network. In May 2023, there was a report of MS-SQL servers being exploited to deploy malware called CLRsqlshell. In April 2023, they were exploited to deploy Trigona ransomware. In September 2023, SQL servers were once again compromised to deploy Free world ransomware. Recently in Jan 2024, Turkish hackers exploited MSSQL servers to deploy Mimic ransomware. These are only some of the hacking attacks where MSSQL servers were compromised by hacker groups to deploy their chosen payloads. What is MSSQL server? Why are Black Hat…

In Infection Chain feature our previous Issue, readers learnt about a real-world infection chain of Ursnif malware. Just like all infection chains of Black Hat Hackers, it consists of a variety of files. One such file we see in many of the infection chains is a HTA file. In this Issue, let’s learn more about the HTA file. What is an HTA file? HTML application file or HTA file is a Microsoft Windows inbuilt program. Its source code consists of HTML, Dynamic HTML and a scripting language supported by Internet explorer browser like VBScript or JavaScript. In a HTA file, HTML is used to generate the user interface while the scripting language is used for program logic. HTAs were introduced by Microsoft in 1 999 along with the release of…

Hi readers. This month in the “Tool of The Month” feature, we bring you a complete guide to Medusa password cracker. Medusa (named after a Greek gorgon with living snakes as hair and a power to turn anyone who looks up to her to stone) is a speedy, parallel and modular brute forcing tool. Medusa was built to support brute forcing of many services as possible. The features of Medusa password cracker include, 1) Thread based parallel testing which allows us to perform brute forcing against multiple hosts, users or passwords concurrently. 2) Flexible user input. 3) Modular design. 4) Support to multiple protocols. The protocols supported by Medusa include CVS, FTP, HTTP, IMAP, MSSQL, MySQL, NNTP, pcanywhere, POP3, postgres, rexec rlogin, rsh, smbnt, SMTP, SMTP-VERIFY, SNMP, SSH, SVN, telnet,…

Welcome to the first article of “Exploit writing” feature of year 2024. Till now in our “Exploit Writing”, you learnt about different python commands that can perform various operations while included in an exploit. Here is the summary of those commands and Issues. July 2023 Issue: How to perform various operating system operations. Sept 2023 Issue: How to create new processes, running shell commands, executing external applications and performing various file operations. Nov 2023 Issue: Downloading files from external systems and executing them on target system. December 2023 Issue was a culmination and combination of all the above operations. All the operations we have seen until now in our “Exploit Writing” except Nov 2023 Issue are operations that are performed on the target system. But before performing any operations on…

In this article of Beginner basics, you will learn about Encryption. Encryption plays a very important role in the world of hackers and ethical hackers. It’s used in password encryption, encrypting communication between devices, data encryption, Hard disk encryption, making payloads FUD etc. What is encryption? The transformation of plain text into scrambled text or any other format which is not understandable is known as encryption. It is often used in conjunction with cryptography in cybersecurity. What is cryptography? The word cryptography came from a Greek word kryptos which means “hidden secret”. Cryptography is the study of secure communication techniques. It is closely associated with encryption which is an act of taking an ordinary text and scrambling it to transform it in to cipher text. The aim of this encryption…