Hackercool Magazine July 2022

All rights reserved. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the publisher, except in the case of brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law. For permission requests, write to the publisher, addressed “Attention: Permissions Coordinator,” at the address below. Any references to historical events, real people, or real places are used fictitiously. Names, characters, and places are products of the author’s imagination. Hackercool Cybersecurity (OPC) Pvt Ltd. Banjara Hills, Hyderabad 500034 Telangana, India. Website: www.hackercoolmagazine.com Email Address: admin@hackercoolmagazine.com…

Ever since Microsoft banned the usage ofMacros by default, hackers and APTs alike have shifted to various other methods to deliver malware. Macros were a perfect method to deliver malware for hackers. Seeing the seriousness ofthis feature, Microsoft has finally decided to disable macros by default after some dilly dallying. This move comes a few months after disabling XLM macros by default. To be precise, hackers have been moving towards other delivery methods even before the ban ofmacros by default. Some ofthese methods were being used since long time. It is only the recent Microsoft’s ban on macros that increased their usage. Pròofpoint reported that the use ofVBA & XL4 macros by malicious action reduced approximately by 66% starting from October 2021 to June 2022. It also reported that in…

A new version of Kali Linux, Kali Linux 2022.2 has been released recently. Just like any new release of Kali, this release also received many impressive updates. Let’s learn more about these updates. Desktop Environment Readers know Kali is available in different Desktop Environments like GNOME, KDE, XFCE etc. Kali brings the latest release of GNOME, GNOME 42 with this release of kali. This latest version of GNOME brings a more polished experience and a modern look. GNOME42 also brings one new feature, that of a screenshot and screen recording tool. You can now get a quick screenshot with simple shortcuts (Window screenshot (Alt+ptrscr), Fullscreen Shift + Ptrscr) KDE Desktop Environment also has been updated to the latest 5.24 version. This latest release of KDE focuses on improving overall feel…

In our previous Issue, readers have seen a Ultimate Hacking Scenario which is a combination ofthree hacking scenarios. The three hacking scenarios are, Hacking Scenario 1: Attacker & Target on same network. No Firewall, No AntiVirus on Target. Hacking Scenario 2: Attacker & Target on different networks. Target placed behind Firewall, No Antivirus on Target. Hacking Scenario 3: Attacker & Target on different networks. Target behind Firewall. Antivirus running on target. All these scenarios involved Metasploit and we have told our readers that in our next Issue we will be recreating the same hacking scenarios with non-Metasploit payloads. So as we promised, here is our UHS (Ultimate Hacking Scenario). After searching on internet for a payload generator, I have noticed one thing. There are many payload generators that generate or…

In March 2022, Juniper Threat labs detected a hacking group that previously exploited Log4j and other well-known vulnerabilities was exploiting a recently disclosed vulnerability in Redis Lua Sandbox escape 2 RCE vulnerability. This article is a walkthrough ofhow that Real World hack took place. Redis is an open source NoSQL database that is known for its speed. Redis stands for Remote Dictionary Server. Redis was voted as the most loved database in the Stack Overflow Developer Survey for years 2017, 2018, 2019, 2020 & 2021 consecutively. Companies that use Redis database include Twitter, Amazon Web Services, Microsoft and Alibaba. In the beginning of this year, a researcher named Reginaldo Silva discovered a vulnerability in Redis, that could allow remote attackers to escape the Lua sandbox and execute arbitrary commands on…

Qakbot, Quakbot, Qbot or Pinkslipbot is a type of malware called as financial malware or a banking Trojan. Its main purpose was to steal banking credentials and other related financial information. However, in recent times it has various variants that perform other activities like dropping of additional malware, logging keystrokes or creating a backdoor on compromised machines. It was first discovered in 2007 but even after 15 years is still active in the wild. The reason for this longterm success can be its usage of new techniques to avoid being detected and preventing its analysis. In this month’s Issue, we are providing you an article about evolution of Qakbot in the recent months to make our readers understand AV evasion better. This article is a result of thorough analysis done…