Innehållsförteckning för April 2025 från Hackercool Magazine

In this month’s MTM feature, you will learn about a module that has been in plans from Metasploit team since long time but has seen light recently. This module is SMB to LDAP relay module. In this module we host an SMB server on the attacker machine and then create a relay of this to the LDAP Server of Domain Controller machine. The scenario is given in the image given below. If the relay becomes successful, an LDAP session is created on target. This session can be used to execute other modules in Metasploit that support LDAP sessions. However, this module cannot relay NTLMv2 to LDAP due to the MIC (Message Integrity Check) feature. So, at present, it only works with NTLMv1. This module automatically takes care of the need…

If you are your organization uses NETGEAR routers in your network, then this article is important to you. A critical vulnerability being tracked as CVE-2025-4978 has been detected in one of their router models that is being used by cyber criminals around the world to gain administrative control over routers without access credentials. This vulnerability has been given a CVSS rate of 9.3 out of 10. About the vulnerability If you ever used a WiFi router, you do know that you can access its administrative interface using credentials from either your network or externally if remote management is enabled on it. This is possible due to a light weight mini HTTP server present in routers firmware. This is responsible for serving the web interface in Netgear routers too. Der Spiegel,…

Several of Australia’s biggest super-annuation funds have suffered a suspected coordinated cyberattack, with scammers stealing hundreds of thousands of dollars of members’ retirement savings. Superannuation funds including Rest, HostPlus, Insignia, Australian Retirement and AustralianSuper have all reportedly been targeted. However, so far AustralianSuper appears to be the worst affected. It is Australia’s largest superannuation fund. It has roughly 3.5 million members and manages more than $365 billion in retirement savings. In this cyberattack, a handful of its members have lost about A$500,000 in combined savings. AustralianSuper is reportedly assisting authorities recover the money. It has not yet confirmed if any remediation will occur. "It is Australia’s largest superannuation fund. It has roughly 3.5 million members and manages more than $365 billion in retirement savings. In this cyberattack, a handful…

In this month’s feature of Red Team Hacking, you will learn about a network reconnaissance tool named AutoRecon. AutoRecon is a multi-threaded network reconnaissance tool that performs automated enumeration of services on the target network. This tool has been designed to save time for use in CTFs but can also be used in penetration tests and Red team operations. This tool first performs Portscans/service detection scans. After analyzing the result of scan and service detection, the tool will launch further enumeration scans of those services using a number of different tools. For example, let’s say it found port 53 open on the target system or network. Then, it will then launch ‘dig’ tool to query the DNS server. Similarly, if it finds port 80 open, it will launch What web…

In Hacking Tool feature ofthis month, you will learn how to compile server and client of ASyncRAT CSHARP. AsyncRAT sharp is an open-source Remote Access Tool (RAT) that is designed to monitor and control other computers through a secure encrypted connection. The features of this RAT include, Client screen viewer & recorder Client Antivirus & Integrity manager Client SFTP access including upload & download Client & Server chat window Client Dynamic DNS & Multi-Server support (Configurable) Client Password Recovery Client JIT compiler Client Keylogger Client Anti Analysis (Configurable) Server Controlled updates Client Antimalware Start-up Server Config Editor Server multiport receiver (Configurable) Server thumbnails Server binary builder (Configurable) Server obfuscator (Configurable) etc Although binaries of ASyncRAT are readily available to use, it would be very knowledgeable and informative if you build…

Researchers at Cybereason have detected a threat activity going on from April 2025 delivering Rhadamanthys stealer. In this month’s “Theat Intelligence” feature, let’s learn about this threat that is affecting almost all of Europe. The main tactic of this threat here are using fear-based social engineering tactics. Targets The target of this hacking campaign are content creators those are individuals working in photography, video production and music industries. The countries affected by this hacking campaign are Albenia, Austria, Bulgaria, Germany, Greece, Hungary, Ireland, Israel, Italy, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, UK, Italy, Poland and several Eastern European countries. Attack Vector The attack vector of this campaign starts with a sophisticated phishing email. These emails are being sent from email addresses impersonating legal representatives and law firms. The content of…

The privacy and anonymity-oriented operating system, Tails OS has released the latest version of its OS, Tails OS 6.15. With this release, they have taken a decisive step towards strengthening security further. Let’s see what’s new in their latest release. Latest features to feel more secure about Latest version of Tor browser The one important thing that will make you feel more secure while using the latest version of Tails OS is that Tor browser has been upgraded to its latest version. The version of that should be now 14.5.1. You all know Tor is built for keeping you anonymous while browsing but the latest version of Tor browser fixes many security bugs, adds new security features, improved usability, etc. This makes Tails even more secure. Upgraded Linux kernel To…

Security researchers at Fortinet detected a zero-day vulnerability being tracked as CVE-2025-32756 that impacts FortiVoice, FortiMail, FortiNDR, FortiRecords and FortiCamera devices. It has a CVSS rating of 9.6. About the vulnerability The vulnerability is a stack-based buffer overflow in the administrative API that occurs while handling session cookies. This can be exploited without authentication and allows any attacker to execute code remotely. The vulnerability is present in admin.fe CGI binary of the web server configured with mode-fcgid. This endpoint is accessible without authentication. As already said, this vulnerability impacts several products like Forti Cameras, Forti Mail, Forti NDR, Forti Records and Forti Voice. How this vulnerability can be exploited? Exploitation of this vulnerability is trivially simple as all the attacker will have to do is to access the vulnerable endpoint.…