„Hacked WordPress sites are being defended by their attackers“
„Tech News ||
A zero-day vulnerability was recently discovered in a popular WordPress plugin and now cybercriminals exploiting the flaw have begun to protect the sites they’ve compromised from attacks launched by other threat actors.
The security flaw was first discovered by the security firm Defiant who recorded attacks on over 1.7m WordPress sites that had vulnerable versions of the File Manager plugin installed. However, in the past week, the number of sites attacked has increased to over 2.6m.
If exploited, the flaw allows attackers to upload malicious PHP files and execute arbitrary code on WordPress sites that have not updated to the latest version of File Manager.
The plugin’s developers created and put out a patch for the vulnerability with the release of File Manager 6.9.
Unfortunately though, many site owners have yet to update to the latest version of the plugin which has left their sites vulnerable to attacks.
Defending hacked WordPress sites:
Multiple cybercriminals are currently targeting sites running vulnerable versions of the File Manager plugin according to a new report from Defiant. However, Wordfence QA engineer Ram Gall explained that two of these attackers have begun to defend the sites they’ve hacked, saying:
“We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file.”
One of the attackers, who goes by the handle bajatax, is a Moroccan threat actor who is known for stealing user credentials from PrestaShop e-commerce websites. After compromising a WordPress site, bajatax then injects malicious code which harvests user credentials via Telegram when a site owner logs in and these credentials are then sold to the highest bidder. The other threat actor injects a backdoor, camouflaged as an .ico file, into a randomized folder as well as the site’s webroot to ensure that they can continue to access the compromised site.
Defiant has observed both threat actors using passwords to protect the exploitable connector.minimal.php file on sites they’ve previously infected. Gall provided further details on how these two threat actors are defending WordPress sites they’ve compromised, saying: “Our site cleaning team has cleaned a number of sites compromised by this vulnerability, and in many cases,
malware from multiple threat actors is present. The aforementioned threat actors have been by far the most successful due to their efforts to lock out other attackers, and are collectively using several thousand IP addresses in their attacks.”
WordPress site owners that have the File Manager plugin installed should update to version 6.9 immediately to avoid falling victim to any potential attacks, especially now that cybercriminals have stepped up their efforts.
Via BleepingComputer“
Source. https://todaynewspost.com/uncategorized/hacked-wordpress-sites-are-being-defended-by-their-attackers/
Conspiracy Revelation: 25.11.2020: Yes, that was true. I destroyed their hidden infected ICO.Backup now.
Conspiracy Revelation Archive Vol.142: 03.12.2020:
Conspiracy Revelation Archive:
Hacker Defender Reloaded…these times in form of Server-Rootkits…Why nobody talks about this MEGA-MESS?!!!!
Ico-Exploits are Russian in origin..and likely over 25 years old…it´s the Russian Spambot Style…
Conspiracy Revelation Archive Vol.169:
Conspiracy Revelation Archive: 3.12.2020:
Why nobody talks about Bajatax.Exploit…this thing sabotages half of the Internet´s Websides and not only those with a non-updated File Manager…50% of the Internet uses WordPress… and I see no reports…What´s going on in the IT-Security industry? Sleepy Hollow or what? Have they all become Zombies? Or is everything censored and hidden so well?
Kategorie: Sozialnetzwerke/Socialnetworks
-
Bajatax Exploit Smashed – 2nd Round – Bajatax Exploit – Zertrümmert – 2te Runde
Conspiracy Revelation: 25.11.2020: Bajatax Smashed – 2nd Round – Bajatax Exploit zertrümmert – 2te Runde…
They call it also „ZEROLOGON“…
„Using a WordPress flaw to leverage Zerologon vulnerability and attack companies’ Domain Controllers:
October 7, 2020 By Pierluigi Paganini
Using a WordPress flaw (File-Manager plugin–CVE-2020-25213) to leverage Zerologon (CVE-2020-1472) and attack companies’ Domain Controllers.
Recently, a critical vulnerability called Zerologon – CVE-2020-1472 – has become a trending subject around the globe.
This vulnerability would allow a malicious agent with a foothold on your internal network to essentially become Domain Admin with just one click. This scenario is possible when communication with the Domain Controller can be performed from the attacker’s viewpoint.
Although communication with the internal network and Domain Controller can only be made on the intranet, many networks have weak policies and a bad architecture based on network segregation and segmentation, which allows, for example, that web servers – located at the DMZ – can also communicate internally with the internal network assets and with the Domain Controllers. In detail, network segmentation involves partitioning a network into smaller networks; while network segregation involves developing and enforcing a ruleset for controlling the communications between specific hosts and services.
In order to take advantage these potential flaws, external agents have abusing a vulnerability in File-Manager plugin – CVE-2020-25213 that allows the execution of arbitrary code on the server-side (RCE vulnerability). Figure 1 below emphasizes the problem here explained.
Figure 1: Workflow diagram from black-box exploitation to Domain Controller hashes NTLM dumped via CVE-2020-25213 and CVE-2020-1472.
According to WordFence, on September 4th, 2020, were recorded attacks on over 1.7 million sites, and by today, September 10, 2020, the total number of sites attacked has increased to over 2.6 million. Meanwhile, the CVE-2020-25213 that affects the WP-Manager WordPress plugin continues to be exploited by criminals.
Hello @WordPress @ExploitDB @offsectraining.
I am security researcher and have discovered this 0 day in wordpress (wp-file-manager). I’ve mailed and requested for my CVE and authorship for the exploit but didn’t get any response. Please help me, people are stealing my work. Thks! pic.twitter.com/LOPJoRMVJ8
(@w4fz5uck5) September 8, 2020:
According to the security researcher, “I’ve sent a writeup and POC for the vulnerable plugin for the project author but didn’t get any response, and my private post was deleted. http://elFinder.py issue is a common vulnerability with so many scripts on the internet… my script only changes to “wp-content” path“.
Exploit-code – GitHub“
Source: https://securityaffairs.co/wordpress/109175/hacking/zerologon-dc-
hack.html
History/Historie/Reference/Referenz/Other Sources/Andere Quellen:
https://conspiracyrevelation.com/2020/09/28/conspiracy-revelation-hat-bajatax-exploit-zertruemmert/
https://conspiracyrevelation.com/2020/09/28/angriffe-auf-websites-auf-denen-eine-anfaellige-version-des-dateimanager-plugins-ausgefuehrt-wird/
https://conspiracyrevelation.com/2020/09/28/wordpress-malware-using-the-telegram-api/
https://conspiracyrevelation.com/2020/09/28/attackers-fight-for-control-of-sites-targeted-in-file-manager-vulnerability/
https://conspiracyrevelation.com/2020/09/28/hacker-krieg-um-300-000-gefaehrdete-wordpress-sites/
https://conspiracyrevelation.com/2020/09/28/attacks-targeting-recent-wordpress-file-manager-flaw-ramping-up/ -
Johan Fritz: Structure of the SSP, Corporations, Psychology, Mind Programming, Genetics, Experiments
„Johan Fritz: Structure of the SSP, Corporations, Psychology, Mind Programming, Genetics, Experiments
1.200 Aufrufe•23.11.2020
Awakening Cosmic Reality Show
12.500 Abonnenten
A discussion with Johan Fritz about the structure of the SSP and corporations that are connected, psychology, MK Ultra, Mind programming, Genetics, and Medical experiments.“
Conspiracy Revelation: 24.11.2020: You have by far more ads turned on than any commercial TV-Station… Never have I seen so many ads in such a short amount of time at YT.
„Part of your genetics is in that cyborg or part of your soul is in that cyborg.. while you are still on the base and you are still functioning.“
„Correct, we call it Soul Fragment and that Soul Fragment, essentially, the Alter, resides then in the canister, the sleeve of that cyborg body or brain, when cyborg finally dies or passes away, it holds back the original Soul and that is when people start to have memory call and start having reconnection, in some cases they biolocate, mean they can step into that cyborg body for a second and back in their own, because there is an energetic connection between these 2 particular energy bodes.“
„This video may have been shared on this group already. But for those of your who don’t have time to listen to 3 hours of video discussion, these notes might be helpful. Click the link to see ALL of the notes including the SSP/ICC org chart.
* 9:00 – Mention of using cyborgs (clone) instead an actual human body for dangerous missions in order to eliminate using a human body that might be killed.
* Editor Note: What’s not mentioned here is that the cyborg or clone is inhabited by a consciousness (“soul fragment”) that gets installed into it, in order for the cyborg body to carry out its mission. Otherwise the cyborg would not be able to live and perform its function.
* 11:55 – Mention of Kruger Mercenary Corps.
* 13:05 – Mention of Mars Defense Force (MDF), discussion of Super Soldier armor types.
* 14:15 – Mention of Nacht Waffen (Dark Fleet), Lunar Operations Command (LOC), Interplanetary Corporate Conglomerate (ICC), US Space Force, black goo
* 15:35 – US Space Force officer is a “white hat” who has taken over the ICC’s operations, which includes Japan’s Secret Space Program, China’s Red Dragon Secret Space Program, Red Star Rising Group (country unstated, possibly Japan).
* 20:30 – Meeting with the Clintons on Moon for a “dog and pony” show.
* 22:08 – Interplanetary Corporate Conglomerate (ICC) contracts with Lockheed Martin, Boeing, NASA JPL (jet propulsion laboratory), Douglas, reverse engineering of ET tech. Merck pharmaceuticals.
* 26:10 – SDI later became Solar Warden (associated with the US Navy. See corporate chart presented to Ronald Reagan in the 1980s.“
„30:00 – Mention of Taiwanese med bed technology developed from reverse-engineered Secret Space Program (SSP) medical technology that specializes in a non-invasive cure for brain cancer. Do a search for the term “med bed” on this website for more information.
37:40 – Genetic scanners that analyzes the body’s DNA within 30 minutes. Thereafter, genetic editing device can edit the body’s DNA to correct mutations and other problems.
1:11:55 – Johan states he remembers seeing Corey Goode on his ship while Corey was doing was doing repairs on the ship.
1:33:35 – Johan speaks of his service on Jupiter and a Jupiter moon. Randy Cramer may have discussed this also.
1:37:15 – Jupiter moon location does cloning done by Monarch Security Solutions LLC.
1:40:40 – Metagene discussion.
1:43:40 – Hyperion Space Station was built in the 1960s by the Tall White ETs – not Earth-human technology. Then run by Russians, then taken over by ICC when Red Rising Star program failed. Hyperion can jump to different physical locations.
1:47:15 – “Alters” or “clones” or “version 2.0” of one’s self. Usually used by Super Soldiers. Basically a physical copy made of a body for high risk missions. If the body dies on the mission, the consciousness of that body goes back to the source or original body, then the body is re-cloned and inserted into a time (time travel) before the mission was performed to re-do the mission in a way so that the mission was successful. This practice was typically used by Kruger Mercenary Corps, but was not favored by Nacht Waffen (Dark Fleet), Mars Defense Force (MDF), and the Alliance AKA “White Hats”.
1:55:05 – Johan’s recommendations for people with special experiences who are first “coming out of the closet”.
2:32:40 – Difference between a “screen memory” and an actual memory.“
„I was given access to medical labs to do genetics and all that..heavily working and doing that stuff, because that´s what I did in the SSP and it still comes obessively compulsely comes up…I do stuff on myself medically…test & stuff to just try to figure out what I can improve healthwise, but I do it through the medical system. I am not afraid of medical system or alternative medicine. I use both, because they advantages and disadvantages. (right)“
„So what would you recommend people first coming out?“
„Okay.. I did it the wrong way. I am just going to be blunt,, when I initially first start talking about some of the stuff I went through, I did it completely the wrong way. I came out using my actual name initially and that´s where I got doxxed, so that´s the reason why I am using one of my alter IDs as the name that I speak under publicly. From my experience here is what I will see: One, if you have family, if you have children, if you have significant others and people who are dependent on you, for safety, for income, for security, you need to think very hard and very carefully, if you really want to step into this arena, because there are people, we have already talked about, who will actively go after you and try to complete and utterly destroy you in social media and in direct in person interviews and all kinds of stuff, secondly, I would say if you decide to come it, if you still feel your message is important enough to come out like I did, then you have to figure out how to safeguard, both the people you care about and yourself enough, so that you are creating kind of a barrier between them and you… If you look up that name, that Johan Fritz, it brings up all these guys in Germany who are very pissed off, looking like a near bear, okay, it´s not me. I am doing this, because it creates that safety buffer
until I am ready to come actually out under my real name,.. as a response for an adult, I have to think about other people, not just me,..there are some people who don´t have any sort of siblings or children or significant others..the need to come out, I understand this too…So If you come out you can turn off the very people you want to have in your life as well, I experienced that first hand, in terms of family. … People in my family they don´t want to hear that stuff, because they don´t believe it´s real. The idea is, what I would say is safety is the number one thing, that is the number one thing you have really closely look at, if you have people, especially people who could be medically at risk, do not risk coming out. So I am being flat blunt with you, do not do it, because there is a possibility that that could be use against you or your spouse or your significant other later on the line.. If you have someone who has a genetic disorder,…or if you have someone who has a very severe medical issue that needs constant mediating all the time…let´s say you have children that are autistic…they don´t have a finger in the fight and in my case what happened the first time I got doxxed, was, that these individuals, that came out as one group, they were targeting me and my significant other at that time, because of the fact I have said stuff that they didn´t happen to agree with..whatever. The point is that when they started coming after me, they were not only attacking me, they were
attacking someone in a complete innocent situation…now I am in the process of getting my divorce done… When I step into a dating relationship…to absolutely understand that there are certain safety concerns when I talked about this stuff…Nevada, Las Vegas, we had 2 individuals come into the room, I knew for a fact these individuals were out in a medical suit where intelligence people, one was CIA, the other was Mossad, they were listening to everything we were saying. I started to enlarge my auric field…one guy was trying to attack James..
and then I started dipping into the person that was doing the attack, I started dipping into his brain and I asked, why are you here, why are you doing this behavior? „I am Mossad“ Then you need to leave the room.“
„Safety is now paramount.“
„To gain some of this knowledge we are talking about..QHHT..Healing schools.. In the US/Canada/Overseas..PHR.. I recommend finding a practitioner who is metaphysical, not an atheist, ok. I am saying this for a reason, because the practitioners who tend to be more atheistic, have a real problem when we start talking about shit out in space, I don´t know why that is the case, but they do, finding someone who tends to be more of a metaphysician, so more spiritual, right….Shamanistic Soul Retrieval.“
-
TR-3B Anti-gravity spacecraft / TR-3B Anti-Schwerkraft-Raumschiff
„TR-3B Anti-Gravity Spaceship / Anti-Schwerkraft-Raumschiff“
„The TR-3B Anti-gravity spacecraft is one of the secret technologies which were available since a very long time.
It uses highly pressured mercury accelerated by nuclear energy to produce a plasma that creates a field of anti-gravity around the ship. Conventional thrusters located at the tips of the craft allow it to perform all manner of rapid high-speed manoeuvres along all three axes.“
„Das Raumschiff von 1971 war möglicherweise eine frühe Version des Tr-3b. In 1973 beobachtete Edgar Fouche und seine Freunde die TR-3b bei zwei Gelegenheiten auf dem Luftwaffenstützpunkt Edwards AFB, von dem er behauptet, dass die Anti-Schwerkraft mithilfe eines kernbetriebenen Spinnmagnetfelds erreicht wird. Ich habe diese Vergrößerung erhalten aus diesem Foto. Ich habe die Hauptmerkmale der drei Lenkstrahlruder hervorgehoben und einige Bandings sind sichtbar am Rande,…
Diese Fotos verleihen Glaubwürdigkeit durch jene pensionierte Armeeangehörige, die sagten, dass es eine Basis auf dem Mond und auf dem Mars vor 1970 gab.
Es wurde von mehreren Regierungsangestellten angegeben, dass die TR3b in 90 Minuten zum Mond fliegen kann.“
https://youtu.be/-UTg-fyTFCQ -
KW20-43 2. Lockdown – 3. Stufe Machtergreifung…
„KW20-43 2. Lockdown – 3. Stufe Machtergreifung: Christoph Hörstel 2020-10-24
27.611 Aufrufe
•24.10.2020“
„Der Staat arbeitet mit diktatorischen Mitteln, anders kann man das nicht sagen, da gibt es Kontosperrungen überall, inzwischen auch bei meiner Frau und mir und das ist in diesem Fall eindeutig Sippenhaft, ganz klar, da gibt es eine Vielzahl von Gerichtsprozessen, ..bei mir sind es 3, dann gibt es operative Maßnahmen, wie Hausdurchsuchungen und existenzielle Bedrohungen…Die Unterdrückung aktiver Regierungs- und Systemgegner, auch das ist eine offenbare Geschichte und das führt natürlich dann Regierungsgegner in das Lager der Systemkritiker,.. die doppelte Botschaft an „Querdenken“ ist angekommen: Beifall und Respekt vor der Protest-Leistung, klar und dann eben auch Kritik an der politischen Schwäche, wegen Mangel an Einsicht und Erfahrung, und wegen politische Konzeptlosigkeit, mit Unklarheit verbunden..Die Menschen wollen endlich politische Erfolge sehen!..Es muss eben eine Partei her, aber eben mit einer Bewegung dazu, ohne Bewegung geht das nicht. Eine Partei ohne eine große Bewegung auf der Straße, bleibt auch politisch schwach und wenig durchsetzungsfähig..Demonstrationsverboten…das ist die Verweigerung eines Grundrechts…“
Conspiracy Revelation: 20.11.2020: Wenn ihr auf IP 104.xx.xx.xx (CLOUD14) hochladet, seid ihr bei den NWO-Verbrechern und der CIA… in den allermeisten Fällen…und Bitchute (kein 104.. aber CLOUD14), gab.com (104.xx CLOUD14) und all die anderen Alternativen, die die Menschen benutzen, Patreon und weiß Gott was, das sind alles infiltrierte Systeme, das sind i.d.R. alles Plätze des Schattenregierungsterritoriums..Merken.. Außerdem wurde ja schon angemerkt, dass in Deutschland fast alle Server zuerst über einen Zion-Staazi-Regierungsproxy laufen. VPN wäre eine Alternative, aber reicht allein auch nicht.
„Je 1/3 Systemträger und Systemgegner, aber 2/3 davon befinden sich im Totalrückzug aus der Politik, die machen nix und die 1/3 Beobachter in Deutschland, die sind vollkommen gelähmt. Der 2. Lockdown, der überwindet möglicherweise die Lähmung hier, nämlich bei den Systemgegnern und bei den Beobachtern und das ist allerdings nur mit diktatorischen Mitteln zu bremsen, dass die dann aufwachen, das ist spannend.“
Die Twit-Heads sowieso….das ist ein Kompliment dort präemptiv gesperrt zu werden. Im Nest der NWO-Mafia.
