illmob

Programmable embedded devices have the capability of being detected as a HID device , just like a keyboard or mouse. So if you have physical access and a minute alone you can basically own a system with something the size of your thumb. The possibilities are endless, HTTP/FTP download, injecting binaries into debug or Powershell etc.. Also this device is cross platform which means Windows,Linux,UNIX and Apple are all vulnerable. Here’s an example we made for a Windows7 box that adds a new Admin user to the system and hides that user from the logon screen. the whole process takes about 16 seconds , with most of the time taken by the device being detected as a keyboard and the driver installed. The device costs about $20 and can be found here

Seems Comcast has a hidden admin user account on their business class modems other than the usual user:cusadmin-pw:highspeed. You can log in locally using the username mso and password: D0nt4g3tme . Furthermore you can also use Cross Site Request Forgery in iframes to set the modem to open up its remote admin ports to all IP’s not just the ones Comcast has preconfigured. If you wanna test this out you can visit this URL http://illmob.org/comcast BEWARE, if you are on vulnerable Comcast modem it will open remote access to your modem on http port 80, https port 8181 and telnet 2323.

Props to the guys @ Trustwave for the iframe POC.

Used by Stuxnet to escalate privs in win2k and XP Explanation of the code ::here:: and source code ::here::

Circumvent Apples Mac App store receipt validation.
Install the latest Snow Leopard update(10.6.6). Sign into the new App Store (in your dock). Download Twitter, it’s free. Then go to Applications folder, locate Twitter, right click, Show Package Contents, navigate to Contents folder and copy _CodeSignature, _MASReceipt and CodeResources.

Download Angry Birds ( http://bit.ly/gy9wzk ).. run the dmg file.. drag Angry Birds into the Applications folder. right click, Show Package Contents, navigate to Contents folder and delete _CodeSignature, _MASReceipt and CodeResources. Now paste in the files you copied from the Twitter.app .

Done. Enjoy Angry Birds and any other .app file from the new Mac App Store that you can find online 😉

Thats right bitches, after 6 long retarded years being under the government’s thumb for some bullshit charges ,I am finally a free man!!!!

Click Here

Click Here

Piotr, who made kon-boot, finally decided to release the Vista smb2 Negotiate ProcessID Function Table Dereference exploit code he’s been sitting on since last fall.
Download: smb2_exploit_release.zip
It should spawn a shell on TARGET_IP on port 28876
Sample usage
————
> smb2_exploit.exe 192.167.0.5 45 0
> telnet 192.167.0.5 28876

http://en.wikipedia.org/wiki/Robin_Sage

Thomas Ryan tricked people into becoming friends with “Robin Sage”

We decided to find her real identity
We started by tracking down the image to
http://www.godsgirls.com/girls/katya/album and expanded our search from there…

Katharine Cole
San Fransico,CA
DOB: july 6 1989
http://www.myspace.com/teez_bunny_
http://en-gb.facebook.com/katharinecole
We even have her cell phone number but since she was probably an unwilling participant in this experiment we decided not to make that public. Just goes to show that you cant fool everyone. 🙂