Hello and welcome to the Monday, October 2, 2020, 23 edition of the Sandstone Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

We got a couple of quick diaries from Friday and last weekend.

First, Xavier wrote about a simple NetCat backdoor.

And what's sort of simple about it here is that instead of re-implementing NetCat in Python,

all this particular Python script is doing essentially just downloading NetCat to the system and then launching it to set up a backdoor.

Pretty straightforward and of course not sure if it wouldn't actually be easier kind of to set up something like this in Python, but I guess it works.

Secondly, Xavier also wrote about a backdoor that he saw on a virus total that goes hunting for passwords. What let's make this useful is that

Xavi is also listing the files that this particular malware is looking for. So maybe you can use

that for something like an audit function or so making sure you don't have any matching files on the system.

And if you do have, then, well, definitely make sure that they don't contain any passwords.

And finally, on Sunday, we got a quick post by Diddy about his tool EML dump.

This tool allows you to then dump the mime parts.

What of mime types are being used in mime files into a JSON file.

So a cradle tool to use as part of some kind of malware analysis tool chain.

We got some follow-up items here for last week. First of all, I think it was Friday that I talked

about the XIM vulnerabilities that CDI, the CRDA initiative, discovered, well, we now have an official

response from the XM developers regarding these vulnerabilities. Good news is there are some

mitigations and it's likely that many of the default installs are not vulnerable to some of the verse issues.

First of all, I pointed out like the one authentication out of bands right vulnerability.

This was the one that can lead to code execution without actually authenticating.

Well, it turns out that it's only vulnerable if you offer external authentication mechanisms.

...