{"uuid": "b71c2dd3-662a-438e-bae0-ea013f8b662b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28000", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192227", "content": "Real-world tradecraft from a recovered intrusion set against a Phillipine Nuclear Agency: forged ownCloud pre-signed URLs, custom MT19937 exploit, low-and-slow exfil\nhttps://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/\n\nThe Hunt.io (http://hunt.io/) research team recovered an operator's full open directory, useful as a look at how someone actually chained known bugs in the field.  ownCloud CVE-2023-49105: five Python scripts forging pre-signed WebDAV URLs off an empty PBKDF2 salt. OC-Credential set to the impersonated account, GET against /remote.php/dav/files//, no creds needed. The fifth script adds PROPFIND Depth: 1 enumeration to reach folders not known in advance. Low-and-slow exfil: randomized time.sleep(random.uniform(3, 6)) between requests, tightened to 1.5 to 3.5 in one script, to dodge volumetric detection. CVE-2024-28000 (LiteSpeed Cache): a Go build reimplementing MT19937 with PHP mt_rand() parity, self-tested against 11 seed/output pairs, 30 workers across a 0 to 999,999 seed range. Landed on seed 311787 and created an admin account via the REST API. Fallback path: XML-RPC brute force with rockyou.txt against the same site, successful independently. Staged frameworks: Sliver, Metasploit, Mettle, plus a custom stage-1 ELF loader pulling a Mettle stage-2.  Full breakdown and IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor    submitted by    /u/Straight-Practice-99  (https://www.reddit.com/user/Straight-Practice-99) \n [link] (https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor)   [comments] (https://www.reddit.com/r/redteamsec/comments/1vyyrbn/realworld_tradecraft_from_a_recovered_intrusion/)", "creation_timestamp": "2026-09-02T01:00:27.069873Z"}