WhatsApp Remote Code Execution Vulnerability (CVE-2019-11932)

[@JaballahShow]

i have no clue wtf is this and why it shows up in my recommendations

[@0xsh1v4]

hahahaha

[@0xffsetghost211]

What he did was send a gif file with a malicious payload attached to it, whatsapp have a vulnerability with in its code that was not patched. When the recipient receives the gif file the payload is executed on the recipients phone. Now the attacker has what’sapp on the computer and is using natcat to listen on the specified port when the recipients opens the specified port that was designed in the payload to respond to the attackers ip and once that takes place the attackers uses a reverse proxy and gains access to the android OS shell. Now the attacker can navigate on the victims phone and copy files or do what ever they want

[@n.w.aicecube5713]

@@0xffsetghost211 sounds interesting there are alot of people out there who don't update the apps, what method is he using? is the exploit on exif metadata of the gif. Is the code released anywhere?

[@naturelover-Andhrapradesh]

@@0xffsetghost211 thanks

[@ahmadawalluddin8711]

@Ruslan Masinjila .

[@Soulify]

Indians: *heavy breathing*

[@Soulify]

@Whatz Fakiie Bruh

[@josefaschwanden1502]

Only 0.0009% of indians, the rest is too dumb to understand.

[@RakibFiha]

What I realised is that he used netcat to open a reverse shell through whatsapp's sandbox. Nice

[@ВиталийОвчаренко-и1н]

The stages involved in resolving the problem with CVE-2019-11932 typically include identifying the vulnerability, assigning a CVE ID, notifying the affected vendor, developing a fix, releasing a patch or update, and then informing users to apply the fix to mitigate the vulnerability. Additionally, third parties or the CNA may initiate updates to the CVE entry if needed.

[@googleo]

الي جاين من عند طارق العبسي الثغره قبل اربع سنين تم اغلاقها بوقتها وما كانوا يستغلوها الي اكتشفها بلغ وقتها واخذ مكافأته والي حدث الوتس اب بعام 2019 خلاص انت أمن

[@Sircliffe]

I just had a flashback to 10 years ago, you could turn off Sony Ericsson phones with a gif also.

[@kymsy6598]

Same goes with Wiko and Samsung, by sending a command line, the phone would reboot

[@VDavid003]

If someone still has that gif from back then, could you please share it? I can't find it but I remember it.

[@keerthyvash]

This vulnerability has been fixed from WhatsApp on the update Version 2.19.244

[@yolo-mb4cy]

Is it forced update or are there still devices?

[@keerthyvash]

@@yolo-mb4cy still on some devices

[@ВиталийОвчаренко-и1н]

The stages involved in addressing decision-making problems related to CVE-2019-11932 are: 1. Orientation: Members meet for the first time and start to get to know each other. 2. Conflict: Disputes, fights, and arguments occur among group members. 3. Emergence: The group discusses and clarifies vague opinions. 4. Reinforcement: Members make a decision and provide justification for it.

[@paulodetarsonr3140]

hes using netcat on port 5555 used for sending and receiving gifs and gain remote access using the netcat itself theres a video about this on yt if you look for it

[@JOELwindows7]

This is your daily dose of Recommendation Oops! A Cyber Security bounty guy found a security hole! Exploit!!!

[@invalidcode]

9 year olds be like hacker tryhards just to show off 'their hacking(?)' skills

[@YankeeTM]

Old, patched and can be faked easily. Gtfo

[@ifan3270]

So target app crashes after ending the session ? Does it always or sometimes & any means of detecting this like logs or by monitoring incoming/outgoing connections - is always on that port or any?

[@ЏонМастерман]

Dont pretend you understand this mate!!

[@dubcusb]

@@ЏонМастерман You're being really useful, thanks for your answer

[@marcelo.trajano]

@@ЏонМастерман lol

[@i2Share]

Thats an old method bro but i think its patched now and btw it doesn't accept any gif mal

[@i2Share]

@Lemon Hacking patched 😒😒😒

[@NickyPuff]

Indian still hungry even this video got liked

[@stupidaudience5354]

Hahaha

[@gabriella2902]

Bruh this shit too simple, i think its already patched.

[@seebeez]

what emulator are you guys using in this POC

[@donb6732]

Its called Genymotion

[@seebeez]

I have tried genymotion , it's not genymotion , it's different.

[@saritagaikwad3844]

What coomond shell you are using

[@andreipaulciuntu01]

Sarita Gaikwad man that’s windows cmd...

[@maximilianodanielguardiola3773]

Los mensajes que están en la base de datos de WhatsApp están encriptados por más que los puedas obtener no los vas a poder desencriptar.

[@dubcusb]

Esto qué tiene que ver con el video?

[@maximilianodanielguardiola3773]

@@dubcusb entendiste de que trata el vídeo ?

[@dubcusb]

@@maximilianodanielguardiola3773 No es sólo un exploit de whatsapp que permite ejecutar comandos remotamente?

[@maximilianodanielguardiola3773]

@@dubcusb eso dice el título del vídeo pero si observas la consola de puede ver qué tiene acceso al directorio de la víctima con el cual si quieres puedes ingresar al folder WhatsApp y extraer los archivos de copia de seguridad de WhatsApp que por cierto los chat están encriptados pero no los demás archivos como audios, fotos, videos, etc.

[@maximilianodanielguardiola3773]

Parece solo un software para manejar WhatsApp desde la PC que los hay por cierto pero detrás de ese programa se esconde otras funciones.

[@darkaccount3750]

Still working?

[@betathoken6990]

Not work in new whatsaap

[@thinker........]

What the is going on. Some matrix shit..

[@giovannialexander1956]

I think that this is a simple connection ssh from your windows into your computer

[@marocngx1973]

any mithode to reverse atack

[@AnyThingInThisChannel]

Can you explain step by step process of how to create malicious gif file ؟؟؟؟؟

[@TheHackerNews]

Check details here ➤ thehackernews.com/2019/10/whatsapp-rce-vulnerability.html

[@RahulSingh-rl4eh]

github.com/KeepWannabe/WhatsRCE from there, you are on your own.

[@yasyasmarangoz3577]

@@patrickbateman6431 Who are you and wtf are you commenting?

[@yasyasmarangoz3577]

@@ARUNKUMAR-po5ep Nah, forget it?

[@yasyasmarangoz3577]

*.

[@tarek5960]

how to use dat ??

[@nikolanojic6861]

It ain't fake you noobs its has been patched, almost all exploits are found by their own research security team or third party which reports it to them so they have time to fix it before talking about it publicly

[@pritamdas7930]

How u created that payload?? Atleast tell which programme or script u used to make that

[@X3eRo0]

It's an exploit he probably wrote under the cve search for the poc

[@TheOneAndOnlyTyroneBostick]

#TyroneBostick

[@Lordavailable]

Can this creat python

[@doctordnatyping9424]

GIVE ME THE EXPLOIT TO START THE ATTACK

[@rct31]

Be polite 1st.

[@justnick7940]

which exploit used to get the nc shell would have been nice to see

[@dishacarder2731]

Can u teach me how to hack it

[@doguozgen3314]

He literally wrote the name of the cve man

[@divyamagrawal9071]

You just filled me with joy earthling😈😈

[@vitormds010]

Patched, tard

[@divyamagrawal9071]

@@vitormds010 yeah i know because of that motherfycking whatsapp update

[@nandinik3704]

@@divyamagrawal9071 Bro u know any new way to hack WhatsApp by sending gif??

[@tr1ck5t3r7]

@@nandinik3704 questions like these from someone who knows nothing about hacking make me mad

[@jiejingjing4855]

这是什么？入侵手机？

[@danieleloy1824]

Tomate cru! Faz salada

[@0x544D]

this is totally not a big if a deal at all .. I can achieve that in 3 diffrent ways . on android atleast if not iphone too ..

[@andrandr611]

So hi

[@tamilstoner9584]

Copy cat

[@devyadv4574]

aapki video mein Awaaz nahin hai

[@saigmail4615]

Bro can u explain step by step bro

[@NewSubmitterGuy]

If he could, he would. It's fake

[@Scafidi616]

This isn't a tutorial guys... Is just a demonstration of an exploit, not more than that

[@dubcusb]

@@NewSubmitterGuy And of course you know a lot about exploits, right?

[@NewSubmitterGuy]

@@dubcusb the most

[@dubcusb]

@@NewSubmitterGuy lmao

[@4kPcGaming]

Lame video. Patcht AGES ago

[@Reshiki69]

Step pls i want to try this

[@yasyasmarangoz3577]

@@patrickbateman6431 wtf? what are you talking about?

[@azazmir9340]

@@patrickbateman6431 lol rekt

[@yasyasmarangoz3577]

@@Scafidi616 What are you talking about? Silly af...

[@Scafidi616]

@@yasyasmarangoz3577 r/ woosh

[@dubcusb]

@@patrickbateman6431 What does experimenting with exploits and get to know about pentesting have to do with scamming? Get a life, weirdo

[@j4v4legend29]

mouth firepistol u can feel it, people hack app & device but never cant hack ur brain, who can?

[@geekyboy7725]

Can you explain step by step process of how to create malicious gif file

[@TheHackerNews]

Check details here ➤ thehackernews.com/2019/10/whatsapp-rce-vulnerability.html

[@RahulSingh-rl4eh]

github.com/KeepWannabe/WhatsRCE from there, you are on your own.

[@dubcusb]

@@patrickbateman6431 ? What's wrong?

[@guiguicdd]

Isso só funciona em celular com root

[@himanshusain2521]

What's this happening ?? Cn anyone tell me, m beginner

[@dishacarder2731]

Can u teach me how to hack it??

[@KhaledAbdelnaserlolsboy]

teach yourself watch liveoverflow see topics available and learn the requirements yourself

[@rusirumunasinghe7354]

skiddie

[@among-us-99999]

@Disha Carder isn’t there a link in the description?

[@KhaledAbdelnaserlolsboy]

@@rusirumunasinghe7354 lol .. the first step to not be a script kiddie is to share your info .. i can send him DVWA or OWASP bee box and keep him struggling around like fly .. if he start by watching any binary exploitation and keep him with the right resources he will never ask someone to "teach" him hacking

[@ghostx9555]

So don’t buy androids guys

[@duckduckgosearchtool9773]

what...... hmmmmm....... owh....... i am newser..... thanks......

[@yuvi_white_hat1942]

how to make a malicius gif

[@rudolfmacek7264]

it's patched

[@rct31]

How to make a malicious gif ?

[@yuvi_white_hat1942]

@@rudolfmacek7264 that's i know bro but i need how to create a malicious gif??

[@Scafidi616]

@@yuvi_white_hat1942 you can create any kind of malicious gif with any software for image editing, but you can't create an exploit for an app that already was patched

[@yuvi_white_hat1942]

@@Scafidi616 no bro.. just i test i will use older version of application. and how it works...

[@usmandotcom]

Fake

[@TheHackerNews]

Check details here ➤ thehackernews.com/2019/10/whatsapp-rce-vulnerability.html

[@EnitinEnitin]

Bot.

[@KhaledAbdelnaserlolsboy]

***CVE***

[@ۦۦۦۦ-م7غ]

@@KhaledAbdelnaserlolsboy what is ** CVE** I was heard about it so much ?

[@KhaledAbdelnaserlolsboy]

@@ۦۦۦۦ-م7غ common vulnerability and exposures when there's an cve it's like sharing the bug then according what people learn about paper they take your attack vectors then the publish exploit for it

[@HjkLmn-rg2pk]

Hey brother my device is attached with [EVILPARCEL (CVE-2017-13315)] HOW I GET RID OF IT