🔥 FOR SALE: CRITICAL 0-DAY — Unauthenticated RCE & Database Access on Major Malaysian Bank (Bank Rakyat) 🔥
Type: Remote Code Execution (RCE) / Database Access / Full Server Compromise
Impact: CRITICAL (9.8)
Target: Bank Rakyat Malaysia (Production Infrastructure)
Price: $2k
---
📌 WHAT IS THIS?
A complete, unauthenticated compromise of a major Malaysian banking institution. The vulnerability allows full server takeover, leading to root-level file access, a persistent shell, and complete database extraction capabilities. This is not a minor misconfiguration; it is a direct path to the bank's core infrastructure.
---
💀 WHAT CAN YOU DO?
---
🔬 PROOF OF CONCEPT (REDACTED)
1. Server Compromise (RCE):
Verified Impact: Successfully executed arbitrary PHP code on the production server. Server fingerprint confirmed.
2. Database & File System Access:
Verified Impact: Successfully read internal configuration files. Full read/write access to the web root and underlying file system confirmed.
---
🛠️ AFFECTED INFRASTRUCTURE
---
💰 TERMS
#0day #Banking #RCE #Database #Critical #Malaysia #BankRakyat
Type: Remote Code Execution (RCE) / Database Access / Full Server Compromise
Impact: CRITICAL (9.8)
Target: Bank Rakyat Malaysia (Production Infrastructure)
Price: $2k
---
📌 WHAT IS THIS?
A complete, unauthenticated compromise of a major Malaysian banking institution. The vulnerability allows full server takeover, leading to root-level file access, a persistent shell, and complete database extraction capabilities. This is not a minor misconfiguration; it is a direct path to the bank's core infrastructure.
---
💀 WHAT CAN YOU DO?
- Unauthenticated RCE: Execute arbitrary code on the production server without any authentication or valid session.
- Persistent Access: Maintain a stable, hidden backdoor with full file system read/write privileges.
- Full Database Access: Extract configuration files to obtain database credentials and query sensitive financial/customer data.
- Defacement / Data Exfiltration: Full control over the web root to modify content or exfiltrate internal data.
---
🔬 PROOF OF CONCEPT (REDACTED)
1. Server Compromise (RCE):
Verified Impact: Successfully executed arbitrary PHP code on the production server. Server fingerprint confirmed.
WS_PROOF_42_ecs-Web-Server-Bank-Rakyat2_8.2.352. Database & File System Access:
Verified Impact: Successfully read internal configuration files. Full read/write access to the web root and underlying file system confirmed.
---
🛠️ AFFECTED INFRASTRUCTURE
- Bank Rakyat Production Web Server
- Internal Database & Configuration Files
- Admin Panel & Backend Systems
---
💰 TERMS
- Full unredacted PoC (Endpoints, Payloads, Shell Access, DB Dump) provided after payment confirmation.
- Live demo available on request (escrow only).
- Serious buyers only. No time wasters.
- Contact (Session ID): 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
#0day #Banking #RCE #Database #Critical #Malaysia #BankRakyat
(3 hours ago)marlanwg Wrote: 🔥 FOR SALE: CRITICAL 0-DAY — Unauthenticated RCE & Database Access on Major Malaysian Bank (Bank Rakyat) 🔥https://www.bankrakyat.com.my/
Type: Remote Code Execution (RCE) / Database Access / Full Server Compromise
Impact: CRITICAL (9.8)
Target: Bank Rakyat Malaysia (Production Infrastructure)
Price: $2k
---
📌 WHAT IS THIS?
A complete, unauthenticated compromise of a major Malaysian banking institution. The vulnerability allows full server takeover, leading to root-level file access, a persistent shell, and complete database extraction capabilities. This is not a minor misconfiguration; it is a direct path to the bank's core infrastructure.
---
💀 WHAT CAN YOU DO?
- Unauthenticated RCE: Execute arbitrary code on the production server without any authentication or valid session.
- Persistent Access: Maintain a stable, hidden backdoor with full file system read/write privileges.
- Full Database Access: Extract configuration files to obtain database credentials and query sensitive financial/customer data.
- Defacement / Data Exfiltration: Full control over the web root to modify content or exfiltrate internal data.
---
🔬 PROOF OF CONCEPT (REDACTED)
1. Server Compromise (RCE):
Verified Impact: Successfully executed arbitrary PHP code on the production server. Server fingerprint confirmed.
WS_PROOF_42_ecs-Web-Server-Bank-Rakyat2_8.2.35
2. Database & File System Access:
Verified Impact: Successfully read internal configuration files. Full read/write access to the web root and underlying file system confirmed.
---
🛠️ AFFECTED INFRASTRUCTURE
- Bank Rakyat Production Web Server
- Internal Database & Configuration Files
- Admin Panel & Backend Systems
---
💰 TERMS
- Full unredacted PoC (Endpoints, Payloads, Shell Access, DB Dump) provided after payment confirmation.
- Live demo available on request (escrow only).
- Serious buyers only. No time wasters.
- Contact (Session ID): 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
#0day #Banking #RCE #Database #Critical #Malaysia #BankRakyat