16-06-26, 06:25 AM
Hello everyone. We are Orcinus Orca. Due to some reasons, our team needs to recruit one more member specializing in low-level coding. Anyone who is still "lonely" and has the skills, please join us. Sincerely.
Due to a change of plans, we need one more member who specializes in low-level coding for our team. If you're a free agent and have the skills, hit us up.
DM for details.
(My id sesion messenger :05b0ad506bba9fbd093cdc26eea9cb7053c56ca94bc68276c3b23c21cc03b4cb1b)
Hi DarkForums We Are Orcinus Orca
we comeback and target now is wickr:D
Price: Contact for Escrow (Middleman accepted)
Format: Full Analysis + Unstripped Binaries + 300MB+ Shared Libs
Target: Wickr Compliance Cloud / AWS GovCloud / C2S & ISOB Networks
I am selling a complete 0-day exploitation chain and infrastructure intelligence package for Wickr Compliance Cloud. This isn't just a single bug; it's a total subversion of Wickr's FIPS 140-3 security claims.
1. Unstripped Production Binaries (17MB + 300MB Libs):
wickrio_compliance: NOT STRIPPED. Full symbol table visibility.
Includes 622 C++ VTable structures (WickrKeyPair, WickrSecureRoomMgr, etc.).
A complete roadmap for VTable Hijacking & Memory Corruption.
2. FIPS 140-3 Cryptographic Subversion:
0-Day in fips.so: Partial RELRO vulnerability.
Allows GOT.PLT Overwrite (memcmp, memcpy) to bypass HMAC integrity self-tests.
Intercept all cryptographic keys and plaintext data directly in memory.
3. Classified Infrastructure Intel (OPSEC Failure):
Hardcoded government endpoints: c2s.ic.gov (Amazon Secret Region) & sc2s.sgov.gov (SIPRNet/ISOB).
8 AWS Account IDs leaked (Prod, Alpha, Beta, GovCloud).
S3 Registration Key bucket names for classified military networks.
Serious inquiries only. Don't waste my time if you don't understand what Partial RELRO or VTable Hijacking is.
---[A.5] wickrio_compliance RELRO check ---
Command: readelf -l /tmp/wickr_core/wickrio_compliance | grep -A2 RELRO
GNU_RELRO 0x0000000000ce90f0 0x0000000000ce90f0 0x0000000000ce90f0
0x000000000002bf10 0x000000000002bf10 R 0x1
Command: readelf -d /tmp/wickr_core/wickrio_compliance | grep -iE 'BIND|FLAGS'
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
---[A.6] wickrio_compliance writable GOT.PLT entries (CRITICAL) ---
Command: objdump -R /tmp/wickr_core/wickrio_compliance | wc -l
22244
Command: objdump -R /tmp/wickr_core/wickrio_compliance | grep -E 'memcmp|memcpy|getenv|abort|free|malloc' | head -20
0000000000d14138 R_X86_64_GLOB_DAT malloc@GLIBC_2.2.5
0000000000d209e0 R_X86_64_64 malloc@GLIBC_2.2.5
0000000000d14328 R_X86_64_GLOB_DAT CRYPTO_memcmp@Base
0000000000d149f0 R_X86_64_GLOB_DAT free@GLIBC_2.2.5
0000000000d209f8 R_X86_64_64 free@GLIBC_2.2.5
0000000000d10b40 R_X86_64_JUMP_SLOT EC_POINT_free@Base
0000000000d10b88 R_X86_64_JUMP_SLOT __cxa_guard_abort@CXXABI_1.3
0000000000d10c48 R_X86_64_JUMP_SLOT __memcpy_chk@GLIBC_2.3.4
0000000000d10d50 R_X86_64_JUMP_SLOT ECDSA_SIG_free@Base
0000000000d10dd0 R_X86_64_JUMP_SLOT BIO_free_all@Base
0000000000d110d0 R_X86_64_JUMP_SLOT RSA_free@Base
0000000000d11210 R_X86_64_JUMP_SLOT memcmp@GLIBC_2.2.5
0000000000d11640 R_X86_64_JUMP_SLOT EVP_MD_CTX_free@Base
0000000000d11820 R_X86_64_JUMP_SLOT EVP_CIPHER_CTX_free@Base
0000000000d11a48 R_X86_64_JUMP_SLOT getenv@GLIBC_2.2.5
0000000000d11b00 R_X86_64_JUMP_SLOT __cxa_free_exception@CXXABI_1.3
0000000000d11b20 R_X86_64_JUMP_SLOT X509_CRL_free@Base
0000000000d11d08 R_X86_64_JUMP_SLOT EC_KEY_free@Base
0000000000d126f0 R_X86_64_JUMP_SLOT EVP_PKEY_free@Base
0000000000d12878 R_X86_64_JUMP_SLOT BN_free@Base
---[A.7] Messaging endpoint LIVE verification — FULL LIST ---
301 gw-pro-prod.wickr.com
301 api.messaging.wickr.eu-central-1.amazonaws.com
301 api.messaging.wickr.eu-central-2.amazonaws.com
301 api.messaging.wickr.eu-west-2.amazonaws.com
301 api.messaging.wickr.eu-north-1.amazonaws.com
301 api.messaging.wickr.ap-southeast-1.amazonaws.com
301 api.messaging.wickr.ap-southeast-2.amazonaws.com
301 api.messaging.wickr.ap-southeast-5.amazonaws.com
301 api.messaging.wickr.ap-northeast-1.amazonaws.com
301 api.messaging.wickr.ca-central-1.amazonaws.com
301 messaging.wickr.us-gov-west-1.amazonaws.com
301 messaging-beta.wickr.us-gov-west-1.amazonaws.com
301 api.gamma.messaging.us-east-1.wickr.aws.dev
---[A.8] FIPS module self-test strings — proves FIPS integrity check path ---
6666666666666666jjjjjjjjjjjjjjjjproviders/implementations/ciphers/cipher_aes_cbc_hmac_sha256_hw.c
AES-128-CBC-HMAC-SHA1
AES-128-CBC-HMAC-SHA256
AES-256-CBC-HMAC-SHA1
AES-256-CBC-HMAC-SHA256
AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by <[email protected]>
Conditional_KAT
HMAC
HMAC-DRBG
HMAC_CTX_copy
HMAC_CTX_free
HMAC_CTX_get_md
HMAC_CTX_new
HMAC_CTX_reset
HMAC_CTX_set_flags
HMAC_Final
HMAC_Init
HMAC_Init_ex
HMAC_Update
HMAC_size
---[A.9] libcrypto.so.3 FIPS-related exports ---
00000000001fafb0 T EVP_default_properties_enable_fips@@OPENSSL_3.0.0
00000000001fadf0 T EVP_default_properties_is_fips_enabled@@OPENSSL_3.0.0
---[A.10] Certificates embedded in wickrio_compliance ---
2
certificates found in binary
---[A.11] Protobuf message structures in binary ---
Method : google::protobuf::Reflection::
!"#$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$N6google8protobuf2io14ErrorCollectorE
bytes). To increase the limit (or to disable these warnings), see CodedInputStream::SetTotalBytesLimit() in third_party/protobuf/io/coded_stream.h.
exceeded maximum protobuf size of 2GB:
google/protobuf/descriptor.proto
google/protobuf/descriptor.proto"C
!.google.protobuf.EnumValueOptions
" stored in google.protobuf.Any has missing required fields
" stored in google.protobuf.Any.
"WaitingForNetworkBannerEvent.proto
$NetworkTelemetryWebSocketEvent.proto
*N6google8protobuf12_GLOBAL__N_123AggregateErrorCollectorE
*N6google8protobuf12_GLOBAL__N_123GeneratedMessageFactoryE
*N6google8protobuf12_GLOBAL__N_123StringBaseTextGeneratorE
*N6google8protobuf12_GLOBAL__N_124FieldValuePrinterWrapperE
.google.protobuf.EnumOptions
.google.protobuf.FieldOptions
.google.protobuf.FileOptions
.google.protobuf.MessageOptions
.google.protobuf.MethodOptions
---[A.12] s2n TLS library version ---
/home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_certificate.c
/home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_crypto.c
/home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_ecc_evp.c
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:211
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:212
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:213
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:216
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:225
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:228
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:231
Contact: 050478ecf2a2b5807c452969843cc719ef1e815e4c52cd9aa3ab10bb53849c072d
---Orcinus Orca---
Due to a change of plans, we need one more member who specializes in low-level coding for our team. If you're a free agent and have the skills, hit us up.
DM for details.
(My id sesion messenger :05b0ad506bba9fbd093cdc26eea9cb7053c56ca94bc68276c3b23c21cc03b4cb1b)
Hi DarkForums We Are Orcinus Orca
we comeback and target now is wickr:D
Price: Contact for Escrow (Middleman accepted)
Format: Full Analysis + Unstripped Binaries + 300MB+ Shared Libs
Target: Wickr Compliance Cloud / AWS GovCloud / C2S & ISOB Networks
I am selling a complete 0-day exploitation chain and infrastructure intelligence package for Wickr Compliance Cloud. This isn't just a single bug; it's a total subversion of Wickr's FIPS 140-3 security claims.
1. Unstripped Production Binaries (17MB + 300MB Libs):
wickrio_compliance: NOT STRIPPED. Full symbol table visibility.
Includes 622 C++ VTable structures (WickrKeyPair, WickrSecureRoomMgr, etc.).
A complete roadmap for VTable Hijacking & Memory Corruption.
2. FIPS 140-3 Cryptographic Subversion:
0-Day in fips.so: Partial RELRO vulnerability.
Allows GOT.PLT Overwrite (memcmp, memcpy) to bypass HMAC integrity self-tests.
Intercept all cryptographic keys and plaintext data directly in memory.
3. Classified Infrastructure Intel (OPSEC Failure):
Hardcoded government endpoints: c2s.ic.gov (Amazon Secret Region) & sc2s.sgov.gov (SIPRNet/ISOB).
8 AWS Account IDs leaked (Prod, Alpha, Beta, GovCloud).
S3 Registration Key bucket names for classified military networks.
Serious inquiries only. Don't waste my time if you don't understand what Partial RELRO or VTable Hijacking is.
---[A.5] wickrio_compliance RELRO check ---
Command: readelf -l /tmp/wickr_core/wickrio_compliance | grep -A2 RELRO
GNU_RELRO 0x0000000000ce90f0 0x0000000000ce90f0 0x0000000000ce90f0
0x000000000002bf10 0x000000000002bf10 R 0x1
Command: readelf -d /tmp/wickr_core/wickrio_compliance | grep -iE 'BIND|FLAGS'
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
---[A.6] wickrio_compliance writable GOT.PLT entries (CRITICAL) ---
Command: objdump -R /tmp/wickr_core/wickrio_compliance | wc -l
22244
Command: objdump -R /tmp/wickr_core/wickrio_compliance | grep -E 'memcmp|memcpy|getenv|abort|free|malloc' | head -20
0000000000d14138 R_X86_64_GLOB_DAT malloc@GLIBC_2.2.5
0000000000d209e0 R_X86_64_64 malloc@GLIBC_2.2.5
0000000000d14328 R_X86_64_GLOB_DAT CRYPTO_memcmp@Base
0000000000d149f0 R_X86_64_GLOB_DAT free@GLIBC_2.2.5
0000000000d209f8 R_X86_64_64 free@GLIBC_2.2.5
0000000000d10b40 R_X86_64_JUMP_SLOT EC_POINT_free@Base
0000000000d10b88 R_X86_64_JUMP_SLOT __cxa_guard_abort@CXXABI_1.3
0000000000d10c48 R_X86_64_JUMP_SLOT __memcpy_chk@GLIBC_2.3.4
0000000000d10d50 R_X86_64_JUMP_SLOT ECDSA_SIG_free@Base
0000000000d10dd0 R_X86_64_JUMP_SLOT BIO_free_all@Base
0000000000d110d0 R_X86_64_JUMP_SLOT RSA_free@Base
0000000000d11210 R_X86_64_JUMP_SLOT memcmp@GLIBC_2.2.5
0000000000d11640 R_X86_64_JUMP_SLOT EVP_MD_CTX_free@Base
0000000000d11820 R_X86_64_JUMP_SLOT EVP_CIPHER_CTX_free@Base
0000000000d11a48 R_X86_64_JUMP_SLOT getenv@GLIBC_2.2.5
0000000000d11b00 R_X86_64_JUMP_SLOT __cxa_free_exception@CXXABI_1.3
0000000000d11b20 R_X86_64_JUMP_SLOT X509_CRL_free@Base
0000000000d11d08 R_X86_64_JUMP_SLOT EC_KEY_free@Base
0000000000d126f0 R_X86_64_JUMP_SLOT EVP_PKEY_free@Base
0000000000d12878 R_X86_64_JUMP_SLOT BN_free@Base
---[A.7] Messaging endpoint LIVE verification — FULL LIST ---
301 gw-pro-prod.wickr.com
301 api.messaging.wickr.eu-central-1.amazonaws.com
301 api.messaging.wickr.eu-central-2.amazonaws.com
301 api.messaging.wickr.eu-west-2.amazonaws.com
301 api.messaging.wickr.eu-north-1.amazonaws.com
301 api.messaging.wickr.ap-southeast-1.amazonaws.com
301 api.messaging.wickr.ap-southeast-2.amazonaws.com
301 api.messaging.wickr.ap-southeast-5.amazonaws.com
301 api.messaging.wickr.ap-northeast-1.amazonaws.com
301 api.messaging.wickr.ca-central-1.amazonaws.com
301 messaging.wickr.us-gov-west-1.amazonaws.com
301 messaging-beta.wickr.us-gov-west-1.amazonaws.com
301 api.gamma.messaging.us-east-1.wickr.aws.dev
---[A.8] FIPS module self-test strings — proves FIPS integrity check path ---
6666666666666666jjjjjjjjjjjjjjjjproviders/implementations/ciphers/cipher_aes_cbc_hmac_sha256_hw.c
AES-128-CBC-HMAC-SHA1
AES-128-CBC-HMAC-SHA256
AES-256-CBC-HMAC-SHA1
AES-256-CBC-HMAC-SHA256
AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by <[email protected]>
Conditional_KAT
HMAC
HMAC-DRBG
HMAC_CTX_copy
HMAC_CTX_free
HMAC_CTX_get_md
HMAC_CTX_new
HMAC_CTX_reset
HMAC_CTX_set_flags
HMAC_Final
HMAC_Init
HMAC_Init_ex
HMAC_Update
HMAC_size
---[A.9] libcrypto.so.3 FIPS-related exports ---
00000000001fafb0 T EVP_default_properties_enable_fips@@OPENSSL_3.0.0
00000000001fadf0 T EVP_default_properties_is_fips_enabled@@OPENSSL_3.0.0
---[A.10] Certificates embedded in wickrio_compliance ---
2
certificates found in binary
---[A.11] Protobuf message structures in binary ---
Method : google::protobuf::Reflection::
!"#$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$N6google8protobuf2io14ErrorCollectorE
bytes). To increase the limit (or to disable these warnings), see CodedInputStream::SetTotalBytesLimit() in third_party/protobuf/io/coded_stream.h.
exceeded maximum protobuf size of 2GB:
google/protobuf/descriptor.proto
google/protobuf/descriptor.proto"C
!.google.protobuf.EnumValueOptions
" stored in google.protobuf.Any has missing required fields
" stored in google.protobuf.Any.
"WaitingForNetworkBannerEvent.proto
$NetworkTelemetryWebSocketEvent.proto
*N6google8protobuf12_GLOBAL__N_123AggregateErrorCollectorE
*N6google8protobuf12_GLOBAL__N_123GeneratedMessageFactoryE
*N6google8protobuf12_GLOBAL__N_123StringBaseTextGeneratorE
*N6google8protobuf12_GLOBAL__N_124FieldValuePrinterWrapperE
.google.protobuf.EnumOptions
.google.protobuf.FieldOptions
.google.protobuf.FileOptions
.google.protobuf.MessageOptions
.google.protobuf.MethodOptions
---[A.12] s2n TLS library version ---
/home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_certificate.c
/home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_crypto.c
/home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_ecc_evp.c
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:211
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:212
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:213
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:216
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:225
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:228
Error encountered in /home/root/Development/aws-sdk-cpp/crt/aws-crt-cpp/crt/s2n/crypto/s2n_aead_cipher_aes_gcm.c:231
Contact: 050478ecf2a2b5807c452969843cc719ef1e815e4c52cd9aa3ab10bb53849c072d
---Orcinus Orca---
