The Hack o blog

Reinventing the weel

Tag Archives: Microsoft Windows

Dropbox authentication exploit, dbClone.

Image representing Dropbox as depicted in Crun...

Image via CrunchBase

After reading this article on dereknewton.com about Dropbox’s insecure design, sablefoxx: a resourceful young coder on the forum created a python application to exploit the insecure design of the most popular file synchronisation tool Dropbox.

Read more of this post

Rick Hayes – Assessing and Pen-Testing IPv6 Networks

Although it is long, it gives some fascinating insistent in to Pen-Testing.

An Anonymous hacker decompiles Stuxnet, posts on Github.

SVG version of Bug silk.png by Avatar

Image via Wikipedia

An Anonymous hacker de-compiles StuxNet, and posts source code on Github.

Stuxnet is a Windows computer worm discovered in July 2010 that targets industrial software and equipment While it is not the first time that hackers have targeted industrial systems, it is the first discovered malware that spies on and subverts industrial systems, and the first to include a programmable logic controller (PLC) rootkit.

https://github.com/Laurelai/decompile-dump

EasyHook – The reinvention of Windows API Hooking

http://easyhook.codeplex.com/

Project Description
EasyHook starts where Microsoft Detours ends.
This project supports extending (hooking) unmanaged code (APIs) with pure managed ones, from within a fully managed environment like C# using Windows 2000 SP4 and later, including Windows XP x64, Windows Vista x64 and Windows Server 2008 x64. Also 32- and 64-bit kernel mode hooking is supported as well as an unmanaged user-mode API which allows you to hook targets without requiring a NET Framework on the customers PC. An experimental stealth injection hides hooking from most of the current AV software.

Read more of this post

Dump utility to dump process/binary SAFESEH handlers

Sample of the Metasploit Framework 3.0 Beta ru...

Image via Wikipedia

This utility will dump the SAFESEH exception handlers in a process or binary. It is intended for the vulnerability researcher trying to exploit a vulnerability that requires bypassing SAFESEH.

https://code.google.com/p/safeseh-dump/

How to get all the local passwords on a windows PC

Screenshot of Ophcrack version 3.2.0

Image via Wikipedia

So many of my friends have been asking lately “I forgot my password on my PC how do I find it” Or “Dude how do I get the password to my boyfriends / girlfriends PC” or my favorite “how did you get admin access on the University system”, well the fact of the matter is that there are many methods of breaking into a computer system.

Like most hacking some are really freaking stupidly simple and others would take me an age to explain. As I have been really busy on some other things this week I’m going to demonstrate the simple method, I mean the really simple method to all you beginner hackers out there.

I will focus on windows for now, I have Linux and Mac tutorials but they can get a little more complicated, also you need access to the pc not just remote access for this method to work.

Ophcrack is a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. It comes with a Graphical User Interface and runs on multiple platforms.

Step one: Go and get ophcrack:

http://ophcrack.sourceforge.net/download.php?type=livecd

Step two: Burn the ISO (The disk image you just downloaded) to a DVD. I use imgburn on windows.

Step three: Ophcrack runs from boot so press the boot order list during post usually F8 or F10, and select the DVD drive to boot from.

Step four: waste some time for a while and let the magic happen, it usually takes between 5 – 15 minutes to find and crack all the local passwords.

And there you go.

How to make an installation file using Windows Only

The current logo of Microsoft Windows, the com...

Image via Wikipedia

PLEASE NOTE:
I am in no way responsible for the way you use this tutorial. Nor am I responsible if it causes yours or any other persons computer harm.

Ever wanted to make something into an installation file so that users can install whatever you specify on there computer – this may be the case more so if you are a programmer and want to distribute your .exe‘s around.

If you are one of those people then I will now teach you something hidden within Windows that let’s you do just that. Please bear in mind that this looks like a long and complicated tutorial but it’s really not – most of it is optional but I put it in for clarity!

————————————————

– Go to START > RUN and type ‘iexpress’ (minus the quotes) and hit enter.

– Now you should be faced with a small application. Choose ‘Create a new Self Extraction Directive file’ and hit next.

– Now here you can choose how the program is installed, whether the program will automatically open after installation or whether the user has to open it manually – take your pick and click next

– Specify a package title, this will be the name of the package so the user knows what they are installing.

– You then have the option to specify a prompt to the user when they attempt to install your file, put what you want or leave it out if you desire and click next.

– If your program/files are protected by copywrite laws and such, you may at this point want to include a copy of the licence. Otherwise click next.

– This part requires you to add each of the files you want to add to the install. So preferably a .exe or .bat or whatever. Make sure you add them all here and click next.

– If you chose to have your program launch as soon as installation is complete then this screen requires you to select the two dropdown boxes to represent the name of the file you want to autorun. Otherwise ignore this bit.

– This next section asks how you want the installation to be displayed, whether it be hidden, minimized, maximised or normal.

– If you would like to display a message to the user after installation then add it to this bit and click next.

– Now choose a location to save your installation file and click next.

– Its up to you if you save the SED file for future reference but if not then click next, then next again to create your file.

————————————————

– Then look where you told it to save your installation file and it should be there. So go send it to people!

So you have a Virus / Malware / Spybot / RAT

Password

Image via Wikipedia

So you have a Virus / Malware / Spy-bot / RAT

To get rid of all of them download all of these

http://www.filehippo.com/download_hijackthis/
http://www.filehippo.com/download_spyware_terminator/
http://www.filehippo.com/download_ccleaner/
http://www.filehippo.com/download_spybot_search_destroy/

  1. Install and reboot.
  2. Press f8 and boot in to safe mode.
  3. Run them all.
  4. Turn off the router for about 10 minutes ( do this wile in safe mode).
  5. Update Windows.
  6. Create a new non-privileged user from the control panel in windows, you will use this for day to day use.
  7. Change all your passwords make a strong password by using this.

Steps to build a strong password

The strongest passwords look like a random string of characters to attackers. But random strings of characters are hard to remember.

Make a random string of characters based on a sentence that is memorable to you but is difficult for others to guess.

  • Think of a sentence that you will remember
    Example: “My son Aiden is three years old.”
  • Turn your sentence into a password
    Use the first letter of each word of your memorable sentence to create a string, in this case: “msaityo”.
  • Add complexity to your password or pass phrase,Mix uppercase and lowercase letters and numbers. Introduce intentional misspellings.
    For example, in the sentence above, you might substitute the number 3 for the word “three”, so a password might be “MsAi3yo”.
  • Substitute some special characters
    Use symbols that look like letters, combine words, or replace letters with numbers to make the password complex.
    Using these strategies, you might end up with the password “M$8ni3y0.”
  • Test your new password with Password Checker
    Password Checker evaluates your password’s strength as you type.
  • Keep your password a secret
    Treat your passwords with as much care as the information that they protect.

This is a made simple post for the non IT people I know it’s just a reference so I can tell them what to do. It’s not for all you pro hackers out there.

Also I don’t know where I found the pass word tips if the original writer could contact me I will give you credit.