The Destructive Form of Hacking

Note, everything highlighted in blue is code, what you type in the terminal)

Ah, if all else fails, this is what I resort to. Let's be a little bastard, shall we? Say all of the prior methods failed, and you just want to have some fun with these people that you apparently have a grudge against. Go have fun, and open all ports on the router. Let's flood the hell out of it. Go get any sort of program that consists of a UDP flooder, (or TCP) and flood the port that you have now opened on the router. This is amazingly straight forward, and takes pretty much no thought. Just flood the default gateway, plus the given port that you have opened, (or IP of the intranet computer). Eventually, your connection will time out if you do it while connected to the 'SSID' example. So it is best to do it from another host, and be sure to get a port flooder that spoofs your IP. Use your elite Google skills.  So where was I? Ah, yes, flooding. The router will eventually die from massive packets per second, and their connection will be terminated until they decide to reset their router. Now wasn't that fun? I always prefer that method, it is the easiest, and consists of the fastest instant gratification. Sorry folks, didn't mean to put much emphasis on the 'joy' of doing the prior attack. And of course, only do this on a network that you own... =/

Scare Tactics for Website Owners:

Say you just want to scare someone who owns a website, and not necessarily hurt anyone, (good call if you choose this, you won't get in trouble!) Get a Linux box up, and open up a shell. Paste the following code in after gaining internet access. This is kind of a lame attack, and if the person has half a brain, may be determined what has actually happened here. You take some website, and plug-and-chug, as they say into the code provided below. Let us look at it, shall we?

wget http://microsoft.com/ --user-agent="Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1" --referer=http://I_SEE_YOU!_STOP_WITH_THE_DRM_CRAP.com -O /dev/null sh scarenoobs.sh

Allow me to explain the syntax here. Wget is the Linux command that may be found in most shells. It is normally used to retrieve data from some internet source provided after the command. In this case, it is http://microsoft.com. --user-agent="Mozilla/5.0 defines what sort of browser you are using, it may be set to anything you please. --referer= defines who the refferer is, but is not limited to a website. It may be words as well, such as the given:http://I_SEE_YOU!_STOP_WITH_THE_DRM_CRAP.com. -O /dev/null tells wget where to store any temporary data, and sh scarenoobs.sh tells the script to loop. Be sure to save the program as scarenoobs.sh, or at least keep the filename and this string consistant. I may repeat this later on, but it is for your own good.  Also, please be aware that this will loop, meaning that it will repeatedly send a refferer without a pause at a rapid rate, and if left on for long, may be recognized as a DoS attack, (you don't want that...). If you want it not to loop, take out sh scarenoobs.sh.

Copy the supplied string an paste it into a file called scarenoobs.sh. Execute it in a new window, and have fun! But first, you might want to edit I_SEE_YOU! Etc and the website. So what is happening here you say? We are spoofing the refferer is all. The refferer just tells the website admin, (in a log) what webpages have redirected the user to your website. This may be a stealthily way of transporting messages, or taunting web admins who do not have much experience in such a realm. The I_SEE_YOU normally is the refferer site but here, you can obviously change it to whatever you want. If it is a 'warez' site, you could make the refferer http://cia.gov, implying that the website owner is constantly begin pinged/browsed by the CIA. Somewhat absurd, but use your imagination in terms of what it could be used for.

One other way of toying around with a noob's heart would be with the wireless connectivity method. Go get an amazingly simple program, (but brings much joy to us all) called FakeSend.exe. You may find the source code and executable here: http://www.codeproject.com/internet/fakesend.asp. Follow the directions, and send a message from some made up address, and send it to the given address found within net view. Now the user on the other end may find a lovely message that you have written for them. Aw, how nice.


This completes the series I have started. Hope U enjoyed and also found this useful.

Wifi hacking One More Method

Now that we are connected, we may now try a few methods of attack. Of course there are many, but allow me to test a few, and you may choose the one that best suits your situation. (Note, everything highlighted in yellow is code, what you type in the terminal)

Now that you are apart of the network by accessing the router, we may go back to the lovely command prompt, but this time within the Win32 environment. Open up the command prompt and type: ipconfig, so you can gain information about what the router gateway is, and what your IP is automatically assigned as, (such as, 192.168.1.XXX, or 172.16.1.XXX. Simple rule of thumb is, if it is a 192 prefix, then the router address will most likely be 192.168.0.1, and for 172, it will be 172.16.0.1). So, write down the default gateway, and paste it into your browser with http:// infront of it. Odds are, there will be a password. Considering yourself lucky if it does not require one. Second best bet is going to http://www.phenoelit.de/dpl/dpl.html, which lists all of the default username and passwords for each model number of a router out there that may be purchased by the public. If all works accordingly, now you will be able to poke around with all of the glorious settings, such as opening the ports, which is the MOST important thing to hold onto. We will discuss this later. Let us poke around and try this method of attack. Go back to command prompt and type: net view. This will display all computers connected on the network that you have so rudely joined. Now, we whip out our handy dandy program called Nessus, (or any OS fingerprinting tool that you may prefer such as, GDI, etc). The point of this is to find out what OS is on each local intranet IP address. Now, as we all know, Windows XP Pro is the sweet OS. Why, you may ask? By default, XP Pro comes with remote registry enabled by default. I ask myself why everyday, but why not profit from Microsofts flaws. Also, no, you are correct, noobs do not disable this service. This may be time for you to turn off yours by going into services.msc.  So, let us proceed while ignoring that last sidenote. Open up your registry editor, regedit. Click File>Connect Network Registry. (Please note that in certain scenarios, you may not connect to the remote registry if the person has a blank password. To test this theory, I hopped on a wi-fi network that I was indeed allowed to connect to, and tried to connect to a passwordless computer. Low and behold, it worked, but not all of the registry keys showed up, but enough to get yourself into trouble.) Follow the directions, click connect, etc. Now I know that you are thinking to yourself, we are riding on a lot of hope/faith here that everything the victim does fit's our needs. Well, yeah, duh.  This is why this is the 'non-preffered' method of choice. But its the snowballs chance in hell, so 'never going to happen you have to try it anyway' method. Let us proceed. Now, browse to the HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server. Under the Terminal Server key, you'll find a REG_DWORD value named fDenyTSConnection. Double-click on that value to open the Edit DWORD Value box and change the value data from 1 (Remote Desktop disabled) to 0 (Remote Desktop enabled). To reboot the machine if you are impatient, go back to the command prompt shell, and type: shutdown -m \\servername_or_ip_of_server_here -r Ah, now wait for the glorious boot up. If all goes accordingly, you will now be able to connect remotely to the noobs desktop, and do whatever the hell you want. Seriously, do I need to go into FURTHER detail!?

More plausible method

Let's say you are currently connected locally to the same access point, and are eager to try another form of attack. Now, since we wish to have remote access, let us apply what we call, a 'trojan.' A trojan gives you remote access from another place. So there are a couple of ways of doing this. One, you can download a program called Sub7. This is a VERY well known trojan. To get it, go to: http://www.hackpr.net/~sub7/. Follow the directions provided. Once you have created your server.exe, (tweaked it etc. and renamed it) we can proceed to our next step. Odds are, the noob has several victims on his network with open shares. Probably consists of .txt, .doc, .jpg, etc. files within its open shares. Usually, they are accessed quite often, especially if the document is currently being edited. Your job, (for once) is to google for something what we may call, a '.exe binder.' This is a beautiful tool indeed. It binds the server.exe that you have made, and enables you to spoof it as the picture file or text document that the person has in their shares. Once you spoof this, the victim will eventually execute the file, plus the hidden file that you have stealthily implemented. I would suggest to attach this on as many files as possible found on each computer. This is probably the most direct approach. Remember when you assigned a port to the Sub7 server.exe? Well, this brings us back to the default gateway IP address that we cracked, (accessed) earlier. Browse to the open port page, and add the port you had assigned to server.exe. While you're at it, you can go to a remote place such as a library and spoof send server.exe, (preferably rename it for the following instances to game.exe, or patch.exe, setup.exe. You get the picture.) Or apply it to a .jpg as a picture of something random to the e-mail address that you could have stealthfully acquired while sniffing on the network that you had connected to. Such as, getting a packet sniffer for windows and waiting for anything that is sent out with an @. This could also be very useful to get passwords, usernames, and so on. Anyway, be creative in terms of getting the server file to some computer on that network. For the time being, go back home, and leave your Sub7 client on, and it will notify you when it is executed. Thankfully, the programmers of the Sub7 are quite brilliant, and have the server.exe copied to some ambiguous directory, without self-destructing itself. Thus eliminating the idea that the file that 'does nothing' is a trojan. Eventually, the victim will connect, and you will have some fun from there.

Wifi Hacking (WEP Crack)

Let us set up a scenario here. You are eager to gain access to a non-specific, (or specific, if you have an apparent grudge with a mean neighbor) to a local computer. Here are the tools needed to gain access before we go on our mission.

* Laptop with preferably BackTrack 2 for Linux
* Supported wireless card for injection to work properly (please see the list found here >> http://www.aircrack-ng.org/doku.php?id=compatibility_drivers#which_is_the_best_card_to_buy.)
* Enough battery life to serve you well
* Kismet or netstumbler, (to each his own, preferably Kismet for Linux so you do not have to reboot back and forth so often; this comes complete in BackTrack 2)

Part 1

Setting up the perfect OS

1. Download BackTrack 2 Final ISO image from: http://remote-exploit.org/backtrack_download.html

2. Download DeepBurner and install: http://www.deepburner.com/?r=download

3. Start up DB, and select burn ISO image file. Then, find your file, click burn.


Part 2

Beginning the project at hand

1. Start up your laptop into BackTrack 2. To do so, place the CD into the computer, turn it on, and select boot from CD, (it varies from laptop to laptop. It may have the option to hit a function key such as F10 to select boot device to boot from).







2. BT2 will ask you to put in your username and password; root/toor

3. Now, type in startx





4. Once the OS is loaded, click on the black box on the bottom left hand side, this is your shell.





5. Type in kismet and hit enter.

6. Kismet will eventually load, and pull up a fairly primitive color GUI within the shell that shows all access points within your designated area, constantly being updated.

7. After selecting your target, find out by kismet if it is WEP, WPA, etc. Preferably, WEP 64 or 128bit. It tells you in a sorted column on the right hand side.



8. Now, the fun begins. Open up a few tabs within the shell. Now type each line in each new tab. Everything within the parenthesis entails exclamations in terms of what it means, syntax, etc).

9. iwconfig wlan0 mode monitor (This places the wi-fi card in monitor mode; Syntax: iwconfig device_name_here mode command_monitor)

10. airodump-ng --ivs --write file_name --channel 11 wlan0 (Starts the monitoring, collects weak IV packets. Syntax: airodump-ng –ivs_creates_extension_type –-write any_given_filename_here –channel this specifies any specific channel you wish to listen to, so you can filter out any unnecessary data).



11. aireplay-ng -3 -b 00:16:B6:2E:C3:4E -h 00:14:A5:8A:02:CD wlan0 (Stimulates packets; injection. Syntax: aireplay-ng -3 attack level -b BSSID of router goes here, shown by kismet -h the attached computer to the bssid; the router wlan0=device that you are using, remains consistent).

12. aireplay-ng -0 wlan0 -a 00:16:B6:2E:C3:4E wlan0 (This is the deauthentication attack. Aireplay-ng -0 attack number wlan0 device type of yours -a BSSID goes here again wlan0 repeat your device here, yet again).

13. Now, watch the magic happen. To put it in layman's terms, MANY numbers will appear to be rapidly increasing. Within the airodump-ng tab you had opened, the SSID of the attacked victim will increase quite a bit. Look under the IVS column to view how many you have saved to the file. Let's for now on call this default victim SSID. Once the number hits 250,000 (if it is 64-bit encryption) or 1,000,000 for 128-bit, you will be able to execute your cracking method on the IVS file you have been continuously writing.

14. Cracking time! Cd to the directory that the file you have been saving. Then, execute the following: aircrack-ng -0 -n 128 -f 4 file_name.ivs (Syntax: aircrack-ng -0 attack type -n number of the encryption type, 64 or 128 -fudgefactor 2-18 *.cap or *.ivs depending on what file type you decided to save your file as while gathering packets).



15. After a minute or two, (possibly less) you will have your hexadecimal password so now you can connect to your noob, erm, I mean 'victim's' router.

16. Reboot your computer after jotting down the hex code, and log into your winbox on the same laptop.

17. I would recommend to now setup your 'anonymous tools.' I would suggest doing the following; download a program that IronGeek and I wrote that spoofs your MAC address and your NetBIOS each time upon startup. It is entitled MadMacs, and may be found at irongeek.com. Execute it, and reboot back into Windows.

18. Connect to SSID, and input the hex code twice WITHOUT THE COLLONS as required.





19. Hopefully, if you did not screw up, you will be connected.

Remote TCP Session Reset Utility

This security tool can remotely display all active sessions on a terminal server, router, dial-in server, access server, etc. The user can reset any TCP session remotely.

Resetting a connection is simple.

1. 
   
   Start up the remote TCP session reset
2. 
   
   Enter the IP address of the machine whose connection is to be reset.
3. 
   
   Enter the read-write community string.
4. 
   
   Click on connect to retrieve a list of active TCP connections
5. 
   
   Click on the connection that is to be disconnected, and select 'Break' from the toolbar.

Bypassing Firewall using Httptunnel

http://www.nocrew.org/software/httptunnel.html

Httptunnel creates a bidirectional virtual data path tunneled in HTTP requests. The requests can be sent via an HTTP proxy if so desired. This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and telnet or PPP to connect to a computer outside the firewall.

Here is how htc sends data to the destination:

Open TCP connection to hts

Send HTTP POST with a large Content-Length

Send TUNNEL_DATA packets until POST Content-Length would be exceeded.

Send TUNNEL_PADDING packets to exactly satisfy Content-Length - 1

Send TUNNEL_DISCONNECT (1 byte)

Close TCP connection

Go to step 1

Here is how htc gets data from the destination.

Open TCP connection to hts

Send HTTP GET

Wait for response from hts

Read TUNNEL_DATA, then TUNNEL_PADDING, TUNNEL_DISCONNECT packets

Close TCP connection

Go to step 1

Tunnel creation and destruction

This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and, say, telnet or PPP to connect to a computer outside the firewall.

HTTPort - Bypass an HTTP proxy

http://www.htthost.com/

HTTPort allows you to bypass an HTTP proxy, which is blocking you from the Internet. With HTTPort you may use the following software (just a sample list, not limited to !) from behind an HTTP proxy: e-mail, IRC, ICQ, news, FTP, AIM, any SOCKS capable software, etc. etc.

The basic idea is that you set up your Internet software in such a manner, that it considers your local PC to be a remote server it needs. This is where HTTPort enters. It intercepts connection from this software and runs the connection through the proxy - this is called a tunneling. Your software should use TCP/IP. HTTPort does not work with UDP/IP. There are two ways you can set up your software for use with HTTPort:

If your software uses a single (small range of) fixed server with a single (small range of) fixed port: For instance your software would like to connect to some.server.com:some_port. Create a new HTTPort mapping, with any local port, preferably above 1024, remote server of "some.server.com" and remote port of "some_port". Point your software to 127.0.0.1:mapped_local_port as if it was the original server it needs.

If your software can connect through SOCKS4 proxy: Point your software to 127.0.0.1:1080, which is a built-in HTTPort SOCKS4 server.

Sniffers - Tool and Softwares: Network Sniffers

SMAC is a Windows MAC Address Modifying Utility that allows users to change MAC address for most Network Interface Cards (NIC) on the Windows 2000, XP, and 2003 Server systems. This is irrespective of whether the manufactures of the cards permit the change. It must be noted that SMAC does not burn a newaddress on the hardware and the new MAC addresses the user change will sustain from reboots..

SMAC has 2 modes of operation: [WBEM ON] and [WBEM OFF]. If the "Windows Management Instrumentation (WMI)" service is running, it will be running on [WBEM ON] mode. Otherwise, it is on [WBEM OFF] mode. The [WBEM ON] mode shows more information. The tool also allows the user to log and track SMAC activities.

SMAC takes advantage of the NdisReadNetworkAddress function in the Microsoft Device Driver Development Kit (DDK.) NdisReadNetworkAddress(...) is called by the network adapter driver to obtain a user specified MAC address in the registry. After the driver confirms that there is a valid MAC address specified in the registry key, the driver then programs the MAC address to its hardware registers to override the burnt-in MAC address.

SMAC was designed originally as a security vulnerability testing tool for MAC address authorization and authentication systems, Intrusion Detection Systems and MAC address based software licenses testing tool. When changing MAC address, the user must ensure that they assign MAC addresses according to IANA Number Assignments database.

Mac Changer

MAC changer is a Linux utility for setting a specific MAC address for a network interface.

It enables the user to set the MAC address randomly. It allows specifying the MAC of another vendor or setting another MAC of the same vendor.

The user can also set a MAC of the same kind (e.g.: wireless card).

It offers a choice of vendor MAC list (more than 6200 items) to choose from

MAC changer is a Linux utility for setting a specific MAC address for a network interface. It enables the user to set the MAC address randomly. It allows specifying the MAC of another vendor or setting another MAC of the same vendor. The user can also set a MAC of the same kind (e.g.: wireless card). It offers a choice of vendor MAC list (more than 6200 items) to choose from. The latest version is 1.3 and it offers more than 35 wireless cards as well.

Usage Examples:

# macchanger eth1

Current MAC: 00:40:96:43:ef:9c [wireless] (Cisco/Aironet 4800/340)

Faked MAC: 00:40:96:43:ef:9d [wireless] (Cisco/Aironet 4800/340)

# macchanger -A eth1

Current MAC: 00:40:96:43:39:a6 [wireless] (Cisco/Aironet 4800/340)

Faked MAC: 00:10:5a:1e:06:93 (3Com, Fast Etherlink XL in a Gateway 2000)

Iris is an advanced data and network traffic analyzer, a "sniffer", that collects, stores, organizes and reports all data traffic on the network. Iris has advanced integrated technology that allows it to reconstruct network traffic, all with a push of a button.

Iris can reconstruct raw data in packets and turn it into complete HTTP, SMTP and POP3 sessions in their original format. The user can view both outgoing and incoming email messages, web browsing sessions, instant messenger exchanges, non-encrypted web-based email and FTP transfers. Using this, the user can set up automated screens to monitor the Web-browsing patterns of the network. With Iris, the user is able to read the actual text of an email - as well as any attachments - exactly as it was sent. Iris will reconstruct the actual html pages that network users have visited and even simulate cookies for entry into password-protected websites.

Iris provides a larger variety of statistical measurements such as pie charts and bar graphs, and provides information on protocol distribution, top hosts, packet-size distribution and bandwidth usage. Iris' Packet Editor gives the ability to create custom or spoof packets and to send them across the Internet, to specific ports or addresses, or repeatedly across the network. Iris has a fast packet injector that handles up to 9000 packets per second.

Iris can be easily configured to only capture specific data through any combination of packet filters. Packet filters can be based on the hardware or protocol layer, any number of key words, MAC or IP address, source and destination port, custom data and size of the packets

NetIntercept from Sandstorm enterprises belongs to the category of Network Forensics Analysis Tools (NFAT) that is gaining popularity these days. Using a network forensics tool a user can spy on people's email, learn passwords, determine Web pages viewed, and even spy on the contents of a person's shopping cart. The tremendous power these forensic tools have over today's networks makes them subject to abuse. The difference is in range or depth of network monitoring. These tools can be used for full content network monitoring - not just filters.

NetIntercept 1.2 captures LAN traffic using a standard Ethernet interface card placed in promiscuous mode and a modified UNIX kernel. The capture subsystem runs continuously, whether or not the GUI is active. NetIntercept performs stream reconstruction on demand. When the user selects a range of captured network traffic to analyze, NetIntercept assembles those packets into network connection data streams. The reconstructed streams are then presented to the NetIntercept analysis subsystem for identification and analysis. Once TCP streams are reconstructed and parsed, some of the objects that they contain need to be stored for long periods of time. Examples of such objects are web pages, files transferred by FTP, and e-mail attachments.

Besides controlling data capture and analysis, the GUI offers sophisticated search criteria. A user can find one or many network connections according to the time of day, source or destination hardware or Internet address, source or destination TCP or UDP port name or number, username associated with the connection, electronic mail sender, recipient(s) or subject header, file name or World Wide Web URI associated with the transfer, specific protocols or content types recognized in the connection's contents. Once a connection has been identified, the user can drill down to view the search criteria extracted from it