Juggaar - Hack your life

Monday, June 10, 2013

How the USB AutoRun virus works

If you have been frustrated by this one, you might also be interested in how it works so I'm sharing it here...

This file virus is a Windows PE EXE file. The file is 380 416 bytes in size. It is written in Delphi.

When launched, the virus copies its executable file as follows:

%System%\config\csrss.exe
%WinDir%\media\arona.exe

It also creates the following file:

%System%\logon.bat

When this file is run, it will launch a copy of the virus:

%System%\config\csrss.exe

In order to ensure that the virus is launched automatically when the system is rebooted, it adds a link to its executable file to the system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Worms" = "%System%\logon.bat"

The virus also creates the following files:

%System%\config\autorun.inf
h:\autorun.inf
f:\autorun.inf
i:\autorun.inf
g:\autorun.inf
k:\autorun.inf
l:\autorun.inf
o:\autorun.inf
j:\autorun.inf

These files will be launched each time the user opens the corresponding hard disk partition using Windows Explorer. When one of these files is run, it will launch a copy of the virus: %System%\config\csrss.exe.

Payload

The virus modifies values of the following system registry keys:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]

DisableTaskMgr = 1

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

NoFolderOptions = 1

It also searches the hard disk partitions listed below for files with an ".mp3" extension:

d:\
c:\
e:\
f:\
g:\
h:\

These files will then be deleted.

Sunday, June 9, 2013

Websites that give hacking missions

If you want to learn intrusion techniques for pentesting, these are a few sites that teach you by giving you tasks that involve hacking onsite pages:

http://www.hackthissite.org

http://www.hack-test.com/

(for different exploits)

http://ha.ckers.org/xss.html

Convert password asterisks to text

Running this java script in your browser address bar would convert the "asterisks" entered into a password field back into text and reveal the entered password (if you forgot or if some one left it in the input box without pressing enter):

javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j<F.length; ++j) { f = F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Passwords in forms on this page:\n\n" + s); else alert("There are no passwords in forms on this page.");})();

Invisible Folders

Here's a simple and obvious trick to make your folder apparently invisible:

1) Right click on the desktop. Make a new folder.
2) Rename the folder to a space (hold ALT key and type 0160).
3) Now u have a folder with "space" character as its name.
4) Right click on the folder > properties > customize. Click on change icon.
5) Scroll a bit, u should find some empty spaces (blank icons), click on any one of them. Click ok.

Your folder will be there, you will be able to select it and the contents will appear in search results too.. but hidden from the naked eye.

Embedding the logout link

There this one trick I used to do back in orkut times when they enabled html etc. I guess you might want to try it with other services by modifying the link. Embed the logout link into the message and when it loads, the reader will be logged out. Nusiance:

<embed src="http://www.orkut.com/GLogin.aspx?cmd=logout" width="1" height="1">