Jump to content

em

Active Members
  • Posts

    1909
  • Joined

  • Last visited

  • Days Won

    26

Everything posted by em

  1. M-am cam blocat umpic la runda cu SHA-256. M-a futut bitul de semn
  2. Salutare. Nu ai voie sa posteze ca challenge taskuri la care tu nu stii rezolvarea.
  3. 8. Nu ave?i voie s? vinde?i/cump?ra?i sau s? da?i XSS în serviciile Yahoo. Nici pe forum, nici pe chat, nici în mesageria privat?. Nerespectarea acestei reguli duce la ban permanent.
  4. In October 2012, Kaspersky Lab’s Global Research & Analysis Team initiated a new threat research after a series of attacks against computer networks of various international diplomatic service agencies. A large scale cyber-espionage network was revealed and analyzed during the investigation, which we called «Red October» (after famous novel «The Hunt For The Red October»). This report is based on detailed technical analysis of a series of targeted attacks against diplomatic, governmental and scientific research organizations in different countries, mostly related to the region of Eastern Europe, former USSR members and countries in Central Asia. The main objective of the attackers was to gather intelligence from the compromised organizations, which included computer systems, personal mobile devices and network equipment. The earliest evidence indicates that the cyber-espionage campaign was active since 2007 and is still active at the time of writing (January 2013). Besides that, registration data used for the purchase of several Command & Control (C&C) servers and unique malware filenames related to the current attackers hints at even earlier time of activity dating back to May 2007. Main Findings Advanced Cyber-espionage Network: The attackers have been active for at least several years, focusing on diplomatic and governmental agencies of various countries across the world. Information harvested from infected networks was reused in later attacks. For example, stolen credentials were compiled in a list and used when the attackers needed to guess secret phrase in other locations. To control the network of infected machines, the attackers created more than 60 domain names and several server hosting locations in different countries (mainly Germany and Russia). The C&C infrastructure is actually a chain of servers working as proxies and hiding the location of the ‘mothership’ control server. Unique architecture: The attackers created a multi-functional kit which has a capability of quick extension of the features that gather intelligence. The system is resistant to C&C server takeover and allows the attack to recover access to infected machines using alternative communication channels. Broad variety of targets: Beside traditional attack targets (workstations), the system is capable of stealing data from mobile devices, such as smartphones (iPhone, Nokia, Windows Mobile), enterprise network equipment (Cisco), removable disk drives (including already deleted files via a custom file recovery procedure). Importation of exploits: The samples we managed to find were using exploit code for vulnerabilities in Microsoft Word and Microsoft Excel that were created by other attackers and employed during different cyber attacks. The attackers left the imported exploit code untouched, perhaps to harden the identification process. Attacker identification: Basing on registration data of C&C servers and numerous artifacts left in executables of the malware, we strongly believe that the attackers have Russian-speaking origins. Current attackers and executables developed by them have been unknown until recently, they have never related to any other targeted cyberattacks. Read more here
  5. U wukk bir fucw nt aikyruib ri irgwea. . Textul a fost primit de la un prieten. Nu mi-a zis cum l-a criptat, e in engleza. Encriptez si un scurt text in romana la primu care cere asta aici. Premiu: ??? Solvers: - sonyx - abraxyss - B7ackAnge7z
  6. Tutorial postat de sonyx la VIP acum unu, doi ani. Dar, dupa ce a luat zeci de jocuri au inceput sa bage alte verificari. La diferite jocuri merg diferite texte
  7. De curand m-am hotarat sa ma joc cu niste .exe-uri bindate prin documente word/excel. Ma trec pe linux, mi le generez (metasploit), folosesc mai multe tipuri de injectii, urmand sa vad cum ar functiona fiecare. Dar, ce vad dupa ce ma trec pe windows? Imediat ce deschid calculatorul primesc asta. Primul lucru care ma gandesc este de ce primesc erori de la un fisier pe care nici macar nu am incercat sa il deschid (inca). Dar pana acolo ... hai sa vedem ce se afla in calea cu pricina. Ce concluzie pot sa trag eu de aici? MS mi-a "scanat" acele documente excel fara sa ma intrebe. In plus de asta, voia sa i le si trimit pe tava. Banuiesc ca a scanat doar headerul fisierelor si a vazut ca e invalid, dar tot mi se pare o nesimtire. Deci .. aveti grija ce mai tineti prin documente office.
  8. Ma nush, eu v-as hali daca ati arata toate ca aia din poza ta. Pana una alta, tu ai acuzat fara niciun fel de suport si nu vad sa imi fi dat reply cu un numar de post, ca sa iti arat editarile. (Desi ti-am zis foarte clar care a fost singura editare, putin mai sus).
  9. Esti dus. Da-mi exact numarul postului care te intereseaza si eu iti dau screenshot cu toate editarile lui. Dar esti de acord ca daca nu gasim nimic interesant la niciunu sa primesti ban aici? (Asta pentru efortul de a face screenshot + uploadat desigur).
  10. @Chiloti, Inainte de editare postul meu arata asa Asta pentru ca la mine acel browser minune (frame de iexplore.exe) crapa mereu cand il deschid imediat ce face GET la aia. Nota 2. @Chilotiv2. Astept un singur post in care eu am zis ca asta era virus. Poate ai print screenuri inainte de nush ce editare. Ca eu le-am verificat. @Chilotiv3. Si imi editez posturile sa nu fac posturi aiurea.
  11. @DarkyAngel A zis cineva ca are ceva? Te rog, show me. @DarkyAngel v2. Ce ma mira pe mine e ca stimabilul B3st isi batea pula de un user de pe aici ca facuse un tool de Y!. Pai .. aici ce vad? Niste prostioare + cateva ferestre cu iexplore.exe in ele. Ideea ar fi buna daca ar fi spart in mai multe tool-uri (proiecte diferite) mai mici axate pe diferite arii. Eventual keyloggerul ar fi fost bun daca ar fi putut fi ascuns cumva, asa cum se prezinta acum e complet inutil.
  12. Scrie in descriere ca are integrat. Probabil de-aia il vede. Uploaded with ImageShack.us Asta apare la tool-ul de Web IP Finder.
  13. False positive? Raport de la BSA. Pachete catre HY apar si in wireshark. Ma gandesc ca apare detected keylogger pentru ca are integrata si functia asta. Detailed report of suspicious malware actions: Checked for debuggers Created a mutex named: CTF.Asm.MutexDefaultS-1-5-21-220523388-602162358-1417001333-1003 Created a mutex named: CTF.Compart.MutexDefaultS-1-5-21-220523388-602162358-1417001333-1003 Created a mutex named: CTF.Layouts.MutexDefaultS-1-5-21-220523388-602162358-1417001333-1003 Created a mutex named: CTF.LBES.MutexDefaultS-1-5-21-220523388-602162358-1417001333-1003 Created a mutex named: CTF.TimListCache.FMPDefaultS-1-5-21-220523388-602162358-1417001333-1003MUTEX.DefaultS-1-5-21-220523388-602162358-1417001333-1003 Created a mutex named: CTF.TMD.MutexDefaultS-1-5-21-220523388-602162358-1417001333-1003 Created a mutex named: Local\!IETld!Mutex Created a mutex named: Local\!PrivacIE!SharedMemory!Mutex Created a mutex named: Local\_!MSFTHISTORY!_ Created a mutex named: Local\c:!documents and settings!valentin!cookies! Created a mutex named: Local\c:!documents and settings!valentin!local settings!history!history.ie5! Created a mutex named: Local\c:!documents and settings!valentin!local settings!temporary internet files!content.ie5! Created a mutex named: Local\ZoneAttributeCacheCounterMutex Created a mutex named: Local\ZonesCacheCounterMutex Created a mutex named: Local\ZonesCounterMutex Created a mutex named: Local\ZonesLockedCacheCounterMutex Created a mutex named: MSCTF.Shared.MUTEX.AHG Created a mutex named: MSCTF.Shared.MUTEX.MCM Created a mutex named: RasPbFile Created an event named: Global\CPFATE_3112_v4.0.30319 Created an event named: MSCTF.SendReceive.Event.MCM.IC Created an event named: MSCTF.SendReceiveConection.Event.MCM.IC Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\3LJ0TPNB\global_style[1].css Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\3LJ0TPNB\pageBG[1].png Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\3LJ0TPNB\twilight[1].css Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\62JKW7WU\0x0Q[1].css Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\62JKW7WU\style[1].css Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\A0UYJU4B\monaco-webfont[1].eot Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\FI35LKDN\crayon_style[1].css Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\FI35LKDN\hackyard_net[1].txt Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\FI35LKDN\ie7style[1].css Created file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\FI35LKDN\monaco[1].css Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\3LJ0TPNB\jquery-ui.min[2].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\62JKW7WU\crayon[1].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\62JKW7WU\jquery[1].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\62JKW7WU\util[1].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\A0UYJU4B\jquery.easing.1.3[1].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\A0UYJU4B\jquery.popup[1].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\A0UYJU4B\superfish[1].js Defined file type created: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\FI35LKDN\jquery.cycle.all.min[1].js [COLOR=#FF0000]Detected keylogger functionality[COLOR=#FF0000] Got computer name Got user name information Hide file from user: C:\Documents and Settings\valentin\Local Settings\History\History.IE5\index.dat Hide file from user: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Hide file from user: C:\WINXP\SbiePst.dat Internet connection: C:\Documents and Settings\valentin\Desktop\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2.exe Connects to "173.194.65.95" on port 80 (TCP - HTTP). Internet connection: C:\Documents and Settings\valentin\Desktop\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2\Hackyard Multi Tool v1.2.exe Connects to "178.63.72.86" on port 80 (TCP - HTTP). Listed all entry names in a remote access phone book Modified file in defined folder: C:\Documents and Settings\valentin\Local Settings\History\History.IE5\index.dat Modified file in defined folder: C:\Documents and Settings\valentin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Opened a service named: RASMAN Opened a service named: Sens Query DNS: ajax.googleapis.com Query DNS: hackyard.net Query DNS: www.hackyard.net Slept over 2 minutes Started a service
  14. Confirm ca merge si pe browserul stock din android. Acolo eu consider vul erabilitatea critica pentru ca linkbarul e by default hidden. Daca nu as fi citit articolul chiar m-ai fi pacalit sa ma loghez iar. Felicitari
  15. OK, Eu cred ca vinzi vise. Correct me if i'm wrong. Cum definesti tu vizite reale? Trafficul de pe traffic exchange e vizita reala? Traficul de pe P2T, P2P sunt vizite reale?
  16. Sa te conectezi prin ssh si sa rulezi cam orice dracie iti trece prin cap, doar ca trebuie sa fie compilata pentru ARM. De exemplu ai putea lasa un brute-force deschis pe router
  17. Inca ceva legat de dd-wrt. Asta ca un plus. Iti permite sa ii setezi frecvente mai ciudate pentru wifi, libere (bine, te avertizeaza ca incalci legea and stuff, dar unii spun ca le merge mai bine pe alte frecvente decat standard). Unele chipseturi nu permit aceste schimbari totusi.
  18. Si eu mi-am prins putin urechile in dd-wrt azi. Nu suporta PPPoE Russia (Dual Access). Chiar nu pot sa pricep cum saracia de firmware default de la tp-link suporta si dd-wrt nu. Pana la urma am reusit sa il configurez din cli dar inca nu m-am prins cum sa pun setarile la boot (problema e ca nu le-as vrea chiar la boot ci dupa ce mi se ridica interfetele and stuff, poate sa pun un timeout..) Concluzia, la fel. No dd-wrt unless you really need it.
  19. Domnule cifra, Din 10 posturi de ale tale 7 sunt cu injuraturi. Inainte erau modificate de ps-axl ca sa te mai tempereze. La urmatorul avertisment esti out. Imi place cum ma ameninti pe privat, si la modul cum suni aici, chiar pari ca unul din piticii de gradina ai lui *****.
  20. 1. Overclocking-ul reprezint? procedeul prin care o component? hardware de calculator este for?at? s? func?ioneze la frecven?? mai mare decât cea specificat? de produc?tor. Componentele cel mai des overclockate sunt microprocesorul, memoria RAM, placa grafic? ?i cipurile de pe placa de baz?. [wiki] 2. Nu. Ai mai putea verifica daca sursa va face fata. (Vezi puterea disipata maxima de la vechiul procesor vs noul) 3 - 6. Inainte de a debloca / overclocka un procesor ar fi bine s? te gânde?ti foarte bine dac? chiar vrei s? faci asta. In primul rând i?i vei pierde garan?ia. În plus asta pentru orice utilizator obisnuit gain-ul de performanta este minim. In ziua de azi, nu doar frecventa unui procesor inseamna neaparat performan??.
  21. em

    Chat facut in C#

    14. Nu aveti voie sa faceti proiecte sau prezentari in numele RST fara acordul unuia dintre administratori. Moderatorii sau super-moderatorii nu au dreptul de a decide ce proiecte sau prezentari vor fi aprobate. // editat titlu
  22. em

    Cautam un ratat

    Nume: Necunoscut IQ: < 99 Owner la rstcenter.com.ro Se ofera recompens?.
  23. em

    Test #1

    paxpaxpaxpaxpaxpaxpaxpaxpaxpaxpaxpaxpaxpax
  24. Ofer? mai multe detalii. Ca de exemplu: De ce nu dai tu withdraw la acei $46.90 in cont direct ca sa iti rezolvi problema. Daca eu il cumpar, pot scoate banii?
  25. Confirm ca peste 50% merg. De fapt au mers imediat ce le-a pus, acum nu stiu.
×
×
  • Create New...