$ tail /var/log/auth.log
Aug  1 20:23:41 www.PCTipsbyAnu.tk sshd[15577]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.218.125.178
Aug  1 20:23:44 www.PCTipsbyAnu.tk sshd[15577]: Failed password for invalid user edward from 210.48.230.5 port 43812 ssh2
Aug  1 20:23:46 www.PCTipsbyAnu.tk sshd[15581]: Invalid user javed from 210.48.230.5
Aug  1 20:23:46 www.PCTipsbyAnu.tk sshd[15581]: (pam_unix) check pass; user unknown
Aug  1 20:23:46 www.PCTipsbyAnu.tk sshd[15581]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.218.125.178
Aug  1 20:23:49 www.PCTipsbyAnu.tk sshd[15581]: Failed password for invalid user javed from 210.48.230.5 port 44088 ssh2
Aug  1 20:23:51 www.PCTipsbyAnu.tk sshd[15585]: Invalid user code from 210.48.230.5
Aug  1 20:23:51 www.PCTipsbyAnu.tk sshd[15585]: (pam_unix) check pass; user unknown
Aug  1 20:23:51 www.PCTipsbyAnu.tk sshd[15585]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.218.125.178
Aug  1 20:23:53 www.PCTipsbyAnu.tk sshd[15585]: Failed password for invalid user code from 210.48.230.5 port 44346 ssh2

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

-N SSH
-N SSH_ABL
-A SSH -m recent --name SSH_ABL --update --seconds 3600 -j REJECT
-A SSH -m recent --name SSH --rcheck --seconds 60 --hitcount 5 -j SSH_ABL
-A SSH_ABL -m recent --name SSH_ABL --set -j LOG --log-level warn --log-prefix "ABL: +SSH: "
-A SSH_ABL -j REJECT
-A SSH -m recent --name SSH --rcheck --seconds 2 -j LOG --log-level warn --log-prefix "RATE: "
-A SSH -m recent --name SSH --update --seconds 2 -j REJECT
-A SSH -m recent --name SSH_ABL --remove -j LOG --log-level warn --log-prefix "ABL: -SSH: "
-A SSH -m recent --name SSH --set -j ACCEPT
-A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j SSH

1. Download RarCrack by using the one of the following commands (just the difference of downloading mirror) in terminal:wget http://superb-east.dl.sourceforge.net/sourceforge/rarcrack/rarcrack-0.2.tar.bz2
   wget http://kent.dl.sourceforge.net/sourceforge/rarcrack/rarcrack-0.2.tar.bz2
   wget http://nchc.dl.sourceforge.net/sourceforge/rarcrack/rarcrack-0.2.tar.bz2
   
2. Extract the RarCrack archive:
   tar -xjf rarcrack-0.2.tar.bz2
3. Change directory into the extracted RarCrack folder:
   cd rarcrack-0.2
4. Install the RarCrack with the following command:make
   sudo make install (so simply make install if already login as root)
   
5. To crack or break the RAR, 7z or ZIP file Password, use the following syntax:
   rarcrack encrypted_archive.ext [--threads thread_num] [--type rar|zip|7z]
   The switch in [] is optional. RarCrack can autodetect the archivetype, so the –type parameter only require if auto-detection of filetype is wrong. And by default, RarCrack launches two cracking threadsif no thread number is specified.
   For example,
   
   rarcrack example.rar
   rarcrack forgetpassword.zip
6. After starting the process to break and crack the password,RarCrack will print and save the current status of cracking to a XMLstatus file. Any valid good password to open the archive, if found,will be printed as good_password variable. An example of the XML fileis as follow:
   
   
   0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ</abc>
   uU
   
   
   
   Tip: If you can barely remember the password but pretty confidentthat only certain characters or digits are used, modify the “abc”character set to include those characters or numbers only. 
   On firstuse, run the RarCrack to generate the XML status file, then edit thenfile and rerun the RarCrack again.
   
   
   Thanks.....

Ok guys, here is a simple n effective way to crack/unlock a locked hdd/harddisk 

password. So lets check it out...
During development of the Rockbox firmware, on several occations the
harddisk has become locked, i.e. password protected. This results in
the Archos displaying:

Part. Error
Pls Chck HD

We are still not 100% sure why it happened. Theories range from
low-power conditions to accidental chip select failure. It has also
happened for normal users, using the standard Archos-supplied
firmware, although it was more frequent for us developers.

Note: None of us developers have experienced this problem since march 2002. 

We do however know how to unlock the disk: 

Windows/DOS unlock
Note: This requires taking the Archos apart, which will void your warranty! 

Grab atapwd
Create a bootable DOS floppy disk, and put atapwd.exe on it 
Remove the harddisk from your Archos and plug it into a laptop (or a
standard PC, using a 3.5" => 2.5" IDE adapter)
Boot from the floppy and run atapwd.exe 
Select the locked harddrive and press enter for the menu 
For Fujitsu disks: Choose "unlock with user password", then "disable
with user password". The password is empty, so just press enter at the
prompt.
For Toshiba and Hitachi disks, if the above doesn't work: Choose
"unlock with master password", then "disable with master password".
The password is all spaces.
Your disk is now unlocked. Shut down the computer and remove the disk. 
Big thanks to Magnus Andersson for discovering the Fujitsu (lack of)
user password!

There is also a program for win32, ArchosUnlock.exe, that creates a
linux boot disk with the below mentioned patched isd200 driver.

Linux unlock
For those of us using Linux, we have written an isd200 driver patch. 

This modified driver will automatically unlock
the disk when you connect your Archos via USB, so you don't have to do
anything special. Apply the patch to a 2.4.18 linux kernel tree.

Still locked?
If the above suggestions don't work, here's some background info about
the disk lock feature:

The disk lock is a built-in security feature in the disk. It is part
of the ATA specification, and thus not specific to any brand or
device.

A disk always has two passwords: A User password and a Master
password. Most disks support a Master Password Revision Code, which
can tell you if the Master password has been changed, or it it still
the factory default. The revision code is word 92 in the IDENTIFY
response. A value of 0xFFFE means the Master password is unchanged.

A disk can be locked in two modes: High security mode or Maximum
security mode. Bit 8 in word 128 of the IDENTIFY response tell you
which mode your disk is in: 0 = High, 1 = Maximum.

In High security mode, you can unlock the disk with either the user or
master password, using the "SECURITY UNLOCK DEVICE" ATA command. There
is an attempt limit, normally set to 5, after which you must power
cycle or hard-reset the disk before you can attempt again.

In Maximum security mode, you cannot unlock the disk! The only way to
get the disk back to a usable state is to issue the SECURITY ERASE
PREPARE command, immediately followed by SECURITY ERASE UNIT. The
SECURITY ERASE UNIT command requires the Master password and will
completely erase all data on the disk. The operation is rather slow,
expect half an hour or more for big disks. (Word 89 in the IDENTIFY
response indicates how long the operation will take.)

Thanks... 

Part 1: MS Terminal Services Overview

Password Cracking Basics

Terminal Services Enumeration

Figure 1.1: Output of a google search for /TSWeb/default.htm

Figure 1.2: A Nmap scan looking for port 3389 open on the Class C.

Figure 1.3: Results on the Nmap Scan looking for open port 3389.

Figure 1.4: The output of probeTS.

Terminal Services Connections

Figure 1.5: the Terminal Services/RDP Client on Windows 2000 Pro to a Windows 2000 Terminal Server.

Figure 1.6: Issuing a command over the Terminal Services Client.

Part 2: TSGrinder

Figure 2.1: TSGrinder being run with no arguments.

Figure 2.2: TSGrinder using a dictionary attack against the administrator account.

Figure 2.3: A failed attempt.

Figure 2.4: if TSGrinder guesses the password it will log into the terminal services and immediately disconnect.

Figure 2.5: A successful attempt with TSGrinder.

Figure 2.6: TSGrinder supports 2 threads. Here you can see two threads running the attack.

Figure 2.7: A successful attempt with TSGrinder that used 2 threads to run the attack.

Part 3: TScrack

Figure 3.1: TScrack being run with no arguments.

Figure 3.2: TScrack being run against a Windows Server 2003 Terminal Server

Figure 3.3: TScrack successfully cracking the password

Figure 3.4: TScrack also does multithreading cracking, use the –t option for 2 connections

Figure 3.5: TScrack with two simultaneous connections running

Figure 3.6: TScrack successfully cracking the password

Figure 3.7: TScrack in Brute force mode (-B option & max word length of 6)

Figure 3.8: TScrack in Brute force mode with the –N (no logging) option

Figure 3.9: Even with –N enabled Windows Server 2003 logged theattempts. I did not test every configuration on every type of OS, Ijust noticed it was logging the attempt and shared the info.

Figure 3.10: Here is the default password policy for Windows Server 2003

Figure 3.11: What I changed the password policy to, to allow “chrisg” as a password

Part 4: Rdesktop & BruteForcing RDP with Rdesktop patch

Figure 4.1: Running Rdesktop with no parameters gives you the help menu.

Figure 4.2: Issuing the command line parameters to start Rdestop in *nix in XDarwin.

Figure 4.3: Rdestop brute forcing the accounts.

Figure 4.4: The command line output of the successful attack against XP SP2 but with the user logged in.

Figure 4.5: Rdesktop against Windows Server 2003 against the “chris” account.

Figure 4.6: Rdesktop successfully cracking the password with a dictionary attack. 

1. Any De-assembler (I use Hackers Disassembler and Hview )
2. Resource Hacker
3. A patch Creator ( Use Universal Patch Creator or Code fusion) 

DOWNLOAD THESE TOOLS : 

Hackers Disassembler
Resourcce Hacker INSTALLER and This one

Universal Patch Creator

The Disassembler will disassemble the executable in assembly code. Nowyou need to search for strings that are used in WinRAR program. PressCtrl + F and type “evaluation” without quotes and search in theassembly code. Hit enter..

After you have reached this block of code by searching, just look atthe block of code above it. There you will find that some assemblyvalues are being compared and then code is jumped to some otherfunction. Now see carefully, the “evaluation copy” function must beinvoked after some specific condition is met. We need to look for it atthe code and the make certain changes to the condition so that theprogram doesn't checks for the condition.

In the above code you can see this code -

00444B6A: 803DF4B84B0000 cmp byte ptr [004BB8F4], 00
00444B71: 0F859B000000 JNE 00444C12

ID-REMINDER, “Please purchase WinRAR license”

Double click on it and you will reach the subsequent code.

* String: “REMINDER”
0048731A: 68EB5E4B00 push 004B5EEB

I will be doing this using HVIEW.
Now load the copy you disassembled in Hacker’s Disassembler in Hview.

After you have loaded it, you will see the code is unreadable. Its justlike opening an EXE file in notepad. You need to decode it. To do that,just press F4 and yoiu will get an option to decode it. Hit DECODE andyou will be able to see code in the form of assembly code and memoryaddresses.

Type .444B71 in place of 00444B71

and search in the code.

After you have reached the respective code, you need to make changes toit. Press F3 and you will be able to edit the code.Now make thefollowing changes -

Now search for next memory location by pressing F5 and entering it. Reach there and make the following changes by pressing F3 -

Now U have a 100% working version of EXE, you might want to change yourregistration information in WinRAR. TO do this, you can use Resourcehacker.

Launch Resource Hacker, load the copyofwinrar.exe in it

Now go to DIALOG – Expand tree – ABOUTRARDLG and click it. NowFind Trial copy line and replace it with your favorite one :P

and click on Compile Script button.

Now save the file with any name on your desktop or any location what so ever.

I will be using Universal Patcher (UPE) for creating thepatch. The patch will work like any authentic one for that WinRARversion. Just like the one U downloaded at anytime of your life fromany Crack and Keygen website.
Launch Patch Creator and click on add new project. Enter project Information and click on save.

Click on Add – ; Offset patch

1. Give path of original winrar.exe
2. Give path of unmodified Winrar.exe (again)
3. Give path for fully patched Winrar.exe (ie Cracked Winrar.exe in this case)
4. Click on compare and it will show difference between both files
5. Click on save.

Now in the next window, click on Create Patch and save it. The Patchwill be created. Now copy it in WinRAR installation directory and hiton patch, it WILL work.

Congrats you have created a patch of your own and have learned to crack WinRAR :)