Logo

User2sid and Sid2user are two small utilities for Windows NT, created by Evgenii Rudny, that allow the administrator to query the SAM to find out a SID value for a given account name and vice versa. User2sid.exe can retrieve a SID from the SAM (Security Accounts Manager) from the local or a remote machine and Sid2user.exe can then be used to retrieve the names of all the user accounts and more. These utilities do not exploit a bug but call the functions; LookupAccountName and LookupAccountSid respectively. These tools can be called against a remote machine without providing logon credentials except those needed for a null session connection. These tools rely on the ability to create a null session in order to work.

Source: http://www.windowsecurity.com/whitepapers/Windows-Enumeration-USER2SID-SID2USER.html
Download: http://securityoverride.com/infusions/pro_download_panel/download.php?did=24

This source code below is written by se7en from LeetCoders.  It is capable of running through the enter C drive in 8 seconds on my computer finding more than 230,000 files.  Although the downside of it is that it costs quite an amount of CPU usage during its process.  You might try to optimize it by placing Sleep function or something that is possible in reducing the CPU usage.

A member in HackForums by the handle Jakash3 has posted a source code on how to download files from the Internet that can be compiled in both Linux and Windows.  Another great feature is that it supports IPv6.

mindlessdeath, a member from HackForums have posted a thread regarding how to write a crypter in C!  I find this source code a very good example for people that are trying to learn to write their own crypter.  Compared to any other source codes that are posted on the internet, the author of this source code gave a very detailed information on each line on what the statements does.  In order to use this source code without much trouble, there are some prerequisites that was mentioned by the author himself. 

If you have already decrypted passwords for Firefox 1, 2 and 3 (if you need them, it's here), here is the source code in C that helps you decrypt Firefox passwords for version 3.5 and 3.6!  This source code is written by ZeR0 from HackHound.org.  This source code is generally open source by the author but the terms of use is to give credits if you use it.

Download source code here.
Download binary / application here.

While i was searching online for a way to display processes for all users, i came across this source code which was coded profesionally.  The source code can be found here.  Be sure to check their homepage here too for more source codes.

Technically, there's 2 way of loading a rootkit according to Greg Hoglund when he wrote Rootkits: Subverting the Windows Kernel book.  One is called The Quick-And-Dirty Way to Load a Driver.  This method allows you to "load a driver into the kernel without having to create any registry keys.  "Pageable" refers to memory that can be swapped to disk. If a driver is pageable, any part of the driver could be paged out (that is, swapped from memory to disk). Sometimes when memory is paged out, it cannot be accessed; an attempt to do so will result in the infamous Blue Screen of Death (a system crash)" by using an undocumented API call. 

Those of you that think of yourself as a hacker, do you know what does a network packet look like?  Have you ever read network packets in your life, do you know how they work?  Take a look in the TCP packet below and try to figure out what the packet is doing as well as getting the source ip address and port of the sender.

[code]
00 1c f0 39 8e 45 00 1c  f0 8a a1 71 08 00 45 00
00 34 06 6e 40 00 80 06  9a 0e c0 a8 01 02 45 a2
52 fb c0 a7 00 50 a1 f6  7c bb 00 00 00 00 80 02
20 00 15 25 00 00 02 04  05 b4 01 03 03 02 01 01
04 02
[/code]

Tips: Think of the packet as an Ethernet frame.

In computer programming, DLL injection is a technique used to run code within the address space of another process by forcing it to load a dynamic-link library.^[1] DLL injection is often used by third-party developers to influence the behavior of a program in a way its authors did not anticipate or intend.^[1][2][3] For example, the injected code could trap system function calls,^[4][5] or read the contents of password textboxes, which cannot be done the usual way.^[6]

Approaches on Microsoft Windows

• DLLs listed under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs will be loaded into every process that links to User32.dll as that DLL attaches itself to the process.^[5][7][8][9]


• Process manipulation functions such as CreateRemoteThread can be used to inject a DLL into a program after it has started.^{[5][6][10][11][12][13]}
  
  
  
  1. Get a handle to the target process. This can be done by spawning the process^[14][15] or by keying off something created by that process that is known to exist – for instance, a window with a predictable title,^[16] or by obtaining a list of running processes^[17] and scanning for the target executable's filename.^[18]
  
  
  2. Allocate some memory in the target process,^[19] and the name of the DLL to be injected is written to it.^[10][20]

     This step can be skipped if a suitable DLL name is already available in the target process. For example, if a process links to ‘User32.dll’, ‘GDI32.dll’, ‘Kernel32.dll’ or any other library whose name ends in ‘32.dll’, it would be possible to load a library named ‘32.dll’. This technique has in the past been demonstrated to be effective against a method of guarding processes against DLL injection.^[21]

  
  
  3. Create a new thread in the target process^[22] with the thread's start address set to be the address of LoadLibrary and the argument set to the address of the string just uploaded into the target.^[10][23]

     Instead of writing the name of a DLL-to-load to the target and starting the new thread at LoadLibrary, one can write the code-to-be-executed to the target and start the thread at that code.^[6]

  
  
  4. The operating system will now call DllMain in the injected DLL.^[10][24]
  
  
  
  

  Note that without precautions, this approach can be detected by the target process due to the DLL_THREAD_ATTACH notifications sent to every loaded module as a thread starts.^[24]



• Windows hooking calls such as SetWindowsHookEx.^{[2][5][6][25][26][27]}


• Use the debugging functions to pause all threads, and then hijack an existing thread in the application to execute injected code, that in turn could load a DLL.^[4][28][29]

[code]
#include <windows.h>

int WINAPI WinMain(HINSTANCE hThisInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
HDC hDC = CreateDC(TEXT("DISPLAY"), NULL, NULL, NULL);
POINT pCurPos;
RECT rRect;
HBRUSH hBrush = (HBRUSH)(CreateSolidBrush(RGB(0, 0, 0)));
int iConst = 1;

for( ; ; Sleep(1000))
{
if (GetAsyncKeyState(VK_ESCAPE) != 0)
break;

iConst += 3;
GetCursorPos(&pCurPos);
rRect.left = pCurPos.x - iConst;
rRect.top = pCurPos.y - iConst;
rRect.right = pCurPos.x + iConst;
rRect.bottom = pCurPos.y + iConst;
FillRect(hDC, &rRect, hBrush);
}

DeleteDC(hDC);
return EXIT_SUCCESS;
}
[/code]

I'm not sure where i got this a year ago but generally this code create a black pixel on your desktop. It will terminate only if you press ESCAPE which is detected by GetAsyncKeyState.

Ever wanted a portable caesar cipher and decipher at one go? At the end of this post you will find the binary as well as the source code (built in C) for the application. Below is an image of the application testing on "abcdefgh" text.  At [+13] you can see that it is equivalent to ROT13 cipher.  For those that are familiar with command line, use application.exe "text here".

Functions

Download

Here's a simple function that helps you dump screenshots into files. By calling CaptureDesktopScreenshotToFile you can simply get the screenshot without dealing with any GDI yourself.

[code]
#include <windows.h>

int main()
{
CaptureDesktopScreenshotToFile("screenshot.bmp");

return 0;
}
[/code]

And here's the code for you.

[code]
#include <windows.h>

PBITMAPINFO CreateBitmapInfoStruct(HBITMAP hBmp);
int CreateBMPFile(LPTSTR pszFile, PBITMAPINFO pbi, HBITMAP hBMP, HDC hDC);
int CaptureDesktopScreenshotToFile(char *FILENAME)
{
HDC hdcScreen,hdcCompatible;
HBITMAP hbmScreen;
hdcScreen = CreateDC("DISPLAY", NULL, NULL, NULL);
hdcCompatible = CreateCompatibleDC(hdcScreen);

// Create a compatible bitmap for hdcScreen.
int ScreenWidth = GetDeviceCaps(hdcScreen, HORZRES);
int ScreenHeight = GetDeviceCaps(hdcScreen, VERTRES);
hbmScreen = ::CreateCompatibleBitmap(hdcScreen,ScreenWidth,ScreenHeight);

if(hbmScreen == 0)
return 0;

// Select the bitmaps into the compatible DC
if(!::SelectObject(hdcCompatible, hbmScreen))
return 0;

if(!::BitBlt(hdcCompatible,0,0,ScreenWidth,ScreenHeight,hdcScreen,0,0,SRCCOPY))
return 0;

// Clean Tmp
DeleteFile(FILENAME);

// Take shot
if(CreateBMPFile(FILENAME,CreateBitmapInfoStruct(hbmScreen),hbmScreen,hdcScreen)​​ == 0)
return 0;

// Compression
//bmp2jpeg(DIRECTORY_TMP, DIRECTORY_TMP);

return 1;
}

int CreateBMPFile(LPTSTR pszFile, PBITMAPINFO pbi, HBITMAP hBMP, HDC hDC)
{
HANDLE hf; // file handle
BITMAPFILEHEADER hdr; // bitmap file-header
PBITMAPINFOHEADER pbih; // bitmap info-header
LPBYTE lpBits; // memory pointer
DWORD dwTotal; // total count of bytes
DWORD cb; // incremental count of bytes
BYTE *hp; // byte pointer
DWORD dwTmp;

pbih = (PBITMAPINFOHEADER) pbi;
lpBits = (LPBYTE) GlobalAlloc(GMEM_FIXED, pbih->biSizeImage);

if(!lpBits)
return 0;

// Retrieve the color table (RGBQUAD array) and the bits
// (array of palette indices) from the DIB.
if(!GetDIBits(hDC, hBMP, 0, (WORD) pbih->biHeight, lpBits, pbi, DIB_RGB_COLORS))
return 0;

// Create the .BMP file.
hf = CreateFile(pszFile, GENERIC_READ | GENERIC_WRITE, (DWORD) 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, (HANDLE) NULL);
if(hf == INVALID_HANDLE_VALUE)
return 0;

hdr.bfType = 0x4d42; // 0x42 = "B" 0x4d = "M"
// Compute the size of the entire file.
hdr.bfSize = (DWORD) (sizeof(BITMAPFILEHEADER) + pbih->biSize + pbih->biClrUsed * sizeof(RGBQUAD) + pbih->biSizeImage);
hdr.bfReserved1 = 0;
hdr.bfReserved2 = 0;

// Compute the offset to the array of color indices.
hdr.bfOffBits = (DWORD) sizeof(BITMAPFILEHEADER) + pbih->biSize + pbih->biClrUsed * sizeof (RGBQUAD);

// Copy the BITMAPFILEHEADER into the .BMP file.
if(!WriteFile(hf, (LPVOID) &hdr, sizeof(BITMAPFILEHEADER),(LPDWORD) &dwTmp, NULL))
return 0;

// Copy the BITMAPINFOHEADER and RGBQUAD array into the file.
if(!WriteFile(hf, (LPVOID) pbih, sizeof(BITMAPINFOHEADER) + pbih->biClrUsed * sizeof (RGBQUAD), (LPDWORD) &dwTmp, ( NULL)))
return 0;

// Copy the array of color indices into the .BMP file.
dwTotal = cb = pbih->biSizeImage;
hp = lpBits;
if(!WriteFile(hf, (LPSTR) hp, (int) cb, (LPDWORD) &dwTmp,NULL))
return 0;

// Close the .BMP file.
if(!CloseHandle(hf))
return 0;

// Free memory.
GlobalFree((HGLOBAL)lpBits);

return 1;
}

PBITMAPINFO CreateBitmapInfoStruct(HBITMAP hBmp)
{
BITMAP bmp;
PBITMAPINFO pbmi;
WORD cClrBits;
// Retrieve the bitmap color format, width, and height.
if (!GetObject(hBmp, sizeof(BITMAP), (LPSTR)&bmp))
return NULL;

// Convert the color format to a count of bits.
cClrBits = (WORD)(bmp.bmPlanes * bmp.bmBitsPixel);
if (cClrBits == 1)
cClrBits = 1;
else if (cClrBits <= 4)
cClrBits = 4;
else if (cClrBits <= 8)
cClrBits = 8;
else if (cClrBits <= 16)
cClrBits = 16;
else if (cClrBits <= 24)
cClrBits = 24;
else cClrBits = 32;

// Allocate memory for the BITMAPINFO structure. (This structure
// contains a BITMAPINFOHEADER structure and an array of RGBQUAD
// data structures.)

if (cClrBits != 24)
pbmi = (PBITMAPINFO) LocalAlloc(LPTR,
sizeof(BITMAPINFOHEADER) +
sizeof(RGBQUAD) * (1<< cClrBits));

// There is no RGBQUAD array for the 24-bit-per-pixel format.

else
pbmi = (PBITMAPINFO) LocalAlloc(LPTR,
sizeof(BITMAPINFOHEADER));

// Initialize the fields in the BITMAPINFO structure.

pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
pbmi->bmiHeader.biWidth = bmp.bmWidth;
pbmi->bmiHeader.biHeight = bmp.bmHeight;
pbmi->bmiHeader.biPlanes = bmp.bmPlanes;
pbmi->bmiHeader.biBitCount = bmp.bmBitsPixel;
if (cClrBits < 24)
pbmi->bmiHeader.biClrUsed = (1<<cClrBits);

// If the bitmap is not compressed, set the BI_RGB flag.
pbmi->bmiHeader.biCompression = BI_RGB;

// Compute the number of bytes in the array of color
// indices and store the result in biSizeImage.
// For Windows NT, the width must be DWORD aligned unless
// the bitmap is RLE compressed. This example shows this.
// For Windows 95/98/Me, the width must be WORD aligned unless the
// bitmap is RLE compressed.
pbmi->bmiHeader.biSizeImage = ((pbmi->bmiHeader.biWidth * cClrBits +31) & ~31) /8
* pbmi->bmiHeader.biHeight;
// Set biClrImportant to 0, indicating that all of the
// device colors are important.
pbmi->bmiHeader.biClrImportant = 0;
return pbmi;
}
[/code]