25 replies to this topic

[ali_ali]

I need Help in Compiling Exploits and using Them.I am using Windows Xp

[oddflux]

Well, an exploit is code written inorder to penetrate certain hardware/software vulnerabilities. Now, considering the fact that you "probably" acquire no programming networking skills, you evidently hope to acquire skiddie status. For you to achieve this, you must have some sort of compiler, interpreter for the exploit, depending on what it is coded in. Preferrabily you would require some sort of UNIX box, as most exploits are coded without Win32 API's. There is a multitude of exploits on the net, just search google. , inorder to use an exploit, you have to find a vulnerability. Find that, then find an exploit, if you can't find an exploit, then learn how to code and make one for a certain vuln.

[ali_ali]

Ok Buddy...........
I have found some C Exploits and I have two Pc c connected by LAN.Now Tell me How to FInd Vulnerbilities and Expoit the other Pc

Note that Both Pcs are using Windows XP

[Elzair]

First, do you have PERMISSION to exploit these computers? (i.e. if they are yours and are connected to your network) If so, then the first thing to do would be to use a port scanner that scans for services running on the target machine. Nmap is a good choice. Now that you know what services are running, and hopefully you have some idea of their version numbers, search for vulnerabilities at Security Focus (or some other vulnerability site). If you do not find any exploits at Security Focus, then try to find some with a search engine. For example, if I wanted to find a buffer overflow exploit for IIS 5.0, then I would type into Google:

"buffer overflow exploit" "IIS 5.0"

Then you will need a compiler for the language in which the exploit was written (probably C). Browse the source code to see how to use the program, then compile it and run it.

You could also use a vulnerability scanner, such as Nessus, to scan for vulnerabilities, but vulnerability sites are more up to date. You could also search for code at sites like www.milw0rm.com.

To run the exploit, you need to read the code to understand what it does.

Edited by Elzair, 28 January 2006 - 07:06 PM.

[ali_ali]

Yeah!!
ofcourse it is my own computer.I do not need to use Namp coz i have Physical acccess
but if u say i scaned it.I found port 80,21,139 and Many Other open.


But i still do not know howfind vulnerbility
I visit securityfocus.What the Hell is Security Focus

[ali_ali]

Ok...................

I visit the site milw0rm.com.I click on WMF vulnerbility Nothing Happen a Page was loaded with some text what should i do next

[Rightcoast]

Your kind of missing the General Idea. "Exploits" are code that undermine a service running on the computer. A web server with port 80 exposed would be running Apache, IIS, etc. Port 21 is FTP. Find what ports handle what usually, and what service is running on them. Look to Security Focus, etc for an exploit specific to that service.

Like Elzair said you will need to learn C to understand the most common way of exploiting a service on a machine. The most common for a long time is the way C automates the verification of array indices. If you want the shortest "easy" way, what comes to mind is a live distro like auditor or nubuntu and the Metasploit Framework. You'll likely learn something about Linux along the way which is a good thing. Irongeek has a Hacking Illustrated on his site I believe on exactly that.

Now be sure to read all the docs for whatever you are using, and I do mean *all*. Read the How To Ask A Question FAQ on why that is important. http://www.catb.org/...-questions.html

Be prepared to spend at least 40 hours reading before beginning to grasp this. hundreds of hours reading before you are good at it. That is just the honest truth. Also learn how to use Google in an efficient manner, it is invaluable.

Edited by RightCoast, 28 January 2006 - 11:46 AM.

[ali_ali]

Ok.
Thanx for telling me.I have donloaded and watched all the Movies available at irongeek.com

I like the Meta Sploit movie(flash) coz it is Goood
So u mean I should Install LinuX.

I have a Free Shell acount and Meta Spoilt is only avialabe for Linux.How i can install meta Spoilt on Windows XP


Can be Linux Red Hat is Good For Hacking i have install it on my computer but i can not access resource coz other pc is on window so i delete Red Hat and Install Slackware

[Rightcoast]

Use a security/attacking/pentesting Linux live CD like auditor or nubuntu or whatever you choose too. You can install Metasploit on XP. I haven't but the website has instrutions on how to do it in the docs. Having a HDD linux install is fine too, whatever you prefer.

[ali_ali]

Thank u sir!!!!!!!!
I downloaded Linux Slackware in Zip Format it size is 37 mb........


Now i am very impressed by You That We install Metaspolit on XP plz send me Xp url Hurry i am excited and waiting for Sir

[Exvitel]

<--edit by droops-->

look, exvitel, we dont treat people like that here. if you want to be a bastard to someone asking a question, then you need to find a new forum to do that at.

[Seal]

Um... Am I the only one that thinks that this is a joke?

[Rightcoast]

Perhaps the poster is from Asia or Eastern Europe. Who knows, I am sure he is trying to write his best. So for he hasn't really broken any rules (read them ali ali, so you know what they are). He is certainly being friendly, what with the "sirs" and all. As for URL's Ali....I have to insist you read the question FAQ I linked to, and begin to use Google or Yahoo or whatever search engine you want. put metasploit into it and begin reading. That is all the advice you will ever get from me unless you have a specific question. Documentation for programs is there for a reason. Good Luck!

[Elzair]

The text that you saw on Milw0rm was the 'source code' for the exploit. You can learn more about 'source code' at http://en.wikipedia....iki/Source_code]http://en.wikipedia....iki/Source_code[/url]. Save the source code to disk and compile it with a C compiler, which will produce an executable program.

SecurityFocus is a website that deals with Computer Security and features an extensive vulnerability database.

Yeah, I have heard the Metasploit Framework is a good way to learn about and test exploits, although I have not played with it much.

Edited by Elzair, 28 January 2006 - 07:13 PM.

[oddflux]

Ok.
Thanx for telling me.I have donloaded and watched all the Movies available at irongeek.com

I like the Meta Sploit movie(flash) coz it is Goood
So u mean I should Install LinuX.

I have a Free Shell acount and Meta Spoilt is only avialabe for Linux.How i can install meta Spoilt on Windows XP


Can be Linux Red Hat is Good For Hacking i have install it on my computer but i can not access resource coz other pc is on window so i delete Red Hat and Install Slackware

Inorder to install the metasploit framework on windows, you must have Cygwin, which is a Linux-like environment for Windows. (www.cygwin.com) Then, you may go to www.metasploit.com and acquire your skiddie status.
Also, kindly learn functional english, as not too many people would take you seriously if you don't read over what you type.
Try learning C or Perl as most known exploits are coded in either one of them.

[ali_ali]

Ok.
Thanx for telling me.I have donloaded and watched all the Movies available at irongeek.com

I like the Meta Sploit movie(flash) coz it is Goood
So u mean I should Install LinuX.

I have a Free Shell acount and Meta Spoilt is only avialabe for Linux.How i can install meta Spoilt on Windows XP


Can be Linux Red Hat is Good For Hacking i have install it on my computer but i can not access resource coz other pc is on window so i delete Red Hat and Install Slackware

Inorder to install the metasploit framework on windows, you must have Cygwin, which is a Linux-like environment for Windows. (www.cygwin.com) Then, you may go to www.metasploit.com and acquire your skiddie status.
Also, kindly learn functional english, as not too many people would take you seriously if you don't read over what you type.
Try learning C or Perl as most known exploits are coded in either one of them.

Ok Buddy!!
I have install metasploit on My windows and I know How To use it With Web interface

But There is little Problem.When i Exploit some other PC on My LAN.Web interface says Page can not be Displayed.

[Elzair]

Have your thoroughly read the MetaSploit Users Guide?

Edited by Elzair, 01 February 2006 - 02:53 PM.

[MetalguyX]

WHY NMAP dosnt work to me?? i instal WinPac and everithyng and i run Nmap and nothing appears??!!

This shows for a sec. Pic

Edited by MetalguyX, 01 February 2006 - 04:16 PM.

[Hiryu]

WHY NMAP dosnt work to me?? i instal WinPac and everithyng and i run Nmap and nothing appears??!!

This shows for a sec. Pic

That is part of the standard help text you get when you mistype the commands.

How are you starting nmap? Are you using any of the switches or just runnig nmap?

Try this:

nmap -vv -O -P0 127.46.23.151

and replace the IP with the one from the PC you are scanning.

[Elzair]

WHY NMAP dosnt work to me?? i instal WinPac and everithyng and i run Nmap and nothing appears??!!

This shows for a sec. Pic

Are you starting a Command Prompt first? The standard Nmap program is command-line based and requires additional options to run, such as the hostname/IP to be scanned. If you are just clicking on the nmap.exe, then it is running without any options, and so it finds no host to scan, prints out usage information, and then exits, which causes Windows to terminate the prompt. Go to Start->Program->Accessories->Command Prompt then cd to Nmap's directory and run what Hiryu posted above.