Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
Prefetch-Hash-Cracker : A Small Util To Brute-Force Prefetch Hashes

During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch(Prefetch-Hash-Cracker) file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created.

Using the tool

The following fields must be provided:

* Executable name
Including the extension. It will be embedded in the prefetch filename, unless this happens.
* Prefetch hash
8 hexadecimal digits at the end of the prefetch filename, right before the .pfextension.
* Hash function
* Bodyfile
* Mount point

Hash function

There are 3 known prefetch hash functions:

* SCCA XP
Used in Windows XP
* SCCA Vista
Used in Windows Vista and Windows 10
* SCCA 2008
Used in Windows 7, Windows 8 and Windows 8.1

Bodyfile

A bodyfile of the volume the executable was executed from.

The bodyfile format is not very restrictive, so there are a lot of variations of it – some of which are not supported. Body files created with flsand MFTECmdshould work fine.

Mount point

The mount point of the bodyfile, as underlined below:
0|C:/Users/Peter/Desktop ($FILE_NAME)|62694-48-2|d/d-wx-wx-wx|...
How does it work?

The provided bodyfile is used to get the path of every folder on the volume. The tool appends the provided executable name to each of those paths to create a list of possible full paths for the executable. Each possible full path is then hashed using the provided hash function. If there’s a possible full path for which the result matches the provided hash, that path is outputted.

Limitations

The following cases are not supported:

* Hosting applications, such as svchost.exeand mmc.exe
* Applications executed with the /prefetch:#flag
* Applications executed from a UNC (network) path

The 29-character limit

If the executable name is longer than 29 characters (including the extension), it will be truncated in the prefetch filename. For example, executing this file:
This is a very long file nameSo this part will be truncated.exe
From the C:\Tempdirectory on a Windows 10 machine, will result in the creation of this prefetch file:
THIS IS A VERY LONG FILE NAME-D0B882CC.pf
In this case, the executable name cannot be derived from the prefetch filename, so you will not be able to provide it to the tool.
Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Prefetch-Hash-Cracker : A Small Util To Brute-Force Prefetch Hashes

During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch(Prefetch-Hash-Cracker) file. While its content

6 viewsedited 08:24

Hacking Articles Tips Tricks Videos Tutorials

BMW sistemində necə boşluq tapdım?

Mercedes-Benz sistemində tapdığım “subdomain takeover” boşluğundan sonra dostlardan birinin “İnşallah BMW-də açıq taparsan” cümləsindən…Continue reading on Medium »
Read more...

7 views08:36

Hacking Articles Tips Tricks Videos Tutorials

6 views08:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
WonderCMS 3.1.3 Vulnerable to Authenticated Server-Side Request Forgery – CVE-2020-35313

https://external-preview.redd.it/dx5jlcVRmgXDLPzjMo1eNGzx9AjQPxc-omDOEbL9PCg.jpg?width=640&crop=smart&auto=webp&s=72ea0ba0a1021cdc93d4d3287d8b5244212a73b1 submitted by /u/shantanu14g
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

WonderCMS 3.1.3 Vulnerable to Authenticated Server-Side Request...

Posted in r/hacking by u/shantanu14g • 1 point and 0 comments

6 viewsedited 08:49

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Been thinking about getting into hacking, curious about one thing.

I was wondering if it would be possible to mimic keycards at my high school to get access to classrooms/labs just as a pet project. If so, how would I be able to do it?

submitted by /u/NokkieBabookie
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Been thinking about getting into hacking, curious about one thing.

I was wondering if it would be possible to mimic keycards at my high school to get access to classrooms/labs just as a pet project. If so, how...

6 viewsedited 08:49

Hacking Articles Tips Tricks Videos Tutorials

6 views08:57

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Do NOT Plug This Into Anything – Hak5 Rubber Ducky

https://external-preview.redd.it/z_gOrUADRfaiKX2ipbe5tREhAbA5OovcUHx4Lr00hQw.jpg?width=320&crop=smart&auto=webp&s=2e0fc6f95ee7c04bdd83d785fea0c7b75f20d32b submitted by /u/Notalabel_4566
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Do NOT Plug This Into Anything – Hak5 Rubber Ducky

Posted in r/hacking by u/Notalabel_4566 • 0 points and 0 comments

6 viewsedited 08:57

Hacking Articles Tips Tricks Videos Tutorials