Problems with cracking a program with OllyDBG ( debugging )
Basically it's a game bot that used to be free to many players and now the owner of this bot ( who didn't even make this bot 100% himself ) made it VIP version and demands 20 bucks from everyone. I don't wanna pay for it and my new project is to crack it free.

So when i open the injector ( bot ) it opens a CMD and does some codes, 2 seconds later the CMD is gone and the bot launches. This was in the free version.. now after CMD vanishes, it opens a small window that says '' VIP IS REQUIRED '' and also opens a small image called '' splash screen '' and the image has a text '' VIP required '' at the same time it opens my google chrome and takes me to the '' VIP '' website.

How can i crack this? I've tried watching some videos about OllyDBG and changing the memory, but i can't find the memory for those things at all.

There are 3 DLL files ( 1 main DLL ) and the injector of course, what should i do? Are there easier ways to pass this than debugging?

EDIT: i've tried searching for certain texts in OllyDBG such as '' VIP '', '' free '', '' VIP is required '' and other stuff.. no luck. I have no idea how to find a memory to change or remove that '' VIP '' sign lol

EDIT 2: I tried opening the DLL file with '' JetBrains '' and copy the whole botting scripts and make my own bot but i couldn't find any scripts on the DLL files and it was full of codes, too complex :D.. even though the script on this small video game is pretty small lol
🗣BalkanRay

RE (reverse engineering) took me about seven years in IT and net sec to get into.

Between day zero year 1, and day 365 year 7 I...

- learned to write C
- learned to read / bang around assembly
- picked up OS and CPU specific knowledge
- learned many programming concepts
- several crash courses on RE
- 100s of hours with true wizards at this
- attended dozens of hack-a-thons
- finally ended up knowing several debugging tools enough when to use others.

Yes there is a 5 year old kid who likely blasts us all out of the park some where.

My point is, you need to try applying some staged learning here.

Crawl, walk, then run.

My first suggestion is to start getting a few methods of extracting strings and comments from the file.
👤eggumlaut


🎖@malwr

Docker container that logs all DNS and new outbound TCP/UDP connections.
Finally got this Docker container ready that can log all DNS and new outbound TCP/UDP connections using a modified version of suricata, an open source intrusion detection system.

If you log DNS requests, this takes it one step further by matching your outbound traffic with DNS requests. This means that it can detect traffic that might be DoH (DNS over https).

Tested using a workstation running Ubuntu (host and container). Alpha software, so please don't use this on a production network. Happy to make modifications it if you have a use case that others will benefit from.

https://github.com/morsgiathatch/suricata\_edits/tree/master/DOCKER/syn\_detector
🗣1stOctet


🎖@malwr

SpecterOps Adversary Tactics: PowerShell course material:

https://github.com/specterops/at-ps

ℹ️ Just released (2 hours ago) ℹ️


🎖@malwr

Cracking my first WPA2 password! (It’s my home network)
🗣Perellex_Music

Do you still need to collect I think it use to be 100K or 1M "good packets"?
👤drman769

Dictionary attack? What dictionary file did you use?
👤acousticcoupler

Use hashcat for GPU cracking with almost 12000 H/s speed ( GPU specific ) and it cracks passwords with more ease cause it doesn't even requires a wordlist , it creates of its own.
Good luck
👤Jidnyesh


🎖@malwr

Information Leaks via Safari's Intelligent Tracking Prevention

🎖@malwr

User: admin Password: admin
🗣jadoredior

Honeykey
👤eyemokurok


🎖@malwr

VirusTotal is not an Incident Responder - a tool that aids in analysis should not be a “one-stop-shop” in determining if content is malicious. Attackers can easily manipulate these results.
🗣cyberbutler

There's a lesser used VT result that I think should be implemented more often: unrated. If a URL hasn't been scanned or whatever it should default to unrated, not clean. But of course that doesn't look as great in the results list so a lot of companies default to Clean.

Disclaimer: I work for a VT contributing company.
👤Fr0gm4n

It's understood that the better APT groups will use Virustotal to verify that their malware is undetectable. They will also monitor it and pivot if they see any of their stuff submitted by a third party.
👤K3wp

Reliance on tools like this to come up with conclusions, means that there must be a lack of tools provided to an analyst or proper training/funding.

I know for the team I manage, tools like this are amazing to help pivot to other tools/techniques which can be part of an operators tool belt.

One of the problems to me is, too many vendors sell numerous fucking tools with fancy interfaces, and forget to teach the underlying concepts behind how the tools actually work... Once the tools are down or can't use it.... you're left there thinking.. what next.

edit. - I feel like it's also quite trivial to bypass these types of sandboxes/tools, I have a malicious binary I use for threat hunting as a stager, still hasn't been detected by any tools we use :)
👤cloudy_ft


🎖@malwr

Analysis of a Fake Threema App
🗣antoinet123

It doesn't fucking help that the playstore just pretends that apps which are incompatible with your device just don't exist. That fake app requires Android > 4.4. For the real app it "varies by device". In the end, searching for an app that you know exists and looking through the search results trying to figure out which one is real is not enough. I cannot tell how often I run into this problem, including some banking apps (looking at you Revolut, you POS still owe me money and you can't even tell me what phone I should buy/Android version I should install to being able to communicate with you or even look up my balance).

Thanks Google for being of absolutely no help at all. I'm pretty sure plenty of people installed that fake crap just because you decide to hide the real one from them.
👤electrodraco


🎖@malwr

My employees keep abusing social networks while at work (facebook, whatsapp, youtube). Is there a tool that I can install on all workstations and monitor or possibly block all that activity? Thank you.
🗣zzizourm

The company I work for makes software for employee monitoring/internet filtering that is sold by the license. To avoid potentially breaking rule 5 (" Do not ask for or offer services or products ") I won't mention my company specifically, but a Google search for "employee internet monitoring will give you some results you can look into.

My personal recommendation is to go the monitoring route vs blocking some websites entirely -- a reasonable level of "Cyberloafing" can help employees blow off some steam between tasks and help with their wellbeing/productivity in the long run. Using monitoring instead of filtering can help you keep it at a manageable level and prevent employees from feeling resentful, just make sure they're aware they're being monitored.
👤TransientWonderboy

OpenDNS for direct site blocking or you could look into Application Awareness in a next gen firewall. Basically you set the rules as time of access or if you want to allow just view and not allow them to post.
👤MikePencesBurnerAct

OpenDNS: will block all of that

https://www.opendns.com/

How many employees?

Who does your IT?
👤bbsittrr


🎖@malwr

About Jeff Bezos' phone hacking
How a video can be delivered through "an encrypted downloader hosted on WhatsApp’s media server" ?

I read all the report on VICE and I found it very interesting.

I don't understand however how it was possible through whatsapp, sending the video via "an encrypted downloader hosted on WhatsApp’s media server".

I mean, what's the difference to just directly send a video file or via this encrypted downloader ?

This is what VICE writes (and report too):

"They did not find any malicious code embedded in the video file, but discovered that the video was delivered via an encrypted downloader hosted on WhatsApp’s media server."

Thanks for an explanation
🗣AnotherRedditUsr

My guess is that a well resourced attacker purchased a 1 click exploit and used CVE-2019-11932 to get access to Bezo's phone.
👤darknetj

In the PDF below it says the encrypted file was slightly larger than the video itself

https://assets.documentcloud.org/documents/6668313/FTI-Report-into-Jeff-Bezos-Phone-Hack.pdf

"Encrypted" is probably because all WhatsApp communications are encrypted

The video wasn't just a video file but an exploit + a video file (hence the diff in file size).

The "hosted on WhatsApp media server" probably just means that all data sent on WhatsApp goes through their infrastructure.

See "zero click" exploits https://threatpost.com/apple-imessage-remote-attackersread-iphone-messages/146789/ and https://media.ccc.de/v/36c3-10497-messenger\_hacking\_remotely\_compromising\_an\_iphone\_through\_imessage
👤octave1

/u/bnimblebquick has a good explanation, and a good level of salt grains. But, as a further point, the golden rule is “authenticate before you operate”. As a total guess, maybe that didn’t happen here.

It seems like one could assume the internal services of WhatsApp may have been vulnerable to /something/ in the media call - either at the start or end of the upload. This would leave the file benign but could introduce a vector for compromise based on a trust relationship with the client (ie Jeff’s WhatsApp binary).

It’ll be interesting to see if the hacking claim is proven true, and secondarily what the postmortem reveals, if anything.

Lastly, Facebook is a company that actively makes money by harvesting and reselling personal information. They’ve also actively claimed “privacy needs to go away”. (Randi Zuckerberg, Marketing ‘Director’ and coincidentally family member of another infamous Zuckerberg who works at Facebook. Entirely a coincidence, I’m sure.)

This is important as it seems likely the assumptions on their WhatsApp implementation by the public will be wrong. For example, they’ve made a few claims that seem contradictory about how it operates: “it uses the Signal Protocol” vs “We can uniquely identify content to stop spam messages”. All bets are off in terms of attack vectors. There’s no implementation verification, no OSS of their use case, etc. If they’re going to be caught doing something bad, again, it seems likely they’ll simply I’m stop this investigation.
👤i_build_minds


🎖@malwr