Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 48 guests and 1 member online
You are here:
Home
Resources
Tutorials
hiding a programme__help
EH-Net
May 21, 2013, 04:42:46 PM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Resources
>
Tutorials
(Moderator:
don
) >
hiding a programme__help
Pages: [
1
]
Go Down
« previous
next »
Print
Author
Topic: hiding a programme__help (Read 13344 times)
0 Members and 1 Guest are viewing this topic.
bojan
Newbie
Offline
Posts: 19
hiding a programme__help
«
on:
April 24, 2008, 07:07:43 AM »
Is there any way to hide a programme ??I mean I want to execute that programme,but I want to hide it under any image,video or anything else,so whenever I will save that image,video etc or run it the hidden programme will be installed automatically??/is there any tool available for this or any procedure???please help!
Logged
Andrew Waite
Hero Member
Offline
Posts: 928
Re: hiding a programme__help
«
Reply #1 on:
April 24, 2008, 07:21:03 AM »
Bojan,
have you asked Google first?
From my understanding you will need to modify an existing application to execute your 'hidden' code, therefore I'd be surprised if there are any tools that can automate the process (at least I haven't come across anything).
Logged
--
http://www.infosanity.co.uk
--
http://blog.infosanity.co.uk
dean
Guest
Re: hiding a programme__help
«
Reply #2 on:
April 24, 2008, 08:04:33 AM »
First, try to use some punctuation it will make things a little easier to read and there is no need for the multiple '?' We understand that you're asking a question.
Second, Google is your friend there is a substantial amount of information on this topic out there. Show that you actually did some research before posting.
To answer your question:
Use a binder. This is a tool that allows you to 'wrap' one executable with another. There are many variants out there. Whether or not it will be detected depends on whether your RAT is known or not.
Logged
bojan
Newbie
Offline
Posts: 19
Re: hiding a programme__help
«
Reply #3 on:
April 24, 2008, 08:12:43 AM »
yes dean,I am looking for a good binder!!I was using upx for some time but it was not that good!So can you please tell me is there any good binder available?but at the same time I want to know that what actually a binder does?Is binder will help me to change the look of my programme??
Logged
oneeyedcarmen
Full Member
Offline
Posts: 233
Klaatu, Borada,Necktie?
Re: hiding a programme__help
«
Reply #4 on:
April 24, 2008, 08:24:18 AM »
again...
Quote from: dean
Google is your friend there is a substantial amount of information on this topic out there. Show that you actually did some research before posting.
Logged
Reluctant CISSP, Certified ASS
pseud0
Recruiters
Full Member
Offline
Posts: 208
Re: hiding a programme__help
«
Reply #5 on:
April 24, 2008, 10:11:39 AM »
Reading back to the original post, he wanted to hide it within a picture or video. That changes the deal a little bit. It is easier to hide an executable within another executable than it is to hide an executable in a picture or video. The idea is that the .exe is already making system calls and such that you can abuse, while a video or picture is generally read from and interpreted by some other application. There are ways to include nasty code into a video or picture so that the application reading the file gets "hacked", but this isn't the same as having a hidden program kick off in the background. There are some ways to do this, but they are not as clean or consistent as you'd probably like.
Logged
CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
dean
Guest
Re: hiding a programme__help
«
Reply #6 on:
April 24, 2008, 11:25:39 AM »
Quote from: bojan on April 24, 2008, 07:07:43 AM
but I want to hide it under any image,video or anything else,so...
or anything else would be an .exe, no?
a binder does not 'abuse' the calls made by the host exe. One is simply run in the background. If you bind two exe's the size will generally increase. Just something to be aware of.
if you want to hide an exe in an image try this:
zip the executable
copy /b image.jpg+file.zip output.jpg
right click on the image that is created and use winzip/winrar to open it.
it won't execute it but it is a way to hide it.
Tools like YAB will bind exes. FileBinder will bind any file. Whether or not this will run when the jpg is open I have not tested.
Honestly, there are a far easier ways to get an executable on a remote host. ADODB stream being one.
dean
Logged
pseud0
Recruiters
Full Member
Offline
Posts: 208
Re: hiding a programme__help
«
Reply #7 on:
April 24, 2008, 11:36:07 AM »
dean,
Agree with your post, I just noticed that he seemed to be stressing the "image,video" issue. As you mentioned, it can be straightforward to hide a file in an image, but getting to execute and run when viewed isn't trivial.
Logged
CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
iSmith
Full Member
Offline
Posts: 157
Do or do not. There is no try. - Yoda
Re: hiding a programme__help
«
Reply #8 on:
April 24, 2008, 01:28:09 PM »
here is my not-so-expert advice.
1 create a batch file that executes your program. be sure to add a line at the end "open media.xxx" to open you media. (this will only appear to work if the person opens the file with the default program.)
2 create a shortcut to the batch file and then edit it's properties so that it has the icon of the appropriate media.
note this will not hide the little arrow that is typical of shortcuts.
Logged
In my eyes, your operating system is as solid as swiss cheese.
pseud0
Recruiters
Full Member
Offline
Posts: 208
Re: hiding a programme__help
«
Reply #9 on:
April 24, 2008, 02:06:39 PM »
I think the purpose of his question was to find a way to hid a program so that it was not directly observable to the user. To do that the program would have to be hidden in the data and file structure of the trojaned data (or an alternate date stream), and the resources necessary to run the program would have to be shared in such a way that they are not directly attributable to the hidden executable. (or hidden with a rootkit?)
Logged
CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
bojan
Newbie
Offline
Posts: 19
Re: hiding a programme__help
«
Reply #10 on:
April 25, 2008, 12:42:22 AM »
I just want to hide it actually,because it's not easy to compromise the target for running the programme!!!so If I want to hide any programme what I have to do?Target will run a programme and the hidden one will be executed automatically and silently and will not be detected!!!
«
Last Edit: April 25, 2008, 01:05:32 AM by bojan
»
Logged
pseud0
Recruiters
Full Member
Offline
Posts: 208
Re: hiding a programme__help
«
Reply #11 on:
April 25, 2008, 07:02:26 AM »
Well there's your problem... it looks like your blinker fluid is low and you need to rotate your muffler bearings. If you have a VAX system sitting around you could put together a banyan bomb and push it through the intergoogletubes to your target.
Logged
CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
oneeyedcarmen
Full Member
Offline
Posts: 233
Klaatu, Borada,Necktie?
Re: hiding a programme__help
«
Reply #12 on:
April 25, 2008, 07:52:54 AM »
Could be the flux capacitor...
Logged
Reluctant CISSP, Certified ASS
don
Editor-In-Chief
Administrator
Hero Member
Offline
Posts: 4165
Editor-In-Chief
Re: hiding a programme__help
«
Reply #13 on:
April 25, 2008, 10:16:12 AM »
Hey bojan,
You've been given a few things to go on, and if it ends up being that difficult to compromise the target, maybe we can deduce that the security is good. Now we can move on to other machines in the network that you have permission to test. You know the theme of this site, so I'm assuming this is either a client for which you have permission to do this or it's your own lab.
Either way, I think this thread has run its course.
Don
Logged
CISSP, MCSE, CSTA, Security+ SME
Pages: [
1
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
Programming
: Finished Python Course in Codecademy now what?
(13) by
securitian
Network Pen Testing
: Ruby on Rails Vulnerabilities/Attacks in BackTrack 5 r3
(0) by
SUdoctstudent
Network Pen Testing
: De-ICE 1.140 released!
(2) by
superkojiman
Network Pen Testing
: AIX Vulnerability Assessments
(1) by
3xban
General Certification
: CPT Practical Submission
(1) by
UNIX
OSCP - Offensive Security Certified Professional
: Failed my first attempt at the OSCP exam
(94) by
azmatt
Tools
: Social-Engineer Toolkit (SET) Version 5.0 “The Wild West” Released
(2) by
m0wgli
Malware
: EICAR?
(3) by
UKSecurityGuy
Advisories
: HTB23154: Multiple Vulnerabilities in Exponent CMS
(0) by
AndyP
Advisories
: HTB23153: Multiple Vulnerabilities in Jojo CMS
(0) by
AndyP
Advisories
: HTB23151: Cross-Site Request Forgery (CSRF) in UMI.CMS
(0) by
AndyP
Tutorials
: Need guidance
(8) by
r0ckm4n
OSCP - Offensive Security Certified Professional
: Class Scheduled 6/8 - Linux n00b
(7) by
Taemyks
OSCP - Offensive Security Certified Professional
: OSCP exam scheduled
(6) by
gbhat
Incident Response
: LinkedIn Forensics
(0) by
AFENTIS_Forensics
General Certification
: Red Team/Blue Team
(1) by
ajohnson
Career Central
: Starter cert?
(3) by
Grendel
Network Pen Testing
: Beginner Ethical Hacker
(1) by
m0wgli
Web Applications
: Nessus and Nikto
(4) by
Seen
Network Pen Testing
: Cracking salted MD5 hash
(4) by
n37sh@rk
CEH - Certified Ethical Hacker
: Passed my C|EH
(3) by
n37sh@rk
Mass Media
: EC-council hacked, irony at his best?
(0) by
j0rDy
Web Applications
: SQL Injection into an INSERT statement.
(6) by
eyenit0
Network Pen Testing
: Solution for sipXtapi INVITE Message CSeq Field Header Remote Overflow
(1) by
m0wgli
Web Applications
: dns
(2) by
H1t M0nk3y
Other
: BSides Boston
(0) by
3xban
Career Central
: InfoSec in Central, FL
(2) by
tturner
Web Applications
: Web vulnerability scanner
(4) by
H1t M0nk3y
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.