Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 48 guests and 1 member online
 
Advertisement

You are here: Home arrow Resourcesarrow Tutorialsarrow hiding a programme__help
EH-Net
May 21, 2013, 04:42:46 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: hiding a programme__help  (Read 13344 times)
0 Members and 1 Guest are viewing this topic.
bojan
Newbie
*
Offline Offline

Posts: 19


View Profile
« on: April 24, 2008, 07:07:43 AM »

Is there any way to hide a programme ??I mean I want to execute that programme,but I want to hide it under any image,video or anything else,so whenever I will save that image,video etc or run it the hidden programme will be installed automatically??/is there any tool available for this or any procedure???please help!
Logged
Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #1 on: April 24, 2008, 07:21:03 AM »

Bojan,

have you asked Google first?

From my understanding you will need to modify an existing application to execute your 'hidden' code, therefore I'd be surprised if there are any tools that can automate the process (at least I haven't come across anything).
Logged

dean
Guest
« Reply #2 on: April 24, 2008, 08:04:33 AM »

First, try to use some punctuation it will make things a little easier to read and there is no need for the multiple '?' We understand that you're asking a question.

Second, Google is your friend there is a substantial amount of information on this topic out there. Show that you actually did some research before posting.

To answer your question:

Use a binder. This is a tool that allows you to 'wrap' one executable with another. There are many variants out there. Whether or not it will be detected depends on whether your RAT is known or not.
Logged
bojan
Newbie
*
Offline Offline

Posts: 19


View Profile
« Reply #3 on: April 24, 2008, 08:12:43 AM »

yes dean,I am looking for a good binder!!I was using upx for some time but it was not that good!So can you please tell me is there any good binder available?but at the same time I want to know that what actually a binder does?Is binder will help me to change the look of my programme??
Logged
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 233


Klaatu, Borada,Necktie?


View Profile
« Reply #4 on: April 24, 2008, 08:24:18 AM »

again...

Quote from: dean
Google is your friend there is a substantial amount of information on this topic out there. Show that you actually did some research before posting.
Logged

Reluctant CISSP, Certified ASS
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #5 on: April 24, 2008, 10:11:39 AM »

Reading back to the original post, he wanted to hide it within a picture or video.  That changes the deal a little bit.  It is easier to hide an executable within another executable than it is to hide an executable in a picture or video.  The idea is that the .exe is already making system calls and such that you can abuse, while a video or picture is generally read from and interpreted by some other application.  There are ways to include nasty code into a video or picture so that the application reading the file gets "hacked", but this isn't the same as having a hidden program kick off in the background.  There are some ways to do this, but they are not as clean or consistent as you'd probably like.
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
dean
Guest
« Reply #6 on: April 24, 2008, 11:25:39 AM »

but I want to hide it under any image,video or anything else,so...

or anything else would be an .exe, no?

a binder does not 'abuse' the calls made by the host exe.  One is simply run in the background. If you bind two exe's the size will generally increase. Just something to be aware of.

if you want to hide an exe in an image try this:

zip the executable

copy /b image.jpg+file.zip output.jpg

right click on the image that is created and use winzip/winrar to open it.

it won't execute it but it is a way to hide it.

Tools like YAB will bind exes. FileBinder will bind any file. Whether or not this will run when the jpg is open I have not tested.

Honestly, there are a far easier ways to get an executable on a remote host. ADODB stream being one.

dean

Logged
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #7 on: April 24, 2008, 11:36:07 AM »

dean,
    Agree with your post, I just noticed that he seemed to be stressing the "image,video" issue.  As you mentioned, it can be straightforward to hide a file in an image, but getting to execute and run when viewed isn't trivial. 
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
iSmith
Full Member
***
Offline Offline

Posts: 157


Do or do not. There is no try. - Yoda


View Profile
« Reply #8 on: April 24, 2008, 01:28:09 PM »

here is my not-so-expert advice.
1 create a batch file that executes your program. be sure to add a line at the end "open media.xxx" to open you media. (this will only appear to work if the person opens the file with the default program.)
2 create a shortcut to the batch file and then edit it's properties so that it has the icon of the appropriate media.
note this will not hide the little arrow that is typical of shortcuts.
Logged

In my eyes, your operating system is as solid as swiss cheese.
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #9 on: April 24, 2008, 02:06:39 PM »

I think the purpose of his question was to find a way to hid a program so that it was not directly observable to the user.  To do that the program would have to be hidden in the data and file structure of the trojaned data (or an alternate date stream), and the resources necessary to run the program would have to be shared in such a way that they are not directly attributable to the hidden executable.  (or hidden with a rootkit?) 
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
bojan
Newbie
*
Offline Offline

Posts: 19


View Profile
« Reply #10 on: April 25, 2008, 12:42:22 AM »

I just want to hide it actually,because it's not easy to compromise the target for running the programme!!!so If I want to hide any programme what I have to do?Target will run a programme and the hidden one will be executed automatically and silently and will not be detected!!!

« Last Edit: April 25, 2008, 01:05:32 AM by bojan » Logged
pseud0
Recruiters
Full Member
*
Offline Offline

Posts: 208



View Profile
« Reply #11 on: April 25, 2008, 07:02:26 AM »

Well there's your problem... it looks like your blinker fluid is low and you need to rotate your muffler bearings.  If you have a VAX system sitting around you could put together a banyan bomb and push it through the intergoogletubes to your target.
Logged

CISSP, CISM, CISA, GCIH, GREM, CEH, HMFIC, KTHXBIROFLCOPTER
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 233


Klaatu, Borada,Necktie?


View Profile
« Reply #12 on: April 25, 2008, 07:52:54 AM »

Could be the flux capacitor...
Logged

Reluctant CISSP, Certified ASS
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 4165


Editor-In-Chief


View Profile WWW
« Reply #13 on: April 25, 2008, 10:16:12 AM »

Hey bojan,

You've been given a few things to go on, and if it ends up being that difficult to compromise the target, maybe we can deduce that the security is good. Now we can move on to other machines in the network that you have permission to test. You know the theme of this site, so I'm assuming this is either a client for which you have permission to do this or it's your own lab.

Either way, I think this thread has run its course.

Don
Logged

CISSP, MCSE, CSTA, Security+ SME
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.067 seconds with 24 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.