https://0x00sec.org/t/remote-shells-part-ii-crypt-your-link/306
https://0x00sec.org/t/remote-shells-part-iii-shell-access-your-phone/508
https://0x00sec.org/t/remote-shells-part-iv-the-invisible-remote-shell/743

code c pour des remote/reverse shell.
tuto 4 pour un canal ICMP

technique(s) LARGEMENT connue(s) mais je poste quand même...

dans les comments :

- For mac in 140 chars:reboot>hold Command + R>Click the Utilities menu > select Terminal> type resetpassword > press enter. Macs are Secure!
- Reboot > command+S > "mount -uw /" > "ls /Users" > "passwd [username]"

Then what to do ?
- To add accounts: "net user AccountName /add". To grant admin: "net localgroup Administrators /add AccountName".
- Once you get to the cmd prompt type "net user administrator /active:yes" There are much easier ways to do this...

Why it works :
- The reason this works is that Windows doesn't check the integrity of the Sticky Keys executable and just runs it regardless.
- 1/2: The reason why this works, is that the processes in the logon-environment always is started in context of the system user.

Other options...
- Hirens boot CD >Tools >Security> Reset Admin Password >follow Prompt (yes) Reboot no Password. Takes 2 minutes and less fart ass ing about.
- I think changing sethc by registry debug value to cmd is much neater. But that works too. That debug can be also used for many other things.

Countermeasures :  
- Windows : System Settings -> Security and Privacy -> File Vault.
- As a network manager, disable startup repair via group policy. Fixed.
- bcdedit /set {default} recoveryenabled No
- Unless it's a public machine (home/work),you can prevent this by adding disk encryption or even a BIOS boot password.Just don't forget them.
-Disable Startup Repair with: bcdedit /set {default} bootstatuspolicy ignoreallfailures

Trop fort seb !

Sebsauvage a hacké le code de l'application de sa banque qui voulait le géolocalisé en neutralisant les appels aux API de Géolocalisation : un peu de reverse et recompilation et Hop ! (euh nop !).

Il publie sur son wiki comment il a procédé et quels outils il a utilisé. Merci ;-)

Les équipes de Microsoft prennent en considération les CSRF & Clickjacking telles qu'elles leur ont été expliquées par J. Grossman et R.Hansen (RSnake) pour développer IE8.