You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
No voy a generar un post por una duda, y enviar un privado seria restringir la informacion libre.
Es mi opinion al respecto del "desvirtue" .. Ademas de que tecnicamente estamos hablando de control-remoto de archivos al menos.

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Y sobre lo que quiero saber, si es que me podes dar una mano, es si desde el navegador de archivos del Kali, entro a los archivos compartidos de una pc en la misma red... queda un log en algun lado?

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Pero eso quiero saber, si esa intrusion "simple" que hice, queda registrada en algun lado.

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Porque en el caso de ser un honeypot estaria en problemas?

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Hace poco que he instalado Comodo Firewall y le tengo configurado el ARP, como puedo saber de donde viene ese aviso de (Intrusiones en la red). Y cómo se interpreta o se busca.

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Me dado cuenta que son equipos que tengo en red que tengo, los puedo poner como abiertos?. o se puede poner que tengan acceso pero no a todo, si no lo acepto yo. Para que esten señalzados cuando me salga toda una lista y pueda diferencia lo que conozco de lo que no.

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Pero no entiendo los número que salen en la imagen, el que significan.

NUMEROS +IN + A(adreess) + IP

¿Que son esos números?

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Pero yo quiero aprender todos estos temas(especialmente a partir del Cap. 6) en C++ que es el lenguaje que estoy aprendiendo (mi primer lenguaje) y ademas no tengo el nivel de ingles suficiente para leer y aprender de un libro en ingles. Les dejare el indice del libro que les mencione para que me recomienden, algun libro como este pero en C++. Obiamente me refiero a algun libro en español por lo ya dicho. Calculo que si hay de Delphi tendria que haber de C++?

Este es el indice del libro resumido a los titulos de las unidades:

Capítulo 1: Delphi y el API de Windows
Capítulo 2: Los requisitos del logotipo Windows y Delphi
Capítulo 3: Funciones de creación de ventanas
Capítulo 4: Funciones de gestión de mensajes
Capítulo 5: Funciones de información sobre ventanas
Capítulo 6: Funciones de procesos e hilos
Capítulo 7: Funciones de librerías de enlace dinámico
Capítulo 8: Funciones del registro y de ficheros de inicialización
Capítulo 9: Funciones de gestión de memoria
Capítulo 10: Funciones de manejo del portapapeles
Capítulo 11: Funciones de entrada
Capítulo 12: Funciones de entrada/salida a disco
Capítulo 13: Funciones de cadenas y átomos
Capítulo 14: Funciones de información del sistema
Capítulo 15: Funciones de temporización

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Hola, me podrias pasar el PDF.. me intereso.

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Y si lo corro directamente desde la terminal tampoco ejecuta el shellcode.

setarch $(uname -m) -R <tu_programa>

setarch $(uname -m) -R /bin/bash

sysctl -w kernel.randomize_va_space=0

Citar
randomize_va_space:

This option can be used to select the type of process address
space randomization that is used in the system, for architectures
that support this feature.

0 - Turn the process address space randomization off.  This is the
    default for architectures that do not support this feature anyways,
    and kernels that are booted with the "norandmaps" parameter.

1 - Make the addresses of mmap base, stack and VDSO page randomized.
    This, among other things, implies that shared libraries will be
    loaded to random addresses.  Also for PIE-linked binaries, the
    location of code start is randomized.  This is the default if the
    CONFIG_COMPAT_BRK option is enabled.

2 - Additionally enable heap randomization.  This is the default if
    CONFIG_COMPAT_BRK is disabled.

    There are a few legacy applications out there (such as some ancient
    versions of libc.so.5 from 1996) that assume that brk area starts
    just after the end of the code+bss.  These applications break when
    start of the brk area is randomized.  There are however no known
    non-legacy applications that would be broken this way, so for most
    systems it is safe to choose full randomization.

    Systems with ancient and/or broken binaries should be configured
    with CONFIG_COMPAT_BRK enabled, which excludes the heap from process
    address space randomization.

env - /path/to/<tu_programa>

env - gdb /path/to/<tu_programa>

Citar
When learning to exploit with memory safety vulnerabilities, I recommend to use the wrapper program below, which does the heavy lifting and ensures equal stack offsets:

$ invoke stack         # just call the executable
$ invoke -d stack      # run the executable in GDB

Here is the script:

#!/bin/sh

while getopts "dte:h?" opt ; do
  case "$opt" in
    h|\?)
      printf "usage: %s -e KEY=VALUE prog [args...]\n" $(basename $0)
      exit 0
      ;;
    t)
      tty=1
      gdb=1
      ;;
    d)
      gdb=1
      ;;
    e)
      env=$OPTARG
      ;;
  esac
done

shift $(expr $OPTIND - 1)
prog=$(readlink -f $1)
shift
if [ -n "$gdb" ] ; then
  if [ -n "$tty" ]; then
    touch /tmp/gdb-debug-pty
    exec env - $env TERM=screen PWD=$PWD gdb -tty /tmp/gdb-debug-pty --args $prog "$@"
  else
    exec env - $env TERM=screen PWD=$PWD gdb --args $prog "$@"
  fi
else
  exec env - $env TERM=screen PWD=$PWD $prog "$@"
fi

Citarfixenv
A script to make stack addresses the same when running a program under gdb,ltrace,strace or without debugging (without ASLR of course). Env variables order is saved too.

CitarThe basic idea behind stack protection is to push a "canary" (a randomly chosen integer) on the stack just after the function return pointer has been pushed. The canary value is then checked before the function returns; if it has changed, the program will abort. Generally, stack buffer overflow (aka "stack smashing") attacks will have to change the value of the canary as they write beyond the end of the buffer before they can get to the return pointer. Since the value of the canary is unknown to the attacker, it cannot be replaced by the attack. Thus, the stack protection allows the program to abort when that happens rather than return to wherever the attacker wanted it to go.

hcitool scan

hcitool inq

Citar
Local Bluetooth adapters are assigned identifying numbers starting with 0, and a program must specify which adapter to use when allocating system resources. Usually, there is only one adapter or it doesn't matter which one is used, so passing NULL to hci_get_route will retrieve the resource number of the first available Bluetooth adapter.

int hci_get_route( bdaddr_t *bdaddr );

* It is not a good idea to hard-code the device number 0, because that is not always the id of the first adapter. For example, if there were two adapters on the system and the first adapter (id 0) is disabled, then the first available adapter is the one with id 1.

If there are multiple Bluetooth adapters present, then to choose the adapter with address ``01:23:45:67:89:AB", pass the char * representation of the address to hci_devid and use that in place of hci_get_route.

Citar

int hci_open_dev( int dev_id );

Most Bluetooth operations require the use of an open socket. hci_open_dev is a convenience function that opens a Bluetooth socket with the specified resource number [2]. To be clear, the socket opened by hci_open_dev represents a connection to the microcontroller on the specified local Bluetooth adapter, and not a connection to a remote Bluetooth device. Performing low level Bluetooth operations involves sending commands directly to the microcontroller with this socket.

Citar
hci_inquiry performs a Bluetooth device discovery and returns a list of detected devices and some basic information about them in the variable ii. On error, it returns -1 and sets errno accordingly.

int hci_inquiry(int dev_id, int len, int max_rsp, const uint8_t *lap, inquiry_info **ii, long flags);

hci_inquiry is one of the few functions that requires the use of a resource number instead of an open socket, so we use the dev_id returned by hci_get_route. The inquiry lasts for at most 1.28 * len seconds, and at most max_rsp devices will be returned in the output parameter ii, which must be large enough to accommodate max_rsp results. We suggest using a max_rsp of 255 for a standard 10.24 second inquiry.

Citar
Once a list of nearby Bluetooth devices and their addresses has been found, the program determines the user-friendly names associated with those addresses and presents them to the user. The hci_read_remote_name function is used for this purpose.

int hci_read_remote_name(int sock, const bdaddr_t *ba, int len, char *name, int timeout)

hci_read_remote_name tries for at most timeout milliseconds to use the socket sock to query the user-friendly name of the device with Bluetooth address ba. On success, hci_read_remote_name returns 0 and copies at most the first len bytes of the device's user-friendly name into name. On failure, it returns -1 and sets errno accordingly.

Citar
The basic data structure used to specify a Bluetooth device address is the bdaddr_t. All Bluetooth addresses in BlueZ will be stored and manipulated as bdaddr_t structures.

int ba2str( const bdaddr_t *ba, char *str );

str2ba takes an string of the form ``XX:XX:XX:XX:XX:XX", where each XX is a hexadecimal number specifying an octet of the 48-bit address, and packs it into a 6-byte bdaddr_t. ba2str does exactly the opposite.

Citar
The inquiry_info structure is defined as

typedef struct {
    bdaddr_t    bdaddr;
    uint8_t     pscan_rep_mode;
    uint8_t     pscan_period_mode;
    uint8_t     pscan_mode;
    uint8_t     dev_class[3];
    uint16_t    clock_offset;
} __attribute__ ((packed)) inquiry_info;

For the most part, only the first entry - the bdaddr field, which gives the address of the detected device - is of any use. Occasionally, there may be a use for the dev_class field, which gives information about the type of device detected (i.e. if it's a printer, phone, desktop computer, etc.) and is described in the Bluetooth Assigned Numbers [3]. The rest of the fields are used for low level communication, and are not useful for most purposes. The interested reader can see the Bluetooth Core Specification [4] for more details.

apt-get install libbluetooth-dev

gcc -o simplescan simplescan.c -lbluetooth

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Me pueden corrigen este código que yo edite. Se que esta muy mal hecho y que ni siquiera va a lo que quiero sino que solo da el nombre del archivo.
Lo que yo quería hacer es enviar un archivo .exe

You are not allowed to view links. You are not allowed to view links. Register or Login or You are not allowed to view links. Register or Login
Solo encontre cursos y cosas por el estilo de la parte de Interface User pero de lo demas, como por ejemplo; Los servicios del sistema, no encontre nada explicado de forma gradual como los cursos de Como crear un ventanas y eso.
Debo aprenderlo de la forma dificil no? Es decir, leyendo la pagina de Microsoft e ir sacando conclusiones por mi mismo. Ya que solo en esa pagina eh visto que nombre y de ejemplos de TODAS las funciones de winapi. O hay algo que se me esta escapando?
Siempre que pregundo donde aprender el manejo de winapi, me mandan a la pagina de cconclase, pero ahi solo explica como crear una interface de usuario.