+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: [Challenge] CRACK THIS IF YOU CAN [CHALLENGE] (/showthread.php?tid=1229470)
Pages: Pages
1
2
[Challenge] CRACK THIS IF YOU CAN [CHALLENGE] - hf_l33t - Apr 20, 2011
[size=medium][b]Hey guys i have a challenge for all of you just try to Crack it & you will have a secret message on it ..
Well after you crack it PM me the Message and the Method you used: in short
But i think no one can crack it including Kobac in HF
VIRUS SCAN :- http://my-avscan.com/result.php?scan=MTU5MzI=
[color=#FFD700]
[deleted]
* - MultiMedio - Apr 20, 2011
Nice i dident manage to crack :' (, btw kobac can easily crack. u just remove the hole system.
Remmember: Nothing is UnCrackabel, but u can make it hard as fuck.
* - [email protected] - Apr 20, 2011
Cant crack it Bro its too hard...
I think nobody can crack it...
* - pr0t0typ3 - Apr 20, 2011
Looks like a bad try to infect HF.
![[Image: 5icnH.png]](https://i.imgur.com/5icnH.png)
* - Nazworth - Apr 20, 2011
(Apr 20, 2011 09:03 AM)pr0t0typ3 Wrote: Looks like a bad try to infect HF.
Haha, I'm glad you pointed that out. There shouldn't be a RunPE in a crack me :)
* - Elbobo - Apr 20, 2011
i also noticed it(the pe dropped in memory) tried to access mozilla sqlite dll's, its trying to steal passwords :/
* - pr0t0typ3 - Apr 20, 2011
Uhm a .net crack me does not need a RunPE and a installation routine.
Even if you would store hashes (wtf has this to do with a RunPE) you don't need to install your application to startup.
* - Helios. - Apr 20, 2011
(Apr 20, 2011 09:03 AM)pr0t0typ3 Wrote: Looks like a bad try to infect HF.
And it seems that his "Forum" (hackforall.com) that is in his signature is not so innocent as his application:
Virustotal url scan: http://www.virustotal.com/file-scan/report.html?id=6a0d5caea143c16e653c09eea3dbda89cb76a36bd04a41ca5910c262e42e0386-1303317398
Anubis (here we can see and memory functions): http://anubis.iseclab.org/?action=result&task_id=185000a00724d2564ade4800605e4e3c7&format=pdf or http://anubis.iseclab.org/?action=result&task_id=185000a00724d2564ade4800605e4e3c7&format=html
* - StaTiX - Apr 20, 2011
(Apr 20, 2011 09:03 AM)pr0t0typ3 Wrote: Looks like a bad try to infect HF.
lmao
op shud at least obfuscate his shit if he wants to infect members
* - Infinitus - Apr 20, 2011
(Apr 20, 2011 09:03 AM)pr0t0typ3 Wrote: Looks like a bad try to infect HF.
How did you get to bejn.dll I only see amir.exe, but maybe that's only me.
* - Blue Screen of Death - Apr 20, 2011
He replaced the download link?
I opened that file in .net Reflector and looks legit:|
* - pr0t0typ3 - Apr 20, 2011
(Apr 20, 2011 10:18 AM)Blue Screen of Death Wrote: He replaced the download link?
I opened that file in .net Reflector and looks legit:|
I unpacked the file -.-
He the part you can see is the loader which does get the actually application from resources and invokes it in memory and I unpacked it...
* - Infinitus - Apr 20, 2011
(Apr 20, 2011 10:25 AM)pr0t0typ3 Wrote: I unpacked the file -.-
He the part you can see is the loader which does get the actually application from resources and invokes it in memory and I unpacked it...
Would you mind telling me how you did that?
* - StaTiX - Apr 20, 2011
(Apr 20, 2011 10:25 AM)pr0t0typ3 Wrote: I unpacked the file -.-do you mean this ?
He the part you can see is the loader which does get the actually application from resources and invokes it in memory and I unpacked it...
Spoiler (Click to View)
?
if so that makes some cence
* - pr0t0typ3 - Apr 20, 2011
(Apr 20, 2011 10:29 AM)StaTiX Wrote: do you mean this ?Yeah exatly that is it.
Spoiler (Click to View)
?
if so that makes some cence
If you replace some of the characters you get a valid base64 string which can be decoded and opened in reflector.