[TuT] Brewing your own password stealer with FlyCrypter [PICS + Noob Friendly]

[TuT] Brewing your own password stealer with FlyCrypter [PICS + Noob Friendly]

03-01-2010, 09:38 PM (This post was last modified: 03-02-2010 02:17 AM by GigaWatt.) Post: #1

GigaWatt  I wonder how long a title I can fit Posts: 63 Joined: Feb 2010 Reputation: 6

This guide is posted by request, so here's a shout-out to you, segers909. [BACKGROUND] The idea for this started when I realized how much a pain it is to upload files using most RAT tools. Once the files were on the host I could just run a batch file to get the job done, but uploading files one at a time was becoming unbearable and most pre-existing password stealers seemed a bit overkill for what I needed. [WHAT THIS PROGRAM DOES] Simply put: it dumps passwords for each of the respective bound programs to the current directory. [HOW TO] Download a copy of FlyCrypter and USG from a location of your choice. Download any of the programs from Nirsoft for the programs you wish to rip passwords from. If you don't have a stub already, generate one with USG for later usage. Open up FlyCrypt and add each of the password programs to the list. You can do this by right clicking, then select "File Options" -> "Add a file". Visual Example (Click to View) Right click each and select "Main Options" -> "Command Line" -> "Custom". Visual Example (Click to View) For each program, you want to put "/shtml [NAME].html" (no quotes) where [NAME] is the name you want for the output. Make sure each program outputs to a different .html file! Visual Example (Click to View) Right click any of the programs and select "Main Options" -> "Custom Stub" and select a stub you've generated with USG. When it asks for a password setting, pick any and hit OK. OPTIONAL: Right click and select "Pe Options" and use any of the Clone/Null Icon/Info settings as you chose. If you're new to FlyCrypter or crypting in general, avoid using any of the other settings. Right click and select "Crypt File(s)" and select a file name for the result .exe file. Visual Example (Click to View) Run the result file and make sure it works properly! Before... (Click to View) After! (Click to View) NOTE: If you're running this remotely from a RAT, some of them attempt to run the file with blank parameters instead of no parameters which causes it to not function. To get around this, open a remote Command Prompt, use CD to get to the directory its stored in, then just type the name of the executable. If you wait a few seconds then use "dir *.html", you should see your collection of password dump files! Using the command line option in FlyCrypter adds a lot of potential to a program, especially if you consider the number of useful command-line programs (like pwdump, used for taking Windows login hashes). Just remember, if you can run it from your computer, you can make FlyCrypter do the same. Its just a matter of a little tweaking! Enjoy! -GigaWatt. (As always, these guides are provided for educational purposes only! The author takes no responsibility for the actions of his readers.)