Approved: Fortect
In this guide, we’re going to identify some of the possible causes that might cause the Poisen ivy 2.3.0 troubleshooting, and then suggest ways to try and fix the problem.
What You Need For This Project
- The Windows 2008 Server virtual host that you used in previous projects.
- A healthy real or virtual machine with Windows XP, Ivy.
Context
Poison is often a remote administration tool (RAT)in fact he is very popular with criminals andgovernment sponsored cyberattacks. This was usedCompromise RSA 2011.
The manufacturer offers a free version thatdetected by antivirus products, howeverat some point a proposal from the developer Poison Ivy (“Jonas”)Custom made items have been guaranteedto avoid virus detection.
Your Computer First: C&C Server
Start the Windows Server 2008 virtual machine. Thisits C&C (Command and Control) withserver.
Installing 7-Zip
On your Windows 2008 Server virtual machineOpen explorer, go to the Internethttp://7-zip.org,Download and configure 7-zip.
Show Filename Extensions
Pressbegin,a computer…
Disable “Hide add-ons for known file types”The box is given below.
Find Out The IP Address Of Your C&C Server
Click on the Windows desktopbegin… Enter the search fieldCMD and enter the key.
In the Gather Command Prompt window, enter the IPCONFIG command and press Enter. Multiple IP addresses appear
Find the adapter that goes with your local network. In S214, this is an adapter whose IP address starts with “192 s.168.1”. The gloss of this IP address.
Download Poison Ivy
On one Windows 2008 C&C serverOpen Internet Explorer then go tohttp://www.poisonivy-rat.com/index.php
Alternative Download Location
If this page, which is CCSF, is blocked,Download here. This is 7-zip encryptedUsually archive with password sam
Poison% 20 Ivy% 202.3.2.7z
Approved: Fortect
Fortect is the world's most popular and effective PC repair tool. It is trusted by millions of people to keep their systems running fast, smooth, and error-free. With its simple user interface and powerful scanning engine, Fortect quickly finds and fixes a broad range of Windows problems - from system instability and security issues to memory management and performance bottlenecks.
When the file is extracted, open PI2.3. And 2double click the folderThe file Poison Ivy 2.3.2.exe.
Eliminationtroubleshooting
If the ivy poison refuses to run,and the message “does not work anymore” appears,Windows Data Execution Prevention (DEP) may blockthis is.
To disable DEP go to AdvancedSystem settings as you think in the project 2.
If the DEP rate is due to the following fact,it’s wrong to wear”Contact DEP for information on basic Windows programs.and only service ”.
Then restart the Windows server.
Creating A Trojan Horse
In the Poison the Ivy window, clicksubmit, “New server”.
In our boxIn the “Connection” section, change the address inDNS / port form”127.0.0.To 1″ is your truthIP address as shown below.
This is command and control(C&C) Computer for your bots.hardcoded into a Trojan.
Click the Add button.The DNS / Port field will open. PressYour IP address to allocate it.
On the site,Don’t change anything “advanced”.Keylogger is tempting too,but it froze my target when i trieduse this.
Start The C&C Server
In the Poison window, click on a specific ivy.submit, “new customer”.
The desired page is displayedChange the port settings or add a password.
Poison ivy – [listenPort: 3460 (Connections: 0)] “A window will appearHow? ‘Or’ Whatindicated below.
Infected Target
Start any Windows XPvirtual machine.
Open the ping order template and yourC&C server. If you do not receive an answer,You need to solve network problemsbefore continuing.
Move the entire VOTRENOM.exe file fromThe target C&C server on the computer.You should be able to drag and drop a file directly from one desktop to another. If this letter fails,and sometimes a USB stick or mounted folder.
Look At Both Of You
Target looks like ivy in poisonThe window shown below showsYour name in relation to the ID line.
Save Screenshot
Usually watch out for the target to appear in the poison ivy.Window as shown above.
Click the taskbar at the bottom of the desktop of a powerful Windows host to display a list of listening host computers that can use the keyboard instead of the real computer Vera.
Usually press the PrintScrn key in the upper right corner of the keyboard. This should definitely copy the entire desktop to the clipboard.
On the host, not on the exclusive computer, click the Start button.
Type mspaint in the search box and press Enter.
Click on the unnamed window – Paint, on it press Ctrl + V on your keyboard. The desktop remains in the drawing window.
Save the log under the file name “YOUR NAME Proj 11a” and replace “YOUR NAME” with your valid legal name.
Purpose Of Operation
DoesPoison ivy windowDouble click on all target computers.
A box with all these things will appearYou can reach your goalas shown below.
Try the options. Here are the exactwhich worked best for me.
Process
Windows Hashes
Save Screen Details
Submit Your Project
Email the image regarding:[email protected] in the subject line with “Project 11 YOUR NAME”and replace” YOUR NAME “with your real name.
Sources
