[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foYnHjFeMClletGXDfpH-ze62UDnb_Ke3_4JV_JgfkvY":3,"$fPOZdEDtLnnDGF-GSM9q-YOFKV1frI5vSBS3dSHWlSIo":58},{"slug":4,"title":5,"summary":6,"category":7,"author":10,"image_url":16,"image_thumb_url":16,"published_at":17,"updated_at":18,"body_html":19,"keywords":20,"reading_time_minutes":21,"related_articles":22,"related_course":14,"related_specialty":14},"realizando-ingenieria-inversa-al-keylogger-ardamax","Realizando ingeniería inversa a keylogger ardamax.","Hola comunidad de backtrackacademy, hoy se explicare como reversear Ardamax Keylogger, con una ligera regla de registro, pero antes debo agradecer al Maestro Ricardo Narvaja por su nuevo aporte IDA PRO y sus exámenes propuestos, además al grupo Perú Crackeando, que le integra DavicoRm que aporta y nos enseña su método de punto mágico, a SoftDat por sus videos de cracking, y Abel por los retos propuestos y por motivarnos.",{"slug":8,"name":9},"reverse-engineering","Ingeniería Inversa",{"username":11,"name":12,"avatar_url":13,"headline":14,"aboutme":15},"Lior","Rafael PeruCrackers","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBdGdKIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--18ea99d6876a18ae422b2c3858846ac9d9979bfa\u002F41473879_681300015589328_2914457510192611328_n.jpg",null,"Estudiante de la ingenieria Inversa usando las herramientas de Ollydbg y el actual IDA PRO, actualmente me encuentro investigando sobre Creacion de Exploit, con animo de ayudar a las personas que les interesa el mundo del reversing, :)","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBaVVPIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--3ee1cdc68cd1158f807146bb66ab94e97eb43eb0\u002Fshutterstock_1107463670.jpg","2017-03-12T23:26:02-03:00","2026-10-26T18:15:52-03:00","\u003Cp>\u003Cstrong>Ardamax\u003C\u002Fstrong> es una herramienta que captura las actividades del usuario y guarda en  un archivo de registro. El archivo de registro se puede ver en modo texto o vía web, también puede utilizar dicha herramienta para ver qué sucede con su computadora mientas estas ausente.\u003C\u002Fp>\r\n\u003Ch2>Al ataque...\u003C\u002Fh2>\r\n\u003Cp>EL software tiene un tipo de seguridad que muchos conocen es la versión de prueba o TRIAL, de lo cual como siempre en casi todos mis futuros tutoriales, encontrar el “CHICO BUENO” es mi especialidad, comenzaremos a sacar un BACKUP al .\u003Cstrong>exe\u003C\u002Fstrong>, para futuras metidas de patas, bueno lo primero que se realizar es ver si Ardamax presenta protección o un unpack y el tipo de lenguaje que se compilo, en este caso vemos que no presenta protección y que está en lenguaje Visual C ++ 9.0. \u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh3.googleusercontent.com\u002FuKpgvaCoKH8-EdeIyBRCbuiNmWi38pUuVthejPAWBTLNobEyFuiuz8NHnM470gxHeIbGJ9Sq3GrFqegOZfVSvHbDATlEhDr8JjNT37rh2lUXQy6CSYJ_gtDlfqT5XTmZrC8_4t_UG_BcU4Pwwg\" width=\"363\" height=\"188\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp> \u003C\u002Fp>\r\n\u003Cp>Nota: Tener en cuenta la ruta en donde se instala el software. \u003C\u002Fp>\r\n\u003Cp> \u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FgW_SearV225dOQi82CDmExVMtuEdxIKn9RdQQ1GQkzBe6Mf6dr4wXqV3nqWhrqHgfuMSO1XQu1oYSGn7_4mSi0phEVKkIgt7vTKdA3ePJDNR0SEe2Sy9XcX0U4wqq__25SK7Chi5cIP3tqJbcQ\" width=\"567\" height=\"181\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>Para poder hallar el “\u003Cstrong>BAD BOY\u003C\u002Fstrong>”, tuve que ejecutar la aplicación “\u003Cstrong>F9\u003C\u002Fstrong>”, luego intente registrarme y bum me apareció el “\u003Cstrong>BAD BOY\u003C\u002Fstrong>”, en donde pause. Y luego hice clic en la opción “\u003Cstrong>K\u003C\u002Fstrong>”, como muestra en la imagen:\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002F0k_aTWvk17eZJHz6SVNV1-fgiJdczE9CGRBrK5dyCTYEuQNWOaiTO9zdZUdVIJgJsaQ0UGnfwxLvseYXP6OB_sUBLp_qYzyReIdk0IRB-iDjDZ3TFkE-foX7VBwFCHy9XS_uytV1eSbRAbcpBw\" width=\"433\" height=\"242\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>Como muestra la Opción “\u003Cstrong>K\u003C\u002Fstrong>” o “\u003Cstrong>VIEW-CALL STACL\u003C\u002Fstrong>”, nos muestra el \u003Cspan>call\u003C\u002Fspan> que entramos al momento de poner PAUSA. En este caso vemos que \u003Cspan>MessageBoxW\u003C\u002Fspan>, tiene el proceso de vacilación.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002FXI-C19vazMGk512b3p5w9N_xf-26UGz_ivHaQs0aPxSWjRz8Pel8DpjjK2LXcRJrH86C0KErdhbQ9C4G80WL_04y144rVohPlF1LuSKnD0YdCJJxzMCDVsr3X8DmvTBLT9tbC5F4VJmrIjDKEw\" width=\"466\" height=\"263\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>Reiniciamos la aplicación y nos vamos a \u003Cstrong>Search for -> Name (label) in current module.\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cstrong> \u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh3.googleusercontent.com\u002FC3waJgB9nsOgWYEYIgmHVGnKPCTinl-HIMTDkZ_MtBlpR9XPWMXLx1MWfBkCyRTA2MOrYtPtjeWTBdEPPuZrGro1xAGnubD41b_Y9J7On8rjbFy2RpYGRB7cOZF9fXY4_pK5KAY9BdYvKVgZAw\" width=\"330\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cstrong> \u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>Encontramos la clase \u003Cstrong>MessageBoxW\u003C\u002Fstrong> donde nos muestra el mensaje de el “\u003Cstrong>BAD BOY\u003C\u002Fstrong>”, de lo cual iremos al area de Disassembler de la clase.\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh6.googleusercontent.com\u002FeVMcM7g2r3GIGHP5AvlZwqZWel99J_ICSGU3gFaEI5hgVcL7Y80UkQ3e7DU5I33X9us405hWQeh_Z-kANWHWz7voYv_N6Pus1WzLCcYeydmOl7nUfRCu5mgR2q_Sp9W0TY7-tFZuC38VCijT7Q\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>En nuestro caso pondremos un BP en la dirección de memoria 7604EA5F (Inicio) y 7604EAA5 (FIN), de la clase \u003Cstrong>MessageBoxW\u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cstrong> \u003C\u002Fstrong>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FeEi3jHLytMxKtpN8j_QJtE9K8u0gNUzhMnsbBwvyb_h8w7z9ZGBBIGEsXcBC3HLTUpjTkYaN4tmtHZ2OKlCXxF6ndcdXfDCk27QtHJVvDZrnymLi8_GMnxi7HOg6ZDPOAxsYQyhYG6JNxS2INg\" width=\"567\" height=\"300\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>En este caso ejecute Ardamax con “\u003Cstrong>F9\u003C\u002Fstrong>”,  intente registrarme, donde se detuvo en el \u003Cstrong>MessageBoxW\u003C\u002Fstrong>, luego aprieto una vez mas “\u003Cstrong>F9\u003C\u002Fstrong>”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FQWF7VdN2RcPXSgFN160NFfqkFMjtNhyxqs7ZekyF0Z7pWm-9DO_PzIMp1L9GzUpjxFN1kC89pvPf9sI7yft3UcF6MOsvCRvYYZplQcL5BgNy01eI9K3AWQIRrMxCtxS8de5E9ZFDmBSQgRd6iw\" width=\"566\" height=\"334\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>Otra manera de ir al final de la clase \u003Cspan>\u003Cstrong>MessageBoxW\u003C\u002Fstrong>\u003C\u002Fspan>, ir a Debug -> Execute till return.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh3.googleusercontent.com\u002Fpl5XtaRCdzIKulezISuTlYY_4G3Aofrn_G95M5Q40fg3p8A-n5xcOK__uwyO_Uemhp675me5rqxvxCKdG6W_c6LWK-rhhQCNSo6t1bWzLZ1f4BJLXgn8RSgl4RzkNWRVtgsoobdVSA9d6SpB4w\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>Donde nos mostrara el \u003Cspan>\u003Cstrong>MessageBox\u003C\u002Fstrong>\u003C\u002Fspan> con el “\u003Cstrong>BAD BOY\u003C\u002Fstrong>”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FI0CQy8v7Yzvs6ov1uztHiu_2eO8hTHskc1pqqx5TN6PGB_gaq5OZNMBVaP5-gBgGFqxt5u6LT67trhCHjxltAuadb9Gmd2gwkLFh5R8SL1w5XIiOMOWK_ypCdyCGUnXTMyQ56QTlouxhMeF7dA\" width=\"567\" height=\"246\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>Cuando lleguemos a la dirección de memoria \u003Cstrong>7604EAA5\u003C\u002Fstrong>, y finalmente apretamos “\u003Cstrong>F8\u003C\u002Fstrong>”, para retornar y ver que CALL realizo la invocación de \u003Cspan>MessageBoxW en este caso se realizo en el 00424273.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002FpyqMKdafHoounoR9C7FOvAkywC6N3So5MLIJkuAqhe7wqGK2n3gY26lqZbkQ7kmeU2RN2GHqIH4irc4PNDLWH0SLJM5GeyrWE_4LsmhelkVuun50Dn1InZzyhULu0mtDVNcwALCQP3NDQ0nLvg\" width=\"479\" height=\"187\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>En el punto anterior se presiono  “F8”, y llegamos a la dirección de memoria 00424279, en donde para no tardar tiempo en explicar, se analizo cada \u003Cspan>MessageBoxW\u003C\u002Fspan>, el de circulo azul con carita feliz, es el “GOOD BOY”, con la dirección de memoria 00424217 y el que esta sombreado con color amarillo con dirección de memoria 00424273, es el “BAD BOY”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh3.googleusercontent.com\u002FdlCqzDZ1bkDftT8N2RxTxX5gA9ry88clh67d8YK4p7sOY0gSSRn7jnpgmgMcRO3SuLlgFGFmboXaPhDXkhBWSpxW2L5nWmnyPrJJ-CKGRjSI75OYGtMe71HUGZpaLERVJZzEYNHIJFPxdvVmqA\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>Este es otro \u003Cspan>MessageBoxW\u003C\u002Fspan> con dirección de memoria 00424103 y sombreado de amarillo es otro “BAD BOY”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh6.googleusercontent.com\u002Ftl3iMSA3hm_a3axlqD_5kX-2BmEbWQ9eBiGOr6d2twsu4VXzNZrdSc4PZxXlcTn86AIfmcbHmMCOa1UjdEA3myXkD28d00MCU3EzELInc4PAwC1duZUPaDKDUldsrB-Y3tiJ_OiuCMy7IjVvhg\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>Nota: Antes de seguir con el análisis, debemos quitar el \u003Cspan>BreakPoint\u003C\u002Fspan> de la clase \u003Cspan>MessageBoxW\u003C\u002Fspan>, sino estaríamos deteniéndonos en cada momento.\u003C\u002Fp>\r\n\u003Cp>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh3.googleusercontent.com\u002FAzt2rOV8jjzPvddkbhITMdJevGOTpKVFSxIGUX5wGtcoDsxU8mYwGiqpKzs-kKddnBSPbbhGNC2yeMM01RfEc4xoqX22Nxw0cf9hOImm47gaVwC3F41GmnQV--F6XtQHfB77pG0iswvojFRPBA\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>Sigamos con el análisis, hagamos clic en el boton “B”, para poder ver los \u003Cspan>\u003Cstrong>BreakPoints\u003C\u002Fstrong>\u003C\u002Fspan> que se asigno a cada dirección de memoria y poder realizar nuestro análisis.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002FSgidFy2w2SpXQExcHhkYGmefNHoOmczz5Z2-WLnglSErntPQwpF1lbJO6oKhC8PmiGqx63fSWSYJDCAzJ1LlcIrI7KRcdGN0wHTLeVYoIKQ820_U9d9z8ZelBqSKezP2YB4MIAymsSMwjJotWw\" width=\"567\" height=\"140\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>En este caso presionamos “\u003Cstrong>F9\u003C\u002Fstrong>”, intentamos registrarnos y nos detenemos en el primer BreakPoint, si traceamos con “\u003Cstrong>F8\u003C\u002Fstrong>”, para poder analizar.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002FUiHxFSc7mxTKAwPfNIDC7LBtV2k6VqOn_0lC1qQy_wOwWk5eFs1D5f_Y9Q4yXXuCGCyV1sDRwKtw5nkTRxOgLAAPCgzOzSeclOgw65bBEJzxBwuaXoeTr_X-cT198YgsGZC3FZ8Ms-cYjnEaWQ\" width=\"469\" height=\"335\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>Llegamos al primer análisis, en la dirección de memoria \u003Cspan>\u003Cstrong>0042401F\u003C\u002Fstrong>, que es una comparación donde: EAX=0 y EBX=0, si Z=1 entonces salta pero si Z=0 -> No salta y sigue con su proceso de validación, recordar los dos registros EAX y EBX y sus valores.\u003C\u002Fspan> \u003C\u002Fp>\r\n\u003Cp> \u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh6.googleusercontent.com\u002FdoBpanhL25dONfHJT89LG7CiXOANFC6UHkZlJBCmsWU-d--bFOPqywi3Q2ghWGcvLL_SyVorUq-mmbxt-xLAbF9JZbJ4R87j_nvfTw1MI3QoT4hHcS8sn62XNDpq--U_rhcDMeqYdOlKEigJRQ\" width=\"567\" height=\"192\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>Hagamos doble clic en el flag Z y cambia a 0 (cero), y asi no salte al “BAD BOY”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh3.googleusercontent.com\u002FYWzGgsrmjiEqxJETOzVI608k1wmUryLoTlyugEEr2UahonyQA1NFWoo5GJoI4fwfuz_HBxiJw5mcaIlwESEQW2w1pSABMUSebO34mtazV3pUQRNo0ghGvtHRz4EEEwgwmIZwDVR7AmzBjhoUqQ\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>Sigamos traceando con “F8”, llegamos a la direccion de memoria 004240CB donde se encuentra un CMP (comparación), donde: \u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cstrong>EDI=1 y EBX=0, Z=0 ->\u003C\u002Fstrong> No salta y nos muestra “BAD BOY”\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>Pero si :\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cstrong>EDI=1 y EBX=1 -> Z=1 ->\u003C\u002Fstrong> Salta y nos muestra “GOOD BOY”\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>como les comente recodar el registro EBX=0 en la anterior comparación\u003C\u002Fspan>\u003Cspan>.\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002Fk0gi2xQ6BcaxkVblsQVm41oRebFKkC1eJoVbCWdK-yUxCDDOF6MznwmC9vuvtM93lDhJjshrQ7-wpQrhX6VPfN5OtCxjw-hEOyaNUDUofFJrBS1RY7yT-qklBqW13X0WbW-w4O9oGH2VOcB_2Q\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>Sigamos con el análisis luego le explicare el cambio que se debe realizar, si :\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>Activamos el \u003Cspan>Flag Z=1 ->\u003C\u002Fspan> saltaremos al “GOOD BOY”, como muestra la carita feliz, realizara un salto a la dirección de memoria 004241E7.\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002Fg21tKHFOn24fRU2K4JvmixhQuvSrCq1TCbxdBknBTJ6jJagq1OS_TTYhndje2tkiIg4R3m0VtQIDf2461M4DVgEIHWJIPw8qzuOfOj33-7Jq9xXnuaVxXOIuT4JSnEXWDRYqiDBJAVYVGsjd7w\" width=\"567\" height=\"307\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>Si observamos la flecha azul donde sigue el salto con la dirección de memoria 004241E7, y seguimos traceando con “F8”, llegaremos al “GOOD BOY”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FcY4eTBBwIaoxnDxtxwxUO-NQQbY_Pn42II2XzteNspu83YPNgfN9FPy3qWGH-4BwHWugQ0Rzle9gk0jR4qxDhDyV_xOjFJ1Whc3qpkegUBj54zoZLwW6fiAPFTB-Fp_ed37AYPWaND3JPe743w\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>Al final observamos con tracear con “F8”, para poder ver el \u003Cstrong>MessageBoxW\u003C\u002Fstrong> de “GOOD BOY”.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FpEszD9JyRiUESgRaiORJlqvKC5kBLYg2lE9vZ3FS2BXbFJvMC4bqXuSvzpijMqYvI_-1xhA_VooMcjupZ_y9QI_YJhxuvVkxykwInWUGR4s7QTy6ChWVLRLqkuyHu2EZvE-2k4JemH0dzBkH-A\" width=\"567\" height=\"319\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Ch2> \u003C\u002Fh2>\r\n\u003Ch2>PARCHEAR ARDAMAX\u003C\u002Fh2>\r\n\u003Cp> \u003C\u002Fp>\r\n\u003Cp>Lo que debemos hacer es analizar la zona del primer salto, en la dirección de memoria 00424018, modificaremos el código por \u003Cstrong>MOV EBX,01\u003C\u002Fstrong>, quiere decir:\u003C\u002Fp>\r\n\u003Cp>EAX=0 - EBX=1 -> Z=0 -> NO SALTA y sigue analizando.\u003C\u002Fp>\r\n\u003Cp> \u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002FVGsQNc3d5ux1GeJYln1axzvGcI4ceUNbn4PCUnqmA_IRENziVHb8ikNAreOFMgtboZ8L-WcvynrhBOQAvIOIZChpl2Qy1N2Sh1GkXahlKi7luopQ5mWyvEfcqDeKB5RaxxVL4nSeJkUDCvm7LQ\" width=\"566\" height=\"273\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>Vamos a guardar la modificación realizado en la dirección de memoria \u003Cstrong>00424018\u003C\u002Fstrong>.\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh5.googleusercontent.com\u002FH-5bhUMN3zuZtmFQoLvMAyF1VAAwJlJYznYjsK6BeZpv9ql7eLdnJTGwQU7rUGcq3D9JNzyLMl9pojTekj_dNbWiYn9r04gpSneB2i-X9lDHCpwAta5WNlucYumeuUtRLyX3gB8e5N4PGGKYyQ\" width=\"567\" height=\"473\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cspan>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>Luego la observación que se realiza en este caso es que debe cumplir estas reglas para poder registrarlo, tener una cuenta de Usuario (Lo que desee) y la clave, cualquiera que se le ocurra pero debe tener en cuenta estas reglas : ZZZZ-XXXX-YYYY-WWWW, para poder registrar como versión profesional, cada vez que ingreses una clave aleatorio debes tener en cuenta que debe ser alfanumerico y con sus guiones en grupo de 4 dígitos. \u003C\u002Fp>\r\n\u003Cp>Por ejemplo agrege: \u003C\u002Fp>\r\n\u003Cp>\u003Cstrong>Usuario\u003C\u002Fstrong> : lior\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cstrong>Clave\u003C\u002Fstrong> : das2-dad3-ffr4-gtw2\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>\u003Cspan>\u003Cimg src=\"https:\u002F\u002Flh4.googleusercontent.com\u002FRTp6_tLRYPunooixrfvMh78jwRzxgJaHK4dRkAOtmWrPUODb9g0AGfN9UtdDYyb9D66X1qUDJN77Jq35Joaej97oviF3N50tGFrjJKkTitVorcNFGFMfctUbkpAmXlXItjFU8A_EGSKV0OuDpA\" width=\"216\" height=\"210\">\u003Cimg src=\"https:\u002F\u002Flh6.googleusercontent.com\u002FzcJZXH7QVPVqZZuFQIzlDDEd7xfbtNvnVTAmc2xzy2GX-lO_-ZRNp4aBEpkZmnr3J1jpk0aUX7mYHN8na0Ac_O_xYMebUhxb2oWIKTNXFVCgpIWZ0nXzYaK6GhRkbuTyUuius5dH_R8DGE_vnA\" width=\"216\" height=\"148\">\u003C\u002Fspan>\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan>Eso seria todo comunidad, gracias por su paciencia, espero que le guste, el manual, y si tiene critica, los espero.\u003C\u002Fspan>\u003C\u002Fp>\r\n\u003Cp>\u003Cspan> \u003C\u002Fspan>\u003C\u002Fp>","keylogger, reverse engineering",5,[23,35,46],{"slug":24,"title":25,"summary":26,"category":27,"author":28,"image_url":32,"image_thumb_url":32,"published_at":33,"updated_at":34},"inteligencia-de-amenazas-ciberneticas-con-ibm-x-force-exchange","Inteligencia de Amenazas Cibernéticas con IBM X-FORCE EXCHANGE","La inteligencia de amenazas ciberneticas tiene muchas aristas, y se deben utilizar muchas herramientas para tomar un veredicto en relación a una dirección ip o url , que se encuentra generando trafico hasta nuestro sitio web.",{"slug":8,"name":9},{"username":29,"name":30,"avatar_url":31},"user-1543237612","Cristian Jose Acuña  Ramirez","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBaUFQIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--c84d5840f618ed711f6d776d0a8e54daa3f13bbe\u002F6e76f75b-b5b8-49f8-8b6a-73d757ad7c65.jpg","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBdDhPIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--8bae43d6642cf508a945274c83140364f49adc3d\u002Fshutterstock_1712503435.jpg","2020-09-04T11:38:43-04:00","2026-10-26T19:14:12-03:00",{"slug":36,"title":37,"summary":38,"category":39,"author":40,"image_url":43,"image_thumb_url":43,"published_at":44,"updated_at":45},"simple-reverse-icmp-shell","Simple reverse ICMP Shell","Planteando el escenario para ejecutar nuestra revershell, tenemos un equipo al que ya tenemos acceso con un usuario que nos permitirá la ejecución del Reverse shell ICMP en powershell.",{"slug":8,"name":9},{"username":41,"name":42,"avatar_url":14},"elzerpineda","Elzer Pineda","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBdlFPIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--f839aa72cf39bd28065fd4b33680a238fc0ee42a\u002Fshutterstock_1382645309.jpg","2020-07-20T13:14:51-04:00","2026-10-26T12:22:02-03:00",{"slug":47,"title":48,"summary":49,"category":50,"author":51,"image_url":55,"image_thumb_url":55,"published_at":56,"updated_at":57},"4chan-y-nido-org-conoce-que-es-un-imageboard-o-tablon-de-imagenes","4chan y nido.org - Conoce todo sobre los Imageboard o tablón de imágenes.","La historia de los foros o tablón de imágenes (También conocidos en inglés como imageboard) data de 1999, cuando se creó el imageboard anónimo 2channel (2ch), este es un popular foro de imágenes creado en Japón con el objetivo de discutir sobre cómics japoneses y animé.",{"slug":8,"name":9},{"username":52,"name":53,"avatar_url":54},"pmcguirec","Paola Mc Guire Cancino","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBbHNTIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--2bf31b5bf5b3e51e57bd3d83fc5b3c84e336e11d\u002FIMG_4294-3.jpg","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBckFPIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--5da25444100f4afc83fe2109fbecaa01d27cc8b0\u002FPost192_NN1.png","2019-02-26T21:57:26-03:00","2026-10-26T10:39:47-03:00",{"levels":59,"specialties":72,"categories":88,"instructors":122,"article_categories":160,"article_authors":189,"discussion_categories":302},[60,64,68],{"slug":61,"name":62,"courses_count":63},"basicos","Basicos",15,{"slug":65,"name":66,"courses_count":67},"intermedios","Intermedios",28,{"slug":69,"name":70,"courses_count":71},"avanzados","Avanzados",16,[73,76,80,84],{"slug":74,"name":75,"courses_count":21},"enterprise-pentesting-training-ept","Penetration Testing Student",{"slug":77,"name":78,"courses_count":79},"penetration-testing-and-ethical-hacking-pthh","Penetration Testing Professional",7,{"slug":81,"name":82,"courses_count":83},"web-application-testing-wat","Web Application Testing",12,{"slug":85,"name":86,"courses_count":87},"information-security-training-ist","Information Security Analyst",6,[89,93,96,100,103,106,109,113,116,119],{"slug":90,"name":91,"courses_count":92},"administracion-de-servidores","Administración de Servidores",1,{"slug":94,"name":95,"courses_count":92},"vulnerability-analysis","Análisis de Vulnerabilidades",{"slug":97,"name":98,"courses_count":99},"auditoria-de-redes","Auditoría de Redes Informáticas",4,{"slug":101,"name":102,"courses_count":87},"auditorias-wireless","Auditorías Wireless",{"slug":104,"name":105,"courses_count":21},"forense","Forense ",{"slug":107,"name":108,"courses_count":83},"pentesting","Pentesting ",{"slug":110,"name":111,"courses_count":112},"pentesting-mobile","Pentesting a Aplicaciones Móviles",2,{"slug":114,"name":115,"courses_count":83},"auditoria-aplicaciones-web","Pentesting a Aplicaciones Web",{"slug":117,"name":118,"courses_count":99},"programacion","Programación",{"slug":120,"name":121,"courses_count":83},"seguridad-informacion","Seguridad de la información",[123,127,131,134,137,140,143,145,148,151,154,157],{"username":124,"name":125,"courses_count":126},"misaelban","Misael Banales",21,{"username":128,"name":129,"courses_count":130},"Sheyla_Leacock","Sheyla Leacock",8,{"username":132,"name":133,"courses_count":79},"Rodolfo","Rodolfo Cecena",{"username":135,"name":136,"courses_count":87},"ggomez","Gianncarlo Gómez",{"username":138,"name":139,"courses_count":21},"yulytas","Julita Inca",{"username":141,"name":142,"courses_count":99},"pacopadilcyber","Juan Francisco Padilla Suaste",{"username":29,"name":30,"courses_count":144},3,{"username":146,"name":147,"courses_count":92},"user-22500","Ignacio Benedini",{"username":149,"name":150,"courses_count":92},"magdielgutierrez","Magdiel Gutierrez",{"username":152,"name":153,"courses_count":92},"Mroodriguezb","Mario Rodriguez Barraza",{"username":155,"name":156,"courses_count":92},"coldd","Martin Frias",{"username":158,"name":159,"courses_count":92},"Omar_veliz","Omar Jacobo Muñoz Veliz",[161,162,164,168,170,171,174,175,177,179,180,182,184,187],{"slug":90,"name":91,"articles_count":83},{"slug":94,"name":95,"articles_count":163},9,{"slug":165,"name":166,"articles_count":167},"wireless-attacks","Ataque al Protocolo Wireless",11,{"slug":97,"name":98,"articles_count":169},13,{"slug":101,"name":102,"articles_count":144},{"slug":172,"name":173,"articles_count":112},"exploitation-tools","Explotación de Vulnerabilidades",{"slug":104,"name":105,"articles_count":163},{"slug":8,"name":9,"articles_count":176},26,{"slug":107,"name":108,"articles_count":178},99,{"slug":110,"name":111,"articles_count":163},{"slug":114,"name":115,"articles_count":181},33,{"slug":117,"name":118,"articles_count":183},27,{"slug":185,"name":186,"articles_count":167},"information-gathering","Recolección de Información",{"slug":120,"name":121,"articles_count":188},18,[190,193,196,201,202,207,211,212,216,217,219,223,227,228,232,235,236,239,243,247,251,255,257,261,264,268,272,276,279,281,285,288,291,294,298],{"username":158,"name":159,"avatar_url":191,"articles_count":192},"https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBdmdGIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--de6eb458d07377fb9d25e6ed92e1917f274c8cdb\u002Fprofile.jpg",70,{"username":124,"name":125,"avatar_url":194,"articles_count":195},"https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBam9HIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--fcb46747ff2b0df3099425d0012f4da090b1db67\u002FIMG_2344.PNG",32,{"username":197,"name":198,"avatar_url":199,"articles_count":200},"saamux","Samuel Esteban","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBbDRJIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--6e60a39152819c1c857e0a1e157e99a5fe76ddf9\u002Fperfil.png",30,{"username":11,"name":12,"avatar_url":13,"articles_count":176},{"username":203,"name":204,"avatar_url":205,"articles_count":206},"Felipe","Felipe Barrios","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBalVGIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--75c29db071130db1bdbb64cb6ed6b4b0767c7178\u002F12063705_10207273024561428_59106377850244238_n.jpg",17,{"username":208,"name":209,"avatar_url":210,"articles_count":71},"user-1582119990","José Moreno","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBczhMIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--695dbd13093235a9632272a6a98b0c9ef21a0319\u002FJoseMoreno-300x180.jpg",{"username":29,"name":30,"avatar_url":31,"articles_count":167},{"username":213,"name":214,"avatar_url":215,"articles_count":167},"__script1an__","Cristian Palma P","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBc1lKIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--f168fca2e13ca6bb4a0629e2e6a46fc45622c54b\u002FLOGO-URI-SPIONI-MH-1.png",{"username":155,"name":156,"avatar_url":14,"articles_count":79},{"username":128,"name":129,"avatar_url":218,"articles_count":87},"https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBb29TIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--33711e0178d99dfd591d736d16027b251892ab2e\u002F20210721_132408(2).jpg",{"username":220,"name":221,"avatar_url":222,"articles_count":21},"JediCanosa","Alejandro Canosa Ferreiro","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBclVKIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--9b0815c79e7690293117c5cf747d0d9889fd678e\u002F252860.jpg",{"username":224,"name":225,"avatar_url":226,"articles_count":21},"CrisMc","Cristian Mc Guire","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBbThLIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--ecd57b96e2e835d362d2d416b40f531b9752ffbe\u002FIMG-20171010-WA0000.jpg",{"username":41,"name":42,"avatar_url":14,"articles_count":21},{"username":229,"name":230,"avatar_url":231,"articles_count":144},"Funpunch","Andres Galeano","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBbThGIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--e169c1f44d47457dda7935fcd906ce67cf324bbe\u002Ffoto.jpg",{"username":233,"name":233,"avatar_url":234,"articles_count":144},"Pablo Olivares","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBdTRHIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--256f815e15650ad7609a7264df2d0c69742d870c\u002Fmetasploit.png",{"username":52,"name":53,"avatar_url":54,"articles_count":144},{"username":237,"name":238,"avatar_url":14,"articles_count":112},"D4RK0P","Alejandro Rivera",{"username":240,"name":241,"avatar_url":242,"articles_count":112},"user-1529427208","Arturo Ocampo","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBZzBMIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--5c0000472cdff7e7771f11070fa1e865142cc9a9\u002F8c9610617-codsalestease.nbcnews-ux-2880-1000.jpg",{"username":244,"name":245,"avatar_url":246,"articles_count":112},"CannibaL","Cannibal .","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBZ2NMIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--ae676f2a7e452c690824c196a556de0fd878d091\u002FGatoRison.jpg",{"username":248,"name":249,"avatar_url":250,"articles_count":112},"Erik172","Erik Garcia","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBc1lSIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--e703ff6245d2a783835ef18906375a5246ad1b84\u002Fgorickyourself.png",{"username":252,"name":253,"avatar_url":254,"articles_count":112},"damch","Javier Candia","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBam9KIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--036416498d87c59fa3f0ac1f5e0a08336b65faf5\u002Fdescarga.png",{"username":152,"name":153,"avatar_url":256,"articles_count":112},"https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBb1FSIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--d5c1cf9e6152977482e3d8a919cee58dc745a65c\u002Fimage_6483441.JPG",{"username":258,"name":259,"avatar_url":260,"articles_count":112},"user-1522264539","Sebastian Veliz","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBdW9LIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--8b572ca805a6e429859050c0eb0f9270a06aad7f\u002F28428972_394770877650233_1145374104606474240_n.jpg",{"username":262,"name":262,"avatar_url":263,"articles_count":112},"user-1609041409","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBaklNIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--536c91898c7c42c0a3008d37ec317309cb9805cc\u002F9178eae767eec8ff5750bd9a1cfdfe3b.png",{"username":265,"name":266,"avatar_url":267,"articles_count":92},"819215531446900","Alvaro Alexander Palacios Carrillo","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBaE1MIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--bd76f66adfaf8c1175ba43bb480eae08d23db24e\u002Ffoto.jpg",{"username":269,"name":270,"avatar_url":271,"articles_count":92},"gbrayhan","Brayhan Alejandro Gabriel Guerrero","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBamtKIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--e0e7cb50ebcfa80db9c0882df1e3f476c487a572\u002FalexPerfil.jpg",{"username":273,"name":274,"avatar_url":275,"articles_count":92},"els","Estevenson Luis Solano","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBbFlMIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--ac9a04550c2d3b3de33177e3dedd6116ff7bd898\u002Fdownload12.png",{"username":277,"name":278,"avatar_url":14,"articles_count":92},"user-1570553853","Flavio Esteban Canales Salvo",{"username":135,"name":136,"avatar_url":280,"articles_count":92},"https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBaW9IIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--a8a4afb1bc1cbf26867aa952a95ccfa68dd4b198\u002FImagen_1.png",{"username":282,"name":283,"avatar_url":284,"articles_count":92},"uservzk80","Israel Pérez","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBbmdJIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--f26a75b81bb7939355f4181925e7886394bfa1ea\u002FPwtZlZxn.jpg",{"username":286,"name":287,"avatar_url":14,"articles_count":92},"jongo","Jonathan González",{"username":289,"name":290,"avatar_url":14,"articles_count":92},"K1!!","José Guzmán",{"username":292,"name":293,"avatar_url":14,"articles_count":92},"garciaguirre","Moises Garciaguirre",{"username":295,"name":296,"avatar_url":297,"articles_count":92},"user-1571024443","Romario Miranda Paternina","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBcXdMIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--beccfc05028736f1068a40f35597ead611aef1f0\u002FIMG_20190910_145049285-01.jpeg",{"username":299,"name":300,"avatar_url":301,"articles_count":92},"shadebax","SHADE BAX","https:\u002F\u002Fapi.backtrackacademy.com\u002Frails\u002Factive_storage\u002Fblobs\u002Fredirect\u002FeyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBamtMIiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--f59427b74236cfeb0c9c9f4b4d81bb898ce435a4\u002FHacker-icon.png",[303,304,305,306,308,310,311,312,313,315,316,318,320,321],{"slug":90,"name":91,"discussions_count":71},{"slug":94,"name":95,"discussions_count":167},{"slug":165,"name":166,"discussions_count":21},{"slug":97,"name":98,"discussions_count":307},25,{"slug":101,"name":102,"discussions_count":309},20,{"slug":172,"name":173,"discussions_count":71},{"slug":104,"name":105,"discussions_count":21},{"slug":8,"name":9,"discussions_count":144},{"slug":107,"name":108,"discussions_count":314},121,{"slug":110,"name":111,"discussions_count":188},{"slug":114,"name":115,"discussions_count":317},67,{"slug":117,"name":118,"discussions_count":319},40,{"slug":185,"name":186,"discussions_count":63},{"slug":120,"name":121,"discussions_count":322},55]