How To Detect KV Stealers In RTE Tools

In this video I show you how to check RTE tools for KV stealers and how to get your own back on them. ;)

Download Links:

Wireshark: https://www.wireshark.org/download.html

Hex Editor Neo: http://www.hhdsoftware.com/Downloads/free-hex-editor

---

Closed Caption:

what is the glasses has more for your
gamertag bondage and welcome back to
another jtag video another tutorial here
so in this video I'm going to be showing
you guys how to tell if a key party tool
has a kv stealer in it so you don't know
what a kv stealer is basically take your
cue ball right off your hard drive when
you connect the tool to your console it
takes it off your console princess
somewhere on your pc and then upload it
to a server where other people can
access it and just use it and then it
becomes shared and gets banned within
minutes or hours and yeah it really
really really rapidly decreases the life
of your key vault so yeah I'm loss of
lots and lots of coders are doing this
they released free tools some a lot of
the tools work perfectly
the way they should they all the most of
the tools say they're going to have they
do actually have and they do actually
work but it also upload to give all at
the same time so it's pretty sneaky and
in this video i'm going to be showing
you guys are pretty pretty decent method
of detecting kv stealer I'm inside a
tool and how to also maybe get your own
back on the people trying to steal the
key bolts from you
so basically what we're using here is a
hex editor and a network protocol
analyzer it doesn't have to be these two
you know instead of hex editor near you
can use hxd or whatever other header you
have but hex editor Neil is a very good
one for this purpose we are using it for
wireshark is just a network protocol
analyzer pretty good one as well that's
free so popular people for these in the
description but you can use any other
one that you have instead and then I
have a tool that has a kv stealer in it
right here actually two tools i have kv
Steelers in them so first of all to
detect whether key vault to whether
there's a kv stealer and a tool what we
want to do is create a fake key vault as
a test
because if you use a real key vote then
even if you do find that it does have a
kv stealer in it's already too late by
that time in the key box already
uploaded now this RT tool is really
really obvious i mean you run it if it
connects to the console you can see that
you actually puts the key vault in the
same folder as the application which is
really really dumb and obvious that it's
a kv stealer but for other tools they
may not be quite that easy to find
because it'll put its will put the key
vault somewhere else on your computer
and it's only on your computer for a few
seconds and then it deletes it once it's
been uploaded to the server so yeah they
might put in a different location on
your computer so you won't have time to
find it before it gets deleted so it's
not always super obvious that there's a
kv stealer in a tool but with this one
it is but this is kind of the only
example I could get hold off at the time
so first of all what we're going to do
is we're going to go ahead and open up
hex editor Neil and create a fake
keepvault really easy just create a new
hex editor document fill the first line
full of zeros and the hex values that is
not the text string and then you want to
click edit and change file size it will
be called something like change bites or
modified bites or something like that
inside each XD i like heck said attorney
or because you can select you know
kilobytes megabytes gigabytes or bytes
so you know I a key vault is 16
kilobytes so if you select kilobytes and
you just type it 16 and click ok and it
will just fill everything with zeros all
null values and you can just save it
save it to your desktop as K V dot then
once it's saved you can close out of hex
editor Neil and you've got kv on your
desktop now at 16 kilobytes and have
been file and it looks just like a key
vault normally would but of course if
you open it then it's literally just all
zeros so
that doesn't really matter though a kv
stealer is not going to be looking
through all the information all its
gonna do is look for the file name and
make sure it will just check for a kv
dot been and it will try and upload it
which is another good reason why you
should probably flash your keep up to
your hand as well but with this method
that kind of means you don't really have
to take that extra precaution so what
we're going to do here is we're going to
open up xbox 360 neighborhood and
transfer this fate keepvault onto our
hard drive
obviously you're not gonna be able to be
on xbox live when you're using this
because it's completely fake unless you
have your key your actual unbanned
keyboard flashed your hand and then you
just stick that one fake one on the hard
drive but again style services will
probably look for the one on the hard
drive and try to use that one so but
just for the purposes of checking 2c of
a tool as an art as a Navy Seal and it
is well worth doing this
alright so next we want to open up our
network protocol analyzers we open up
wireshark here you want to select
whichever adapter is providing the
computer with internet make sure that
the computer obviously that you're
you're running the network protocol
analyzer on is the same as is the same
computer you're running the RTE to lon
as well course
ok so my computer is connected through
wireless it's using the wireless network
connection three adapters have got
wireless adapter on my computer that
connects me to the Richer rotor if
you're connected through wired with an
ethernet cable to your route or writer
than it would be local area connection
that you would select so i'll select
wireless network connection three and
before actually not start capture and
then inside the filter you want to type
in ftp and select ftp and click apply
what that's going to do is it's going to
only check for only only going to shore
packets that are using the FTP protocol
the file
transfer protocol so it should be blank
unless of course you're using filezilla
ticket to transfer files over from your
your pc to your computer your pc to your
xbox
so first of all let's go ahead and try a
tool that does not have a kv stealer and
that's so you can see what happens
so I'm going to use apparition as an
example obviously doesn't have a kv
stealer in it and we're going to run
this and we're going to see what happens
in here so after that requires connected
to the console yep connected to the
console nothing absolutely nothing for
file transfer protocol are still waiting
yep there we go average net has opened
and there's nothing we can go ahead
launch the console manager fetch console
data fetches the data from the consorts
was actively connected to the console
and nothing showing up in wireshark so
that's how you can tell you know if that
happens that
yep there's not more candy stealer in
the tool so let's go ahead and try the
tool that does have a kv stealer in it
now open up this going to run it and
watch what happens when i connect
connect it to the console whole now look
at that loads and loads of FTP protocol
showed up there when I connected
let's try this one as well now nothing
to the tool is designed not even to work
at all is literally only purpose is to
steal the key ball and you can see right
here what it's done you can see loads of
ftp showing up so you know that is
definitely trying to take something from
your console and upload it you can see
here this is the destination so you can
see it's taken it to public underscore
HTML or class /a and then so that's the
destination on the server where it's
trying to store the key vault and it's
renamed it as a dot been so it's
obviously the key vote is taken but it's
renamed itself caveat Bennett's tried to
make it look more the Jedi suppose by
using my pc name plus the dates plus
user login dot been based the keepvault
obviously but the simple fact is if if
the two was legit and didn't have a kv
stealer and there would be no protocol
for ftp in here and there is a lot but
here's the thing here's how we can kind
of get our own back on the people trust
your key vaults with this method you can
see ftps so unsecured you've got user so
it gives you the username
it also gives you the password of the
server so you got the username and the
password to his server
plus you have the destination the IP
address of the server that it's trying
to upload the keepvault to with those
three pieces of information you can
literally go on an access the server you
can you can login to the server and you
can delete all the cables that are in
there you can upload large files and try
and use up their day a limit and just
try and screw the server / as much as
you can and they totally deserve it for
trying to steal your key vaults anyway
so if you don't have an ftp client then
you can go ahead and go on google chrome
google chrome let you use ftp but if you
have filezilla use files look at that is
bear type in ftp semicolon double slash
and then the IP address which is you
know 31.1 70.1 62 points63 then another
semicolon and type in the port now you
need to know what the poor is normally
it's going to be 21
that's the normal port will be 21 for
ftp but it could be something different
so just check with wireshark down here
where it says transmission control
protocol tell you the ports are being
used and you can see the destination
port is 21 which is fine so we know
thats using port 21 but sometimes it may
be using a different port but most of
the time it would be using 21 because
they know that that would be unblocked
on your firewall by default normally
so we'll go ahead and click enter see
what we got here
so says authentication is required so we
can see that is definitely a ftp server
and you can enter the username that's up
there and you can enter the password
Snoopy 13 and click login and obviously
more ftp packets are going to show up
now i'm accessing this but um yeah we've
got access to the server work on their
server and you can't really do much on
google chrome in terms of ftp you can I
think you can delete the files so i have
if there's any cavies in there you can
delete them but file transfer protocol
if you use filezilla for it then you can
upload other files and stuff to the
server and try and use up your data
limit and just try and screw them over
as you can see it's not successfully
uploaded the kv maybe some but maybe it
did and somebody's already taken it and
deleted it but yeah that's where would
have stored the key vault but that is it
guys it's actually a really cool method
of detecting kv steelers and it's a
pretty pretty decent method actually so
you can do that with pretty much any r/t
tool there may be other ways of stealing
key vaults other than using ftp in which
case this probably wouldn't work but
most of them if not like ninety percent
of them at least use this method to
upload your key vaults to their server
these fight these ftp and now you can
totally screw them over by finding out
their username and password and their
destination further ftp server so anyway
guys that is it thank you very much for
watching go ahead and leave a like if
you liked the video i found the
information useful comment if you have
any questions subscribe if you haven't
subscribed already and i'll see you guys
next time