Owned=(if you dont know this expression, then you shouldnt read this article)
Introduction
~~~~~~~~~~~~
I wanted to write this article so you guys out there, who think BO is safe, will be more secure. There has been an uprise in the number of anti-bo applications, which capture your IP, time, date and what command you send. BO of course stands for Back Orifice, and was created by the Cult of the Dead Cow (cDc). It can be downloaded from http://www.cultdeadcow.com
Back Orifice can do many things, such as: Editing Registry entries; Rebooting; Getting cached password; looking through your webcam; keylogging; erasing/creating/viewing folders and files; Killing/Spawning/Viewing Applications; and jumping through the network. The possibilities are almost endless. According to Wired, 79% of Australian ISP's are 'infected'. However, as it was before, it aint secure anymore. IP logging is now available through NOBO, BOSPY (http://www.angelfire.com/id/chaplin), BO Detector and other utilities available (such as BO freeze which freezes the person trying to scan you for BO) all over the internet. For more information on the commands, then read bo.txt, which follows the installation of Back Orifice. Well, lets get on.
To install BO Server on a victim's computer
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-=> On a mac
Run RealPC, SoftPC or SoftWindows, then follow the PC steps. Alternatively, you could use deadly_muffin's port of the Back Orifice command-line client. I do not recommend this step unless you know what you are doing.
-=> On a PC
If you're in Windows, run ms-dos prompt and follow the steps. If you're in dos, just follow the steps:
Open up boconfig this way: C:\<dir\boconfig.exe boserve.exe then you'll get some questions...
1. Runtime executable name (what should the installer name the trojan)
2. Exe description in registry (this could be a clue, like a hacker name, must not be null!)
3. Server port (wich port should the server listen on. The default is 31337)
4. Encryption PW (the password needed to enter the server. The default is null)
5. Default Plugin Start (this can be a command to pass a plugin. The default is null)
6. File to attach (This can be anything, it will start at boot. The default is null)
Note - If you set the port to a non-default value, then nobo (an anti-bo app) won't work, because nobo listen to port 31337.
To reduce the chance of getting cought
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On a Mac, WeeDo's Wingate Power Router (http://weedo.blackout.org/) should do the job. Put in a port in the port selection and if you connect out of that port it uses the wingate you specified.
On a Windows/Dos machine, you can use a number of DLL's which add support for the SOCKS firewall feature onto WinSock stacks:
o SocksCap from NEC (http://socks.nec.com/)
o AutoSOCKS from Aventail
o Hummingbird's SOCKS Client from Hummingbird
Then, you need to get a firewall. Use Porter.exe (PC) or a similar Port Scanner (such as AGNetTools) for MAC. All theese utilties can be downloaded at the Happle hotline server.
Useful procedure
~~~~~~~~~~~~~~~~
If you dont have a 'victim', MASS PING (which I will go into in more detail later.)
If you have a 'victim', get his ip, via ICQ, HOTLINE or by social enginering. Ping him, to make sure you got him, then use the 'Process List' commands. This is good so you know what he's doing, like, if he's running starcraft then you got time. If he's at the homepage of 'REPORTING IT CRIMINALS', then watch out. If he's running anti virus, or any security watchdog, then kill it. This is done by copying the number right of the application, and then paste it into the 'Process ID' box, and press enter. Voila, 'Process terminated' should appear. Then use the command 'List Password', to get cached passwords, and his screen saver password. Remember that junk text can appear after the password, ignore this. After this, you could use 'HTTP ENABLE', enter C:\WINDOWS in the root, and 31337 in the port, and then goto your internet-browser and enter Http://<ip>:31337 and then upload patch.exe, which is a netbus server (get this from Happle,) then close the browser, open bo again, process spawn, and enter the directory: c:\windows\patch.exe in the directory box. Then you can use the Netbus client to fuck around (together with the server, get it at HappleHL.) From here you can open his cd rom drive, disable certain keys, use your imagination!
Mass Pinging IP's
~~~~~~~~~~~~~~~~~
Make a normal text file in your root, and call it ip.txt, then put in subnets. A subnet is for example 194.255.248.89 without the numbers after the last dot, so a subnet would be 194.255.248. Here i removed the 89, becouse that is the last, get it? Then it searches the whole of 195.255.248.* for possible BO serverz at port 31337.
I hope this quick-compiled walkthrough can help! There might be many spelling errors, but i'm too lazy to check them ;P
