Magazyn Amiga 14

home *** CD-ROM | disk | FTP | other *** search

/ Magazyn Amiga 14 / MA_Cover_14.iso / internet / muibov1.0 / readme < prev next >

Wrap

Text File | 1998-11-01 | 14.8 KB | 369 lines

Cult of the Dead Cow Communications presents Back Orifice Remote Administration System v1.20 7-30 Initial Release Back Orifice is a client/server application which allows the client software to monitor, administer, and perform other network and multimedia actions on the machine running the server. To communicate with the server, either the text based or gui client can be run on any Microsoft Windows machine. The server currently only runs in Windows 95/98. This package contains: bo.txt This document. plugin.txt The plugin programming documentation. boserve.exe The Back Orifice self installing server. bogui.exe The Back Orifice gui client. boclient.exe The Back Orifice text client. boconfig.exe Utility to configure exename, port, password, and default plugin for a BO server melt.exe Decompresses files compressed with the File freeze command. freeze.exe Compresses files that can be decompressed with the File melt command. To install the server the server simply needs to be executed. When the server executable is run, it installs itself and then deletes itself. This is useful for network enviroments where the server can be installed on a machine simply by copying the server executable into the Startup directory, where it will be installed, then removed. Once the server is installed on a machine, it will be started every time the machine boots. To upgrade a running copy of Back Orifice remotely, simply upload the new version of the server to the remote host, and use the Process spawn command to execute it. When run, the server will automatically kill any programs running as the file it intends to install itself as, install itself over the old version, run itself from its installed position, and delete the updated exe you just ran. Before installation, several aspects of the server can be configured. The filename that Back Orifice installs itself as, the port the server listens on, and the password used for encryption can all be configured using the boconf.exe utility. If the server is not configured, it defaults to listening on port 31337, using no password for encryption (packets are still encrypted), and installing itself as " .exe" (space dot exe). The client communicates to the server via encrypted UDP packets. For successful communication, the client needs to send to the same port the server is listening on, and the client password must match the encryption password server was configured with. The port the client sends its packets from can be set using the -p option with both the gui and text clients. If packets are being filtered or a firewall is in place, it may be necessary to send from a specific port that will not be filtered or blocked. Since UDP communication is connectionless, the packets might be blocked either on their way to the server or the return packets might be blocked on their way back to the client. Actions are performed on the server by sending commands from the client to a specific ip address. If the server machine is not on a static address, it can be located by using the sweep or sweeplist commands from the text client, or from the gui client using the "Ping..." dialog or by putting a target ip of "1.2.3.*". If sweeping a list of subnets, when a server machine responds the client will look in the same directory as subnet list and will display the first line of the first file it finds with the filename of the subnet. The commands currently implemented in Back Orifice are listed below. Some of the command names differ between the gui and text clients, but the syntax is the same for almost all commands. More information for any of the commands can be displayed in the text client by typing 'help command'. The gui sets the label of the two paramater fields to a description of the arguments each command accepts when that command is selected from the 'Command' list. If a piece of required information was not supplied with the command, the error 'Missing data' will be returned by the server. The Back Orifice commands are: (gui/text command) App add/appadd Spawn a text based application on a tcp port. This allows you control a text or dos application (such as command.com) via a telnet session. App del/appdel Stops an application from listening for connections. Apps list/applist Lists the applications currently listening for connections. Directory create/md Creates a directory Directory list/dir Lists files and directory. You must specify a wildcard if you want more than one file to be listed. Directory remove/rd Removes a directory Export add/shareadd Creates an export on the server. The exported directory or drive's icon does not get overlaid with the shared hand icon. Export delete/sharedel Deletes an export. Exports list/sharelist Lists current share names, the drive or directory that is being shared, the access for that share, and the password for the share. File copy/copy Copys a file. File delete/del Deletes a file. File find/find Searches a directory tree for files that match a wildcard specification. File freeze/freeze Compresses a file. File melt/melt Decompresses a file. File view/view Views the contents of a text file. HTTP Disable/httpoff Disables the http server. HTTP Enable/httpon Enables the http server. Keylog begin/keylog Logs keystrokes on the server machine to a text file. The log shows you the name of the window the text was typed into. Keylog end Ends keyboard logging. To end keyboard logging from the text client, use 'keylog stop'. MM Capture avi/capavi Captures video and audio (if available) from a video input device to an avi file. MM Capture frame/capframe Captures a frame of video from a video input device to a bitmap file. MM Capture screen/capscreen Captures an image of the server machine's screen to a bitmap file. MM List capture devices/listcaps Lists video input devices. MM Play sound/sound Plays a wav file on the server machine. Net connections/netlist Lists current incomming and outgoing network connections. Net delete/netdisconnect Disconnects the server machine from a network resource. Net use/netconnect Connects the server machine to a network resource. Net view/netview Views all network interfaces, domains, servers, and exports visable from the server machine. Ping host/ping Pings the host machine. Returns the machine name and the BO version number. Plugin execute/pluginexec Executes a Back Orifice plugin. Executing functions that do not conform to the Back Orifice plugin interface may cause the server to crash. Plugin kill/pluginkill Tells a specific plugin to shut down. Plugins list/pluginlist Lists active plugins or the return value of a plugin that has exited. Process kill/prockill Terminates a process. Process list/proclist Lists running processes. Process spawn/procspawn Runs a program. From the gui, if the second paramater is specified, the process will be executed as a normal, visable process. Otherwise it will be executed hidden or detached. Redir add/rediradd Redirects incomming tcp connections or udp packets to another ip address. Redir del/redirdel Stops a port redirection. Redir list/redirlist Lists active port redirections. Reg create key/regmakekey Creates a key in the registry. NOTE: For all registry commands, do not specify the leading \\ for registry values. Reg delete key/regdelkey Deletes a key from the registy. Reg delete value/regdelval Deletes a value from the registy. Reg list keys/reglistkeys Lists the sub keys of a registry key. Reg list values/reglistvals Lists the values of a registry key. Reg set value/regsetval Sets a value for a registry key. The values are specified as a type followed by a comma, then the value data. For binary values (type B) the value is a series of two digit hex values. For DWORD values (type D) the value is a decimal number. For string values (type S) the value is a text string. Resolve host/resolve Resolves the ip address of a machine name relative to the server machine. The machine name can be an internet host name, or a local network machine name. System dialogbox/dialog Creates a dialog box on the server machine with the supplied text and an 'ok' button. You can create as many dialog boxes as you want, they will just cascade in front of the previous box. System info/info Displays system information for the server machine. Information displayed includes machine name, current user, cpu type, total and available memory, Windows version information, and drive information, including drive type (Fixed, cd-rom, removable, or remote) and for fixed drives, the size and free space of the drive. System lockup/lockup Locks up the server machine. System passwords/passes Displays cached passwords for the current user and the screen saver password. Displayed passwords may have garbage data at their end. System reboot/reboot Shuts down the server machine and reboots it. TCP file receive/tcprecv Connects the server machine to a specific ip and port and saves any data recieved from that connection to the specified file. TCP file send/tcpsend Connects the server machine to a specific ip and port and sends the contents of the specified file, then disconnects. NOTE: For tcp file transfers, the specified ip and port must be listening before the tcp file command is sent or it will fail. A useful utility for transfering files this way is netcat, which is available for both unix and win32. Files can be transfered _from_ the server using the tcp file send command and netcat with a syntax like: netcat -l -p 666 > file Files can be transfered _to_ the server using the tcp file receive command and netcat with a syntax like: netcat -l -p 666 < file NOTE: The win32 version of netcat does not disconnect or exit when it reaches the end of the input file. After the contents of the file have been transfered, terminate netcat with ctrl-c or ctrl-break. BOConfig: BOConfig.exe allows you to configure the options for a bo server before it has been installed. It asks you for the executable name, which is the name that Back Orifice will install itself as in in the system directory. It does not have to end in .exe, but it will not append .exe if you do not suply a file extension. It then asks for the exe description, which is the description that will describe the exe in the registry where it gets started from durring boot. It then asks for the port which the server will listen for packets on. It then asks for a password which it will use for encryption. To communicate with the server from a client, the client must be configured with this same password. This can be null. It then asks for the default plugin to run on startup. This is a DLL and function name in the form "DLL:_Function" of a Back Orifice plugin which will automatically be run when the server starts. This can be null. It then lets you enter any arguments that you want to pass to the plugin at startup. This also can be null. And finally, it asks for the path to a file which can be attached to the server, which will be written in the system directory as the server starts. This could be a Back Orifice plugin which is automatically started. The server will work without being configured. It defaults to communicating on port 31337 with no password and installing itself as " .exe". Known bugs/problems: MM Capture screen - The bitmap is saved in whatever resolution and pixel depth the server machine is running in. As a result, bitmaps may be produced with color depths of 16 bit or 24 bit. Most graphics applications can only deal with 8 or 32 bit bitmaps and will either be unable to load the bitmap or display it incorrectly (this includes Graphics Workshop for Windows, Photoshop, and the WANG Imaging distributed with Windows. There is, however, a program that comes with Windows will view it. Paint.exe. Go figure. Keyboard logging - Apparently ms-dos windows don't have a message loop, which prevents the ability to log keys that are typed into them. Text based application tcp redirection (App add) - Several bugs. When command.com is spawned with it's handles redirected, the system also spawns REDIR32.EXE, which it does not apear possible to terminate. (This seems os interface that communicates with a tsr module loaded in the dos session to redirect the input and output handles to pipes) So if you terminate the tcp connection before the application has terminate (or you have 'exit'ed it), REDIR32.EXE and WINOA386.MOD (the 'old application' (16 bit) wrapper) will remain running, and neither Back Orifice nor the operating system itself will be able to terminate them. This even prevents the system from being able to shut down, it just sits at the 'Please wait...' screen forever. There also seems to be problems redirecting the output from some console applications (such as FTP.EXE, and unfortunately currently boclient.exe). Altho output from the program is not relayed out, input may still be relayed in, so you can often quit the program through the tcp session. Otherwise use Back Orifice to kill the executable. Send questions, comments, bitches and bugs to bo@cultdeadcow.com. .-. _ _ .-. / \ .-. ((___)) .-. / \ /.ooM \ / \ .-. [ x x ] .-. / \ /.ooM \ -/-------\-------/-----\-----/---\--\ /--/---\-----/-----\-------/-------\- /lucky 13\ / \ / `-(' ')-' \ / \ /lucky 13\ \ / `-' (U) `-' \ / `-' the original e-zine `-' _ Oooo eastside westside / ) __ /)(\ ( \ WORLDWIDE / ( / \ \__/ ) / Copyright (c) 1998 cDc communications and the author. \ ) \)(/ (_/ CULT OF THE DEAD COW is a registered trademark of oooO cDc communications, PO Box 53011, Lubbock, TX, 79453, USA. _ oooO All rights reserved. __ ( \ / ) /)(\ / \ ) \ \ ( \__/ Save yourself! Go outside! Do something! \)(/ ( / \_) xXx BOW to the COW xXx Oooo http://www.cultdeadcow.com Microsoft, Windows, Windows 95, Windows 98, and Windows NT are all registered trademarks of the Microsoft Corporation.