hi all

jus dwnloded sub7 an totaly 4got wich is the file u use to control the victims ip lol!

so i opend servr an got some weird eror bout my haddrive or sumit. is 'client' the thing u send to ur victim coz its got the sub7 logo an all. so i didnt clik it lol

help me out?

--

I'M JOKING WITH YOU. I REALLY AM.

So anyway. As per usual, erm...Mr. SWIM is messing around with Optix pro.

After countless miutes (about 3) of scanning IRC channels for random infected people, Mr.S got bored and thought, "Meh, might as well use the old 'lol hi im a gurl!!1' in some of the leet dalnet teen rooms."

So he did so. He totally just rang me up and told me all this, just you so you know.

So he made a special server for a special '22/m/canada' he met in #teens.

However, to make it a little more orginal, he didn't only change the icon to an image icon, but he named it meonholiday.jpg

When renaming it to this, it specifies the file to be a JPEG image. Still the same size in KB.

He proceeded to send it to the 22 male who lives in Canada, and he opened it. He got the phony 'error' and everything. PROOVING he opened it.

And got his IP. And it's most definatly his IP, seeing how he /DNS'ed him on IRC and did a quick little NETSTAT -N while sending the file to make sure.

However, when attempting to connect to this sexy 22 year old male. It didn't work.

Now I'm thinking, changing the extension might of fucked up the servers capabilities. Would I be right?

The file didn't turn out to be, meonholiday.jpg.exe

Just wondering.

And the Optix Pro server deletes/disables almost every AV and firewall imaginable. Or maybe he's got an 1337 firewall the server didn't catch?

Any ideas?

Any?

Which was it?

Got milk?

Mr.S is such a stupid n00b.

Spam:

http://team-ads.com/forum_102/viewtopic.php?t=1337

[This message has been edited by Tokolosh (edited 12-24-2004).]

A few possibilities.

1. When he double clicked on the jpg that was really an exe, the default jpg viewer tried to open the program and nothing happened.

2. Hardware firewall.

3. He knew what it was.

I'm almost 100% certain it was #1.

Yeah, I thought that you couldn't open files like that, because of how the viewers handle the file extension.

I heard you can name it picture.jpg.exe if they have hide extension for known file types on, because it will erase the .exe, leaving picture.jpg. I dont know if this works still, and the icon will be fucked up, but it might be worth a shot... anyone with half a brain is going to catch it tho...

If it's viewed by Internet Explorer you can always exploit the bug where you can hide a program within the image. I might be able to find an example.

quote:Originally posted by edf825:

If it's viewed by Internet Explorer you can always exploit the bug where you can hide a program within the image. I might be able to find an example.

You mean stenography? I researched about that ages ago, but never got round to trying it out. Or even finding an application to do it with.

Thanks cense and tru. I guess I'll just have to go back pretending I'm a Microsoft worker and sending 'Winnupdate028.exe' to idiots again.

Er, I mean, Mr.Swim will..Duh!



[This message has been edited by Tokolosh (edited 12-25-2004).]

you sure you didnt rename it removing the .exe?

see that gives you an error too.

and optix pro looks a bit crap. get sdbot or similar, and then change the code around until av doesnt detect it.

sdbot will be better because you dont need to know the ip, you control it from an irc channel. and if you infect him over irc you can be sure his computer can connect to irc..