RE: Backdoor:Win32/Hackdef.E

From: Jeffrey Leggett (jleggett_at_interland.com)
Date: 10/27/05

  • Next message: Michael Gargiullo: "Vuln Scanner" 
    Date: Thu, 27 Oct 2005 12:55:25 -0400
To: "Alex Stender" <alex.stender@gmail.com>, <pen-test@securityfocus.com>

    We see Hacker Defender ALL the time (Webhoster). By far the most popular rootkit on Windows servers. AFAIk, MS tools DO NOT remove them (may have been superceded by new version). Current AV will detect, but is incapable of removing it (again, I don't spend all day reading every update to every vendor, so that may or may not be true any longer).

    Hacking HackerDefender - Helpful Hints!

    Some useful and interesting ways of defeating HackerDefender! Some of these are useful, some of them are interesting, and some are interesting but not particularly useful...

    Using WinHex to help locate HackerDefender

    You can search for text strings that are unique to the HackerDefender .ini file in order to locate the HackerDefender .ini file(s). Keep in mind that you may find old inactive installations of HackerDefender!!

    Some examples of potentially unique text strings are:

        RegValues]

        RegKeys]

        TCP:

    If you can find the .ini file for the active HackerDefender attack, you have an opportunity to uninstall HackerDefender via the built-in backdoor.

    Uninstalling HackerDefender using the built-in backdoor (of limited use)

    First, you will need to locate the HackerDefender .ini file.

    Then, you will need to locate the backdoor password.

        In the HackerDefender .ini file, locate the [Settings] subheading. The first entry below that entry should be:

            Password=<something>

        The password is obviously the string after the equal sign.

    Next you will need to identify the HackerDefender executable. If you've found the .ini file, the executable should be in the same directory as the .ini with the same base name. For example, if the .ini file is 'zx_hxdef.ini', the executable should be 'zx_hxdef.exe'

    Next, download the backdoor client (bdcli100.exe) attached to this document and put in a safe location on your computer. Note: If you have VirusScan installed, you may need to configure it to exclude a directory in order to keep this file on your system.

        Drop to a command line where bdcli100.exe lives and execute the command:

            bdcli100.exe <servername> 80 <password>

        Note: If the server is not a web server, port 80 not be an option. Try other available port...

    You should now have a command line on the hacked server in the hacked directory! Sweet huh!

    Now, let's uninstall HackerDefender...

        zx_hxdef -:uninstall

    -----Original Message-----
    From: Alex Stender [mailto:alex.stender@gmail.com]
    Sent: Wednesday, October 26, 2005 2:19 PM
    To: pen-test@securityfocus.com
    Subject: Backdoor:Win32/Hackdef.E

    After installing October's MS Malicious Software Removal tool, a
    couple of server, one behing a Sonicwall TZ170 firewall have shown he
    presence of Win32/Hackdef.E and Win32/Hackdef.T. The MS tools they
    have been removed.

    Has anyone had any experience with that trojan in terms of detecting
    payload etc? Is there a security scanner to check for that specific
    vulnerability?

    Thanks

    Alex

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Michael Gargiullo: "Vuln Scanner"

    Relevant Pages

    • RE: Experiences with company nCircle and their IP360 product
      ... since I installed it for myself I have helped to install it at ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)
    • Re: 3rd party vuln assesment firms
      ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • RE: Pre-Scanning for Marketing
      ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Hackers are concentrating their efforts on attacking applications on your ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)
    • Re: Qualys
      ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • Re: Spis products worth a try? Or any suggestions for developers tool?
      ... your site utilizes Javascript heavily, SPI will have a tougher time ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on ...
      (Pen-Test)