IPB

Welcome Guest ( Log In | Register )

remote login Trojan, Trying to make a program that will select remote login.
lokin
post May 18 2008, 04:44 PM
Post #1





Group: Members
Posts: 299
Joined: 27-January 08
From: USA
Member No.: 11772



******** EDIT Begins **********

6/25/08 EDIT *IMPORTANT* For Visitors:
QUOTE
The following links to our knowledge base contain further information on this subject, including Solutions, Discovery, Templates, and more:
ARDAgent exploit & Com.apple.SystemLoginItems.plist Exploit

- Spratt_

******** EDIT Complete **********


So the deal is I'm trying to write a script that will locate preferences--->sharing--->and then select remote login if there is write privileges.
This will be my first attempt at making something that does this so please give me a break.
what language should I use? perl?
what compiler? Xcode?
The program also has to run in the background or imbed it in a file or document of some kind.
Once again I have no experience here so please help all you can.
p.s. please don't write the code and say heres an example, I'll end up copying most of it.


--------------------
-Lokin-
Go to the top of the page
 
+Quote Post

Posts in this topic
- lokin   remote login Trojan   May 18 2008, 04:44 PM
- - callmenames   QUOTE(callmenames @ May 17 2008, 10:06 AM...   May 18 2008, 05:08 PM
|- - lokin   And I have. I've forgotten all about preferenc...   May 18 2008, 09:54 PM
- - callmenames   Ok, step one is to figure out which file(s) are ch...   May 18 2008, 10:24 PM
|- - lokin   Ok, well using fseventer I found that just clickin...   May 19 2008, 01:48 PM
- - callmenames   For instance... restart. Open Terminal and type.....   May 19 2008, 01:31 PM
- - callmenames   CODEls -alo /System/Library/LaunchDaemons/ssh.plis...   May 19 2008, 01:55 PM
|- - lokin   Ok. I get it. The next problem is that that comman...   May 20 2008, 02:04 AM
- - callmenames   There are ways to have things run under the root a...   May 20 2008, 12:29 PM
|- - lokin   So, If I add launchctl load -w /System/Library/Lau...   May 20 2008, 07:41 PM
- - callmenames   Yes, although what constitutes an 'executable ...   May 20 2008, 08:03 PM
|- - lokin   O sweet. how should I save that file? does it matt...   May 21 2008, 12:23 AM
- - callmenames   How should you save which/what file? An AppleScri...   May 21 2008, 12:44 AM
|- - lokin   QUOTE(callmenames @ May 20 2008, 10:44 PM...   May 21 2008, 01:50 AM
- - callmenames   You need more help with it than me giving you the ...   May 21 2008, 01:57 AM
|- - lokin   You're a quick one to reply... I was under the...   May 21 2008, 02:30 AM
- - callmenames   Inside the Applications folder should be a folder ...   May 21 2008, 02:44 AM
|- - lokin   So close.... gotta love a syntax error A identifie...   May 21 2008, 02:59 AM
- - callmenames   RE: remote login Trojan   May 21 2008, 03:02 AM
|- - lokin   Hmm well I did all that it was found in my login i...   May 21 2008, 03:20 AM
- - callmenames   What does 'found in my log in items' mean?   May 21 2008, 11:06 AM
- - callmenames   Do you have write access to /Library/Preferences/c...   May 21 2008, 05:45 PM
|- - lokin   QUOTEWhat does 'found in my log in items' ...   May 21 2008, 07:05 PM
|- - lokin   ok made it in textedit added the name of my script...   May 21 2008, 07:46 PM
- - callmenames   The Login Items shown in System Preferences are ru...   May 21 2008, 07:31 PM
- - callmenames   What says that?   May 21 2008, 07:58 PM
|- - lokin   system preferences.   May 21 2008, 09:03 PM
- - callmenames   What can I do to convince you to stay out of Syste...   May 21 2008, 09:37 PM
|- - lokin   Lol, ya I know you've pointed that out. It sti...   May 21 2008, 10:44 PM
|- - lokin   And everything as far as I can tell is in place.(e...   May 21 2008, 10:47 PM
- - callmenames   What does "It still isn't working" m...   May 21 2008, 11:13 PM
|- - lokin   When I simply try and open com.apple.SystemLoginIt...   May 21 2008, 11:47 PM
- - callmenames   And if you run Terminal and enter ssh 127.0.0.1 W...   May 22 2008, 12:03 AM
|- - lokin   Well if I ssh my self then it does nothing conside...   May 22 2008, 01:27 AM
- - callmenames   No, the AppleScript run-only application bundle ca...   May 22 2008, 01:36 AM
|- - lokin   Well it all seems to be in order, I'll play ar...   May 22 2008, 04:04 AM
- - Squid   Hehe, I remember writing an applescript that did t...   May 22 2008, 04:04 PM
|- - lokin   Was it similar? My main problem is that once I hav...   May 23 2008, 02:28 AM
|- - Squid   QUOTE(lokin @ May 23 2008, 03:28 AM) Was ...   May 24 2008, 04:07 AM
|- - Oktane   I think I'm missing pieces here can you explai...   May 24 2008, 09:21 AM
|- - lokin   That was my original idea. Because making it run o...   May 25 2008, 02:52 PM
- - callmenames   You could place the file inside your application b...   May 23 2008, 10:34 AM
- - callmenames   GOAL: Enable Remote Login without user interaction...   May 24 2008, 11:46 AM
- - callmenames   Incidentally, launchctl only applies to 10.4 and 1...   May 24 2008, 03:43 PM
- - callmenames   Are you saying that you have no access, at all, to...   May 25 2008, 02:57 PM
|- - lokin   Ya chances are I won't ever have physical acce...   May 25 2008, 09:22 PM
- - callmenames   Sigh. So then your actual question is either how t...   May 25 2008, 10:07 PM
|- - Oktane   It would be nice if the trojan emailed you the tar...   May 25 2008, 10:46 PM
- - callmenames   No point even discussing that part until the big m...   May 25 2008, 11:12 PM
|- - lokin   QUOTEIs the user an absolute moron with admin priv...   May 26 2008, 02:55 AM
- - callmenames   I think you will get as much success from this as ...   May 26 2008, 03:27 AM
|- - Oktane   QUOTE(callmenames @ May 26 2008, 03:27 AM...   May 26 2008, 10:54 AM
|- - lokin   That one is impressive. I have to learn applesript...   May 26 2008, 02:40 PM
- - Siph0n   Making a replica of the Mac OS X password prompt a...   May 26 2008, 08:35 AM
|- - callmenames   QUOTE(Siph0n @ May 26 2008, 06:35 AM) Mak...   May 26 2008, 11:23 AM
|- - Oktane   QUOTE(callmenames @ May 26 2008, 11:23 AM...   May 26 2008, 12:05 PM
|- - lokin   Sorry, I'v been gone on vacation. Love coming ...   May 26 2008, 02:44 PM
- - callmenames   http://www.google.com/search?q=%22with+adm...%22+a...   May 26 2008, 01:11 PM
|- - Oktane   I did it: CODE tell application "System Eve...   May 26 2008, 01:14 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 11:14 AM) I m...   May 26 2008, 01:49 PM
|- - Oktane   1. Start up XCode 2. Select “File -> N...   May 26 2008, 02:02 PM
- - callmenames   QUOTEdo shell script "command" user name...   May 26 2008, 01:31 PM
- - callmenames   CODEtry if text of (do shell script "echo...   May 26 2008, 02:13 PM
|- - Oktane   QUOTE(callmenames @ May 26 2008, 02:13 PM...   May 26 2008, 02:33 PM
- - callmenames   No, not at all. For some of us, the effort is the ...   May 26 2008, 02:51 PM
|- - Oktane   Wait a second I wasn't doing a teaching/learni...   May 26 2008, 03:01 PM
- - callmenames   Suit yourself, as always. Whether you are intentio...   May 26 2008, 03:11 PM
|- - Oktane   Truce, I got what your saying next time when I pos...   May 26 2008, 03:17 PM
- - callmenames   CODE--Variables set admin_user to false set root_a...   May 26 2008, 05:02 PM
|- - Oktane   Thanks, I'm working on combining what you just...   May 26 2008, 05:57 PM
|- - Oktane   This has been skiddie proofed!!! CODEo...   May 26 2008, 07:15 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 05:15 PM) set...   May 26 2008, 08:01 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 05:15 PM) set...   May 26 2008, 08:19 PM
||- - Oktane   QUOTE(callmenames @ May 26 2008, 08:19 PM...   May 26 2008, 08:40 PM
||- - callmenames   QUOTE(Oktane @ May 26 2008, 06:40 PM) Can...   May 26 2008, 08:51 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 05:15 PM) -- ...   May 26 2008, 09:00 PM
|- - Oktane   i am currently working on that cause I don't h...   May 26 2008, 09:02 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 07:02 PM) I a...   May 26 2008, 09:14 PM
|- - Oktane   QUOTE(callmenames @ May 26 2008, 09:14 PM...   May 26 2008, 09:19 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 07:19 PM) YES...   May 26 2008, 09:28 PM
|- - Oktane   The first ip address of my traceroute is that of m...   May 26 2008, 09:34 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 07:34 PM) The...   May 26 2008, 10:03 PM
|- - callmenames   QUOTE(Oktane @ May 26 2008, 08:28 PM) How...   May 26 2008, 10:49 PM
- - lokin   This is getting beyond me. Callmenames your script...   May 26 2008, 08:50 PM
|- - callmenames   QUOTE(lokin @ May 26 2008, 06:50 PM) Call...   May 26 2008, 08:56 PM
|- - Oktane   QUOTE(lokin @ May 26 2008, 08:50 PM) try ...   May 26 2008, 08:56 PM
||- - callmenames   QUOTE(Oktane @ May 26 2008, 06:56 PM) I a...   May 26 2008, 09:02 PM
||- - Oktane   I am testing the trojan on my other computers on m...   May 26 2008, 09:09 PM
||- - callmenames   QUOTE(Oktane @ May 26 2008, 07:09 PM) I a...   May 26 2008, 09:16 PM
|- - callmenames   QUOTE(lokin @ May 26 2008, 06:50 PM) This...   May 26 2008, 10:16 PM
|- - Oktane   How can we make the Applescript email us the resul...   May 26 2008, 10:28 PM
||- - lokin   Send results ~/Public/.howdy to your ip through po...   May 26 2008, 11:34 PM
|- - lokin   They are coming along I downloaded an e-book on ap...   May 26 2008, 11:30 PM
- - callmenames   In looking back over my posts I must say I can no ...   May 27 2008, 12:08 AM
- - callmenames   Did you guys get it working yet? Need a hint? :) ...   May 27 2008, 01:02 AM
- - lokin   After a minute or two of pasting.... CODEset admi...   May 27 2008, 01:15 AM
- - callmenames   You have the "if admin_user then" block ...   May 27 2008, 01:27 AM
- - Oktane   I had an idea for the con aspect: You use a previ...   May 27 2008, 06:39 AM
- - callmenames   QUOTE(Oktane @ May 27 2008, 04:39 AM) I h...   May 27 2008, 11:58 AM
- - Oktane   Name the application "vacation" then use...   May 27 2008, 02:49 PM
7 Pages V   1 2 3 > » 


Reply to this topicStart new topic
2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)
0 Members:

 



Lo-Fi Version Time is now: 7th September 2010 - 11:42 PM