Do Not Use Kaht.exe

Help - Search - Member List - Calendar

Full Version: Do Not Use Kaht.exe

GovernmentSecurity.org > The Archives > Exploit Articles

Skoup

Aug 11 2003, 12:53 AM

Is Someone has look sources of KaHt.exe ???

look a this :

CODE

#ifdef MULTITHREADING
strcpy(cadena,"net send * KaHT 0WnZ U\n");
send(conn_s,cadena,strlen(cadena),0); sleep(100);

Imagine the result of this command

If someone can compile a new KaHt.exe with a new cmde likes "net user add ..."
It's may be a nice work

thx for look this

Fletcher

Aug 11 2003, 11:38 AM

effectively not good !

thank for you analyse !

Feuerstein

Nov 11 2003, 10:14 AM

hmmm, i think that this option "net send" IS DISABLED

CODE

#define MULTITHREADING /* Just a joke */
.
.
#undef MULTITHREADING

and later on ..

CODE

#ifdef MULTITHREADING
strcpy(cadena,"net send * KaHT 0WnZ U\n");
send(conn_s,cadena,strlen(cadena),0); sleep(100);
#endif

so the code wont be compiled at all

guess that is only a joke by the coder

but recompiled exe by Skoup can be found here.

Wolfman

Nov 11 2003, 02:55 PM

You guys dont even bother to trie out the exploits on controlled environments (virtua pc, vmware, etc) and then make these kind of remarks.

Whenever you can, try out an exploit before using it "out there", its the best way to know if it really works, and also to see what traces does it leave like open cmd boxes, net sends, logs, crashes, DoS, etc.

As for KaHT it does not NET SEND anything.

Cya
Wolfman

ComSec

Nov 11 2003, 04:22 PM

just run a sniffer...soon find out

PrarieDog

Nov 12 2003, 02:19 AM

thanx for ths info guys, much appreciated....

Feuerstein

Nov 12 2003, 12:20 PM

QUOTE (Wolfman @ Nov 11 2003, 04:55 PM)

Whenever you can, try out an exploit before using it "out there", its the best way to know if it really works, and also to see what traces does it leave like open cmd boxes, net sends, logs, crashes, DoS, etc.

i barely agree

thesource

Nov 12 2003, 12:58 PM

i TOTALLY agree with wolfman. you dont wanna be (filtered) do you??

jak3c

Nov 12 2003, 08:31 PM

yes its just an other possibility of kath...just a demonstration or a joke !

good idea to replace this with net user add blah blah blah !

Feuerstein

Nov 15 2003, 12:17 PM

QUOTE (jak3c @ Nov 12 2003, 10:31 PM)

good idea to replace this with net user add blah blah blah !

thats the clue ^^

JDog45

Nov 15 2003, 09:12 PM

..why was this thread brought back up? It's already been takin care of if you searched the board

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.