+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Must See ]HOW TO DETECT A BACKDOOR ON A TOOL [simple ] (/showthread.php?tid=1125541)
[Must See ]HOW TO DETECT A BACKDOOR ON A TOOL [simple ] - T3eS 2 - Mar 13, 2011
H!!
Iam back again..
I want to share this with HF members..
How to detect a backdoor on a tool <EXCLUSIVE for HF>
FIRST METHOD:
Right click it, if you got winrar installed and you see
"open with winrar" then this means it was binded with winrar
so def backdoored
SECOND METHOD:
Open it with a resource editor such as resource hacker/restorator/pe explorer and check the rcdata section,if theres 1 & 2 entries in it
then its binded
THIRD METHOD:
Open it with a hex editor , at the start of a PE header theres always this line "This program cannot be run in DOS mode" , search for it,if it
exists more then once then it might be binded
it depends on the specific app,for example its not unusual for
binders/crypters to have the stub file attached in the resources
also search for .exe and inspect the results,a binded file
drops the files to a temp folder before executing em , so if
you find somethin like this: %.t.e.m.p.%..x.x...e.x.e or file1.exe/file2.exe
then its def binded
FOURTH METHOD:
Run it in sandboxie ,when a file is ran'd in sandboxie its isolated (cant access your files/registry, first click the sandboxie tray icon to
open up its Window , then right click the file and click "run with sandboxie"
if you see another process name in the sandboxie Window then its probably backdoored (this doesnt include sandboxie rpcss/dcom launch processes,those are legit and needed for some programs) , thats not all , the file may drop another when one of the buttons in the program GUI is clicked or after you close it , so click all the buttons and close it
just to make sure , if you do see other processes then immdiatly click file>terminate all processes from the sandboxie menu , if a file refuses to run in sandboxie or its suppose to be a program and it runs
without GUI then it would probably be best to delete it ::::
IF THIS HELPED YOUUU..
DONT FORGET TO LEAVE A REPLY..👍 ENJOY
* - SIM-668047 - Mar 13, 2011
Nice tutorial!
It looks nice!
* - lemmerule86 - Mar 13, 2011
good one for fud bakdoors ..thanks
* - T3eS 2 - Mar 13, 2011
thanks mate..
replys are accepted ..
* - -mothered- - Mar 13, 2011
Nice and simplistic methods mate, which are all known to myself and are very well written.
Thanks.
* - irrationalByte - Mar 13, 2011
Thanks For The Share I Was DoubtFull About It! Neat xD
* - T3eS 2 - Mar 13, 2011
thanks frnds.... all suggesstions are welcome
* - GreenLee - Mar 13, 2011
Thanks bro for all this suggestions :) I will try it rightaway
* - X Makube - Mar 13, 2011
about the resource editor >>> resource hacker/restorator/pe explorer...
where did I find the rcdata section?
nice tutorial, Thanks
* - DeadlyDeath - Mar 13, 2011
Thanks for the tut mate, very usefull.
* - walidbj - Mar 13, 2011
thanks a lot very helpfull
* - kingibi - Mar 13, 2011
thanks man. this will be helpful
* - angelotiti - Mar 13, 2011
thanks for this but open with winrar doesnt mean its backdored
* - do_rrr_die - Mar 14, 2011
Thanks for the helpful tut:)
* - PHARAOH47 - Mar 14, 2011
thank you, i was thinking about this problem for few days and have asked some more experienced friends than i am and they didnt know the answer.