Looks very nice. Might buy this! :)
GhostIRC v1.2 | DDos | Botkill | Persistance | IRC included | Cheapest bot on HF! |
(Oct 21, 2013 09:24 AM)KFC Watermelon Wrote: You should add information about the persistence. What are you using to protect the startup, file, and process? Also, what methods are you utilizing to remove "almost all malware sold on HF"? there is no persistence there is no need for it with 32 startup methods no matter what even if bot-killed once slave restarts bot 'will' come back. yes Ghost IRC uses authhost and logon-logout system. (Oct 21, 2013 09:51 AM)TheSonOfTheDevil Wrote: there is no persistence there is no need for it with 32 startup methods no matter what even if bot-killed once slave restarts bot 'will' come back. If something is called it doesn't come back because of start up lol. Even if you had a bootkit if it gets killed by AV then it's killed lol. (Oct 21, 2013 10:07 AM)Brian Krebs Wrote: If something is called it doesn't come back because of start up lol. Even if you had a bootkit if it gets killed by AV then it's killed lol. that's what I always thought to but this bot has been tested for 2 months now botkillers has no effect😎 now as far as AV's go as long as Bin is FUD and gets picked up it will kill its self after 20-30 seconds it reconnects, if Bin is not FUD and AV picks it up it runs from the AV's vault folder. (Oct 21, 2013 10:22 AM)Vector Dynamics Wrote: Are you sure of that? yes, I know how it sounds but that's really how it works, I'v tested 1st hand on my computer with AVG, the was picked up and sent to AVG virus vault and still connected to the irc.. (Oct 21, 2013 10:33 AM)KFC Watermelon Wrote: OK, I assume this incorporates some rootkit functionality, correct? yes, well i guess on the the definition of rootkit, when i was researching rootkits I learned there was ring0 , ring1, ring2 and ring3 so i pit the main parts together and noticed on ring2 and ring3 on the workings of it so between that and a post on hack forums on working on AV folder I put the two together and hell no i far from got it on first try didn't think it would work but glad it it tho.. (Oct 21, 2013 10:58 AM)KFC Watermelon Wrote: So you're incorporating a ring2-ring3 rootkit? What hooks are you utilizing? not sure what your meaning is when you say hooks, but ghost hooks its self onto user32.dll and services.exe running off Async and win32. and UDP amplified meaning ghost runs off two users the user and administrator so when attacks are sent the ring0 takes effect so if the slave has the built in administrator account (most do) that account+user sending say 6500 both send at same time while keeping stability. so its more its more of a split attack.
Windows only utilizes rings 0 and 3 for backwards compatibility purposes.
Man if you are going to claim rootkit-like functionality in a CLR based program, you really need to back that up with some indisputable evidence or else it just sounds like more smoke blowing. Quote:not sure what your meaning is when you say hooks, but ghost hooks its self onto user32.dll and services.exe running off Async and win32. That does not make sense. Are you talking about SetWindowsHookEx? (Oct 21, 2013 01:15 PM)betamonkey Wrote: Windows only utilizes rings 0 and 3 for backwards compatibility purposes. kinda, if you read the post i reply to KFC you will see I only used parts of rootkits not then kootkits its self.. and as of crypter's most C# crypters should work was only able to test cube crypter at the time cause that's all i had at the time, But there's no eof or anything but as time comes I hope to test ether crypters with it.
Yes but what I am saying is your responses make no sense.. Nothing you have said says how or what exactly any of this does? If you know what you're doing then it should be easy to explain. Even easy to just explain enough to make it seem credible.
I dunno man, I think I already know the answer but I'll just quit here because I don't want to get into a flame war. |
|
|