Trojan Horses / Backdoors.

Hacking takes many forms, and has varying definitions. There are also many activities which people refer to as hacking, but for various reasons, they are not. The use of Trojan Horses is one of these activities. It must be clearly stressed that the use of Trojan Horses on their own is NOT hacking, in fact its just plain shit. The ONLY reason to use trojans is to gather information about people/systems/other things. NOT to scare the shit out of people and go on a power trip. For example, I recently got enough information about a kiddie porn trader with one to actually do something about it. Use trojans with discretion !

This is an alphabetical list of every Trojan Horse that I know of. There are many others, mostly written in VBasic as opposed to C/C++ or Delphi, but most of those I haven't mentioned wouldn't be worth the space they'd take up. If you wish to download one, go to the homepage given below the title. Contact details of writers given below in an 3lit3 contact list.

NB:// I compiled this list quite a while ago and therefore some information may be out of date, for example, I know that Sub7 has had many updates since the last one listed on here, I just never have the time to update it all any more.

• Back Orifice - Also known as BO. Coded by the Cult of the Dead Cow (cDc).

Default Port: 31337
Homepage: http://www.cultdeadcow.com
Click here to go to the page devoted to Back Orifice. How it works / What it does / How to remove it.

Back orifice is probably the most well known Trojan available today, most likely attributed to the 'interesting' name ;-). BO is the most basic of Client/Server programs with no strict connection. When in use, the client sends commands to the specified IP on port 31337 (default) and awaits a reply. This therefore does not need a direct connection as a verification command is sent back to the originating IP.

• Back Orifice 2000 - Also known as BO2k. A cDc creation also.

Default Port: 54320
Homepage: http://www.BO2k.com

So different to the original, that it is worth a different subsection. Admittedly, I have never used this version of BO, but from having a quick look over the program it seems that it has become a direct connection Client/Server program as opposed to a quick packet send. It appears that you can create and save personal workspaces, so that many different people can have their own profiles. I have not yet been bothered to work out what port BO2k uses, so if anyone wants to let me know, just email me or use ICQ UIN# 3104669.

NB:// Please do not use my ICQ UIN# for questions about trojans/hacking/phreaking/virii etc.. If you have any questions about this kind of stuff, please email me or ask the newsgroups listed on the homepage.

• Bladerunner - Created by Blade.

Default Port: 5400
Homepage: http://www.come.to/soul4blade

This is another direct connection Trojan, and it has quite a nice graphical user interface (GUI). It is comparable to a mixture of NetBus v1.70 and Sub7 v1.4. It is laid out a little sloppily and is quite square, but all the functions are there as well as a function almost unique to Bladerunner, it tells you the ICQ UIN# of the victim. Whether it works or not, I don't know.

• DeepThroat - Coded by ^Cold^ KiLler, with help from Iced.

Default Port: 2140
Homepage: http://www.sohons.com/deept/
Click here to go to the page devoted to DeepThroat. How it works / What it does / How to remove it.

This a very handy little program with many functions. The current version is version 3 and its absolutely brilliant. Definitely worth using if you want a Trojan Horse. (Brilliant startup picture for the client.. a must see.) Like BAck Orifice, this is not a direct connection client/server interface, the server sends commands to the target port. If the server is there it will act on the commands, so there is not definite way to know if a server is on. (I'm not sure if the server sends a reply back or not.)

• Girlfriend - Client called Boyfriend, Server called Girlfriend, (How lame can you get?).

Default Port: 21554
Homepage: http://www.gfailure.da.ru

You have to be careful if you download this one as it is not obvious which files are which. The GUI is called GF.exe and the server is called windll.exe and has two different icons. This program, authored by General Failure definitely emulates its writer. It is simply a failure. Other than 'connect', there are solely 5 options and from the look of it, I would doubt if they actually work. Frankly I wouldn't use it unless I needed to get by a Virus Checker as it doesn't seem to show up on them (well it didn't on FindVirus.)

• Hack'a'Tack - Coded by Da SuckA and The Bart33.

Default Port: 31789
Homepage: http://lbfinc.hypermart.net
Click here to go to the page devoted to Hack'a'Tack. How it works / What it does / How to remove it.

This is a relatively simple and easy to use Trojan with a very unique feature. It has a connector to an FTP (I think) server with lists of infected IPs that are online. You add to this list by connecting to an IP and then clicking "Transmit IP". The other functions are all relatively standard with an IP scanner and a screenshot resolution slidebar. P.S.. Keep an eye out for my name in the credits list..

• HVL Rat - Unknown, I can't get it to work.

Default Ports: 1095, 1097, 1098, 1099
Homepage: Unknown. Available from http://www.hacked-r00t.com/industries

HVL Rat stands for "Hardcore Virus Labs Remote Administration Tool". If you are using Win98, steer clear, someone (not me) accidentally installed this on my machine, and there is no obvious way to uninstall. You need to be a registry wizard. Basically, do not go near this one unless you //really// want it.

• Master's Paradise - By Dan Lehmann of Munich Brain House.

Default Port: 40421-40426
Homepage: http://www.brain-house.de

The copy that I have of this is the 1999 beta 9.9d which has now expired (doesn't stop you changing the date tho !!). The one thing you must be aware of is which is the server and which is the client because it really isn't obvious, Angel.exe is the Server and Paradise.exe is the Client. This seems to be quite an intricate little tool as it seems to have been written by a legitimate company with a copyright. It has options for configuring the Server to use different ports. The Client is fully configurable and the GUI isn't bad.

• Netbus (v1.70) - By Carl-Fredrik Neikter, also known as 'cf'.

Default Port: 12345
Homepage: http://www.trancometer.se

This has got to be the second most famous trojan ever to exist and I think it was one of the first of its kind. Even the computer security magazine circulated to me by the British Computer Society felt it needed mentioning (along with Back Orifice). I think the most famous version of this program was v1.70, with its 'recognizable at a glance GUI'. It has all the necessary options, but without the pointless stuff, it is all useful and easy to use. The default port is very easy to remember and you can change the port, although you can't change the server's port until you are connected to it. The server is called 'patch.exe' and uses the same icon as the IE4 channel bar. I remember someone tried to give it to me once by pretending that it was a program to get SkyTV on the computer, how lame can you get? An extra function is that, when minimized, it sits in the systray not the taskbar. There is one major problem with running NetBus, especially if you are a complete luser (oh by the way, the origin of 'luser' is 'loser' altered for 'users'). That problem is Netbuster by Håkan Bergström. Netbuster is a program that emulates the NetBus server, making the luser who is connected think he is doing things, while all the time, the 'victim' is logging it, watching and has a note of the connected IP. It even has the option to scan the remote client's machine for NetBus server in case the user is a dumb newbie who doesn't realise that someone put it on his machine before he ever heard of it. I would definitely recommend the use of NetBus as a base. From Netbus you can then upload the less stable trojans like NetSphere and Sub7. One final problem with NetBus is passwording (available with most trojans). But, however, if the server is version 1.60, then the password can be bypassed with Telnet, and here's how:

1. Open Telnet (Start > Run > enter "telnet" > OK)
2. Open the Connect menu, then click Remote System.
3. Enter the IP or DNS of the NetBus server.
4. Enter 12345 for the port (or a different port if you know it is running on a different one).
5. Hit Connect.
6. If you see "NetBus 1.60 x" after a few seconds, the password can be broken. If not, close Telnet and forget it.
7. Type the following (case sensitive):

Password;1;<new password> [enter]
ServerPwd; [enter]

8. Close Telnet.

• NetBus 2.0 Pro - By Carl-Fredrik Neikter, also known as 'cf'.

Default Port: 20034
Homepage: http://fly.to/netbus

NetBus has gone professional. The GUI has been changed so dramatically that it could compare to changing from Linux to Windows2000. Officially a 'remote administration and spy tool for LAN/WAN' this version is as full as if it had come from a well established company, with a full Help/About section. All of the original options are still there as well as tons of new ones. The server is fully configurable from the client (even its Windows visibility). I think that this version is, in some ways, worse than v1.70 as it is less 'hands-on' and harder to understand on a basic level. I have a copy of the NetBus 2.0 Pro server that is slightly more interesting than the original. It masquerades as an ICQ patch to get more information from people in ICQ and then loads itself in. I have not tested it (would you), but I am told that it is not detected by virus scanners.

Look, that's enough NetBus for now.. I have been rambling on for ages..   what's up next, ah yes..

• NetSphere - By Sean "DeathBreadstick" Hamilton and Adam "Beefcake" McGirr.

Default Port: 30100
Homepage: http://www.netsphere.org

NetSphere is comparable to NetBus 2.0 Pro in its approach with the GUI, but there the similarity ends. The options available to you are not obvious until you are actually connected to someone and //then// you realise just how useful it is. I believe that NetSphere was the first trojan to fully integrate ICQ options, and it does it well. There are options to tell you their ICQ UIN, add you to their list, add them to your list, steal their contact list etc..  NetSphere picks up where NetBus failed. Another fine piece of work is in the filelisting of the remote computer. It is displayed exactly like the Windoze explorer and so means that you don't have to download the entire file tree, you just download the listings folder by folder. The main screen is your address book which, unfortunately, you just can't use in England because almost all ISPs use dynamic IPs and so the address book is meaningless. NetSphere also runs on either the taskbar or in the Systray. The Systray icon is a little computer, and the screen colour of the computer indicates connection status.

• SubSeven also known as Sub7 - By Mobman.
  
  Default Port: 1243
  Homepage: http://come.to/subseven
  
  • v1.3 - Release Date: March 22nd 1999 - BUG= Doesn't always close, using Ctrl-Alt-Del is safe
    This is the earliest version that I know of, but obviously since it is v1.3, there should have been a v1.2 and v1.1. Even though it is the earliest version, it really isn't bad. The default port for every version I know of is 1243 although every version allows you to change it. Version 1.3 has quite a squared off window compared to the later versions and not everyone likes the red unchangeable skin, but hey, you can't please everyone. This has every option you need, even changing the server port once connected. By far the most revolutionary of options has to be the ICQ Notify where you can tell a server to send you an ICQ Pager message telling you that someone is online and what their IP is. Even this early version allows you to edit the server a little before you send it, you can change the password and port to listen on by running the server with /PORT and /PASS extensions. The file manager is like that of NetSphere in that it is folder by folder, but it is a simplistic 'MS-DOS like' listing as opposed to a graphical one.
  • v1.4 - Release Date: March 28th 1999 - BUG= Doesn't always close, using Ctrl-Alt-Del is safe
    As far as I can see, there are only two differences between v1.3 and v1.4 which are an extra button entitled "Hang up victim's connection to the internet" and a few extra options about the OS layout such as "Hide/Show Start Button" and Num/Scroll lock controls.
  • v1.7 - Release Date: May 3rd 1999 - BUG= Keylogger doesn's work sometimes, no fix.
    As of this version, Sub7 completely changed in options and appearance (I have never seen v1.5 or v.1.6). In this version Mobman started to contract the size, now the corners are rounded, the skin is blue and some functions are hidden inside a pop-up menu called the 'fun manager'. Also you can contract the client to a smaller window and this is the first version to run in the Systray. All of the fuctions are roughly the same apart from the new local options menu for configuring the quality of screenshots and an option to run a 3rd EXE file given away with Sub7. This new EXE is called Editserver v1.0 and is a program designed to fully configure the server as you want it for each individual victim with options such as a victim name to go with ICQ and email notify and the possibility of changing the server filename once it is installed to better hide it from the victim (default is rundll16.exe as windows already has rundll.exe and rundll32.exe).
  • v1.8 - Release Date: May 27th 1999 - BUG= Keylogger doesn's work sometimes, no fix.
    The best thing about this version is the configurability of the client in that the skin can be changed in a new, bigger, local options menu along with new settings for the client chat. Also, Mobman correctly decided that the squared edges were better and so reverted to them. This version comes with EditServer v1.1 which is much wider than its predecessor and has new options like different ways for it to be run, i.e. in win.ini or in the registry. Also this EditServer introduces a new concept which is IRC notify so that it will send a notify message with name and IP to a specific nickname on a specific IRC server. I have tested it and it definitely works, I had my doubts.
  • v1.9 - Release Date: June 20th 1999 - No known bug.
    This, the latest version of the original Sub7 as far as I know, there are NO client changes as it is a quick release with a better server to get around Virus Checkers. (NB:// Virus checkers refer to Sub7 as Backdoor-G). This version also comes with EditServer v1.2 with a really good new option to increase the size of the EXE and the DLL so that when people search for it by size, they wont find it.
  • Server2.exe Addon.
    This is a second, separately downloadable server for Sub7 v1.9, and the main feature is that, with another program, the server icon can be changed.
  • Apocalypse Client Addon.
    I am not entirely sure as to the point of this as I don't think it is the long awaited Sub7 v.2.0, it is just a different client. It is, however, quite different to the other clients, as all the options are in slide-bar menus on the left hand side, with detailed options in the main window. All the buttons look better as they are 'on mouse hover' buttons and by changing the skin, you can change what colour the mouse hover colour is. Another set of features are 'newbie help', 'restore all defaults in Sub7 client' and a toggle for whether you want it to run on the taskbar or in the Systray.

• the tHing - By Blade, creator of Bladerunner.

Default Port: 6400
Homepage: Unknown. Available from http://www.hacked-r00t.com/industries

This has an advantage in that the GUI looks //so// good that you can't help but use it. Also the feature that is so much better in this trojan than in others is program spawning and uploading (and running). There is also a simple Whois command and an EditServer with good ICQ/mail notify and autostart options.

• Trojan Man

Default Port: Unknown
Homepage: Unknown. available from http://www.hacked-r00t.com/industries

I don't know who wrote it and i don't know anything about it. I believe that there is a possibility that it is not a Trojan Horse, but an EXE binder, if anyone can help me with info about this, I would appreciate it. All else I know is that it has a different set of files for Win9x and WinNT.

• War Trojan - By Björn Andreasson of The War Industries.

Default Port: 4201
Homepage: http://www.hacked-r00t.com/industries

I have just tried to open in and it said I wuz missing a .DLL file, so I'll have to ask my mate from The War Industries (TWI) where to get it first. (It's probably in the needed files section of TWI but since I have only just found that I needed, I haven't had time to check.

Contact List of the 3lit3

If your internet browser doesn't support frames then you can browse through the site using the buttons here.