Re: KSpynix ::: the Unix version of KSpyware? (Proof Of Concept)

[Day Jay <d4yj4y () yahoo com>]

That's gotta be the most half assed piece of code
offered as something for spyware I've ever seen! All
of the directories are like hardcoded and statically
linked! that is no where near any spyware
sophistication I have seen in windows spyware
programs.

d
--- khaalel <khaalel () gmail com> wrote:
> Since KSpyware was on the net, i received some mails
> of people who
> wanted to know if spywares under Unix systems could
> be coded.  I did
> some search on the net to find an unix spyware, but
> i found nothing.
> So i launch my freebsd box and i started to code an
> unix spyware :
> like under windows systems, spywares under Unix
> systems can be easily
> coded but its long (i coded KSpynix during 5 hours)
> because we have to
> find the right conf files.
>
> So KSpynix is only a proof of concept but it work
> well : i tested it
> under FreeBSD 5.3 (like i don't use Linux i can't
> tell you if all the
> code work under Linux but i know it will work well
> under Gentoo Linux
> that use the system of ports like the BSD systems).
>
> For the moment, KSpynix can  list all the installed
> programs, can spy
> the web sites the victim visited, can obtain a list
> of e-mail
> adresses, cookies, can hijack Opera's main page and
> can do the things
> you want if the victim have root powers (like copy
> the /etc/htpasswd
> file).
>
> All the glaned informations are put in a repertory,
> to send the
> repertory, the spyware could create a shell script
> that would use sftp
> or other tools.
>
> Well, here is KSpynix's code cource (in Python) :
> http://nzeka-labs.com/hacking/KSpynix.htm
>
> KSpynix is under GPL so: 
> "You may copy and distribute verbatim copies of the
> Program's source
> code as you receive it, in any medium, provided that
> you conspicuously
> and appropriately publish on each copy an
> appropriate copyright notice
> and disclaimer of warranty; keep intact all the
> notices that refer to
> this License and to the absence of any warranty; and
> give any other
> recipients of the Program a copy of this License
> along with the
> Program." BUT DON'T TRY IT ON THE WEB.
>
>
> - Nzeka Gilbert aka Khaalel
> - www.nzeka-labs.com
> - Author of the french security book: "La protection
> des sites
> informatique face au hacking".
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia -
> http://secunia.com/

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/