Regedit, You may be thinking "Regedit, what the hell is that?!" or if you have a reasonable amount of experience with computers "Oh awesome a page about what this program is.
What is Regedit?
Regedit is basically a program that lets you edit ceratin values in your computer (short for "Registry Editor"). BEWARE, DON'T JUST PLAY AROUND IN REGEDIT, SOME THINGS CAN SERIOUSLY HARM YOUR COMPUTER IF CHANGED OR REMOVED. You can do really cool things with it such as remove buttons on your computer .e.g remove the shutdown option or make a message appear at startup.
Before you do anything you will need to know how to access the program.:
So first go to your start menu
Then click run
Now type "regedit" without the quotes
Regedit should open (if it doesnt contact me)
How to display a legal notice on startup
This is how to make a legal notice appear on startup:
Open Regedit
Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system"
legalnoticecaption:"enter your notice caption here"
legalnoticetext:"enter your legal notice text here"
Add admin user to welcome screen:
Start the Registry Editor Go to:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList \
Right-click an empty space in the right pane and select New > DWORD Value Name the new value Administrator. Double-click this new value, and enter 1 as it's Value data. Close the registry editor and restart.
Kill Processes immediately:
When logging off, you sometimes get an “End Task” dialog prompt, indicating a program that doesn’t shut itself down. You can suppress the prompts and have Windows kill these programs automatically when you log off. In regedit, find key HKEY_CURRENT_USER\Control Panel\Desktop Look for the value AutoEndTasks, and change it from 0 to 1.
No Shutdown:
Wanna play with your friends by removing the shutdown option from start menu in their computer.
Regedit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
"NoClose"="DWORD:1"
Show Superhidden Files:
Even if you turn on show hidden files in Windows Explorer some files will remain hidden. These files are super hidden. Set the registry value below to 1.
Unblock Regedit and CMD prompt:
Save this file is a .reg file then execute it
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp]
"Disabled"=dword:0
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools"=dword:0
Windows Genuine Ballon Hack
The fix works a treat.
1.C:Documents and SettingsAll UsersApplication DataWindows Genuine Advantagedata
inside you will find a file called Data.dat open that file with notepad and
delete all the stuff in it… now save the file and set it as read only and restart pc but in SAFE mode ** Yes, this step is required ** ** Will NOT immediately solve problem until rest of steps completed **
Now go to c:windows system32 folder: MUST be in safemode
wgalogon.dll ** You CANNOT delete this file. RENAME it to wgalogon.bbb ***
spmgs.dll ** This is a spelling error. File is actually spmsg.dll. RENAME it to spmsg.aaa **
wgatray.exe *** DELETE this file ***
Now go to C:WINDOWSSoftwareDistributionDownload and DELETE the following folder
6c4788c9549d437e76e1773a7639582a
REBOOT & all should be resolved
End the process wgatray.exe in Windows TaskManager and restart Windows XP in safe mode. Now delete the following files:
Delete WgaTray.exe from c:\windowss\ystem32
Delete WgaTray.exe from c:\windows\system32\dllcache
Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify. Delete all references in your registry to WgaTray.exe
Another alternative suggest that three files are installed Windows XP System Folder:
\WINDOWS\system32\WgaLogon.dll
\WINDOWS\system32\WgaTray.exe
\WINDOWS\system32\LegitCheckControl.dll
The wgatray.exe process makes the check for genuine windows software. You can disable WGA by removing the execute bit on WgaLogon.dll. That way, winlogon can't call it as a notification package at boot, and since WgaLogon is responsible for running and maintaining WgaTray.exe, no more tray popups either.
To change the execute bit of WgaLogon.dll, first turn off Simple File Sharing. Now right click the file in Windows Explorer and open the Security Tab. Hit the Advanced button, uncheck the Inherit box at the bottom, hit the Copy button, then hit OK. Go through each listed user/group and remove the "Read & Execute" permission for that file, leaving the "Read" permission as-is.
Hit OK to apply the permission changes and close the file properties dialog. Restart the machine. You can now turn "Use simple file sharing" back on, if you want.
A third alternative posted on the internet suggest that users clear the content of file data.dat located in the following directory:
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data
Windows uses 20% of your bandwidth Here's how to Get it back
This page is contributed bytabcap u can click his name to ask him more or
give the Feedback
Windows uses 20% of your bandwidth Here's how to Get it back
A nice little tweak for XP. Microsoft reserve 20% of your available bandwidth for their own purposes (suspect for updates and interrogating your machine etc..)
Here's how to get it back:
Click Start-->Run-->type "gpedit.msc" without the "
This opens the group policy editor. Then go to:
Local Computer Policy-->Computer Configuration-->Administrative Templates-->Network-->QOS Packet Scheduler-->Limit Reservable Bandwidth
Double click on Limit Reservable bandwidth. It will say it is not configured, but the truth is under the 'Explain' tab :
"By default, the Packet Scheduler limits the system to 20 percent of the bandwidth of a connection, but you can use this setting to override the default."
So the trick is to ENABLE reservable bandwidth, then set it to ZERO.
This will allow the system to reserve nothing, rather than the default 20%.
windows Vista user access control UAC
Microsoft's advertising has stressed the new security features found in Windows Vista. From the user perspective, one such feature, User Access Control, is arguably the most noticeable enhancement. User access control is a mechanism by which users -- even administrators -- perform common Windows tasks with non-administrative rights, or as a standard user. Before administrative tasks can be performed, users must actively approve actions that could be potentially dangerous to the computer.
In this article, I'll give you a complete look at User Access Control's inner workings and show you some ways you can change the behavior of this new feature.
How does User Access Control work?
The inner workings of User Access Control reveal a lot about how this feature protects your computer. First, let's talk about why User Access Control was developed.
The problem: Windows XP and silent installations
In pre-Vista versions of Windows, upon login, a user was assigned an access token. A non-administrative user was assigned a token that granted him access to resources that did not require administrative rights. Users that were members of an administrative group were assigned a single token that granted them full rights to all of the resources on the local computer.
From an ease-of-use perspective, this level of authority was great. However, from a security perspective, it's not so great; even for IT pros. Consider the potential for "drive-by" spyware installation. A drive-by installation happens when you visit, either accidentally or intentionally, a site containing malicious code that you don't know about. While spyware scanners have significantly improved over the past couple of years, there's not a single solution on the market that will protect against every known threat. Even if there was such a product, there would still be the issue of unknown threats. New spyware pops up every day and it takes vendors time to discover these new nuisances and update their products.
If you're logged in to Windows XP as a user with administrative privileges at the time the drive-by takes place, spyware may get installed to your computer with absolutely no notice to you. This spyware could be anything from a fairly innocuous tool to a key logger that keeps track of everything you type and sends the results to a predetermined location. You might end up with the installation of a back door that allows a hacker to make his way into your system at some point in the future to achieve his nefarious goals. Worse, the deeper spyware is embedded into your system, the more difficult it is to remove, short of a complete system rebuild, which can take hours.
Note: When you install Windows XP, the Setup Wizard assigns administrative rights to all local accounts.
Now, you might tell yourself you already knowall of this; but, in your organization, you're forced to allow users to run as a local administrator for any number of reasons. For example, many users (with the backing of management) feel it is vital that they have the ability to install new applications on their desktop. Unfortunately, they're often right. Doing business on the Web often means having to install a new ActiveX control or other type of application. While not the safest behavior, allowing people to do their jobs is preferable to paying people to sit in a chair doing nothing under the unyielding thumb of IT.
The solution: Windows Vista and User Access Control
Windows Vista's introduction of User Access Control aims to tame this beast and bring some order back to chaos. Under Vista, when an administrative user logs in to the system, he is granted not one, but two access tokens: an administrative access token and a standard user access token. The standard access token is used to start the user's desktop. The end result is that the administrator is running a system with more limited rights than he would have received upon login under Windows XP. Until there is a need, the second token -- the one with administrative rights -- is not used.
This situation takes place, for example, when the administrative user starts a control panel applet and tries to change a setting, Windows Vista's User Access Control feature pops up a window indicating that permission is necessary to continue. When you choose to allow an administrative action to take place using the administrative token, you are allowing that application to run with elevated privileges. Figure A gives you a look at a typical User Access Control dialog box. If you want to allow the action, press the Continue button.
Figure A
User Access Control asks if you want to proceed with the action.
If you've seen the Mac v. PC commercials on Apple's Web site, you'll recognize this dialog box as being the point of discussion between the PC and the Mac with a security guard standing behind the PC to verify every communication with the Mac. In reality, the situation is not quite that bad. In fact, although annoying from time to time, the situation is much better as the new system provides a visual cue that something is going on and gives a user an opportunity to decline an action.
Annoyance is one of the results I will try to help you with in this article. I'll show how you can disable User Access Control altogether, and how to indicate that specific applications should always run in an elevated state.
Completely disabling User Access Control
I'll preface this section by saying I don't recommend you take this action, even on your own computer. Much as I am loathe to admit it, even though I preach the dangers of the "blind click" on a pop-up and the resulting spyware that ensues to students and users, I sometimes forget my own advice. Last summer, when I was in a hurry to complete a task, I got what appeared to be a system dialog box and pressed the OK button. Just as I released the mouse button, I realized that the "OK button" I had just pressed was actually a pop-up from a Web site. Just hours later, my system was infested with spyware.
The lesson here is this: Even those of us that do this for a living fall victim to spyware. With User Access Control, at least there is one more barrier between us and them.
But, if you find that User Access Control is seriously debilitating, you candisable it and move on. There are a number of ways to disable User Access Control. I'll show you how to do so using the Control Panel, the Registry Editor, and Group Policy.
All of the solutions in this article require that you log on as a user with administrative rights. For most solutions, however, you cannot use the local administrator account. This account is not subject to administrative approval. Use another account that is a member of the local administrators group.
Disable User Access Control using MSConfig
For a few machines, you can use MSConfig to change the behavior of User Access Control:
Go to Start | All Programs | Accessories | Run.
In the Run box, type "msconfig", and press [Enter].
From the System Configuration window, choose the Tools tab, as shown in Figure B.
In the Tool Name column, look for the Disable UAC option.
Press the Launch button.
Reboot the system.
Figure B
The System Configuration window Tools tab.
Disable User Access Control via the Control Panel
If you have just a couple of machines, the easiest way to disable User Access Control is to disable the feature via the Control Panel. Follow these steps to achieve this goal:
Go to Start | Control Panel.
Viewing the Control Panel in "Classic" mode, choose the User Accounts applet. This opens the screen shown below in Figure C.
Figure C
The User Accounts control panel applet.
Choose the "Turn User Account Control on or off" option. Note that this applet has a little shield next to it. This shield indicates that this function is itself protected by User Account Control.
Deselect the checkbox next to Use User Account Control (UAC) To Help Protect Your Computer. See Figure D.
Figure D
The User Accounts control panel applet.
Press OK.
Reboot your computer for the changes to take effect.
Disable User Access Control via the Registry Editor
A second way to disable User Access Control involves the use of the registry editor. By changing a specific key on each Vista machine, you can disable User Access Control. Here are the steps:
Start the Registry Editor.
Browse to the following key: HKEY_LOCAL_MACHINE Software Microsoft Windows CurrentVersion Policies System.
Change the value of the EnableLUA entry to "0" If you ever want to re-enable User Access Control, follow these instructions, but change the value of the EnableLUA entry to "1". See Figure E for a look at the screen.
When you are done, reboot the computer for the change to take effect.
Figure E
The EnableLUA key in the Registry Editor.
Manage/Disable User Access Control via Group Policy
If you have a lot of computers and you want to change User Access Control behavior across all of them, your best bet is to use Group Policy. The Group Policy method is also the most granular of the bunch and allows you to set a variety of parameter related to User Access Control. I'll show you how to accomplish this using the local group policy administrative tool.
Go to Start | All Programs | Accessories | Run.
In the Run box, type "secpol.msc" and press [Enter].
When User Account Control asks for permission to continue, press the Continue button.
Browse to Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options. You'll see the screen shown in Figure F.
Select the group policy object you wish to modify and change the setting to the desired value. The list below provides you with a look at all of the group policy settings associated with User Access Control.
Figure F
The Group Policy Object Editor.
There are a number of options related to User Access Control:
User Account Control: Behavior of the elevation prompt for the built-in Administrator account -- This setting determines the behavior of User Access Control when used with the built-in Administrator account.
Enabled: When running an application that needs administrative rights, the built-in Administrator account will be subject to User Access Control.
Disabled (default): The built-in Administrator account will run all applications without further prompting.
User Account Control: of the elevation prompt for administrators in Admin Approval Mode -- This setting determines what takes place when administrators (besides the built-in Administrator account) run a privileged application.
Elevate without prompting: This is the most dangerous setting and should be used only in very secure environments. Restricted applications are run with administrative rights without intervention.
Prompt for credentials: The user is prompted to provide the user name and password for a user with local administrative rights.
Prompt for consent (default): This is the normal behavior for User Access Control and asks the user (assuming the user has administrative rights) to permit or deny running an application with administrative rights.
User Account Control: Behavior of the elevation prompt for standard users -- This setting determines what takes place when standard users try to run a privileged application.
Prompt for credentials (Default for Home editions): The user is prompted to provide the user name and password for a user with local administrative rights.
Automatically deny elevation requests (Default for Enterprise editions): The user will receive a message indicating that access to the application has been denied.
User Account Control: Detect application installations and prompt for elevation -- How will the User Access Control system respond to requests for the installation of new programs?
Enabled (Default for home): Application installations that require administrative privileges will trigger the User Access Control prompt.
Disabled (Default for enterprise): Since many application installations are handled via Group Policy, user intervention and approval is not necessary.
User Account Control: Only elevate executables that are signed and validated -- Do elevated applications require a valid PKI certificate chain?
Enabled: Requires that an application has a valid PKI certificate chain before it is allowed to run.
Disabled (default): Does not require that an application be signed in order to run.
User Account Control: Only elevate UIAccess applications that are installed in secure location -- Applications that request execution with a UIAccess integrity level must reside in a secure area of the system.
Enabled (default): An application with UIAccess integrity with launch only if it resides in a protected area of the system.
Disabled: An application with UIAccess integrity will launch regardless of the location of the executable.
User Account Control: Run all administrators in Admin Approval Mode -- Run all users, including administrators, as standard users. This effectively enables or disables User Access Control. If you change this setting, you must reboot the system.
Enabled (default): Administrative Approval Mode and User Access Control is enabled.
Disabled: Disable User Access Control and Admin Approval Mode.
User Account Control: Switch to the secure desktop when prompting for elevation -- When User Access Control is enabled and displays an elevation prompt, change Windows Vista to the secure desktop as opposed to the standard user's desktop.
Enabled (default): Elevation requests are directed to a secure desktop.
Disabled: Elevation requests are directed to the standard desktop.
User Account Control: Virtualize file and registry write failures to per-user locations -- This setting enables the redirection of legacy application write failures to defined locations in both the registry and file system, mitigating those applications that historically ran as administrator and wrote runtime application data back to %ProgramFiles%, %Windir%; %Windir%\system32 or HKLM\Software\. In short, this key helps to maintain backward compatibility with legacy applications that do not like to run as a standard user.
Enabled (default): Applications writing data to protected areas will be redirected to other locations.
Disabled: Applications writing data to protected areas will fail.
</LI>
Selectively disabling User Access Control
Not all applications are marked in such a way as to trigger a User Access Control warning when executed. However, many applications need to be run with administrative rights enabled in order to function as intended. In order to accommodate this situation, you can mark an application so it runs with administrative rights each time the application is executed. To do so:
Right-click the executable associated with the application.
From the shortcut menu, choose the Properties option.
From the Properties page, select the Compatibility tab.
Under the Privilege Level heading, select the checkbox next to "Run this program as an administrator" , as seen in Figure G.
Press OK.
Figure G
The application' s Compatibility tab.
For some applications, the "Run this program as an administrator" option may not be available. There can be a number of reasons for this:
You are not logged in as a user with administrative rights.
The application is not capable of being run with elevated rights.
The application is a part of the operating system. OS applications cannot be modified in this manner.
Annoying, but worth it
User Access Control might be an annoying way to achieve system security, but it's actually pretty welcome when it comes to maintaining system security, especially for home users. Mac and Linux users have long had to deal with the same basic security scheme, but it's new to Windows users. Once Windows users get used to it, they'll appreciate the added security it provides.
Xp Tricks Contd.. More of Dem
Make your folders invicible...:)
1)Right Click on the desktop.Make a new folder
2)Now rename the folder with a space(U have to hold ALT key and type 0160).
3)Now u have a folder with out a name.
4)Right click on the folder>properties>customize. Click on change icon.
5)Scroll a bit, u should find some empty spaces, Click on any one of them.
click ok
Easily Disable Messenger
Go into: C:/Program Files/Messenger. Rename the Messenger folder to "MessengerOFF".
Remove Messenger
· Go to Start/Run, and type: "rundll32 setupapi,InstallHinfSection BLC.Remove 128
%SystemRoot%\INF\msmsgs.inf"
Turn Off Autoplay for Program CDs
How can you stop Windows XP from launching program CDs?
· Click Start, click Run, type GPEDIT.MSC to open Group Policy in the Microsoft
Management Console.
· Double-click Computer Configuration, double-click Administrative templates,
double-click System, and then click Turn off autoplay.
· The instructions on your screen describe how to configure this setting. Click
Properties to display the setting dialog.
· Click Enabled, and choose CD-ROM drives, then click OK, to stop CD autoplay.
This setting does not prevent Autoplay for music CDs.
Change Drive Letters in Windows XP
When you add drives to your computer, such as an extra hard drive, a CD drive, or a
storage device that corresponds to a drive, Windows automatically assigns letters to the
drives. However, this assignment might not suit your system; for example, you might have
mapped a network drive to the same letter that Windows assigns to a new drive. When you
want to change drive letters, follow these steps:
· Right-click My Computer, and then click Manage.
· Under Computer Management, click Disk Management. In the right pane, you'll see
your drives listed. CD-ROM drives are listed at the bottom of the pane.
· Right-click the drive or device you want to change, and then click Change Drive
Letter and Paths.
· Click Change, click Assign the following drive letter, click the drive letter you
want to assign, and then click OK.
Do Not Highlight Newly Installed Programs
Tired of that annoying little window that pops up to tell you that new software is
installed? If it gets in the way when you're logging off, turn it off completely. To do
this:
· Click Start, right-click at the top of the Start menu where your name is displayed,
and then click Properties.
· In the Taskbar and Start Menu Properties dialog box, on the Start Menu tab, click
Customize.
· Click the Advanced tab, and then clear the Highlight newly installed programs check
box.
· Click OK, and then click OK again
Change the Default Opening Folder in Windows Explorer
By default, Windows Explorer opens showing the My Documents folder. To change the
default setting so that all top-level drives and folders are shown, follow these steps:
· Click Start > Programs > Accessories, then right-click Windows Explorer, and click
Properties.
· Under Target field, which reads %SystemRoot%\explorer.exe, add to make the line
read:
%SystemRoot%\explorer.exe /n, /e, /select, C:\
Close Multiple Windows
If you just opened a number of separate, related windows (a folder inside a folder,
and so on), there's an easier way to close them all than one-at-a-time:
· Hold down the shift-key as you click the X caption button in the upper-right corner
of the last window opened. Doing so closes that window and all windows that came before it
change fat -> ntfs
To change ur File system from command prompt
type: convert c:/fs:ntfs(ex:'c' is the drive letter)
A Wetpaint Site
Sign in to Wetpaint
Home
Discussions
Photos
Videos
News
Updates
Droplets
Members
Invite
Have a Wetpaint account? Sign in
Apply to be a Writer
Email page
Share this
XPHacking With Windows XP
So you have the newest, glitziest, "Fisher Price" version of Windows: XP. How
can you use XP in a way that sets you apart from the boring millions of ordinary
users?
The key to doing amazing things with XP is as simple as D O S. Yes, that's
right, DOS as in MS-DOS, as in MicroSoft Disk Operating System. Windows XP (as
well as NT and 2000) comes with two versions of DOS. Command.com is an old DOS
version. Various versions of command.com come with Windows 95, 98, SE, ME,
Window 3, and DOS only operating systems.
The other DOS, which comes only with XP, 2000 and NT, is cmd.exe. Usually
cmd.exe is better than command.com because it is easier to use, has more
commands, and in some ways resembles the bash shell in Linux and other Unix-type
operating systems. For example, you can repeat a command by using the up arrow
until you back up to the desired command. Unlike bash, however, your DOS command
history is erased whenever you shut down cmd.exe. The reason XP has both
versions of DOS is that sometimes a program that won?t run right in cmd.exe will
work in command.com
note : m not comparing bash to dos
DOS is your number one Windows gateway to the Internet, and the open sesame to
local area networks. From DOS, without needing to download a single hacker
program, you can do amazingly sophisticated explorations and even break into
poorly defended computers.
****************
You can go to jail warning: Breaking into computers is against the law if you do
not have permission to do so from the owner of that computer. For example, if
your friend gives you permission to break into her Hotmail account, that won't
protect you because Microsoft owns Hotmail and they will never give you
permission.
****************
****************
You can get expelled warning: Some kids have been kicked out of school just for
bringing up a DOS prompt on a computer. Be sure to get a teacher's WRITTEN
permission before demonstrating that you can hack on a school computer.
****************
So how do you turn on DOS?
Click All Programs -> Accessories -> Command Prompt
That runs cmd.exe. You should see a black screen with white text on it, saying
something like this:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\>
Your first step is to find out what commands you can run in DOS. If you type
"help" at the DOS prompt, it gives you a long list of commands. However, this
list leaves out all the commands hackers love to use. Here are some of those
left out hacker commands.
TCP/IP commands:
telnet
netstat
nslookup
tracert
ping
ftp
NetBIOS commands (just some examples):
nbtstat
net use
net view
net localgroup
TCP/IP stands for transmission control protocol/Internet protocol. As you can
guess by the name, TCP/IP is the protocol under which the Internet runs. along
with user datagram protocol (UDP). So when you are connected to the Internet,
you can try these commands against other Internet computers. Most local area
networks also use TCP/IP.
NetBIOS (Net Basic Input/Output System) protocol is another way to communicate
between computers. This is often used by Windows computers, and by Unix/Linux
type computers running Samba. You can often use NetBIOS commands over the
Internet (being carried inside of, so to speak, TCP/IP). In many cases, however,
NetBIOS commands will be blocked by firewalls. Also, not many Internet computers
run NetBIOS because it is so easy to break in using them. I will cover NetBIOS
commands in the next article to XP Hacking.
The queen of hacker commands is telnet. To get Windows help for telnet, in the
cmd.exe window give the command:
C:\>telnet /?
Here's what you will get:
telnet [-a][-e escape char][-f log file][-l user][-t term][host
[port]]
-a Attempt automatic logon. Same as --l option except uses the currently logged
on user's name.
-e Escape character to enter telnet cclient prompt.
-f File name for client side logging
-l Specifies the user name to log in with on the remote system. Requires that
the remote system support the TELNET ENVIRON option.
-t Specifies terminal type. Supportedd term types are vt100, vt52, ansi and vtnt
only.
host Specifies the hostname or IP address of the remote computer to connect to.
port Specifies a port number or service name.
****************
Newbie note: what is a port on a computer? A computer port is sort of like a
seaport. It's where things can go in and/or out of a computer. Some ports are
easy to understand, like keyboard, monitor, printer and modem. Other ports are
virtual, meaning that they are created by software. When that modem port of
yours (or LAN or ISDN or DSL) is connected to the Internet, your computer has
the ability to open or close any of over 65,000 different virtual ports, and has
the ability to connect to any of these on another computer - if it is running
that port, and if a firewall doesn?t block it.
****************
****************
Newbie note: How do you address a computer over the Internet? There are two
ways: by number or by name.
****************
The simplest use of telnet is to log into a remote computer. Give the command:
C:/>telnet targetcomputer.com (substituting the name of the computer you want to
telnet into for targetcomputer.com)
If this computer is set up to let people log into accounts, you may get the
message:
login:
Type your user name here, making sure to be exact. You can't swap between lower
case and capital letters. For example, user name Guest is not the same as guest.
****************
Newbie note: Lots of people email me asking how to learn what their user name
and password are. Stop laughing, darn it, they really do. If you don't know your
user name and password, that means whoever runs that computer didn't give you an
account and doesn't want you to log on.
****************
Then comes the message:
Password:
Again, be exact in typing in your password.
What if this doesn't work?
Every day people write to me complaining they can't telnet. That is usually
because they try to telnet into a computer, or a port on a computer that is set
up to refuse telnet connections. Here's what it might look like when a computer
refuses a telnet connection:
C:\ >telnet 10.0.0.3
Connecting To 10.0.0.3...Could not open connection to the host, on port 23. A
connection attempt failed because the connected party did not properly respond
after a period of time, or established connection failed because connected host
has failed to respond.
Or you might see:
C:\ >telnet hotmail.com
Connecting To hotmail.com...Could not open connection to the host, on port
23. No connection could be made because the target machine actively refused it.
If you just give the telnet command without giving a port number, it will
automatically try to connect on port 23, which sometimes runs a telnet server.
**************
Newbie note: your Windows computer has a telnet client program, meaning it will
let you telnet out of it. However you have to install a telnet server before
anyone can telnet into port 23 on your computer.
*************
If telnet failed to connect, possibly the computer you were trying to telnet
into was down or just plain no longer in existence. Maybe the people who run
that computer don't want you to telnet into it.
Even though you can't telnet into an account inside some computer, often you can
get some information back or get that computer to do something interesting for
you. Yes, you can get a telnet connection to succeed -without doing anything
illegal --against almost any computer, even if you don't have permission to log
in. There are many legal things you can do to many randomly chosen computers
with telnet. For example:
C:/telnet freeshell.org 22
SSH-1.99-OpenSSH_3.4p1
That tells us the target computer is running an SSH server, which enables
encrypted connections between computers. If you want to SSH into an account
there, you can get a shell account for free at http://freeshell.org . You can
get a free SSH client program from http://winfiles.com .
***************
You can get punched in the nose warning: Your online provider might kick you off
for making telnet probes of other computers. The solution is to get a local
online provider and make friends with the people who run it, and convince them
you are just doing harmless, legal explorations.
*************
Sometimes a port is running an interesting program, but a firewall won't let you
in. For example, 10.0.0.3, a computer on my local area network, runs an email
sending program, (sendmail working together with Postfix, and using Kmail to
compose emails). I can use it from an account inside 10.0.0.3 to send emails
with headers that hide from where I send things.
If I try to telnet to this email program from outside this computer, here's what
happens:
C:\>telnet 10.0.0.3 25
Connecting To 10.0.0.3...Could not open connection to the host, on port 25. No
connection could be made because the target machine actively refused it.
However, if I log into an account on 10.0.0.3 and then telnet from inside to
port 25, here's what I get:
Last login: Fri Oct 18 13:56:58 2002 from 10.0.0.1
Have a lot of fun...
cmeinel@test-box:~> telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1... [Carolyn's note: 127.0.0.1 is the numerical address meaning
localhost, the same computer you are logged into]
Connected to localhost.
Escape character is '^]'.
220 test-box.local ESMTP Postfix
The reason I keep this port 25 hidden behind a firewall is to keep people from
using it to try to break in or to forge email. Now the ubergeniuses reading this
will start to make fun of me because no Internet address that begins with 10. is
reachable from the Internet. However, sometimes I place this "test-box" computer
online with a static Internet address, meaning whenever it is on the Internet,
it always has the same numerical address. I'm not going to tell you what its
Internet address is because I don't want anyone messing with it. I just want to
mess with other people's computers with it, muhahaha. That's also why I always
keep my Internet address from showing up in the headers of my emails.
***************
Newbie note: What is all this about headers? It's stuff at the beginning of an
email that may - or may not - tell you a lot about where it came from and when.
To see full headers, in Outlook click view -> full headers. In Eudora, click the
"Blah blah blah" icon.
****************
Want a computer you can telnet into and mess around with, and not get into
trouble no matter what you do to it? I've set up my techbroker.com
(206.61.52.33) with user xyz, password guest for you to play with. Here's how to
forge email to xyz@techbroker.com using telnet. Start with the command:
C:\>telnet techbroker.com 25
Connecting To Techbroker.com
220 <techbroker.com> Service ready
Now you type in who you want the message to appear to come from:
helo santa@techbroker.com
Techbroker.com will answer:
250 <techbroker.com> host ready
Next type in your mail from address:
mail from:santa@techbroker.com
250 Requested mail action okay, completed
Your next command:
rcpt to:xyz@techbroker.com
250 Requested mail action okay, completed
Your next command:
data
354 Start main input; end with <CRLF>.<CRLF>
<CRLF> just means hit return. In case you can't see that little
period between the <CRLF>s, what you do to end composing your email is to hit
enter, type a period, then hit enter again. Anyhow, try typing:
This is a test.
.
250 Requested mail action okay, completed
quit
221 <techbroker.com> Service closing transmission channel
Connection to host lost.
Using techbroker's mail server, even if you enable full headers, the message we
just composed looks like:
Status: R
X-status: N
This is a test.
That's a pretty pathetic forged email, huh? No "from", no date. However, you can
make your headers better by using a trick with the data command. After you give
it, you can insert as many headers as you choose. The trick is easier to show
than explain:
220 <techbroker.com> Service ready
helo santa@northpole.org
250 <techbroker.com> host ready
mail from:santa@northpole.com
250 Requested mail action okay, completed
rcpt to:cmeinel@techbroker.com
250 Requested mail action okay, completed
data
354 Start main input; end with <CRLF>.<CRLF>
from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
.
250 Requested mail action okay, completed
quit
221 <techbroker.com> Service closing transmission channel
Connection to host lost.
The message then looks like:
from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
The trick is to start each line you want in the headers with one word followed
by a colon, and the a line followed by "return". As soon as you write a line
that doesn't begin this way, the rest of what you type goes into the body of the
email.
Notice that the santa@northpole.com from the "mail from:" command didn't show up
in the header. Some mail servers would show both "from" addresses.
You can forge email on techbroker.com within one strict limitation. Your email
has to go to someone at techbroker.com. If you can find any way to send email to
someone outside techbroker, let us know, because you will have broken our
security, muhahaha! Don't worry, you have my permission.
Next, you can read the email you forge on techbroker.com via telnet:
C:\>telnet techbroker.com 110
+OK <30961.5910984301@techbroker.com> service ready
Give this command:
user xyz
+OK user is known
Then type in this:
pass test
+OK mail drop has 2 message(s)
retr 1
+OK message follows
This is a test.
If you want to know all possible commands, give this command:
help
+OK help list follows
USER user
PASS password
STAT
LIST [message]
RETR message
DELE message
NOOP
RSET
QUIT
APOP user md5
TOP message lines
UIDL [message]
HELP
Unless you use a weird online provider like AOL, you can use these same tricks
to send and receive your own email. Or you can forge email to a friend by
telnetting to his or her online provider's email sending computer(s).
With most online providers you need to get the exact name of their email
computer(s). Often it is simply mail.targetcomputer.com (substitute the name of
the online provider for targetcomputer). If this doesn't work, you can find out
the name of their email server with the DOS nslookup program, which only runs
from cmd.exe. Here's an example:
C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11
> set q=mx
> dimensional.com
Server: DNS1.wurld.net
Address: 206.61.52.11
dimensional.com MX preference = 5, mail exchanger =
mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =
mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =
mx3.dimensional.com
dimensional.com nameserver = ns.dimensional.com
dimensional.com nameserver = ns-1.dimensional.com
dimensional.com nameserver = ns-2.dimensional.com
dimensional.com nameserver = ns-3.dimensional.com
dimensional.com nameserver = ns-4.dimensional.com
mail.dimensional.com internet address = 206.124.0.11
mx2.dimensional.com internet address = 206.124.0.30
mx3.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.10
ns.dimensional.com internet address = 206.124.26.254
ns.dimensional.com internet address = 206.124.0.254
ns.dimensional.com internet address = 206.124.1.254
ns.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.32
ns.dimensional.com internet address = 206.124.0.30
ns.dimensional.com internet address = 206.124.0.25
ns.dimensional.com internet address = 206.124.0.15
ns.dimensional.com internet address = 206.124.0.21
ns.dimensional.com internet address = 206.124.0.9
ns-1.dimensional.com internet address = 206.124.26.254
ns-2.dimensional.com internet address = 209.98.32.54
ns-3.dimensional.com internet address = 206.124.1.254
ns-4.dimensional.com internet address = 206.124.0.254
>
The lines that tell you what computers will let you forge email to people with
@dimensional.com addresses are:
dimensional.com MX preference = 5, mail exchanger =
mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =
mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =
mx3.dimensional.com
MX stands for mail exchange. The lower the preference number, the more they
would like you to use that address for email.If that lowest number server is too
busy, then try another server.
Sometimes when you ask about a mail server, nslookup will give you this kind of
error message:
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to [207.217.120.202] timed-out
To get around this problem, you need to find out what are the domain servers for
your target online provider. A good place to start looking is
http://netsol.com/cgi-bin/whois/whois . If this doesn't work, see
http://happyhacker.org/HHA/fightback.shtml for how to find the domain servers
for any Internet address.
****************
Newbie note: A domain name server provides information on the names and numbers
assigned to computers on the Internet. For example, dns1.wurld.net and
dns2.wurld.net contain information on happyhacker.org, techbroker.com,
securitynewsportal.com, thirdpig.com and sage-inc.com. When you query
dns1.wurld.net about other computers, it might have to go hunting for that
information from other name servers. That's why you might get a timed out
failure.
***************
Once you know the domain servers for an online service, set one of them for the
server for your nslookup program. Here's how you do it:
C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11
Now give the command:
> server 207.217.126.41
Default Server: ns1.earthlink.net
Address: 207.217.126.41
Next command should be:
> set q=mx
> earthlink.net
Server: ns1.earthlink.net
Address: 207.217.126.41
earthlink.net MX preference = 5, mail exchanger = mx04.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx05.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx06.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx00.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx01.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx02.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx03.earthlink.net
earthlink.net nameserver = ns3.earthlink.net
earthlink.net nameserver = ns1.earthlink.net
earthlink.net nameserver = ns2.earthlink.net
mx00.earthlink.net internet address = 207.217.120.28
mx01.earthlink.net internet address = 207.217.120.29
mx02.earthlink.net internet address = 207.217.120.79
mx03.earthlink.net internet address = 207.217.120.78
mx04.earthlink.net internet address = 207.217.120.249
mx05.earthlink.net internet address = 207.217.120.31
mx06.earthlink.net internet address = 207.217.120.23
ns1.earthlink.net internet address = 207.217.126.41
ns2.earthlink.net internet address = 207.217.77.42
ns3.earthlink.net internet address = 207.217.120.43
>
Your own online service will usually not mind and may even be glad if you use
telnet to read your email. Sometimes a malicious person or faulty email program
will send you a message that is so screwed up that your email program can't
download it. With telnet you can manually delete the bad email. Otherwise tech
support has to do it for you.
If you think about it, this ability to forge email is a huge temptation to
spammers. How can your online provider keep the bad guys from filling up a
victim's email box with garbage? The first time a bad guy tries this, probably
nothing will stop him or her. The second time the online provider might block
the bad guy at the firewall, maybe call the bad guy's online provider and kick
him or her and maybe get the bad guy busted or sued.
**************
You can go to jail warning: Sending hundreds or thousands of junk emails to bomb
someone's email account is a felony in the US.
***************
***************
You can get sued warning: Spamming, where you send only one email to each
person, but send thousands or millions of emails, is borderline legal. However,
spammers have been successfully sued when they forge the email addresses of
innocent people as senders of their spam.
****************
Now that you know how to read and write email with telnet, you definitely have
something you can use to show off with. Happy hacking!
Oh, here's one last goodie for advanced users. Get netcat for Windows. It's a
free program written by Weld Pond and Hobbit, and available from many sites, for
example
http://www.atstake.com/research/tools/#network_utilities . It is basically
telnet on steroids. For example, using netcat, you can set up a port on your
Windows computer to allow people to telnet into a DOS shell by using this
command:
C:\>nc -L -p 5000 -t -e cmd.exe
You can specify a different port number than 5000. Just make sure it doesn't
conflict with another port by checking with the netstat command. Then you and
your friends, enemies and random losers can either telnet in or netcat in with
the command:
C:\>nc -v [ipaddress of target] [port]
Of course you will probably get hacked for setting up this port. However, if you
set up a sniffer to keep track of the action, you can turn this scary back door
into a fascinating honeypot. For example, you could run it on port 23 and watch
all the hackers who attack with telnet hoping to log in. With some programming
you could even fake a unix-like login sequence and play some tricks on your
attackers.