by Nick & Chris Graham
Written in Visual Basic
Compressed with UPX
Released in June 2001
CANG is a respectable remote administration tool, not a Trojan Horse. Important information about CANG that can't be determined from its command list is contained in this file. The command list is accessible from the client. CANG supports privileges and passwords: this is why it is respectable, as well as it having a user interface on the server (unless it is turned off for simplification reasons). For Network admins who need to work with firewalls, etc, the ports used by CANG are: 543 and 345. Recommended supplementary software: - WinVNC (Remote control as if you are at the other PC) - Garth (Telnet server, allows you to control a DOS prompt) CANG Works well with Netwatcher (Windows Remote Administration must be on). Netwatcher comes with windows. When "local files" are referred to, it doesn't mean a file necessarily on the clients computer, but rather a pathname which the clients computer can understand. The pathname might point to a directory on a accessible network computer: \\examplecomputer\exampleshare\windows\test.tmp The same goes for "remote files". When copying a file using "get" or "put" or "copy" the destination filename is required as part of the destination path. When using the filebrowser, the destination filename should only be appended to the path if it asked for: it is automated for the other commands. For Registry function, HKEYS must be given in the format of: LOCAL_MACHINE CURRENT_USER etc. Actually there is a little flexibility: case is worked around, and the HKEY_ prefix will be accepted. When saving to the registry, a special input box is put up on the client to requested a third parameter: what to write. These are the only commands that require a third parameter, which is why we haven't created a third parameter box. When filebrowsing, the filter defines what must be to one of the sides of the filename to see it. File browsing is no more than a user friendly front end to the file commands. The Server routinely checks to see if the file c:\disco.now exists. If it does, the client is disconnected. This allows a remote administrator to gain control of the CANG server in "an emergency" (only one client can access the server). For get_handle_match only one of the parameters is required, use "" for the other. Server: size: 25.088 bytes port: 543, 345 TCP startup: noneMegaSecurity