Summary and Research on telnet extension backdoor (1)

Backdoor, it sounds very high. Some programmers or program editors often set a webshell that they know when editing programs and conducting some network applications. Today, let's talk about the telnet extension backdoor. Currently, there are three popular telnet extension backdoors: winshell, wollf, and wineggdropshell. The three backdoors start with w. I don't know if it is a coincidence. below I will detail the functions, sizes, stability, advantages and disadvantages, and security comparison of these three backdoors.

The latest version of winshell is 5.0, so there should be no new version.

The latest version of wollf is 1.6 and has not been upgraded for a long time. It is very likely that there will be no more new versions.

The latest version of wineggdropshell is matrix. The author has extended the upgrade time since version 1.40. However, some useful new functions will be added to backdoors on a regular basis.

Author of three backdoors:

The author of winshell is jacker. The main masterpiece is winshell, and there are no other free works.

The author of wollf is wollf. The main masterpiece is wollf.

Wineggdropshell is written by wineggdrop and Hotmail. The masterpiece is the telnet extension backdoor. It has also been written into many gadgets, which are quite productive. The biggest feature of these gadgets is small, generally, the size of a widget is between 3 K and 8 K. The size of the widget is more than 20, and the backdoor can be completely mounted on a floppy disk.

Size comparison:

Winshell: After the server is compressed, it is only 6 kb, the smallest one.

Wollf: 56 k after compression on the server, which is not big.

Wineggdropshell: the latest version is 58 KB.

The size of wollf and wineggdropshell is almost the same, but wineggdropshell is much better than wollf in terms of hiding, because it is inserted into other processes for running, and the wineggdropshell backdoor itself is not seen in the process.

Function:

All three telnet extension backdoors are started as services and support simultaneous connections by multiple users.

Winshell: basically, there is no major function. It only provides download, get a shell of cmd, close it, and restart several functions.

Wollf, you can operate on the shell of cmd by yourself. the basic useful functions are viewing and killing processes, downloading through ftp or http, sniffing passwords, opening ftp services, and record keys.

Wineggdropshell: One of the most functional backdoors. Many functions are first introduced in telnet extension backdoors.

Stability:It is basically the same stability.

Security:

Winshell: the configuration information is stored in the file, which is encrypted and safe.

Wollf: the configuration information is placed at the end of the file, all in plain text, and the password is also in plain text, which is extremely insecure. People can get the server to know the connection password.

Wineggdropshell: the configuration information is placed at the end of the file, and the password is md5 encrypted. Because of the md5 features, even if the server program is obtained, the password cannot be obtained.

Advantages:

Winshell: small is the biggest advantage of winshell.

Wollf: It has reverse connections, which is a prominent advantage of wollf.

Wineggdropshell: wineggdropshell has many features, high hiding and rich online help.