GirlFriend details

  • Description

    GirlFriend 1.3 From the doc:GirlFriend 1.3 by General Failure1. DESCRIPTIONGirlfriend is a program which allows you to get information on applications running on remote PC. That means that if any computer connected to net is infected with GirlFriend - you can connect to this PC and "steal" such information as: - text, that "infected" user enters to any window containing password field; - passwords, which "infected" user enters to password fields. You also can: - send "system" messages to remote PC; - play sounds; - show bitmaps (.bmp pictures); - send "victim" to any URL; - change server's port; - hide GF Client with BOSSKEY=F12; - scan subnet for infected servers; - ping server; - save windows list; In future versions you'll find a file manager...GirlFriend 1.3 pack includes: a) GirlFriend Server (windll.exe) - this file is for "victim"; b) GirlFriend Client (gf.exe); c) help text file (gf.txt)2. HOW DOES IT WORK?GirFiend Server sits on infected computer and looks for windows in which user enters passwords. Server writes these passwords with other textfields in that window to registry and send this list on your demand.3. INFECTINGFirst you have to infect "victim": if you haven't physical access to victim's PC - send him windll.exe. You may rename it and/or attach it to any other executable file using silkrope (you may take it on www.netninja.com/bo/silkrope.html). When victim executes this file, GirlFriend will write itself to Windows' directory and rename itself to windll.exe. It also will write a string "Windll.exe=windll.exe" to HKEY LOCAL MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun in registry. GirlFriend Server will save all it's data in HKEY LOCAL MACHINESOFTWAREMicrosoftGeneral Ones victim runs GirlFriend Server - it will run every time when victim loads Windows. If you have physical acces to victim's PC - just run GirlFriend Server on it!4. CONNECTING FROM CLIENTTo connect to GirlFriend Server run GilrFriend Client (gf.exe) on your PC. Then in field "IP:" enter IP address of infected computer. In field "Port:" enter port which GirlFreiend Server "sits" on (default=21554). Then press "Connect" button. When client connects to server in statusbar "Connected to: " appears. If there will be message like "Error connecting to " - it means that server is not active (may be victim hadn't execute it?). You also can scan subnet for infected PC's writing ip like this: "194.83.11.1+ 254".5. COMMANDSWhen you are connected you can:- press "Show Passes" button. It will show a list of processes (windows) containing password fields with passwords and other textfields data in this window (e.g. window of remote access with Username, Password, Connection name, etc.).- press "Send Message" button. There will appear a windows with types of system messages which you can show on remote computer.- press "Reset Password List" button which deletes the server's password list in "victim's" registry.- press "Custom" button to enter custom commands to server. Here the list of them (instead of words in parentheses you have to write specified data( without parentheses)):TEST? - sends "Are you alive?" request to server. Server's answer in "Server's answers" list must be "Server is alive!"ver - asks for server's versionKillHER - kills server (clears registry from server, but it doesn't delete windll.exe from Windows' directory){U} - sends "victim" to specified URL (begin with "http://"){S} - plays specified "wav" file on "victim's" PC{P} - shows specified "bmp" file on "victim's" PCDOWN - switches "looking for passwords" timer on server OFF (server won't scan for passwords)UP - switches "looking for passwords" timer ONsetport - sets server port to specified one (identic to pressing "change" button)That's all I think... I don't remember more :)You can press F12 to tray client and then press on trayicon with right button to use these commands from popupmenu. Press "About" button to know "more" about this program. Press "Save list" to save windows & passwords list to text file.I think that's all what I can tell you about my program... If you'll have any questions/suggestions please write me to [email protected]! Regards, General Failure.P.S. Oh! I have forgotten to notice that it also takes passwords from Web sites which infected user inputs!

  • Alias

    Backdoor.GF.13Backdoor.GF.135.a

  • Exe

    gf.exewindll.exe