A question about the WinVNC payload

[remkow]

I saw that a program called services.exe installs the WinVNC app as a service. My question is, what does it exactly do, and is the source code available?

This is because I am making my own payload, and services.exe is the only program that is still detected by my AV (trying to make a pyload that doesn't need to kill any antiviruses)

EDIT: i got it working without using services.exe, topic can be locked or whatever

[DLSS]

hey , i'm interested :D

if u succeed pls do release it !

(groetjes :D DLSS)

[pseudobreed]

Services.exe is part of Microsoft's OS. It's the program that actually installs, starts, stops, deletes services.

[remkow]

I am talking about the services.exe in the winvnc payload. This is probably a different program with the same name, because I don't think that antivirus software would detect a legit windows application..

[spektormax]

well considering I reslised it, servercies.exe is a modifed services, tit uses some weird registries to alwasy have r00t, use avkill it should work

[DLSS]

yeah but he wants to make a stick that install's vnc , without the need for a av kill and without the virus detectors going off ...

[spektormax]

it can be done, I was just lazy to do it, look at the hacksaw, follow the same struckture and use a registry in the run registery to auto run the winvnc. Its not hard, I jsut did it that way cuz I was in a rush

[remkow]

Can you tell me which registry entries are created/modified??

EDIT: nevermind guys, I've found a way to do it without even using services.exe

[DLSS]

Can you tell me which registry entries are created/modified??

EDIT: nevermind guys, I've found a way to do it without even using services.exe

can u release wot u've got ?

[remkow]

Yeah sure. I used regmon to to check what registry entries were created when the services.exe would be used, and I saw that they were exactly the same as those in vncdmp2.reg, meaning that the entire services.exe component was not necessary..

So I deleted services.exe, and removed it from services.bat in the VNCInstallfiles dir. I tried it out, and it worked just like it used to, without my antivirus going crazy :D

[geocine]

ill give it a try

[remkow]

lol, I forgot I made this topic :P

I do have to say that the installation doesn't occur correctly without the services.exe, not sure what the reason is though

[geocine]

i tried the payload and i didn't delete services.exe but it says failed to load or install service.. something like that i'll try to make a screenshot