| www.PESTy.cjb.net PEST HELP AND FAQ
About Getting Started Getting an IP address Using the Batch Editor About The Server Functions The MSN password stealer Test It Faq's The PEST community and rules | PEST V4.0 Remote Administration Tool for Win9x and XP (The servers are not 2000 compatible!) Help File by Glenn "Genoshin-GX" Chiu About PEST v4.0 is a remote client & server. It connects to a computer over a TCP/IP network (ie the Internet). To connect, the target computer must be running the server part of the PEST program. The server runs when windows starts up and is undetected by (most) virus scanners. PEST is one of the best Server & Client programs. Once you have connected with PEST, you have access to the remote computers hard disc, and a whole range of other options. You have full control over the victims PC! You can control the mouse, you can control nearly all aspects of the Windows O/S. You can open/close CD-ROM, you can get their saved passwords, you can get their computer info, you can change windows colors, you can send a messagebox, you can chat with your victim, you have full control over shutdown, you can even view the remote screen, and you can do much much much more! (This is not the what the program was built for (i.e. hacking) but it is fun and you should only do it when the other user agrees that you can connect to their PC - Genoshin-GX) Getting Started Before you begin to use PEST, you must understand that the software is beta-class, and as such is provided as-is and is not supported. The PEST team cannot take any responsibility for any damages to software, hardware or persons through use of this software. Use at your own risk! First off, locate the file that you downloaded from www.pesty.cjb.net or any other site. Now extract the files using Winzip or another compressed archieve extractor, if you haven't done so yet. Then open the folder that you extracted the files to. Now look at all the files and you should have these files: PEST v4.exe Server.exe Windows XP server.exe EdtSrv.exe Portscan.exe Help.html If you do not have any of the above files, you can download the full zipped version from the official site at www.pesty.cjb.net Once you are sure you have all of the above files, you need to go over all the files and check what they do. Edtsrv-This edits the server that your going to infect the victim with. Portscan-Is a port scanner. Server-This is what receives commands from the client and you infect your victim with it. Help-This is the help file. Legal-This is the legal information file. update notes-This is the misc notes file. Now that you know what every file does, open Edtsrv.exe. Now, goto open and browse to the server.exe and select it. Now click on Read server settings. Then you can modify the servers settings: Enable ICQ Notify UIN Server Port Server Filename RegistryKeyname Upload/Download Port Install Directory This is what each option does: Enable ICQ Notify-Pages you the victims IP via ICQ everytime the victim comes online. UIN-This is your ICQ number (required if Enable ICQ Notify is enabled) Server Port-This is the main port that the server is on. Example: 11831 (Required to connect) Server Filename-The name of the server after its installed on the victims computer, don't make it easy to guess its a Trojan like: Trojan.exe lol use something like mshtml.exe ;-) Registry Keyname-This is the name of the key in the registry from where the server starts with windows. Upload/Download Port-This is the port so you can view,delete,upload,download files on the victims computer. Example: 29559 Install Directory-This is the place where the server is installed after it is opened. System directory is: C:\WINDOWS\SYSTEM\ Windows directory is: C:\WINDOWS\ This is not really important. Now Fill Out The Server Settings After Your Done Click On Save new settings. Now you need a victim to infect. This is the hard and yet fun part. Using MSN messenger to get a victim: MSN messenger is one of the best ways of infecting a victim. You just need to find someone on your contact list, and use 'send file or photo' to send them the 'server.exe' file. Don't forget: You can rename the server file to anything you like, as long as the filename ends .exe (e.g. call it mypic.exe) Unless you choose ICQ notify in the server settings, you will need to get the victims IP address. This is usually the tricky part. Take a look at Getting an IP address - by MonkeyCircus for information on how to get their IP. Using a chat room: There are many strategys for infecting people in chat rooms. By far the best is to pretend to be a girl (unless you are a girl) and trick the victim into accepting the file, telling them that it is a picture of you. Pretending your a girl might sound gay, but it nearly always works. The basic trick is to ask people in the chat room to cyber with you on MSN messenger or AOL messenger etc. And then send them the file over that program. Refer to 'Using MSN messenger to get a victim' for more information. Once they hve recieved and run the file (The file must be run!) then you can connect. Find the file PEST v4.exe and run it. This will open up the client on your cmoputer. When the client is open, select the text box at the top left, where it says 'IP:' and type in the victims IP address. You may also change the ports if you did not use 11831 and 29559. Now, click the connect button (below the IP text box). When the status bar at the very bottom of pest says 'Connected' then you have complete control over the remote computer. hope this was helpfull to you. How to get an IP address - by MonkeyCircus There are many ways of getting an IP address. I will explain here a few ways to get an IP from your victim. Method 1.) Netstat - Old reliables. Netstat is by far the most reliable way of getting an IP address. Heres how to use it: In windows, goto start>programs>MS-DOS prompt. You will see a black DOS box appear. You should see something similar to this: C:\WINDOWS\ and a blinking cursor. When your connected to the internet, type in: netstat -n and press enter. If it works, you will see a list of all the IP's your currently connected/connecting to (if you get a response: bad command or file call, then you cant use this method of getting IPs, skip this method and have a look at some others). Now, if your using a instant messaging service to send the victim the server (e.g. MSN messenger or yahoo! messenger etc.), you can use netstat to find out their IP. WHILE the server is sending to the victim, goto dos and type: netstat -n The list of IP's will appear. The victims IP is one of the addresses under the foreign coloum. REMEMBER: YOU MUST DO THIS WHILE THE FILE IS STILL SENDING! Now, how can you tell which is your victims? The simple and obviouse way is to wait until they have the file and then go through each IP in pest until you get a connection. An advanced user wont need to do this. Advanced users can easily spot the address, becuase of either the connection status, the prefix of the address or the port that the address is on. You dont need to confuse yourself with that though. IMPORTANT NETSTAT NOTE: When you copy down the IP address from netstat, DONT COPY the colon and any numbers after the colon. The colon and numbers after it represent a port. For example: if netstat says 125.63.624.747:6891 then the IP address is 125.63.624.747 Method 2.) The easy way - "the picture doesn't work' method ;-) This method is not very reliable, but is by far the simplest way. If you have told your victim that the server is a picture (hehe), then you can use this method. Basically, when the victim runs the server, it will appear to them that nothing has happened. So, they will probably say something to you like: 'It doesnt work'. WHen they say this, say: 'oh, i know whats wrong, it does this on my computer sometimes. Goto start>run and type in winipcfg and click ok. Then tell me the number next to where it says IP address and I will fix it for you.' If they fall for that, then they should tell you their IP. HA! (In XP use: Go to start -> Programs -> dosprompt (where paint is) then type IPconfig - Genoshin-GX) Method 3.) ICQ and UIN If you have ICQ, you can edit the PEST server (as explained earlier in this help file) so that when they connect to the internet, the server pages you their IP address. This is an easy method and is already explained earlier in this help file, so thats all i need to say. Method 4.) IRC scripts The best way of getting an IP is from IRC. Just type /Whois NICKNAMEHERE and the IRC server will tell you their IP or host name. Usually like this: NICKNAME@223-532-646-243.aol.ipt.com If there is no visible IP address, open a DOS box (like in netstat) and type PING thestuffafterthe@here and it will reveal the correct IP. Using the Batch Editor - by MonkeyCircus What is the Batch Editor? The batch editor is a tool which allows you to write a mini-program and execute it immediatly on the remote computer. What is a Batch File? A Batch File is a file which contains a list of DOS commands. When you run the file, Windows will open a DOS prompt and execute the list of commands automatically. The file uses basic dos commands, some examples of DOS commands are given in the example code in the PEST v4 client. Why is this usefull? This is usefull becuase it will allow you to run several commands very, very quickly. It also allows you to create your own addon functions for PEST. The batch editor has thousands of possible uses, use your imagination. Example code There is an example in the PEST v4 client, but here is another quick program sample. This one backs up the directory 'pesttest' and then deletes the original. @ECHO OFF ECHO Now backing up c:\pesttest to c:\pesttestbk Copy c:\pesttest\ c:\pesttestbk\ ECHO Back up complete, now deleting original directory Del c:\pesttest\ ECHO Task completed, PAUSE About The Server First we will start with Server #1 Then we will goto Windows XP server Server #1 This is the windows 9x compatible server. How the server works: When the server file is executed, it copys its self into the installation directory and adds a start-up key to the registry. Then, it opens the specified port and listens for instructions. When you connect with the client, and choose a function, the client sends a simple text message to the server. When the server recieves this message, it reacts accordingly. In simpler terms, this is what happens: Server recieves text message Server compares the message to its list of possible messages it can recieve The server finds a match, and executes the function. Something like this: If recievedmessage = 'opencd' then /Code to open CD here/ That is all that the server does. It does nothing else (besides a few other start-up installation functions). Some functions also require the server to send information back to the client, but that is more complex. Windows XP Server Windows XP is a very annoying product. It has many compatibility issues with the 9x build of PEST. If you want to use PEST with XP, the only viable option is to use PEST Professional, which can be downloaded in the remote administration tools section of the PEST site at www.pesty.cjb.net Functions This is a discription of each function included in PEST v4.0. Server Options This contains some options to remove/restart the server on the remote computer. Close Server - Shutdown the server (note that it will still load up with windows next time the computer is booted) Restart Server - This closes the server, and then re-installs it. Remove Server - This completly removes the server from the remote computer perminantly. Boot Manager This contains some options to shutdown/restart the remote computer. Shutdown Windows - Shutsdown the remote computer Log off Windows - Logs the current windows user out of windows Reboot System - Reboots the computer Force Windows Shutdown - Forces windows to exit NOTE: may result in any open programs loosing unsaved data. Lock up Windows - Disables all running windows operations by killing important running tasks of the system. Remote Information This reports information from the remote computer. Retrieve Information - Retrieves all information from remote system Windows Folder - Where windows is installed on the hard disc System Folder - The /System folder in the windows folder Temporary Folder - The folder where temporary files are stored Windows Version - The version of Windows currently on the system Windows Product Key - The validation key for installation of Windows Time in Windows (mins) - Number of miniutes the system has been running for Computer Name - Current name of the computer Windows user Name - Name of the current Windows user that is logged in CPU Name - Name of the make/model of Central Proccessing Unit currently installed in the system Windows Language - The language that windows is currently using Web Browser - The defualy web browser installed on the system IE Home Page - The Internet Explorer home page Screen Resolution - The current dimensions of the interface Numlock state - Current state of the NumLock key (on/off) CapsLock state - Current state of the CapsLock key (on/off) Scrolllock state - Current state of the ScrollLock key (on/off) Sound Available - Is there a sound card installed in the system (yes/no) Defualt Printer - Name of the defualt printer installed in the system Current Remote Time - Current date/time on remote computer DirectX Vesion - Current version of DirectX installed Workgroup Name - Name of current LAN workgroup the computer belongs to Free HDD space - Current amount of space free on the computers hard discs Local Host - The local network servers computer name Clients Connected - The number of PEST clients connected to the PEST server Clear - clears the information from the PEST client Save as... - Saves the informaion into a text file Misc. Controls A collecion of standard windows controls DeskTop (Show/Hide) - Shows/Hides all desktop icons Start Button (Show/Hide) - Shows/Hides the Windows start button TaskBar (Show/Hide) - Shows/Hides the taskbar Task Icons (Show/Hide) - Shows/Hides the taskbar icons Task Clock (Show/Hide) - Shows/Hides the clock on the taskbar Task Rebar (Show/Hide) - Shows/Hides the task rebar CD-ROM (Open/Close) - Opens/Closes the CD-ROM tray CTRL + ALT + DEL (On/Off) - Enables/Disables CTRL+ALT+DEL key combo ScrollLock (On/Off) - Turns the scrolllock function on and off CapsLock (On/Off) - Turns the capslock function on and off NumLock (On/Off) - Turns the Numlock function on and off Monitor (On/Off) - Turns the monitor on and off More Misc. Controls Some more standard Windows controls Execute screensaver - Runs the current Windows screensaver Open Start Menu - Opens the start menu Remove Desktop Wallpaper - Removes the wallpaper from the desktop Minimize all Windows - Minimizes all the windows on the desktop Disable Screensaver - Disables the current Windows screensaver Disable Keyboard - Disables the keyboard (cannot be enabled without system reboot) Set IE Home Page - Sets the Internet Explorer home page to the text in the text field Open Web Browser - Opens the defualt web browser at the page set in the text field New Computer Name - Sets the computers name to the text in the text field - Requires reboot to take effect Remote Clipboard Manger Some functions which control the remote copy and paste clipboard Read Clipboard Text - Reads any text currently on the copy/paste clipboard Set Clipboard Text - Sets the clipboard text to the text in the large text field Empty Clipboard - Clears the contents of the remote clipboard Lock/Unlock Clipboard - Disables and Enables the remote computers copy and paste clipboard Remote Data/Time Various date and time related functions Set - Sets the remote time to the text/combo box values Read current time and date - Reads the remote computers time and date Remote Mouse Manager Various Mouse related functions Reverse Buttons - Reverses the left and right click functions of the remote computers mouse Restore Buttons - Restores the normal left and right click functions Enable Crazy Mouse - The mouse pointer goes crazy Disable Crazy Mouse - The mose pointer stops going crazy Lock Mouse - Locks the mouse pointer Unlock Mouse - Unloacks the mouse pointer Move Mouse (start/Stop) - The remote computers mouse pointer mimics the movement of your mouse pointer Double Click Speed (read/Set) - Read/Set the remote mouse double click speed System Message Manager This allows you to display system message dialogs on the remote computer. Message Icon - The image displayed on the message dialog Available Buttons - The buttons that the user can click on the message dialog Message Title - The text that appears in the dialog title bar Message Text - The main text of the message Test Message - Text the message on your computer Send Message - Send message to remote computer. When a button is presses, the result will be reported in the PEST client satus bar. Remote Windows Manager Allows you to control the remote computers task list Show all Apps. - Shows all the tasks running, not just active windows. Refresh - Refreshs the list of applications Close - Close the selected window. Disable X - Disables the X button of the selected window. Disable - Disables the selected window. Enable - Enables the selected window. Hide - Hides the selected window from the user Show - Shows the selected window. Focus - Brings the selected window to the top of the desktop. Maximize - Makes the window fit the screen dimensions. Minimize - Minimizes the window to the taskbar. Change Window Title - Changes the title of the application to the text in the text field. Remote File Manager Go - Goes to the drive that you give. Root - Goes To C:\. Get Drives - Get all the drives that the victim has on their pc. Show Path - Showes the full path (not just the name). Run - Runs the selected file on the victims computer. Delete - Deletes the selected file on the victims computer. Delete *. * - Deletes all files in the current directory Get size - Gets the selected file size. Set Wallpaper - Sets the the wallpaper to the selected image. Play WAV - Plays the selected WAV file. Create Dir - Creates a new directory. Download - Downloads the selected file to your harddrive. Upload - Uploads a file from your PC to the victims pc. Chat to Remote User Open Chat With Victim - Opens a chat window and you and the victim can talk. Remote Keylogger Auto Scroll - Scrolls the text down when a new text line is displayed. Enable - Enables Keylogger (tracks the keys pressed by the victim). Disable - Disable Keylogger. Clear - Clears the text you have gotten so far. Save As... - Saves the text to a file. Remote Printer Manager Bold - Prints the text bold. Italic - Prints the text italic. Underline - Prints the text underlined. Strike - Prints the text striked out. Font Size - Prints the font size as big as you put. Print Text - Prints the text you just made on the victims printer. Get Remote Passwords Get RAS pwds - Get stored passwords on the victims computer (stored passwords) Get cache pwds - Get saved passwords on the victims computer (passwords currently in the system cache). Clear - Clears the text that is displayed. Save As...- Saves the text to a file. Remote Windows Colors Menu Colors - Changes the start menu, and other menus color to what is selected. 3D Face Color - Changes the taskbar, buttons color to what is selected. Window Color - Changes the window background color to what is selected. Desktop Background - Changes the desktop background to color to what is selected (Victims wallpaper needs to be "none" or else the desktop background color will not work). Print In Remote Screen Center Of Screen - Places the text that you create in the center of the screen. Custom - Places the text that you create in the X & Y that you define. Back Color - Changes the text background color to the color selected. Font Color - Changes the text color to the color selected. Font Size - Changes the font size to the selected size. Print Text - Prints the made text onto the screen. Clear - Clears the textbox value. Remote RAS Manager Refresh - Refreshes the list of RAS. Rename - Renames the selected RAS. Delete - Deletes the selected RAS. Show "Edit" Dialog - View the Internet setup dialog. Hang Up Connection - Disconnect the Internet Connection. Show 'New Connection' Dialog - Shows the make a new connection screen (this screen is where you make a new I.E. connection). Remote ScreenCapture Connecting -The pest server is split into two parts, so if one part of the server is shut down, you still have partial-control (some technical stuff). The screencapture server is seperate from the other functions, so, you have to connect again. The IP address is the same for this connection (of course :-)) All you need to do is type in the IP address of the victim and click connect. ScreenCapture Basics - The purpose of screencapture is to allow you to view the victims desktop, as they can see it on there monitor. This is one of my favorite parts of PEST. When you connect to the screencapture server, the screen refreshes automatically. You will now see a screenshot of the victims desktop. Hehe! Refreshing the screen - To update the image, click the button with the circular arrows on. This will start a new screenshot download, and within a few seconds, you should see the screen update. Sometimes, the screen becomes scrambled (the reason for this is highly technical, to do with the way it updates the image). To fix this, either reconnect to the screencapture server, or press the button with the down arrow on (to do a complete refresh). Streaming Images - This will automatically update the image every few seconds. You can choose the number of seconds between each refresh in the box below. NOTE: setting the seconds too low will cause the screen to scramble as explained above. Disconnect - This disconnects you from the screencapture server, clicking again prompts you to reconnect. Save screenshot - Click this button to save the screenshot to your hard disc! So you can remember the time you hacked your friend ;-) Image Options -This allows you to choose the format of the image, from the following selections: greyscale (4-bit) greyscale (8-bit) color (4-bit) color (24-bit) Greyscale (4-bit) is by far the fastest option, but has no color. Color (24-bit) is true color, but is much slower. Find Remote Files Look For - Supply what you want to try to find on the victims pc. Look In Folders - This is not required but it narrows your search down. Supply a folder to look in. Search In Subdirectory's - Search in sub-directorys of the choosen search folder. Find! - This starts the search and tries to find the file you suppled. Download Selected! - Download a file you found on the victims harddrive to your computer. Clear - Clears the search results. Remote CPU Manager Clear CMOS - You know when you turn on the computer, you see all that white writing saying detecting IDE etc. Well that is all controled by a program stored on the motherboard called CMOS. CMOS is the computers BIOS (Basic Input Output System). Without CMOS, the computer will do nothing at all when you turn it on, and reairing the 'damage' is expensive. Clear CMOS will delete the CMOS program from the motherboard. ONLY USE THIS OPTION IF YOU KNOW WHAT YOUR DOING. Enable CPU Beep - This makes the victims computer beep like holding down Ctrl-Alt-Del But it last forever! Disable CPU Beep - Disables the beep. Matrix Emulator Mimics the scene in the file 'The Matrix' where the computer talks to neo in green writing. You can choose to allow the user to talk back. In windows 9x the black screen that appears is un-closeable and cannot be escaped. Remote MSN manager This allows you to partially control the remote users MSN messenger program. You can choose to sign the user out (so when they sign back in, you can read their password on the keylogger) as well as change their status. There is also a online/Offline flooder. This is a very simple tool that can be used to annoy the victims MSN contact list. When this is enabled, their status changes from online to offline and back again very quickly, causing a multi-popup box effect on all of their contacts computers. This will make them very unpopular ;-) Test It On Your PC You can run the server on your own computer. The server is not lethal in anyway. You can then connect to yourself with the client using the address 127.0.0.1 You do NOT have to be online to test the server on yourself! This is for people worried about other people connecting to the system. Once you have finished testing, just goto server options in the pest client and click remove server, then, when prompted, click OK. Then the server is completly removed. Faq's Q. Does PEST's server screw your machine up? A. No, all the server does is receives commands from PEST. Q. When I am using screencapture, the screencapture goes all scrambled and weird, whats wrong? A. This is becuase the screencapture client is updating the image serveral times at once. Heres how to fix the problem: press the button with the down arrow once and wait a few seconds, if this doesnt fix it, press the red-cross button to disconnect, and then reconnect to the screencapture server. Everything should now be fine :-) Q. When using the server on Win2000, my computer crashes when I try to shutdown, why? A. MonkeyCircus is working on this problem. As noted at the top of this FAQ, the servers are only Win9x and XP compatible. Q. Can you connect to a server offline? A. No, there will be no connection to the server. Q. I infected my self how do i delete the server? A. Quite simple just log onto your IP or 127.0.0.1 as an IP and connect to your self. Then go under server and click remove server. When a messagebox comes up say yes. Now your not infected any more :-). Q. What dose IP stand for? A. Internet Protocol Address. This is a 32bit number Q. Are the PEST servers backward compatible? A. Yes. You can connect to a PEST v1 or v2 server with PEST v4.0. To get access to the new functions, however, you will need to update the server with the new v4.0 version. Q.Is this Remote Administration Tool Program free? Basically yes, but if you have anything to donate you can contact us anytime to support us to build more tools/programs. Q. How can I contact MonkeyCircus? A. You can email MonkeyCircus at monkey@monkeycircus.cjb.net The PEST community and rules You can take part in forums discussions about PEST on the pest website at www.pesty.cjb.net. The PEST IRC chat room The PEST chat room is on the webstite at the above address. If you have mIRC you can access it on irc.mircx.com #PESTy.cjb.net RULES OF THE PEST COMMUNITY 1.) Spamming will get you a perminant ban. 2.) Impersonating PEST staff will also result in perminant ban. 3.) If we find that the chat room is constantly abused by visitors, it will be shutdown. 4.) DOS attacks or any other attempt to hack or crack the PEST website or IRC chat facility will result im much more than a ban ;-) CREDITS PEST v4.0 design, coding: MonkeyCircus - Im usually around on the IRC chat room and Forums, or you can email me at monkey@monkeycircus.cjb.net If I catch anybody impersonating me or any other staff member, you better go where I cant find you ;-) PEST testing: Rabid Tangerine - Im usually around on the forums and IRC chat room Genoshin-GX - Me too, hehe MonkeyCircus can build LAN/WAN networking software to requirements, if you are interested in free networking software, e-mail MonkeyCircus at monkey@monkeycircus.cjb.net Thank You And I Hope This Made Your Life Easier With PEST!