'Net Send' messages over the web

[Chilling_Silence]

I had CyberChuck ask me earlier this evening if I'd had any.. and I think i just got one.

I was in ICQ Lite chatting.. and typing real fast... as you do.

Now, I had a beep and a window appeared on my screen. I dunno what it was coz I hit space pretty quickly, but I missed the last 3 letters on the word i was writing in ICQ, and so Im assuming that I got sent one. ICQ is the only thing open and Ive got one contact who's actually talking to me, the rest are simply permanently online. It was too small to be an ICQ window (Yes, i noticed the size was about half what I have my ICQ windows at) and it made a 'ding' when it appeared.

Sent myself a message and it came up in the same place (Center of the screen) and made the same ding.

Now, is this a flaw in the OS?

How is it possible?

Can I do it at home?

Who may have sent it to me, and what about?

Anybody care to comment???



Chilling_Silence

[-=JM=-]

I know that 2k/xp can do it, not sure about earlier NT based OSs and I haven't tried on Server 2003 or Longhorn. 98SE needs to run winpopup before it can receive them.

If you received one on the net there is a good chance that you don't have an adequate firewall ;).

As far as I'm aware it is actually done by way of a text file being sent with a special windows share type thing. It is possible to spoof senders *looks at program a mate wrote*.

A netsend message is sent by going net send <IP/ComputerName> <message> and it will send the message.

At the college I was at last year these messages were used A LOT. Was very handy for communicating with people in class.

The reason for netsend spam to have only started fairly recently (since XP released) is that up until then the majority of home users were using a Windows 9x based OS. Now with XP theres a whole heap of people that can receive these messages.

It is possible to disable the messenger service in XP which will mean that you could no longer receive them. I personally like having the ability to recieve them and will some times inform my firewall to allow the message in.

I recommend looking at what sort of firewall protection you have as I don't think it could be all that much if you received the message.

[Chilling_Silence]

Well, I dont use a firewall at the moment.. Im connecting at 28K on a 56K modem, so nobody could really hack the PC in a hurry, im not gonna worry til I get ADSL.


Ive been having some fun though with CyberChuck...

He gave me his IP address, and told me to Net Send to him.

I did, and it worked.. Just typing:
Net Send CC's_IP message_goes_here

So I thought "Why not try and take it one step further"?

So I made a batch file to send it to CC's IP address (ending in .31) and this Batch file sent a message to:
.31 (CC)
.32
.33

The IP ending in .32 got my message, so Im assuming it was running an NT-Based system, wherea .33 timed out.

Could the culprits simply be doing this?

Could this possibly be classed as Spam in the future?

Any comments?

[sal]

> Could this possibly be classed as Spam in the
> future?
>
> Any comments?

the future is now, spammers have been using this method for a wee while

http://www.uwm.edu/IMT/purchase/itpsfaqs/msgservice.html

grtz sal.
tga

* im been offline for a while due to poorness and an overdue isp account :(

[-=JM=-]

Yeah they'll pretty much just do a big mass send out to lots of IP addresses.

The other really annoying one is when you're at a LAN playing games and someone sends you a message :_|

[PoWa]

Heres one sort of spam from the messenger....results in a type of DOS attack.. great for getting back at someone that pissed you off, and their on your LAN (aka polytech haha)..

Try this on yourself

Run -> Cmd

type in
for /L %i IN (1,1,150) DO net send IP_ADDRESS_OR_NETWORK_NAME %i

That should send the messages 1,2,3,4,5,6 etc up to 150.

If you get bored of clicking enter remove the messages..type in
'net stop messenger'

[promethius]

you could write a batch file to do it automatically...

:label
start net send IP MSG
goto label

....hehehe when you put the start bit in...it starts a new message before the fist one is completed...so you get a zillion of em...and they dont stop!!!

[promethius]

...hmm, maybe i shouldnt hav posted that on a public forum...

[PoWa]

haha good one promethius...will try tomorrow lol

[-=JM=-]

I'd just have to say that one should be VERY careful with batch files to do this.

Last year we used netsend messages A LOT. Ofcourse we started to use batch files and bomb people. Anyway, some fool left their computer logged in when they'd gone home. This person had done this quite a lot of times. So someone decided to teach them a lesson. Some creative editing was taken to on this batch file. :D

This was the result (http://geek.orcon.net.nz/pressf1/retard.bmp).

[-=JM=-]

Just to add to that. CCC is the workgroup so it went to EVERY computer in the college.

[promethius]

LMAO...yea I hav had to restart my computer b4...

[PoWa]

why do you need for them to leave their computer open?? If your workgroup has average computer security u can telnet into their machine and run the batch file from there...

Result..the message appears to come from their machine anyway ;)

[-=JM=-]

> why do you need for them to leave their computer
> open?? If your workgroup has average computer
> security u can telnet into their machine and run the
> batch file from there...
>
> Result..the message appears to come from their
> machine anyway ;)

Well we couldn't do that. hmmm maybe we could've done that with the admin shares. But it was better to see the look on the guys face when he ran his batch file to bomb someone and instead it sent a message to everyone saying "I'm a retard".

As for using telnet and running from another machine. Using a spoofer is easier.

[stu140103]

Can that be done with a win 98 or ME computer at all??
Or does that only happen with NT based computers???

[-=JM=-]

You'll find that you'll need to run winpopup before the 98/me can receive the messages.

[PoWa]

A spoofer?? whats that? how do I get a hold of one?

[nz_liam]

Ah yes, net send; a very handy tool.

I often use it to announce network wide messages, (my network is on 192.168.1.XXX, so I net send 192.168.1.255 to reach everyone).

Here's a copy of a batch file I made if anyone wants it, just paste it into notepad and save it as net_send.bat net send <IP_ADDRESS_HERE> <MESSAGE_HERE>
net_send.bat


Cheers

Liam

[Chilling_Silence]

> Try this on yourself

Well, Im glad I didnt.....

> Run -> Cmd
>
> type in
> for /L %i IN (1,1,150) DO net send
> IP_ADDRESS_OR_NETWORK_NAME %i
>
> That should send the messages 1,2,3,4,5,6 etc up to
> 150.

Yep, it does... was great fun watching all those 150 clicks over rAdmin :-)

Can I send a batch message to everybody on a certain IP range, like everybody on192.168.0.xxx coz I run a couple of different Workgroups on that one IP range...
That was great though, i wonder if I can memorize it!
Are there any other things like that which can be done with net send?

[promethius]

> Can I send a batch message to everybody on a certain IP range, like everybody on192.168.0.xxx coz I run a couple of different Workgroups on that one IP range...

Yes...just send it to 192.168.0.255 and eveyone will get it..

[nz_liam]

&gt; &gt; Can I send a batch message to everybody on a
&gt; certain IP range, like everybody on192.168.0.xxx coz
&gt; I run a couple of different Workgroups on that one IP
&gt; range...
&gt;
&gt; Yes...just send it to 192.168.0.255 and eveyone will
&gt; get it..

Except when you network has had the 255 broadcast-to-all thinge disabled, as we do at AUT :(

[Chilling_Silence]

Yeah.. Mine does, how do you enable it?
Running XP Pro on the Gateway PC (Used for ICS and DHCP).

Cheers!

[PoWa]

Another useful this you can do is:

*Don't* Try this on yourself

firstly you'll need to telnet into their machine if you can..
right click on 'My Computer' select manage.. then type in 'open IP/Name'
then in the services section...and start up their telnet.

Now go to
run -> telnet
type in
open IP/NetworkName
then type in
for /L %i IN (1,1,1000) DO explorer.exe

That should cause explorer to crash nicely...making them have to reboot...hahaha

[PoWa]

Also if you telnet into them, you can make it appear as though you are sending messsages from their machine...

Its funny when they get messages from their own computer saying 'hello self' etc they don't have a clue! bwhaha

[Chilling_Silence]

Only problem is that XP is usually smart enough to restart Explorer, and in 2K its easy enough to re-do it without rebooting ;-)

[PoWa]

Oh no restarting explorer won't help...no way :)

It brings up 1000error boxes saying soemthing about failure in some dll that can't be removed unless you either, click 1000 times...or reboot.

Tested on win2000 machines, works like a dream :)

[Chilling_Silence]

LOL - I'll use that on the other PC's when I know that Im not online.. I dont wanna be cut off by killing the Gateway PC ;-)

[promethius]

> right click on 'My Computer' select manage..

If you can manage their machine, then you should be able to just click restart, shut down or log off (remote computer). Not as exciting as your way, but confusing for the poor victim...lol...

[somebody]

Is it possible to send a message using "Net Send" to a Win98/95 machine, IF Winpopup is open? I couldn't get it to work... but has anybody had any luck?

[PoWa]

Promethius I've been meaning to ask you....if you manage their computer remotely, where is the command to make the other computer shutdown or log off???

I Can't find it - lol