How do I send Windows Messenger Pop-Ups?

[Liquid_Darkness]

Over the past few months my friends and I have been recieving these popups that advertise things, often show the IP of the host computer and some even offer links to sites for blocking these messages.

These are not java popups or anything of the sort, they are actually generated by windows. It reminds me of the old messenger service from windows 95 through port 139 or something that gave way to the classic "Win Nuke" attack. These popups are

Doing some research I have found ways of blocking it but that isnt really what I want to know. I could easily do this with a firewall or turning off the service. What I am curious about is how to actually send them. Is there a client for it? Do you do it through the command prompt?

here is some links to info on what I am talking about...

http://help.twspeed.com/security/messengerflaw.asp (This one explains the popups and has a picture)
http://www.defeatpopups.com (This was a link on one of the popups.. trying to sell me software to dissable popups THEY are sending me)


So if anyone knows how they are actually SENDING the messeges I would be really gratefull. I dont intend on spamming anyone, I just want a better knowledge of what these guys are doing to me and how.

Well upon more research I have found quite a bit more info. I know now that the advertisers use comercial software that can send these to a range of IP adresses. I dont want the software, i just want to know how it works. It must be a relativly simple command. I even found a popup tester that does it through an ASP script here:

http://www.mynetwatchman.com/winpopuptester.asp


And this site talks about the spammer themselves:
http://www.mynetwatchman.com/kb/secu...spam/index.htm


Does anyone know how to send a message to a remote computer?

[roswell1329]

Here's how to do it from the command line:

net send [machine name] message

To send a message saying "Hello World" to the machine called "monkey" on my local network, I would do:

net send monkey Hello World!

You may be able to supply an IP address for the machine name, but I think the default is a netbios naming convention which would make it non-routable. I would imagine that any .asp page would be able to activate the net send command from your system since .asp is basically just visual basic running on your local system. They wouldn't have to attack you across the network, your machine is running the .asp code, so they could simply execute a net send from within the page itself, or so it would seem to me. I'm not an expert on .asp code.

I've also heard rumors about MSN messenger being able to carry those kinds of commands, although that's just something I heard. I don't use MSN enough to know the validity of that.

[DjM]

There is a package availabe which automates this process. There is some fairly good information on the net send command and the package HERE


Cheers:

[cross]

I was also interested in these pop ups, so i've done a little research. They can be done with net send, like roswell1329 said, but this will not go accross the i-net, only within a network... I have found a few programs such as Broadcast Marketer Broadcast Marketer Site. Their client will (supposedly) send out messages to any nt/2000/Xp machine on the net. However, I can only get it to work within a network! If any one can figure out how to send over the entire i-net (which this program says it does) please post it here! I hope some of this helps...

[Liquid_Darkness]

Thanks for the replies. Just before I read this I figured it out myself. This is pretty usefull for network comunication but its a very anoying form of advertisements.

I figured that it would be done inside a network or set off by an ASP script but what I am curious about is how it works from outside a network. I'll do some tests and see how it works.

Does anyone know what ports this goes through? (sent from and recieved by) Or is it a range of ports?

Originally posted here by cross
I was also interested in these pop ups, so i've done a little research. They can be done with net send, like roswell1329 said, but this will not go accross the i-net, only within a network... I have found a few programs such as Broadcast Marketer Broadcast Marketer Site. Their client will (supposedly) send out messages to any nt/2000/Xp machine on the net. However, I can only get it to work within a network! If any one can figure out how to send over the entire i-net (which this program says it does) please post it here! I hope some of this helps...

Yes thats what i'm saying, how do you use this command over the internet or even just beyond the scope of a network? It obviously CAN be done because I have seen it several times in the past hour. I dont want a program, i want to know how the program does it. And the windows are also formatted to not show the senders IP and to sometimes show the host's Ip adress.

[DjM]

Originally posted here by Liquid_Darkness
Does anyone know what ports this goes through? (sent from and recieved by) Or is it a range of ports?

Read the link I posted, it explains it quite well.


Cheers:

[Liquid_Darkness]

Ahh yes it does. Thanks a lot. I still have yet to see if it will work remotly outside a network though.

[Nyroca]

So you can send someone a message through dos using net send, then the ip address of the persong receiving message and then the message? All this with out being on a network? I know i can do that here on Hawaii Marine Coprs Base. But this whole base is one big network.

[cross]

I also am trying to accomplish this without a program, however, I dont think that BroadCast Marketer uses Net Send at all.... This is why I posted the link. Mabey some one here can figure out exactly what it's trying to do, I can not... Like I said, everything works within the network but not outside. I know it can be done....

[omalakai]

This was talked about here a while back. Here is the thread:
http://www.antionline.com/showthread...hreadid=235901

The tool that was talked about in the thread can be found at http://www.directadvertiser.com/

Apparently it uses TCP port 135, the RPC port, to receive its messages. Normally, a NET SEND goes over TCP port 139, the NetBIOS session port.