How do I send Windows Messenger Pop-Ups?

Over the past few months my friends and I have been recieving these popups that advertise things, often show the IP of the host computer and some even offer links to sites for blocking these messages.

These are not java popups or anything of the sort, they are actually generated by windows. It reminds me of the old messenger service from windows 95 through port 139 or something that gave way to the classic "Win Nuke" attack. These popups are

Doing some research I have found ways of blocking it but that isnt really what I want to know. I could easily do this with a firewall or turning off the service. What I am curious about is how to actually send them. Is there a client for it? Do you do it through the command prompt?

here is some links to info on what I am talking about...

http://help.twspeed.com/security/messengerflaw.asp (This one explains the popups and has a picture)
http://www.defeatpopups.com (This was a link on one of the popups.. trying to sell me software to dissable popups THEY are sending me)


So if anyone knows how they are actually SENDING the messeges I would be really gratefull. I dont intend on spamming anyone, I just want a better knowledge of what these guys are doing to me and how.

Well upon more research I have found quite a bit more info. I know now that the advertisers use comercial software that can send these to a range of IP adresses. I dont want the software, i just want to know how it works. It must be a relativly simple command. I even found a popup tester that does it through an ASP script here:

http://www.mynetwatchman.com/winpopuptester.asp


And this site talks about the spammer themselves:
http://www.mynetwatchman.com/kb/secu...spam/index.htm


Does anyone know how to send a message to a remote computer?

Here's how to do it from the command line:

Code:

---

net send [machine name] message

---

To send a message saying "Hello World" to the machine called "monkey" on my local network, I would do:

Code:

---

net send monkey Hello World!

---

You may be able to supply an IP address for the machine name, but I think the default is a netbios naming convention which would make it non-routable. I would imagine that any .asp page would be able to activate the net send command from your system since .asp is basically just visual basic running on your local system. They wouldn't have to attack you across the network, your machine is running the .asp code, so they could simply execute a net send from within the page itself, or so it would seem to me. I'm not an expert on .asp code.

I've also heard rumors about MSN messenger being able to carry those kinds of commands, although that's just something I heard. I don't use MSN enough to know the validity of that.

There is a package availabe which automates this process. There is some fairly good information on the net send command and the package HERE


Cheers:

I was also interested in these pop ups, so i've done a little research. They can be done with net send, like roswell1329 said, but this will not go accross the i-net, only within a network... I have found a few programs such as Broadcast Marketer Broadcast Marketer Site. Their client will (supposedly) send out messages to any nt/2000/Xp machine on the net. However, I can only get it to work within a network! If any one can figure out how to send over the entire i-net (which this program says it does) please post it here! I hope some of this helps...

Thanks for the replies. Just before I read this I figured it out myself. This is pretty usefull for network comunication but its a very anoying form of advertisements.

I figured that it would be done inside a network or set off by an ASP script but what I am curious about is how it works from outside a network. I'll do some tests and see how it works.

Does anyone know what ports this goes through? (sent from and recieved by) Or is it a range of ports?

Quote:

---

Originally posted here by cross
I was also interested in these pop ups, so i've done a little research. They can be done with net send, like roswell1329 said, but this will not go accross the i-net, only within a network... I have found a few programs such as Broadcast Marketer Broadcast Marketer Site. Their client will (supposedly) send out messages to any nt/2000/Xp machine on the net. However, I can only get it to work within a network! If any one can figure out how to send over the entire i-net (which this program says it does) please post it here! I hope some of this helps...

---

Yes thats what i'm saying, how do you use this command over the internet or even just beyond the scope of a network? It obviously CAN be done because I have seen it several times in the past hour. I dont want a program, i want to know how the program does it. And the windows are also formatted to not show the senders IP and to sometimes show the host's Ip adress.

Quote:

---

Originally posted here by Liquid_Darkness
Does anyone know what ports this goes through? (sent from and recieved by) Or is it a range of ports?

---

Read the link I posted, it explains it quite well.


Cheers:

Ahh yes it does. Thanks a lot. I still have yet to see if it will work remotly outside a network though.

So you can send someone a message through dos using net send, then the ip address of the persong receiving message and then the message? All this with out being on a network? I know i can do that here on Hawaii Marine Coprs Base. But this whole base is one big network.

I also am trying to accomplish this without a program, however, I dont think that BroadCast Marketer uses Net Send at all.... This is why I posted the link. Mabey some one here can figure out exactly what it's trying to do, I can not... Like I said, everything works within the network but not outside. I know it can be done....

This was talked about here a while back. Here is the thread:
http://www.antionline.com/showthread...hreadid=235901

The tool that was talked about in the thread can be found at http://www.directadvertiser.com/

Apparently it uses TCP port 135, the RPC port, to receive its messages. Normally, a NET SEND goes over TCP port 139, the NetBIOS session port.

ahh I see.. so is there a way using net send or another command to specify port trafic? Or would I have to write my own program that compiles the packets manually and sends through the port I want?

My question is do you have to be on a network though?

Nyroca , for Net Send you need to be on the same network as the target machine. This is my problem. I do not see how these programs (like direct advertiser) are sending these 'net send' messages over the i-net.... What command could they be using? Are they just compiling packets and sending them to an IP? or what????? I can't seem to get a simple answer, so I hope some one here can help out a little with the manual way to send these messages over the i-net without being on the same network, and without these programs....

Quote:

---

Originally posted here by cross
Nyroca , for Net Send you need to be on the same network as the target machine. This is my problem. I do not see how these programs (like direct advertiser) are sending these 'net send' messages over the i-net.... What command could they be using? Are they just compiling packets and sending them to an IP? or what????? I can't seem to get a simple answer, so I hope some one here can help out a little with the manual way to send these messages over the i-net without being on the same network, and without these programs....

---

I may be wrong about this, but the way Directadvertiser works is to target windows machines that are misconfigured. By doing this they scan for machines which have basically opened themselves to the would via port 135 and 139 (I think). I believe there may also be other ports used (136, 137, 138). When they find a vulnerable machine, bang...there goes a pop-up. Most users should be OK if 1) They have set-up the computers correctly (don't broadcast NetBIOS) and 2) They are behind a firewall which will drop all this activity right away.

Cheers:

It would be interesting to see if they are port scanning to gather all of these Ip addresses that they give away with the tool.

To thier credit, they do show you how to stop the Windows Messaging service.

There is an article at securityfocus that discusses this product and how it works.

http://online.securityfocus.com/columnists/117

Interesting site: http://www.directadvertiser.com

I looked at the screenshot and laughed when I seen how simple this program could be recreated with C++ and maybe some open-source snipplets.

The kicker is that they want $700 to install a simple service(135-139) to accomplish this. Wonder how many people got dupped into buying the license crap.

I send popups to my dad, I’m in England he is in the US, from a DOS prompt over the internet with net send IP address, once I get it. It takes about 5 – 10 seconds for it to show up on his machine but it works well from XP to Win2k pro boxes.

Brackenwood! How do you send messeges to you father across the world with out being on a network? i know you need his ip number but i was told you can't do that with out being on a network. Please share your intellegence. Also how do you find out his ip add? As you all can tell i'm very very new at this and i'm trying to soak all this in before i go to colledge so i can have a easier time with this.

I've had sucess with net send across the net but any router or firewall will block it.

It should work as long as both computers have netBios enabled and the target is not behind a router or firewall. Fromt he command prompt type:

net send ip-adress "Message you want to send"

You dont even have to put the message in quotes. I've found it works either way. For more info on net send type "net help send" at the command prompt.

I'm curious as to how the spammers keep the IP from showing in the message that is sent. I imagine that is because they compile the packets manually.

Quote:

---

Nyroca
Also how do you find out his ip add?

---

In order to find an IP address (Assuming you know what an IP adress is) there is many different methods. Anytime another computer makes a connection to yours it leaves its IP. You can find the IP address of a person who sent you an e-mail in the MIME extensions. Somone can find there own IP by looking at there internet connection properties or by typing winipconfig, or ipconfig in the console. They could also find it by going to a webpage that shows your IP such as this one: http://www.whatismyip.com/

If you make a direct connection with somone in AIM or another messenger or sometimes even a direct connection in a game, you can type "netstat" at the console and it will show you the person's IP as well as the prot it is connected through.

You could find the IP of a server such as www.aol.com by doing a whois or a DNS lookup.

Hope some of that helped you. But dont expect info to be spoon fed. If some of this doesnt make sense, search for more info on the topic. go to www.google.com and look it up.

Wow! Thanks Liquid_Darkness! That helps alot! And yes i do understand what a ip add is. I'm not all the way dumb! LOL! Anyway. I've learned so much from this website in the last week than i did in the last 6 years. I love this website. Anyway. Question. So when you are talking to people on im as long as you have a direct connections with them you can get there ip add? what about e-mail? you said that you can find the person's ip number my looking in the MIMS extension? where is that? i can't find that anywhere?