Uzak doğu gibi bazı ülkeler CuteFTP yada FileZilla gibi FTP dosya transferi programı yerine "Sota's FFFTP" isimli programı kullanır.
Bu programda bağlantı kurduğu HOST'a AutoComplete yapabilmek için girilen Ftp Adreslerini ve Şifreleri REG içine saklayarak hosta kaydeder.
Bu REG yedeklerini bulabilirsek bu BASE64 şifrelirini kırıp sitelere FTP ile dosya yada Shell atabilirsiniz...
Bu programda bağlantı kurduğu HOST'a AutoComplete yapabilmek için girilen Ftp Adreslerini ve Şifreleri REG içine saklayarak hosta kaydeder.
Bu REG yedeklerini bulabilirsek bu BASE64 şifrelirini kırıp sitelere FTP ile dosya yada Shell atabilirsiniz...
Örnek REG Dökümü:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\sota\FFFTP]
"Version"=dword:000000c0
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options]
"NoSave"=dword:00000000
"WinPosX"=dword:0000002c
"WinPosY"=dword:0000003a
"WinWidth"=dword:00000276
"WinHeight"=dword:00000189
"LocalWidth"=dword:00000135
"TaskHeight"=dword:00000032
"LocalColm"=hex:78,00,00,00,5a,00,00,00,3c,00,00,00,25,00,00,00
"RemoteColm"=hex:78,00,00,00,5a,00,00,00,3c,00,00,00,25,00,00,00,3c,00,00,00,\
3c,00,00,00
"SwCmd"=dword:00000009
"UserMail"="k-yama@proof.ocn.ne.jp"
"Viewer"="notepad"
"Viewer2"=""
"Viewer3"=""
"TrType"=dword:00000058
"Recv"=dword:00000001
"Send"=dword:00000001
"Path"=""
"Time"=dword:00000001
"EOF"=dword:00000000
"Scolon"=dword:00000000
"RecvEx"=dword:00000000
"SendEx"=dword:00000000
"LFsort"=dword:00000000
"LDsort"=dword:00000000
"RFsort"=dword:00000000
"RDsort"=dword:00000000
"SortSave"=dword:00000000
"ListType"=dword:00000001
"Cache"=dword:0000000a
"CacheSave"=dword:00000000
"DotFile"=dword:00000001
"Dclick"=dword:00000001
"ConS"=dword:00000001
"OldDlg"=dword:00000001
"RasClose"=dword:00000000
"RasNotify"=dword:00000001
"Qanony"=dword:00000001
"PassHist"=dword:00000001
"SendQuit"=dword:00000000
"NoRas"=dword:00000000
"Debug"=dword:00000000
"WinPos"=dword:00000000
"RegExp"=dword:00000000
"Reg"=dword:00000000
"AsciiFile"=hex(7):2a,00,2e,00,74,00,78,00,74,00,00,00,2a,00,2e,00,68,00,74,00,\
6d,00,6c,00,00,00,2a,00,2e,00,68,00,74,00,6d,00,00,00,2a,00,2e,00,63,00,67,\
00,69,00,00,00,2a,00,2e,00,70,00,6c,00,00,00,00,00
"LowUp"=dword:00000000
"Tout"=dword:0000005a
"NoTrn"=hex(7):2a,00,2e,00,62,00,61,00,6b,00,00,00,00,00
"NoDel"=hex(7):00,00
"MirFile"=dword:00000000
"MirUNot"=dword:00000001
"MirDNot"=dword:00000001
"ListFont"=""
"ListHide"=dword:00000000
"ListDrv"=dword:00000000
"FwallHost"=""
"FwallUser"=""
"FwallPass"=""
"FwallPort"=dword:00000015
"FwallType"=dword:00000001
"FwallDef"=dword:00000000
"FwallSec"=dword:00000001
"PasvDef"=dword:00000000
"FwallRes"=dword:00000000
"FwallLow"=dword:00000000
"FwallDel"=dword:00000040
"SndConSw"=dword:00000000
"SndTrnSw"=dword:00000000
"SndErrSw"=dword:00000000
"SndCon"=""
"SndTrn"=""
"SndErr"=""
"DefAttr"=hex(7):00,00
"Hdlg"=hex:8d,01,00,00,d6,00,00,00
"Bdlg"=hex:ff,ff,ff,ff,ff,ff,ff,ff
"Mdlg"=hex:ff,ff,ff,ff,ff,ff,ff,ff
"FAttrSw"=dword:00000000
"FAttr"=dword:00000309
"HistNum"=dword:00000005
"SavedHist"=dword:00000005
"SetNum"=dword:0000000a
"CurSet"=dword:00000000
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\History0]
"HostAdrs"="ftp.vector.co.jp"
"UserName"="anonymous"
"LocalDir"="C:\\Program Files\\ffftp"
"RemoteDir"="/bin"
"Password"="VMMB]eNWeHfeKkeHmPHPNTN^MOF}iIiNBOFcCFRiK_NBNFEFINBTM@G"
"Sort"=hex:00,00,00,00
"TrType"=dword:00000058
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\History1]
"HostAdrs"="www.e027.com"
"UserName"="nnu02271"
"LocalDir"="C:\\My Documents"
"RemoteDir"="/httpd/htdocs"
"Password"="XJRHVHRKJEi@rMF_TI"
"Sort"=hex:00,00,00,00
"TrType"=dword:00000058
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\History2]
"HostAdrs"="www.e027.com"
"UserName"="nnu02271"
"LocalDir"="C:\\My Documents"
"RemoteDir"="/httpd/htdocs"
"Password"="XJRHVHRKJEi@rMF_TI"
"Sort"=hex:00,00,00,00
"TrType"=dword:00000058
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\History3]
"HostAdrs"="www.e027.com"
"UserName"="nnu02271"
"LocalDir"="C:\\My Documents\\e027.9.14"
"RemoteDir"="/httpd/htdocs"
"Password"="XJRHVHRKJEi@rMF_TI"
"Sort"=hex:00,00,00,00
"TrType"=dword:00000058
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\History4]
"HostAdrs"="www.e027.com"
"UserName"="nnu02271"
"LocalDir"="C:\\My Documents\\e027.9.14"
"RemoteDir"="/httpd/htdocs"
"Password"="XJRHVHRKJEi@rMF_TI"
"Sort"=hex:00,00,00,00
"TrType"=dword:00000058
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host0]
"Set"=dword:00008000
"HostName"="anonymous FTP site"
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host1]
"Set"=dword:00000001
"HostName"="Vector"
"HostAdrs"="ftp.vector.co.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:00,00,00,00
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host2]
"Set"=dword:00000001
"HostName"="窓の杜(Forest)"
"HostAdrs"="ftp.forest.impress.co.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host3]
"Set"=dword:00000001
"HostName"="Ring server"
"HostAdrs"="ftp.ring.gr.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host4]
"Set"=dword:00000001
"HostName"="BIGLOBE"
"HostAdrs"="ftp.biglobe.ne.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host5]
"Set"=dword:00000001
"HostName"="IIJ"
"HostAdrs"="ftp.iij.ad.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host6]
"Set"=dword:00000001
"HostName"="SUNSITE"
"HostAdrs"="sunsite.sut.ac.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host7]
"Set"=dword:00000001
"HostName"="WIN Internet Service"
"HostAdrs"="ftp.win.ne.jp"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host8]
"Set"=dword:00000001
"HostName"="Microsoft"
"HostAdrs"="ftp.microsoft.com"
"UserName"="anonymous"
"LocalDir"=""
"Password"="VMZERORLMFQRL@D@GTN^MOFPFFNB^MCFiNFhKNFZLNBiJyaLQ"
"Sort"=hex:ff,ff,ff,ff
"Bmarks"=hex(7):00,00
[HKEY_CURRENT_USER\Software\sota\FFFTP\Options\Host9]
"Set"=dword:00000000
"HostName"="e027.com"
"HostAdrs"="www.e027.com"
"UserName"="nnu02271"
"LocalDir"="C:\\My Documents\\e027.9.14"
"RemoteDir"="/httpd/htdocs"
"Password"="XJRHVHRKJEi@rMF_TI"
"Last"=dword:00000001
"Sort"=hex:00,00,00,00
"Bmarks"=hex(7):00,00
Gizli içeriği görüntüleme kayıtlı kullanıcılar için mevcuttur!