Runescape Webclient - With Nice Features

.....

 

OOh, a 3.8kb runescape.jar?
How did you manage to compress it so much? Lol

This shall install some bad ass crap onto your system! This be a phiser, mate!

 

If you have any proof, feel free to follow it up. But these accusations will not only make you look like an ass, you could likely get banned.

 

Yes, because it's quite obvious that I have no idea what I'm talking about due to my limited knowledge of Java, bytecode, etc (that was sarcasm by the way).

1. View the page source
2. We see that this page loads a client Class from the archive Client.jar, so we download Client.jar from here: http://www.geoffreyy.com/g42w3rfa/client.jar
3. We extract this to a folder, either by using the command line utility provided in the jdk, or by using an extraction tool with a gui, such as 7Zip.
4. We see that this only has 2 classes, a client class, and a ShellCommandExecute class. Now, already we see that this obviously doesn't load runescape (the current loader.jar has 13 classes, and the current runescape.jar has 316 classes, but let's go on).
5. We can now use a Decompiler on this (or a bytecode editor, if the code was obfuscated), but since this dude was retarded enough not to obfuscate the code, we can just use any old decompiler.
6. Because the JVM enters through the client class, let us first decompile that class. Decompiled source code: http://pastebin.com/m577803cb

We see that this applet's init method calls this class's constructor. If the user is not using, the program returns, but if the user is, then the program proceeds to find the user's home directory and download a boot.jar file into that directory and shutdown the user's computer.

Also, if somebody thinks that this teaches people howto make malware, etc., it doesn't. All this does is download and execute a file on a user's computer using very common technieques (his code for downloading a file is very similar to that of the application I submitted to the Sythe programming contest), but the difference is that:
1. This person signed his applet as Jagex, which means, that if a person agrees to let this applet run, it has special permissions (not regularly given to an applet) that allow it to write files and execute commands as an applet.
2. It is a trojan, meaning that it preforms an action that the user was not aware of. Had this only downloaded a file to the user's computer, the user being well informed that this was its intended purpose, then this would not be malware at all.


Enough proof for ya, the_Dark?

 

What?

 

it was edited by a mod or admin, Benwise something.
it had a download link for something that isn't what he said it was i take it.