Shaftnode was recovered, initially in binary form, in late November 1999, then in source form for the agent.
Remote control is done via a simple telnet connection to the handler.
Both passwords and ticket numbers have to match for the agent to execute the request. A simple letter-shifting is in use. The command structure is divided into the agent and handler command syntax groups. The attacker interacts with the handler via a command line. Length of DoS in seconds.