full-disclosure - Re: What's going on about Pangolin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 28 Mar 2008 09:09:07 +0000
From: cocoruder. <frankruder@...mail.com>
To: <zwell@...u.com>, <full-disclosure@...ts.grok.org.uk>
Subject: Re: What's going on about Pangolin

Hey man, I think if you do not use the chinese email address and do not let anyone know you are chinese, there will be not so many worries, you know, chinese guy can became untrust more easily because they even do say "do not free the Tibet", what a strange thing, especially you are sharing an executable file.

OH, chinese man became more evil today.
welcome to my blog:http://ruder.cdut.net

Date: Thu, 27 Mar 2008 04:20:53 +0800From: zwell@...u.comTo: full-disclosure@...ts.grok.org.uk; webappsec@...urityfocus.comSubject: [Full-disclosure] What's going on about Pangolin
I've just read the discussion from here, seriously, I don't know what's going on. 
I've coded it since 2005 and never release it until this year. And I really do not know why it be treated as a backdoor. 

If you think it is a backdoor, so please do a reverse engineering on it. You can capture the network packet, you can list all the strings in it, even you can hook APIs in it. Do anything you like to make sure whether it's backdoor or not. 

BTW, I packeted it through UPX to reduce the size. And some people focused on "http://www.nosec.org/web/index.txt", which is used in ORACLE injection mode when the target database is in intranet so we can use some store-procs to make the target to visit our website then we can receive the internet address that is mapped to outside. Anybody who is good at oracle injection should know this. 

Really, I wanna know why!!!

< div class="w134">

2008ÄêÐ½Ë®·±¶¼¼ÇÉ 

*ÓÃËÑ¹·Æ´ÒôÐ´ÓÊ¼þ£¬ÌåÑé¸üÁ÷³©µÄÖÐÎÄÊäÈë>> 
_________________________________________________________________
MSN 中文网，最新时尚生活资讯，白领聚集门户。
http://cn.msn.com
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/