+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: [Community Alert] UID 2676098 (xBc) selling backdoored scripts (/showthread.php?tid=5301628)
UID 2676098 (xBc) selling backdoored scripts - Nob - Jun 11, 2016
Hello,
So a fun one for you guys tonight.
This guy : xBℓαcΚ is selling backdoored scripts on this thread.
I actually bought his OVHX script to see what it was looking like.
First odd thing, my antivirus detected it, while it never rings the bell for any of the scripts I own. That was awkward. I said it was a false positive, and uploaded it to my "sandbox" server (a 5$ DigitalOcean VPS where I test everything before putting into production). Before running it, I did a "strings" on the file, and, surprise, you'll never guess what I found !
The first thing the script does is this :
![[Image: 3977c58fcbadc46e487301db43d4c41c.png]](https://i.gyazo.com/3977c58fcbadc46e487301db43d4c41c.png)
It loads a shortened link. This shortened link is hiding the URL to a IP-grabbing service (grabify.link), so it grabs the IP of your server when you load it.
It then goes into /etc/passwd and gives permission to a user that hasn't been created yet (it's coming). And it deletes all the log files with "rm -rf /var/log".
Then it does this :
![[Image: 96897796831e5e131f8c48dfd4314274.png]](https://i.gyazo.com/96897796831e5e131f8c48dfd4314274.png)
It actually adds the user that was given permissions above into the Unix password manager.
It's then very easy for this guy to access your server, as he obtained the IP with grabify and added his own credentials into it.
As a broader advice, always strings scripts you found on the internet. You never know what's inside.
Regards
* - Ooze - Jun 11, 2016
You should crack the hash, and hack his shit
But anyway, I can't verify this is true but this is why Community Alerts exist
* - Nob - Jun 11, 2016
(Jun 11, 2016 03:43 PM)The J0ker Wrote: You should crack the hash, and hack his shit
But anyway, I can't verify this is true but this is why Community Alerts exist
I don't really specialize in hash cracking but I guess someone could here, here is the plain text for it :
Spoiler (Click to View)
* - IHitNoobs - Jun 11, 2016
this looks interesting man good find man thanks for the heads up
* - illuminati - Jun 11, 2016
Kid is also a scammer. He revenge negged me so be careful. 😏
* - gochi - Jun 11, 2016
This guy is a scammerr, scammed $325.
Thread: https://hackforums.net/showthread.php?tid=5297976
Also revenge negged me for reporting his scam.
* - PRPS - Jun 11, 2016
Gonna have to start using sandbox. people are scary out here. lol
* - BℓαcΚOuT - Jun 12, 2016
I'm using this script every day..much stresser have it like finestmoddingstresser.net, this script isn't mine , i heve bought it and i use it every day.
* - Agonises - Jun 12, 2016
(Jun 12, 2016 01:26 AM)xBℓαcΚ Wrote: I'm using this script every day..much stresser have it like finestmoddingstresser.net, this script isn't mine , i heve bought it and i use it every day.
No no no, of course you use the script every day.
* - Nob - Jun 12, 2016
Well, if other stressers use it, it means you better tell them their servers are rooted ...
* - JohnAnonDoe - Jun 15, 2016
Where is the script exactly? I only see him selling VPS and Dedi's.
Also, everyone be careful running scripts under sudo (root) (especially from untrusted sources)
* - DarkN3ss61 - Jun 15, 2016
(Jun 14, 2016 02:32 PM)Stratos Wrote: Seriously plain text...? Could have at least xor'd it.
Should hit that link with a layer 7 flood using wget useragent.. then he can have fun finding out which IP were roots lmao.
Oi don't hit my ip logger with a 7 layer flood lmao
* - Kyle1995 - Jun 15, 2016
This is so hilarious, I can't believe it