egghelp/eggheads community

strange??? (netgate)

2007-05-04T23:37:24-04:00

A point of interest: Their forum post has been removed.

I guess they realised we weren't that clueless (again) after all.

Statistics: Posted by Alchera — Fri May 04, 2007 11:37 pm

strange??? (netgate)

2007-05-04T13:35:10-04:00

No one can say they're not a persistent lot (probably a hang over from the Dutch colonial days).

behave sir...

Statistics: Posted by ZEXEL — Fri May 04, 2007 1:35 pm

Re: wooww...

2007-05-04T13:37:33-04:00

Tclpro's bytecode compilation is not encryption and you are not from Sweden. (you and KONTOL are probably the same person and you're both posting from indonesia)

Thx you for information & I appriciated all of it's! Just for you know, many cybercafe in Indonesia that use same connection gateway to Internet & I'm use SPEEDY ISP connection that have a little IP for public. That was "missunderstanding" about me KONTOL and odon! Maybe me and KONTOL connected in same IP coz we use SPEEDY ISP connection especially for cybercafe that we use but we don't same person like you thinking.

Statistics: Posted by ZEXEL — Fri May 04, 2007 1:31 pm

strange??? (netgate)

2007-05-03T19:16:05-04:00

No one can say they're not a persistent lot (probably a hang over from the Dutch colonial days).

Statistics: Posted by Alchera — Thu May 03, 2007 7:16 pm

Re: wooww...

2007-05-03T18:20:06-04:00

Tclpro's bytecode compilation is not encryption and you are not from Sweden. (you and KONTOL are probably the same person and you're both posting from indonesia)

LOL good observation there; they(?) can't get any lamer

Statistics: Posted by Sir_Fz — Thu May 03, 2007 6:20 pm

Re: wooww...

2007-05-03T16:51:08-04:00

Ups! I've been read all source code about NETGATE 9.5. It's seem using strong encryption from TCL Pro 4.1! No one can decrypted it yet...

Tclpro's bytecode compilation is not encryption and you are not from Sweden. (you and KONTOL are probably the same person and you're both posting from indonesia)

You (aka odon) seem to have missed the feature that will optimize procs and omit the plain text version of their bodies, so reading your code requires nothing more than decoding the ascii85 encoded string (or loading the script and dumping what's in the interpreter. (loading the script should be done in a sandboxed environment))

Converting the bytecode (if you come by a script encoded by someone with a bit more clue than yourself) to readable code is not hard... Check: http://groups.google.com/group/comp.lan ... 7fb12839e1
And generating plain Tcl code is also possible (but there are no public tools to do it - for obvious reasons )

Oh and for the record: The script still has its BACKDOORS and EXPLOITABLE BUGS and the code still sucks, so stay away from this piece of crap script unless you want to give away your bots/shells/boxes.

Statistics: Posted by user — Thu May 03, 2007 4:51 pm

wooww...

2007-05-03T11:36:11-04:00

Ups! I've been read all source code about NETGATE 9.5. It's seem using strong encryption from TCL Pro 4.1! No one can decrypted it yet...

Nice work using TCL Pro 4.1

Statistics: Posted by ZEXEL — Thu May 03, 2007 11:36 am

strange??? (netgate)

2007-05-01T21:01:25-04:00

I suppose it'd be easy enough to rip the procs from the script as already demonstrated, if anyone ever wanted to bother, and then release a clean copy

Either that, or just create the backdoor username and give it a different password and +k flags.. Or, then again, I can think of some nice little reverse-hack script to use on whoever tried logging in with that username

But, meh.. Screw them, their script sucks, thats why they have to hide it

Statistics: Posted by rosc2112 — Tue May 01, 2007 9:01 pm

strange??? (netgate)

2007-04-30T11:11:32-04:00

I'd still say it's a hijacking tool, with a few shady attempts to deny responsibility...

It's a hijacking tool and they think we're all idiots.

Unfortunately there are some out there that have fallen for this "con".

Statistics: Posted by Alchera — Mon Apr 30, 2007 11:11 am

strange??? (netgate)

2007-04-30T11:09:21-04:00

Wew netgate again...... KONTOL mean p*nis in english

I already knew that (although I do not speak the language); I assist in an Indonesian (shell provider) channel on DALnet.

Statistics: Posted by Alchera — Mon Apr 30, 2007 11:09 am

strange??? (netgate)

2007-04-30T09:23:21-04:00

Any such "disclaimer" should be put within the license-agreement to carry any validity. Also, mixing languages like that is to me a really bad practise.

Anyway, since they admit to adding a user-account, with a known password and hostmask that only cares for nick (roughly making it possible for anyone to authenticate, and use this account for mischief)...
Do anyone know if they ever provided a reasoable explanation for adding a useraccunt of any kind? Or why it would need such permissions?

I'd still say it's a hijacking tool, with a few shady attempts to deny responsibility...

Statistics: Posted by nml375 — Mon Apr 30, 2007 9:23 am

strange??? (netgate)

2007-04-30T04:13:29-04:00

Wew netgate again......
Guys if u look into netgate FAQ u can read this :
FaQ:
........
- Tapi kan masih ada $ps odon nya, yups masih ada, dan nick PSna masih kami yang pegang, dan gak akan kami salah gunakan, so if u agree with this condition us this script, if not dont use it, Simple !!.
i try to translated : - but tcl still have $ps odon, yes that $ps still exist, and we still holding/keep/have that PS nick, and we would not missused, so if u agree with this condition us this script, if not dont use it, Simple !!.
.......
please refer to the bolded text , so use it if u agree with that condition, don't use its if not...

i notice something wierd in here, TS say he didnt understand indonesia language but his id KONTOL using indonesia language, KONTOL mean p*nis in english

Statistics: Posted by mayday — Mon Apr 30, 2007 4:13 am

strange??? (netgate)

2007-04-28T23:06:50-04:00

I notified the appropriate Tcl/eggdrop channel founders on DALnet when this first reared its ugly head as it targets DALnet bot owners specifically (from memory).

Statistics: Posted by Alchera — Sat Apr 28, 2007 11:06 pm

strange??? (netgate)

2007-04-28T17:38:03-04:00

Wouldn't be surprised to find netgate to be a conglomeration of other peoples scripts/procs mashed together into a mess.

Statistics: Posted by rosc2112 — Sat Apr 28, 2007 5:38 pm

strange??? (netgate)

2007-04-28T08:49:24-04:00

Well, the only purpose for this package is to hijack bots and quite possibly accounts on the system it runs on. The ones targetted by such package would be those who desire an up'n'go bot, and really don't want to bother/care to even check config-files, scripts, and such; and this script "offers it all", it claims to take care of the more difficult config-settings, does all the things eggdrop usually needs added scripts, etc, etc..

The mere fact that people still think about using it despite the widespread knowledge of the backdoors, etc. could only mean the author got the bait right.

Statistics: Posted by nml375 — Sat Apr 28, 2007 8:49 am