egghelp/eggheads community

translate encrypted word

2009-12-23T23:44:00-04:00

As I wrote, the needed procs to "decrypt" this bad-boy is available in user's post. Once you got the dezip proc loaded, all you need to do is issue the dezip tcl command with the various strings that you'd like to decrypt..

I sure do hope that you don't actually intend to run this horrible piece of trojan/backdoor. Having your eggdrop joining some strange channels are the least of your concern, as it attempts to create a new owner's record, as well as replacing any command to list users in order to hide this... In the end, this bad-boy is written to allow it's author (or other malicious users) full access to your eggdrop, and the shell that is hosting it.

Statistics: Posted by nml375 — Wed Dec 23, 2009 11:44 pm

translate encrypted word

2009-12-23T15:58:32-04:00

hai nml375 and blake,
i have try User tcl script to convert the "backdoor-script"
but still got nothing when i use the convert-result..
my bot still running to some strange channel..

the point is, still dont understand what the meaning of
this headache word..

Code:

1. if {[string tolower $channel] != [dezip "EQO/7.meDlC1iq2jE.UVfbE."]} {2. set notc [dezip "c4c0O/Pz7NR0VY05E/t9zZo.PzSIW0c035C/"]3. regsub -all -- [dezip "jGBDx04~ntxb0"] $text "" text4. regsub -all -- [dezip "bFuC0.Jq~aEc0"] $text "" text5. regsub -all -- [dezip "xdxsF1~hBM6q0"] $text "" text6. regsub -all -- [dezip "jG~BDx04ntxb0"] $text "" text7. regsub -all -- [dezip "bF~uC0.JqaEc0"] $sreas "" sreas8. regsub -all -- [dezip "xdxs~F1hBM6q0"] $sreas "" sreas

*still need help..

Statistics: Posted by dec — Wed Dec 23, 2009 3:58 pm

translate encrypted word

2009-12-22T11:39:57-04:00

The thread that Blake linked contains all the needed information to de-obfuscate the lines you posted, including the dezip proc.

Statistics: Posted by nml375 — Tue Dec 22, 2009 11:39 am

translate encrypted word

2009-12-22T11:12:45-04:00

still blank..
any other way to know how to decrypt the dezip code..

Statistics: Posted by dec — Tue Dec 22, 2009 11:12 am

translate encrypted word

2009-12-10T10:41:51-04:00

http://forum.egghelp.org/viewtopic.php? ... e+backdoor

Statistics: Posted by blake — Thu Dec 10, 2009 10:41 am

translate encrypted word

2009-12-10T10:28:29-04:00

haii nml375
1st thing 1st verry sorry for the crosspost.

2nd thing is, can you redirect me to the post that you mention before..
i've try to search but i found lot of post by "user"
verry appreciate for your help before..

Statistics: Posted by dec — Thu Dec 10, 2009 10:28 am

translate encrypted word

2009-11-26T18:47:07-04:00

Please don't crosspost. I will remove your other post in "Script Requests".

Are you thinking of the old netgate backdoor/trojan? Then you'll find a post by "user" on how you could decrypt that code on the forum...

Statistics: Posted by nml375 — Thu Nov 26, 2009 6:47 pm

translate encrypted word

2009-11-26T17:53:14-04:00

i found some script that have backdoor..
1 need help for decrypted on at least translate with word that i can understand..

Code:

1. if {[string tolower $channel] != [dezip "EQO/7.meDlC1iq2jE.UVfbE."]} {2. set notc [dezip "c4c0O/Pz7NR0VY05E/t9zZo.PzSIW0c035C/"]3. regsub -all -- [dezip "jGBDx04~ntxb0"] $text "" text4. regsub -all -- [dezip "bFuC0.Jq~aEc0"] $text "" text5. regsub -all -- [dezip "xdxsF1~hBM6q0"] $text "" text6. regsub -all -- [dezip "jG~BDx04ntxb0"] $text "" text7. regsub -all -- [dezip "bF~uC0.JqaEc0"] $sreas "" sreas8. regsub -all -- [dezip "xdxs~F1hBM6q0"] $sreas "" sreas

thank you so much for help in advance..

Statistics: Posted by dec — Thu Nov 26, 2009 5:53 pm