Skip to content
Permalink
main
Switch branches/tags
Go to file
 
 
Cannot retrieve contributors at this time
<html>
<head>
<title>
r00tabega - group releases
</title>
</head>
<body bgcolor="#FFFFFF" text="#404040" link="#000000" VLINK="#000000" ALINK="#000000">
<img border=0 src="images/r00tabega.jpg"><br>
<img src="images/spacer.gif" width="0" height="11"><br>
<font size="1" face="verdana">
/<a href="index.shtml">home</a>/<a href="about.html">about</a>/<a href="http://www.cafepress.com/r00tabega/">store</a>/<a href="radio.html">radio</a>/<a href="http://www.r00tabega.org/cgi-bin/archive.pl?/home/bansh33/security-archive">archive</a>/<a href="wwwboard/">wwwboard</a>/<a href="backend.html">backend</a>/<a href="upload.html">upload</a>/group/
</font>
<br><br>
<B>Here you will find various tools and programs written by the r00tabega staff.</b><BR><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Source Vulnerability Scanner</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:xtremist@2xs.co.il">xtremist</a> (09.10.00)</font><BR>
A simple program which scans for common buffer-overflow vulnerabilities
in C source files using powerful perl regex's.
<blockquote>
<a href="/security-archive/group_releases/sourcescan.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Remote Overflow in NCSA 1.3</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:xtremist@2xs.co.il">xtremist</a> (09.10.00)</font><BR>
A remote overflow exists in NCSA 1.3. Exploit to spawn remote shell.
Tested on Slackware 4.0.
<blockquote>
<a href="/security-archive/group_releases/ncsa1-3.c">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Rivat Distributed Scanner</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:xtremist@2xs.co.il">xtremist</a> (09.10.00)</font><BR>
A Perl client/server which scans for 400+ Unix and NT vulnerabilities
. Very fast and light weight. And can be used as distributed servers.
Documentation by Mixter
<blockquote>
<a href="/security-archive/group_releases/rivat.tgz">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;BitchX 1.0c16 DoS Exploit</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (07.10.00)</font><BR>
Very simple and stupid
script which exploits the %s invite bug to crash the BitchX IRC client.
Written out of boredom.
<blockquote>
<a href="/security-archive/group_releases/bx-dos.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;ChanServ Smack</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (06.29.00)</font><BR>
Exploits the auto registration feature of most ChanServ bots and causes
it to die. This exploit has been known to work on networks including
DalNet, CobraNet and RelicNet.
<blockquote>
<a href="/security-archive/group_releases/chanserv.c">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;SuidBofCheck</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (06.29.00)</font><BR>
Searches the system for suid binaries in /usr/bin, /bin, /sbin, and
/usr/sbin and tests each one against a standard buffer overflow
(both with and without the use of environmental variables) at a
specified offset.
<blockquote>
<a href="/security-archive/group_releases/suidbofcheck.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;SU Monitor</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (06.29.00)</font><BR>
A simple yet sophisticated perl script that runs in the background
and monitors for user attempts to su to root. If one is detected, the
log file is immediately mailed to a specified user and a backup is created
in /tmp. Very useful for attempting to keep track of logs after an
intrusion has occured.
<blockquote>
<a href="/security-archive/group_releases/sumon.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Exploit Scan Monitor</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (06.29.00)</font><BR>
A simple yet sophisticated perl script that runs in the background
to monitor Apache's access_log file for indications of an exploit scan.
If one is detected, a new exploit_scan_log file is created with the details.
<blockquote>
<a href="/security-archive/group_releases/sploitmon.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;UserCheck</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (06.29.00)</font><BR>
Quick perl script to search through the history file of each user
on your system for a certain command (i.e. "cat /etc/passwd").
<blockquote>
<a href="/security-archive/group_releases/usercheck.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;ICQ Web Front DOS Exploit</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:rishi@felons.org">bansh33</a> (06.01.00)</font><BR>
This is a small shell script to exploit the DOS vulnerability present in the Web
Front feature of ICQ 2000a.
<blockquote>
<a href="/security-archive/group_releases/icqwebfront.sh">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table
width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Magdalena Scanner</font></b></td><td
align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a
href="mailto:futant@r00tabega.org">futant</a> (05.28.00)</font><BR>
This is a small utility written in perl that will scan a list of hostnames
for a certain CGI. It lets the user define a string to match rather than
just relying on HTTP codes. Even has console colors :].
<blockquote>
<a href="/security-archive/group_releases/magdalena.pl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Cart32 Exploit</font></b></td><td align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:futant@r00tabega.org">futant</a> (05.28.00)</font><BR>
Though L0pht released an advisory and patch for the well known Cart32 bug, an exploit has not been released to date. Here's a quick exploit I wrote in Tcl which allows remote command execution.
<blockquote>
<a href="/security-archive/group_releases/wemilo.tcl">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;netsol.c exploit</font></b></td><td align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (05.17.00)</font><BR>
Exploit for the infamous network solutions.com exploit. If run,
this would bind a shell on networksolutions.com to port 31337.
You can read more about this network solutions bug <a href="http://r00tabega.org/security-archive/misc/netsolbug.txt">here</a>.
<blockquote>
<a href="/security-archive/group_releases/netsol.c">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;ns.c exploit</font></b></td><td align="right"bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:lore@r00tabega.org">lore</a> (04.20.00)</font><BR>
Exploit for x86 Linux nslookup that comes with ISC bind.
<blockquote>
<a href="/security-archive/group_releases/ns.c">download it
here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;SmurfScan</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:lore@r00tabega.org">lore</a> (04.20.00)</font><BR>
Scan anything from Class C's to the entire internet for broadcast addresses to use for DoS with this program.
<blockquote>
<a href="/security-archive/group_releases/smurfscan.c">download it here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;CommuniGatePro 3.1 Overflow</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (04.17.00)</font><BR>
CommuniGate is an Internet messaging server application implementing
various services including SMTP, IMAP, and POP3.
It does, however, contain a simple buffer overflow which this perl script will exploit.
When sent such the overflow, CommuniGatePro 3.1 will crash on the remote machine.
<blockquote>
<a href="/security-archive/group_releases/communigate.pl">download it here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Latest Files and Download Script</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:ragnarox@phedz.org">ragnarox</a> (04.15.00)</font><BR>
This program is a great utility if you work in the console. You hate opening up IE or Nutscrape everytime you want to see the latest files on r00tabega.org? Well, now you can bypass all that junk. By running the program it will download a list of the latest files on r00tabega.org and also give you the option to download them straight on to your computer. An X front-end for it is currently in the making. Currently runs with j00nix perl and active perl.
<blockquote>
<a href="/security-archive/group_releases/r00tlate.pl">download it here</a></blockquote>
</font></td></tr>
</table><BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Attrition Script</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (04.12.00)</font><BR>
Gets the latest x (you specify how many) defacements from <a href="http://attrition.org">attrition</a>.
It's a nice script for webmasters because nothing like it has been released up to this point. Just use
the script to save the latest defacements to a file and then include them on your page through SSI.
<blockquote>
<a href="/security-archive/group_releases/attrition.pl">download it here</a></blockquote>
</font></td></tr>
</table><BR>
<!-- Ragnarox's Syn Attacker -->
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Syn Dos Attacker</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:ragnarox@phedz.com">ragnarox</a> (04.12.00)</font><BR>
This is actually a very simple program (errr.. *script* for all you perl haters). It uses a module called Net::RawIP which you are required to have installed before you can run this program. When executed properly on a *nix shell you can considerably slow down the response time of a remote machine. This script can also be used as an example to set for your own source code if you do anything with Net::RawIP. That is all.
<blockquote>
<a href="/security-archive/group_releases/d0s.pl">download it here</a></blockquote>
</font></td></tr>
</table>
<br>
<!-- End of Ragnarox d0s.pl -->
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Frontpage Scanner</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (03.31.00)</font><BR>
Everybody knows about the _vti_pvt password files, but
what about those misconfigured Frontpage servers that allow
remote login and authoring without a login and password?
This script will check for both vulnerabilties.
<blockquote>
<a href="/security-archive/group_releases/frontpage.pl">download it here</a></blockquote>
</font></td></tr>
</table>
<BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Perl Grinder</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (03.30.00)</font><BR>
This is a perl port of the popular tool "Grinder" by Rhino9. The original was written as a windows GUI,
but this is a port for easy use on a *nix shell/box. If you don't know what Grinder is, it essentially scans a
range of IP addresses for a URL (i.e. check for /index.html on 127.0.0.1 to 127.0.255.255).
<blockquote>
<a href="/security-archive/group_releases/grinder.pl">download it here</a></blockquote>
</font></td></tr>
</table>
<BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;Local X Denial of Service Exploit</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (03.22.00)</font><BR>
Nothing special, but this bash script will attempt to crash X. Can be run by any user logged in
to the system. The problem lies in the default configuration of X under Slackware 7, OpenBSD 2.6,
and FreeBSD 3.1. Does not work on RedHat or anything based off it (Mandrake, WinLinux, etc).
<blockquote>
<a href="/security-archive/group_releases/X-DoS.bash">download it here</a></blockquote>
</font></td></tr>
</table>
<BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;*nix Log Wiper</font></b></td><td align="right" bgcolor="#006699"><img
src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:tutor@r00tabega.org">Tutor</a> (03.19.00)</font><BR>
*nix log wiper...nothing fancy, removes your host (or a string) from system logs.
<blockquote>
<a href="/security-archive/group_releases/clean.sh">download it here</a></blockquote>
</font></td></tr>
</table>
<BR>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;DevNull RootKit</font></b></td><td align="right" bgcolor="#006699"><img src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:tutor@r00tabega.org">Tutor</a> and Ashmodai (03.18.00)</font><BR>
Linux rootkit, modified login, chsh, chfn and su. Our login, when in place, will not show the defined user logged into the system, nor log the connection origin. More to come, this is version 0.9.
<blockquote>
<a href="/security-archive/group_releases/DevNull-rootkit-v0.9.tar.bz2">download it here</a></blockquote>
</font></td></tr>
</table>
<br>
<table width="650" cellspacing="0" cellpadding="0" border="0" bgcolor="#EEEEEE">
<tr><td bgcolor="#006699"><b><font color="#FFFFFF" size="2" face="Arial">
&nbsp;MSADC Trojan Run</font></b></td><td align="right" bgcolor="#006699"><img src="images/cornertopright.gif"></tr>
<tr><td><font face="verdana" size="1">
<font color="red">Written by <a href="mailto:bansh33@r00tabega.org">bansh33</a> (03.18.00)</font><BR>
This is a handy little script written in Perl that will upload and execute a trojan that runs on NT
(i.e. netbus) to any RDS vulnerable (see <a href="http://www.wiretrip.net/rfp">r.f.p's site</a>) site.
There are 2 versions available, one for *nix and one for windows (ActivePerl) for all yew wind0ze script kiddies ;p.
The only thing I ask is that you don't abuse this to ./hack sites, this was made as a proof of concept, not to fuel
all the script kiddie bullshit that already exists. Don't abuse it.<blockquote>
<a href="/security-archive/group_releases/msadc-trojan.pl">Unix Version</a><BR>
<a href="/security-archive/group_releases/msadc-trojan-win.pl">Win Version</a><BR></blockquote>
</font></td></tr>
</table>
<br>
<table width="800"><tr><td align=center><font size="1" face="arial" color="#909090"><b>
Rip this design and burn in hell.
</b></font></td></tr></table>