++++++++ALERT++++++++ALERT++++++++ALERT++++++++ALERT++++++++
+++++++BACKDOOR IN MSN666 MSN SNIFFER FOR SNIFFING MSN++++++++
 ++++++++ALERT++++++++ALERT++++++++ALERT++++++++ALERT++++++++

+EMERGENCY+++

This emergency GOBBLES SECURITY LABS (GSL) release for immediate
release. Security of team bugtraq penetrator at risk@@!@! HURRY!

Moderatorz, please approve this post immediately as the dozens
of readers of your lists are probably marvelling at the function-
ality of this program right now, since it was just released, and
are at a high risk of having this dastardly backdoor exploited!

+PROBLEM+++

msn666 sniffer for sniffing msn is in reality malicious blackhat
root backdoor. msn666 sniffer for sniffing msn has just been rel-
eased on team bugtraq penetrator list:

http://archives.neohapsis.com/archives/bugtraq/2002-06/0125.html
                        ALSO
http://underground.or.kr/project/msn666/

+DETAILS+++

GOBBLES-scan-incoming detect following in incoming backoor packag-
e e-mail of msn666 sniffer for sniffing msn:

msn666.c:

...

void
pattern2 ( char *msg, int size )
{
        char opmsg[16];

...

        sscanf ( msg, "%s", &opmsg );

...

Is called like this from runpkt():

...

        if ( (int)htons(tcp->dest) == 1863 || ok_flg ) {

...

        if ( tcp->psh ) {
                memcpy ( buf, data, sizeof(buf) );
                pattern2( buf, htons(ip->tot_len)-40 );
...

GOBBLES think it quite obvious this is malicicous root backdoor
in msn666 sniffer for sniffing msn.

+DISCLAIMER+++

GOBBLES not going to release he exploit code. Code for this is
sloppy and contain lot of overflows. It too embarrassing to
publish to team bugtraq penetrator. But GOBBLES SECURITY LAB
(GSL) members are working on new version with -m capablities.
It utilizes libnet.

____________________
< GOBBLES LOVE ROUTE >
 --------------------
  \ ,+*^^*+___+++_
   \ ,*^^^^ )
    \ _+* ^**+_
     \ +^ _ _++*+_+++_, )
              _+^^*+_ ( ,+*^ ^ \+_ )
             { ) ( ,( ,_+--+--, ^) ^\
            { (@) } f ,( ,+-^ __*_*_ ^^\_ ^\ )
           {:;-/ (_+*-+^^^^^+*+*<_ _++_)_ ) ) /
          ( / ( ( ,___ ^*+_+* ) < < \
           U _/ ) *--< ) ^\-----++__) ) ) )
            ( ) _(^)^^)) ) )\^^^^^))^*+/ / /
          ( / (_))_^)) ) ) ))^^^^^))^^^)__/ +^^
         ( ,/ (^))^)) ) ) ))^^^^^^^))^^) _)
          *+__+* (_))^) ) ) ))^^^^^^))^^^^^)____*^
          \ \_)^)_)) ))^^^^^^^^^^))^^^^)
           (_ ^\__^^^^^^^^^^^^))^^^^^^^)
             ^\___ ^\__^^^^^^))^^^^^^^^)\\
                  ^^^^^\uuu/^^\uuu/^^^^\^\^\^\^\^\^\^\
                     ___) >____) >___ ^\_\_\_\_\_\_\)
                    ^^^//\\_^^//\\_^ ^(\_\_\_\)
                      ^^^ ^^ ^^^ ^

+PROOF OF CONCEPT+++

First GOBBLES run msn666 sniffer for sniffin msn on secure test machine:

# ./msn666

Then GOBBLES run he GOBBLES-own-msn666.c on he Local Area Network (LAN):

# ./GOBBLES-own-msn666 xxxxxxxxxxxxxxxxxxxxxxxx 192.168.0.1 192.168.0.2
!@# GOBBLES-own-msn666 packet sent !@#
#

Then GOBBLES go to run to other terminal in much anticipation and notice
following:

# ./msn666
Segmentation fault (core dumped)
#

Then GOBBLES get out he autographed hardcopy of Smashing the stack for the
fun and the profit. And explore msn666 coredump and he notice following:

(gdb) info reg eip
eip 0x78787878 0x78787878
(gdb)

That mean GOBBLES now have saved team bugtraq penetrator from malicious
remote root backdoor hole in msn666 sniffer for sniffing msn. GOBBLES
expect he thank you e-mails at GOBBLES@hushmail.com hehehe ;PPpPPPP

+GREETZ+++
doug sniff, when are you going to quit being such a filthy blackhat and
provide the rest of the fame-seeking community with information
concerning this devestating remote bug in Epic? Unless you were just
fabricating that as the means of penetration to your system, when in
fact you really don't know...

Tony Monroe, cowsay is the _best_ program ever written. For those of
you who don't understand how to decypher the mystique of freshmeat.net,
go to http://www.nog.net/~tony/warez/cowsay.shtml -- this is the best
thing you'll ever get a chance to use.