[Script][Video] EvilGrade (v0.1.1)

[zlate]

I m trying the new 2.0 version of evilgrade and i can get the notepad++ to get attacked but i cant get skype to work.

This is the output from evilgrade when i try to update:

evilgrade>
[14/12/2010:1:15:59] - [WEBSERVER] - WebServer Client on 80

evilgrade>
[14/12/2010:1:16:0] - [DEBUG] - [WEBSERVER] -[192.168.2.7] - Packet request: "GET / HTTP/1.0\r\n"

evilgrade>
[14/12/2010:1:16:0] - [DEBUG] - [WEBSERVER] - [192.168.2.7] - Connection recieved...

evilgrade>"Host: conn.skype.com\r\n""User-Agent: Skype WISPr\r\n""\r\n"
[14/12/2010:1:16:7] - [WEBSERVER] - WebServer Client on 80

evilgrade>
[14/12/2010:1:16:8] - [DEBUG] - [WEBSERVER] -[192.168.2.7] - Packet request: "GET /ui/0/5.0.0.152.259/sv/getlatestversion?ver=5.0.0.152&uhash=1d0c442e0ba00e34d5f287168922ab134&google-chrome:notoffered;toolbaroffered HTTP/1.1\r\n"

evilgrade>
[14/12/2010:1:16:8] - [DEBUG] - [WEBSERVER] - [192.168.2.7] - Connection recieved...

evilgrade>"User-Agent: Skype\x99 5.0\r\n""Host: ui.skype.com\r\n""Cache-Control: no-cache\r\n""\r\n"

[Mx0back]

very nice

[abhirocks]

You can try the latest build

wget -q -N "http://g0tmi1k.googlecode.com/svn/trunk/evilGrade/evilGrade.sh"

*I haven't yet fully tested it*

I GOT AN ERROR

 line 63: syntax error near unexpected token '}'
line 63: '}'

[SecureSurfer]

I m trying the new 2.0 version of evilgrade and i can get the notepad++ to get attacked but i cant get skype to work.

This is the output from evilgrade when i try to update:

You should start Wireshark to see what happens there, and if the target machine accepts the GET or not, if there's an XML file to include... I encountered the same problem when trying to update Java 6_23. However when comparing the real updates and the spoofed updates using Wireshark I was able to adapt some things and got it working.

[Johnny5]

I GOT AN ERROR

 line 63: syntax error near unexpected token '}'
line 63: '}'

hi guys

i made a small solution for the problem in line 63

i just seperated the lines for there own und set the notneeded^^ semikolons for each line.
and dont know why but it seems to work

function cleanup() {
if [ "$1" == "nonuser" ] ;
then exit 3
fi

echo # Blank line
if [ "$verbose" != "0" ] ;
then display info "*** BREAK ***" ;
fi # User quit

display action "Restoring: Environment";
action "Killing Programs" "killall python xterm";

if [ "$verbose" != "0" ] || [ "$diagnostics" == "true" ] ;
then display action "Removing: Temp files" ;
fi

action "Removing files" "rm -rf /tmp/evilGrade*";

echo -e "\e[01;36m[*]\e[00m Done! (= Have you... g0tmi1k?";

exit 0;
}

[bakru]

@g0tmilk
thanks for this keen script, i also like to mention a small problem.
when i install evilGrade.sh the data dump file, wget called at the ftp server returned an empty one and that makes further installation impossible cause the program stops after looking for data dump.pm. is there a solution for this?
regards
bakru

[g0tmi1k]

I m trying the new 2.0 version of evilgrade and i can get the notepad++ to get attacked but i cant get skype to work.

This is the output from evilgrade when i try to update:

evilgrade>
[14/12/2010:1:15:59] - [WEBSERVER] - WebServer Client on 80

evilgrade>
[14/12/2010:1:16:0] - [DEBUG] - [WEBSERVER] -[192.168.2.7] - Packet request: "GET / HTTP/1.0\r\n"

evilgrade>
[14/12/2010:1:16:0] - [DEBUG] - [WEBSERVER] - [192.168.2.7] - Connection recieved...

evilgrade>"Host: conn.skype.com\r\n""User-Agent: Skype WISPr\r\n""\r\n"
[14/12/2010:1:16:7] - [WEBSERVER] - WebServer Client on 80

evilgrade>
[14/12/2010:1:16:8] - [DEBUG] - [WEBSERVER] -[192.168.2.7] - Packet request: "GET /ui/0/5.0.0.152.259/sv/getlatestversion?ver=5.0.0.152&uhash=1d0c442e0ba00e34d5f287168922ab134&google-chrome:notoffered;toolbaroffered HTTP/1.1\r\n"

evilgrade>
[14/12/2010:1:16:8] - [DEBUG] - [WEBSERVER] - [192.168.2.7] - Connection recieved...

evilgrade>"User-Agent: Skype\x99 5.0\r\n""Host: ui.skype.com\r\n""Cache-Control: no-cache\r\n""\r\n"

This thread is for the script and video which uses evilgrade v1.
I haven't yet fully released the update to the script that support v2 which means this isn't a thread for issues with evilgrade v2...
They could of changed the updating system of skype to stop this method of attack, have you tried reasearching versions?
Have you used wireshark to see what is happening?

very nice

Thanks for the thanks

I GOT AN ERROR

 line 63: syntax error near unexpected token '}'
line 63: '}'

Thanks for pointing this out - It should be fix in the next release (Im in need of releasing the update for the script!)

You should start Wireshark to see what happens there, and if the target machine accepts the GET or not, if there's an XML file to include... I encountered the same problem when trying to update Java 6_23. However when comparing the real updates and the spoofed updates using Wireshark I was able to adapt some things and got it working.

Good advice

hi guys

i made a small solution for the problem in line 63

i just seperated the lines for there own und set the notneeded^^ semikolons for each line.
and dont know why but it seems to work

function cleanup() {
if [ "$1" == "nonuser" ] ;
then exit 3
fi

echo # Blank line
if [ "$verbose" != "0" ] ;
then display info "*** BREAK ***" ;
fi # User quit

display action "Restoring: Environment";
action "Killing Programs" "killall python xterm";

if [ "$verbose" != "0" ] || [ "$diagnostics" == "true" ] ;
then display action "Removing: Temp files" ;
fi

action "Removing files" "rm -rf /tmp/evilGrade*";

echo -e "\e[01;36m[*]\e[00m Done! (= Have you... g0tmi1k?";

exit 0;
}

Thanks for pointing this out - It will be fix in the next release

@g0tmilk
thanks for this keen script, i also like to mention a small problem.
when i install evilGrade.sh the data dump file, wget called at the ftp server returned an empty one and that makes further installation impossible cause the program stops after looking for data dump.pm. is there a solution for this?
regards
bakru

I will have a fix for this in the next update.
Im guessing that the url has been changed due to the update of evilgrade, which could be a reason why wget is failing.

[bakru]

after switching to this URL ftp://ftp.loxinfo.co.th/pub/cpan/aut...mp-1.08.tar.gz
the problem with the empty file was solved and installation perfect.
hope this helped a bit.
regards
bakru