[Xylitol]

Desc: http://seclists.org/fulldisclosure/2010/Sep/268
http://www.exploit-db.com/exploits/15024/
Found on a compromised server also with these files

https://www.virustotal.com/en/file/0493 ... 367228407/

[unixfreaxjp]

Hi @Xylit0l,

Glad that you open this thread. Those chinese ELF moronz is using these too.

Some PoC got from reversing this before I checked into KM...
x32: https://www.virustotal.com/en/file/11cd ... /analysis/ < has comment
x64: https://www.virustotal.com/en/file/11cd ... /analysis/
It's a completely copy-paste, the pricks are just compiling it as per it is..