[Full-disclosure] (no subject)
From: Aditya Deshmukh (aditya.deshmukh_at_online.gateway.strangled.net)
Date: 09/28/05
- Previous message: Tim Hurman: "[Full-disclosure] Exploring Windows CE Shellcode"
- Next in thread: Ademar Gonzalez: "Re: [Full-disclosure] (no subject)"
- Reply: Ademar Gonzalez: "Re: [Full-disclosure] (no subject)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: <full-disclosure@lists.grok.org.uk> Date: Wed, 28 Sep 2005 17:31:30 +0530
Recently 2 days ago I saw this in a compromised system.
Both this file and cpshost.dll were deleted from C:\InetPub\scripts
This file was recovered but I was unable to recover cpshost.dll....
Anyone know what is this ?
<% Response.Buffer = TRUE %>
Version=1.5
<%
PathToPA = "http://" + Request.ServerVariables("SERVER_NAME") +
"/scripts/cpshost.dll"
PostingURL = PathToPA + "?PUBLISH"
TargetURL = "http://" + Request.ServerVariables("SERVER_NAME")
%>
[{8B14B770-748C-11D0-A309-00C04FD7CFC5}]
PostingURL="<%= PostingURL %>"
TargetURL="<%= TargetURL %>"
ComponentInstall="yes"
________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Previous message: Tim Hurman: "[Full-disclosure] Exploring Windows CE Shellcode"
- Next in thread: Ademar Gonzalez: "Re: [Full-disclosure] (no subject)"
- Reply: Ademar Gonzalez: "Re: [Full-disclosure] (no subject)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
