Re: [Full-disclosure] (no subject)

From: Ademar Gonzalez (ademar.gonzalez_at_gmail.com)
Date: 09/28/05

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-disclosure] Suggestion for IDS" 
    Date: Wed, 28 Sep 2005 10:38:23 -0400
To: adityad2005@users.sourceforge.net

    Hi Aditya

    On 9/28/05, Aditya Deshmukh
    <aditya.deshmukh@online.gateway.strangled.net> wrote:
    > Recently 2 days ago I saw this in a compromised system.
    >
    >
    > Both this file and cpshost.dll were deleted from C:\InetPub\scripts
    > This file was recovered but I was unable to recover cpshost.dll....
    >
    >
    > Anyone know what is this ?
    >

    It is a upload script, cpshost.dll is the Posting Acceptor ActiveX control :

    http://support.microsoft.com/kb/q230298/

    >
    > <% Response.Buffer = TRUE %>
    >
    > Version=1.5
    > <%
    > PathToPA = "http://" + Request.ServerVariables("SERVER_NAME") +
    > "/scripts/cpshost.dll"
    >
    >
    > PostingURL = PathToPA + "?PUBLISH"
    >
    > TargetURL = "http://" + Request.ServerVariables("SERVER_NAME")
    > %>
    >
    > [{8B14B770-748C-11D0-A309-00C04FD7CFC5}]
    > PostingURL="<%= PostingURL %>"
    > TargetURL="<%= TargetURL %>"
    > ComponentInstall="yes"
    >

    ciao ciao
    ademar
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-disclosure] Suggestion for IDS"