Full Disclosure: Re: (no subject)

From: Ademar Gonzalez <ademar.gonzalez_at_gmail.com>
Date: Wed, 28 Sep 2005 10:38:23 -0400

Hi Aditya

On 9/28/05, Aditya Deshmukh
<aditya.deshmukh_at_online.gateway.strangled.net> wrote:
> Recently 2 days ago I saw this in a compromised system.
>
>
> Both this file and cpshost.dll were deleted from C:\InetPub\scripts
> This file was recovered but I was unable to recover cpshost.dll....
>
>
> Anyone know what is this ?
>

It is a upload script, cpshost.dll is the Posting Acceptor ActiveX control :

http://support.microsoft.com/kb/q230298/

>
> <% Response.Buffer = TRUE %>
>
> Version=1.5
> <%
> PathToPA = "http://" + Request.ServerVariables("SERVER_NAME") +
> "/scripts/cpshost.dll"
>
>
> PostingURL = PathToPA + "?PUBLISH"
>
> TargetURL = "http://" + Request.ServerVariables("SERVER_NAME")
> %>
>
> [{8B14B770-748C-11D0-A309-00C04FD7CFC5}]
> PostingURL="<%= PostingURL %>"
> TargetURL="<%= TargetURL %>"
> ComponentInstall="yes"
>

ciao ciao
ademar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Sep 28 2005