Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Sidewinder Command/Safemode Exploit 4.1 (PHP.Chaploit)
From: "Maxime Ducharme" <mducharme () cybergeneration com>
Date: Mon, 9 Jan 2006 12:00:02 -0500


we got hit by whats looks like a bot
trying to inject PHP.Chaploit in our sites

Host is in 202.226.224.*
User-Agent : lwp-trivial/1.35

the bot hit one of our dynamic pages (ASP)
trying to inject the PHP script located on

Full URL was


obviously trying to inject PHP in ASP isnt a good idea,
thats what makes me think this is automated (and dumb) attack

Virustotal says :
AntiVir 01.09.2006 Linux/Rootkit 
Avast 4.6.695.0 01.09.2006 PHP:Chaploit 
Avira 01.09.2006 Linux/Rootkit 
DrWeb 4.33 01.09.2006 PHP.Chaploit 
Kaspersky 01.09.2006 Exploit.PHP.e 
McAfee 4669 01.06.2006 PHP/Chaploit 
(other didnt detect anything)

I also advised sysadmin of the web server hosting this

i just wanted to share this information with the community

have a nice day

Maxime Ducharme

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Sidewinder Command/Safemode Exploit 4.1 (PHP.Chaploit) Maxime Ducharme (Jan 09)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]