mailing list archives
r57shell "hidden" feature
From: full_disclosure full_disclosure <fulll_disclosure () yahoo com>
Date: Thu, 7 Sep 2006 11:11:02 -0700 (PDT)
Doing some forensics I found that R57shell(version 1.31) a widely used php shell by RST/GHC, has some "hidden
features", it will log any usage to some russian stats counters. If those counters log the ip, and the script is not
protected by a password, they cand 0wn everything you 0wned.
Starting from line 1469 we have 2 base64 encoded variables $c1 and $c2, at line 1592 the script will check if the
variables are empty and die() if true, then they are decoded and appended to $f, which is echo-ed at line 2204. $f
contains only the counters scripts.
Trust no one(especialy commies), write your own tools.
Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- r57shell "hidden" feature full_disclosure full_disclosure (Sep 07)