Re: Re: Hack question
| From: | Eric Butera | Date: | Fri, 18 Apr 2008 19:11:18 +0000 |
| Subject: | Re: Re: Hack question | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-273269@lists.php.net to get a copy of this message | ||
On Fri, Apr 18, 2008 at 2:59 PM, Jim Lucas <lists@cmsws.com> wrote:
> in the example code above that is injected into the top of the php scripts,
> the eval is evaluating the code that is read from the temp file, the temp
> file is never moved or renamed. There for it will be removed when the
> script is done.
Looking at the first post:
On Wed, Apr 16, 2008 at 12:13 PM, Al <news@ridersite.org> wrote:
> The hack places this file in
> numerous dirs on the site, I assume using a php script because the owner is
> "nobody".
From my understanding this means a stand-alone file is written out by
a compromised means. If something else has been said I missed it
along the way! :)