RE: [PHP] new one is it ??
| From: | scott [gts] | Date: | Mon, 13 Aug 2001 14:37:39 +0000 |
| Subject: | RE: [PHP] new one is it ?? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-62436@lists.php.net to get a copy of this message | ||
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
what about something like this ?
(just configure apache to have PHP handle *.ida files)
<?
// this is so our script won't time out
set_time_limit(0);
// how many bytes of junk to generate
$jsize = 1024 * 10;
// how many times to print $junk
$jout = 1;
// generate some random junk
$n = 0;
while ($n++ < $jsize) {
$junk .= chr( rand(1,200) );
}
$i = 0;
while ( $i++ < $jout ) {
print $junk;
}
?>
> -----Original Message-----
> From: Tim [mailto:infoz@earthlink.net]
> Subject: Re: [PHP] new one is it ??
>
>
> Boy that looks familiar...my (apache) logs are full of 'em.
>
> I wonder if we can make a PHP script called default.ida that sends back
> a big chunk of data and causes the worm to get a buffer overflow? :) :)
>
> - Tim (glad I don't run IIS :)
>
> On 13 Aug 2001 22:27:06 +0800, Mark Lo wrote:
> > 208.251.146.123 - - [13/Aug/2001:22:24:27 +0800] "GET
> > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> > NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
> > u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
> > HTTP/1.0" 400 333 - "-" "-"
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
iQA/AwUBO3fmM8aXTGgZdrSUEQKRAgCgrGf+r6Fma17L39tEVp8lwanC+FwAoJlz
l7k1s47s8EdDHnM+jLZzDuL2
=z2GG
-----END PGP SIGNATURE-----