RE: [PHP] new one is it ??
| From: | Mark Roedel | Date: | Mon, 13 Aug 2001 15:21:45 +0000 |
| Subject: | RE: [PHP] new one is it ?? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-62449@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> From: Tim [mailto:infoz@earthlink.net]
> Sent: Monday, August 13, 2001 9:38 AM
> To: Mark Lo
> Cc: php general
> Subject: Re: [PHP] new one is it ??
>
>
> Boy that looks familiar...my (apache) logs are full of 'em.
>
> I wonder if we can make a PHP script called default.ida that
> sends back a big chunk of data and causes the worm to get a
> buffer overflow? :) :)
I rather liked this approach that I saw posted in another list:
http://www.klippan.seths.se/default.phps
(Does some hostname/whois lookups on the infected server and attempts to
email some people who might be able to do something about it.)
---
Mark Roedel | "Blessed is he who has learned to laugh
Systems Programmer | at himself, for he shall never cease
LeTourneau University | to be entertained."
Longview, Texas, USA | -- John Powell