Re: [Full-disclosure] PHP Command/Safemode Exploit

[Willem Koenings <infsec@xxxxxxxxx>]

hi,

 
> Can't see anything new in there. The usual PHP exploit suite, which is very
> script kiddie compatible, but where do you suspect a new exploit?

Thanks for your input but sorry, but where i reffered that this is new
one? Thing is, that often old vulnerabilities/exploites comes back as
people lose their watchfulness /(re)install things and fell on them.
There are still lot of cases of unicode problem around IIS for
instance.

As i saw those queries on several webserver i was curios whether they
were isolated cases or really something old coming back.


> PS: The site with cse.gif on it is down now.

If you know for sure then they have reopened again.

wget -vv http://213.202.214.198/cse.gif
--01:04:23--  http://213.202.214.198/cse.gif
           => `cse.gif'
Connecting to 213.202.214.198:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 26,593 [image/gif]

100%[====================================>] 26,593        53.00K/s

01:04:25 (53.00 KB/s) - `cse.gif' saved [26593/26593]

W.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/