Tag Info

Hot answers tagged

15

That is someone exploiting the Shellshock bug. Can you determine what the perl script was doing? This is definitely worth you poking into. The second URL used returns a 404, but http://213.5.67.223/ji exists and might be the same thing, seeing as it is a perl script. It seems to be an IRC server of some sort, so connecting to your test server with an IRC ...


6

The Shellshock vulnerability is used to download (using wget) and execute a malicious Perl script, this attack is very basic and requires both Perl and wget to be installed (assuming one of them isn't and you are sure there were no other cracking attempts, your server wasn't compromised). The script itself is a basic script-kiddie IRC bot, once executed ...


2

What you want does fold: fold -s -w80 file -s: tells fold to break only at spaces -w80: declared the width fold: also reads from stdin: echo "..." | fold -s -w80


1

Here's some (rather inefficient) pseudocode to get you started: for filename in (recurse through all files) skip if size(filename) < 100K display filename response = ask user what they want to do if response == "delete" delete filename write filename + current time to logfile else if response == "compress" compress filename It's ...


1

As mentioned by others already, this is a script-kiddie attempt to exploit the bash vulnerability to execute a perl script based IRC bot. If you have bash updated, and in addition, if you run apache under chroot like I do, you have nothing to worry about. I see several versions of this on my log (see below) at least every other day since 9/27...this is just ...



Only top voted, non community-wiki answers of a minimum length are eligible