what www perl script is running?

[Colin Brace]

Colin Brace wrote:
> 
> 
> CyberLeo Kitsana wrote:
>> 
>> Are these files available in a tarball someplace public, for those of us
>> who enjoy performing autopsies on virii? 
> 
> Sure thing: http://silenceisdefeat.com/~cbrace/www_badstuff.gz
> 
> this tarball contains "tmpfile" which is the misbehaving script as well as
> the contents of a directory called ".," which has a bunch of source code
> and so on. As indicated earlier, this stuff was installed by user 'www'.
> 
> It should be unpacked in an empty directory.

Oops, I missed six more files written by www to /tmp. Here they are:

http://silenceisdefeat.com/~cbrace/www_badstuff-2.gz



-----
  Colin Brace
  Amsterdam
  http://lim.nl
-- 
View this message in context: http://www.nabble.com/what-www-perl-script-is-running--tp25112050p25149271.html
Sent from the freebsd-questions mailing list archive at Nabble.com.