what www perl script is running?

[Colin Brace]

CyberLeo Kitsana wrote:
> 
> Are these files available in a tarball someplace public, for those of us
> who enjoy performing autopsies on virii? 

Sure thing: http://silenceisdefeat.com/~cbrace/www_badstuff.gz

this tarball contains "tmpfile" which is the misbehaving script as well as
the contents of a directory called ".," which has a bunch of source code and
so on. As indicated earlier, this stuff was installed by user 'www'.

It should be unpacked in an empty directory.

Have fun!



-----
  Colin Brace
  Amsterdam
  http://lim.nl
-- 
View this message in context: http://www.nabble.com/what-www-perl-script-is-running--tp25112050p25143778.html
Sent from the freebsd-questions mailing list archive at Nabble.com.