Web assessment turns Botnet Tracking
Well about every night til the early mornings I like to perform web assessments to see what I can find in developers web applications. Usually its something different everyday. What I uncovered today was definitely something I do not do all the time. I had found a vulnerable php application on a website. The application was vulnerable to RFI more commonly known as remote file inclusion. So I uploaded a php shell and took a look around. First place I look of course is the /tmp directory. Of course most of you know, almost any user can run malicious code or upload application in the directory because of the permissions that set on it. Well before I could even think about doing something like that I viewed what was already in the directory and the first thing I saw was a "botnet.txt". So of course I "cat" the file and in the very beginning were the configuration to a IRC server and its botnet owner. Then I quickly copy and paste the configuration, then exit the file and remove the malicious code. After thinking for a bit I decided to go check out what really goes on in that server so here is what happens... http://pastebin.com/f561066df
After that conversation I had to share it. Has anything you guys have done on a regular basis led you to something fun and interesting?
After that conversation I had to share it. Has anything you guys have done on a regular basis led you to something fun and interesting?
Comment