Veni, Vidi, VISA

/home/dope/bin/suid-find.sh: line 128: [: -gt: unary operator expected



Error sending message, child exited 78 ().

/home/dope/bin/suid-find.sh: line 139: 14156 Done                    cat $LOG

14157 Segmentation fault (core dumped) | mutt -s "Backup - Report for $HOSTNAME (`date -I`)" backups@strcat.de

[dope@painless:~ ]% gqview --debug

GQview 2.1.5, This is a beta release.

debugging output enabled (level 1)

loader reported [png] [The PNG image format] [.png]

loader reported [gif] [The GIF image format] [.gif]

loader reported [ico] [The ICO image format] [.ico;.cur]

loader reported [ani] [The ANI image format] [.ani]

loader reported [ras] [The Sun raster image format] [.ras]

loader reported [xpm] [The XPM image format] [.xpm]

loader reported [pnm] [The PNM/PBM/PGM/PPM image format family] [.pnm;.pbm;.pgm;.ppm]

loader reported [bmp] [The BMP image format] [.bmp]

loader reported [wbmp] [The WBMP image format] [.wbmp]

loader reported [xbm] [The XBM image format] [.xbm]

loader reported [tga] [The Targa image format] [.tga;.targa]

loader reported [pcx] [The PCX image format] [.pcx]

read ahead cancelled for :(null)

image load completed "(null)" (current)

collection manager flushing

collection manager is up to date

[dope@painless:~ ]%

echo vd ; echo q) | nc localhost 4000 | grep 100.0

[D  19] Sledge.Hammer-[...]                    100.0   800.5mb  800.5mb    0%  23:0  1/240   -     20

<object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/A0HO_NG7ujE"></param>

     <embed src="http://www.youtube.com/v/A0HO_NG7ujE" type="application/x-shockwave-flash" 

      width="425" height="350"></embed></object>

<div style="text-align:center"><object type="application/x-shockwave-flash" 

      style="width:425px; height:350px" data="http://www.youtube.com/watch?v=A0HO_NG7ujE"> 

      <param name="movie" value="http://www.youtube.com/watch?v=A0HO_NG7ujE"></param></object></div>

Published: 2006-06-15,
Last Updated: 2006-06-15 13:17:35 UTC by Bojan Zdrnja (Version: 1)

We've received couple of reports about e-mails being spammed which contain browser exploits. What's interesting about this is that they are targeting Australia.

All e-mails we've received have the same content, but the URL seems to be moving around. The body is pasted below:

"People starting panic withdrawals, some of the accounts were reported closed due to technical reasons, many ATMs are not operating. Does it seem that one of the Australia's greatest goes bankrupt? The full story could be found here: <URL>
Well, hope that isn't true... Anyway You'd rather check your balance..."

The URL contains an obfuscated JavaScript. The JavaScript code will check which browser the user is running and will redirect him to the appropriate exploit, served by a CGI script.
The JavaScript will also detect if a user is running Service Pack 2, and append that information as a CGI parameter as well.

The following Internet Explorer vulnerabilities are exploited:

MS03-011
MS06-006
MS06-014

And one Mozilla FireFox vulnerability is exploited as well:

MFSA2005-50

For FireFox user, there is good add-on tool for preventing malicious Javascripts. The add-on tool called "NoScript". You can find more information following site :
https://addons.mozilla.org/firefox/722/

(dope@dreckskind) : (~): php -v

192.168.1.6 45862 22

PHP 5.0.5 (cli) (built: Mar  1 2006 16:46:00)

Copyright (c) 1997-2004 The PHP Group

Zend Engine v2.0.5, Copyright (c) 1998-2004 Zend Technologies

(dope@dreckskind) : (~): php -v

PHP 5.1.4 (cgi-fcgi) (built: Jun  6 2006 12:08:24)

Copyright (c) 1997-2006 The PHP Group

Zend Engine v2.1.0, Copyright (c) 1998-2006 Zend Technologies

(dope@dreckskind) : (~):

fastcgi.server             = ( ".php" =>

                               ( "localhost" =>

                                 (

                                   "socket" => "/tmp/php-fastcgi.socket",

                                   "bin-path" => "/usr/local/bin/php"

                                 )

                               )

                            )

PKG_PATH="/cdrom;/usr/pkgsrc/packages/All;ftp://ftp.netbsd.org/pub/NetBSD/packages/1.4.2/i386/All/"

export PKG_PATH=ftp://ftp2.de.NetBSD.org/pub/NetBSD/packages/3.0/i386/All