https://www.icyphoenix.com/viewtopic.php?f=35&t=308
-----------------------------------
Kangura
Thu 07 Sep, 2006 04:05

Strange File Found In My XS: /files/py2
-----------------------------------
There's a copy of my XS site on my computer and inside the "files" folder there's no file called "py2" but in the live version of my site there is and I'm writing  here to seek an understanding of what that file is please.

Apparently it was created on 30Aug and when I view it in Notepad, there are lots of symbols and the following text amongst those symbols: 

[quote]v ƒëÿÐ‹ƒøÿuôX[ÉÃU‰åSè    [Ã  PèªûÿÿY[ÉÃ       [+] getting root shell
 /bin/sh [-] execle  
prctl() suidsafe exploit

(C) Julien TINNES

 /proc/self/exe [-] readlink  This is not fatal, rewrite the exploit
 [-] signal [+] Installed signal handler
 /etc/cron.d [-] chdir [-] prtctl   Is you kernel version >= 2.6.13 ?
  [+] We are suidsafe dumpable!
 /etc/cron.d/core 
 [-] cronstring is too small
 [+] Malicious string forged
 [-] fork [+] Segfaulting child
 [-] kill    [+] Waiting for exploit to succeed (~%ld seconds)
  [-] It looks like the exploit failed[/quote]
The current owner of the file is: Webserver

I've stuck the file here: http://europeclubitalia.net/xs/uploads/

I would greatly appreciate an explanation of what the function of this file might be.

Thanks in advance :)


-----------------------------------
ch0pper
Thu 07 Sep, 2006 07:15

Re: Strange File Found In My XS: /files/py2
-----------------------------------
it look like your site mabe hacked!

check here http://www.milw0rm.com/exploits/2005

you need to sum updated on your box i think


-----------------------------------
Kangura
Thu 07 Sep, 2006 07:46

Re: Strange File Found In My XS: /files/py2
-----------------------------------
:censored: kkkk
Could that be why it takes extra time to log on to our site now but navigating around it is fast?


-----------------------------------
ch0pper
Thu 07 Sep, 2006 13:07

Re: Strange File Found In My XS: /files/py2
-----------------------------------
yep check for rookits , and updated as much as you can


-----------------------------------
Kangura
Fri 08 Sep, 2006 03:49

Re: Strange File Found In My XS: /files/py2
-----------------------------------
[quote user="ch0pper" post="2607"]yep check for rookits , and updated as much as you can[/quote]

sorry what are rookits ??

all patches as advised by MG are installed :shock:


