RE: [cobalt-users] hacker

["Sim Ayers" <sim@xxxxxxxxxxxx>]

more info on aCid fAlz
http://www.demokratie99.carinthia.at/

http://www.russiahack.com/english.html

http://www.securitytracker.com/alerts/2001/Oct/1002481.html


> -----Original Message-----
> From: cobalt-users-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Olaf Alders
> Sent: Saturday, November 17, 2001 3:01 PM
> To: cobalt-users@xxxxxxxxxxxxxxx
> Subject: [cobalt-users] hacker
>
>
> ok -- so this is disturbing -- i get a cron message saying this
> at 5:06 p.m.
> today:
>
> sh: /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/: is a
> directory
> sh: /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/: is a
> directory
> sh: /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/: is a
> directory
> Can't exec
> "/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/.._.._
> .._.._.._.
> ._.._.._.._.._.._.._.._.._.._.._bin_id": No such file or directory at
> /home/vilerichard/www/cgi-bin/stats/cronjobs/clean_sessions.pl line 71.
> Can't exec
> "/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/.._.._
> .._.._.._.
> ._.._.._.._.._.._.._.._.._.._.._bin_ls": No such file or directory at
> /home/vilerichard/www/cgi-bin/stats/cronjobs/clean_sessions.pl line 71.
> Can't exec
> "/home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/.._.._
> .._.._.._.
> ._.._.._.._.._.._.._.._.._.._.._bin_pwd": No such file or directory at
> /home/vilerichard/www/cgi-bin/stats/cronjobs/clean_sessions.pl line 71.
>
>
> then I look in this directory:
> /home/vilerichard/www/cgi-bin/stats/users/vilerichard/page/
>
> I find the following files:
>
> |cat _home_sites_site11_web_index.cgi|
> |cat _home_sites_site11_web_private_.htaccess|
> |cat _home_sites_site11_web_private_.htpasswd|
> |echo hm bitcH you are owned
> |echo hm bitcH you are owned<BR>it was me hahahah<BR>aCid fAlz was here
> _home_sites_site11_web_index.cgi|
> |echo hm bitcH you are owned<BR>it was me hahahah<BR>aCid fAlz was here>
> _home_sites_site11_web_index.cgi|
> |echo look bitch you are owned
> |echo onwed> _home_sites_site11_web_index.cgi|
> |id|
> |ls -al _home_sites_site11_web_private|
> |ls -al _home_sites_site11_web|
> |ls _home_sites_site11_data|
> |ls _home_sites_site11_users_wunder_web|
> |ls _home_sites_site11_users_wunder|
> |ls _home_sites_site11_users|
> |ls _home_sites_site11_web_web|
> |ls _home_sites_site11_web_|
> |ls _home_sites_site11_web|
> |ls _home_sites_site11_|
> |ls _home_sites_site11|
> |ls|
> |mv _home_sites_site11_users_wunder_web_index.html _home_sites_site11_web|
> |pwd|
> |uname -a|
>
> Any thoughts as to what I should do?  I don't have sensitive data on the
> XTR, but this is a real pain in the ass.  I've never had to deal with this
> before.
>
> Olaf
>
>
>
> --
> Olaf Alders
>
> olaf@xxxxxxxxxxxxxxx
> http://vilerichard.com
>
> Thursday, Dec 13th @ Holy Joe's in Toronto:  A Vile Christmas
> (Music, Comedy
> and Eats)
>
> $15 Domain Name Registration:  http://www.wundersolutions.com
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>