Author: Paul, Posted: Wed Dec 12, 2007 12:42 am Post subject: [WsIRT#723] C99Shell @AS41186
Attack Alert Full Report: /C99Shell_attack723.html Changed status to confirmed attack.IP Converted: 195.114.18.91
dword = 3279032923
hex1 = 0xc372125b
hex2 = 0xc3.0x72.0x12.0x5b
oct = 0303.0162.022.0133
This is the c99 shell script written in PHP that attackers are attempting to inject into remote webservers, and if successful, compromises such servers for their nefarious uses. Please remove immediately.