Comments on: Anatomy of a blog hack http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/ A blog on prediction markets and innovation Fri, 16 Jul 2010 12:34:39 +0000 hourly 1 http://wordpress.org/?v=3.0 By: Mark http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/comment-page-1/#comment-2258 Mark Tue, 24 Nov 2009 17:56:21 +0000 http://blog.mercury-rac.com/?p=136#comment-2258 This allows the person who has the password embedded in this file to upload any file they want. This allows the person who has the password embedded in this file to upload any file they want.

]]> By: garethdp http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/comment-page-1/#comment-2257 garethdp Tue, 24 Nov 2009 16:05:18 +0000 http://blog.mercury-rac.com/?p=136#comment-2257 The PHP code shown is used to handle a file upload to the server through an html form.<br><br>The attacking server mimics a form submission to the PHP code shown, and it tests to see if the file is successfully uploaded. If the test is successful the attacking server can then send down more files The PHP code shown is used to handle a file upload to the server through an html form.

The attacking server mimics a form submission to the PHP code shown, and it tests to see if the file is successfully uploaded. If the test is successful the attacking server can then send down more files

]]> By: Errant http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/comment-page-1/#comment-2256 Errant Tue, 24 Nov 2009 15:04:55 +0000 http://blog.mercury-rac.com/?p=136#comment-2256 The code does 2 things (just do you know).<br><br>It requires the password the hacker set up to be posted; along with a file - one assumes PHP or Html script. <br><br>Then it will either (depending on the options chosen) save the file to the server. Or execute code in the file (using eval()). <br><br>The it prints a success / fail.<br><br>From the looks of things it looks tailored for use of some sort of bot - because the save_ok/fail/ok text that gets printed is MD5 hashed. The code does 2 things (just do you know).

It requires the password the hacker set up to be posted; along with a file – one assumes PHP or Html script.

Then it will either (depending on the options chosen) save the file to the server. Or execute code in the file (using eval()).

The it prints a success / fail.

From the looks of things it looks tailored for use of some sort of bot – because the save_ok/fail/ok text that gets printed is MD5 hashed.

]]> By: Mark http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/comment-page-1/#comment-2183 Mark Tue, 24 Nov 2009 10:56:21 +0000 http://blog.mercury-rac.com/?p=136#comment-2183 This allows the person who has the password embedded in this file to upload any file they want. This allows the person who has the password embedded in this file to upload any file they want.

]]> By: garethdp http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/comment-page-1/#comment-2182 garethdp Tue, 24 Nov 2009 09:05:18 +0000 http://blog.mercury-rac.com/?p=136#comment-2182 The PHP code shown is used to handle a file upload to the server through an html form.<br><br>The attacking server mimics a form submission to the PHP code shown, and it tests to see if the file is successfully uploaded. If the test is successful the attacking server can then send down more files The PHP code shown is used to handle a file upload to the server through an html form.

The attacking server mimics a form submission to the PHP code shown, and it tests to see if the file is successfully uploaded. If the test is successful the attacking server can then send down more files

]]> By: Errant http://blog.mercury-rac.com/2009/11/15/anatomy-of-a-blog-hack/comment-page-1/#comment-2181 Errant Tue, 24 Nov 2009 08:04:55 +0000 http://blog.mercury-rac.com/?p=136#comment-2181 The code does 2 things (just do you know).<br><br>It requires the password the hacker set up to be posted; along with a file - one assumes PHP or Html script. <br><br>Then it will either (depending on the options chosen) save the file to the server. Or execute code in the file (using eval()). <br><br>The it prints a success / fail.<br><br>From the looks of things it looks tailored for use of some sort of bot - because the save_ok/fail/ok text that gets printed is MD5 hashed. The code does 2 things (just do you know).

It requires the password the hacker set up to be posted; along with a file – one assumes PHP or Html script.

Then it will either (depending on the options chosen) save the file to the server. Or execute code in the file (using eval()).

The it prints a success / fail.

From the looks of things it looks tailored for use of some sort of bot – because the save_ok/fail/ok text that gets printed is MD5 hashed.

]]>