Proable exploited webserver: resources01.phx.ovirt.org
--_000_A2D341A8808F024CAFA63F1287B9929CF1B98864EMBX01exchlocal_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Folks, there's a suspious file I saw when browsing plain.resources01.phx.ov=
irt.org
Specifically, _h5ai_research.php appears to be a shell - it identifies itse=
lf as "c99madshell v.2.0 madnet edition" and prompts for login. It is EXTR=
EMELY unlikely that this is there intentionally.
Distressingly, the file has been there since 2014-09-26.
--Geoff Maciolek
PVDCHosting, LLC
--_000_A2D341A8808F024CAFA63F1287B9929CF1B98864EMBX01exchlocal_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html dir=3D"ltr">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Diso-8859-=
1">
<style id=3D"owaParaStyle" type=3D"text/css">P
{margin-top:0;margin-bottom:=
0;}</style>
</head>
<body ocsi=3D"0" fpstyle=3D"1">
<div style=3D"direction: ltr;font-family: Tahoma;color: #000000;font-size: =
10pt;">Folks, there's a suspious file I saw when browsing plain.resources01=
.phx.ovirt.org<br>
<br>
Specifically, _h5ai_research.php appears to be a shell - it identifies itse=
lf as "c99madshell v.2.0 madnet edition" and prompts for login.&n=
bsp; It is EXTREMELY unlikely that this is there intentionally.<br>
<br>
Distressingly, the file has been there since 2014-09-26.<br>
<div><br>
<div style=3D"font-family:Tahoma; font-size:13px">--Geoff
Maciolek<br>
PVDCHosting, LLC<br>
</div>
</div>
</div>
</body>
</html>
--_000_A2D341A8808F024CAFA63F1287B9929CF1B98864EMBX01exchlocal_--
Attachments:
- attachment.bin (multipart/alternative — 1.6 KB)