HackTool.Perl. IrBot.d
Posted by CyberLord on July 22 2008 12:27:25
Hack tool. Script language Perl. The file size varies from 12 to 69 KB.

Payload

This script is IRC-bot, is used to find RFI (Remote File Inclusion) vulnerabilities.

Depending on the commands received bot could do the following: .......


Extended News
Hack tool. Script language Perl. The file size varies from 12 to 69 KB.

Payload

This script is IRC-bot, is used to find RFI (Remote File Inclusion) vulnerabilities.

Depending on the commands received bot could do the following:

* Purify logs;

* Search RFI vulnerabilities in Web sites. To find a site receives bot keyword, which searched in the following search services:
http://www.google.nl
http://busca.uol.com.br
http://www.alltheweb.com
http://it.ask.com
http://search.aol.com
http://suche.fireball.de
http://search.lycos.com
http://arianna.libero.it
http://search.yahoo.com
http://search.live.com

If the sites were discovered containing the strings "buterfly" and "uid =" in the address, the program forms a request which transmits the address link:
http://linknet *****. com / source / cmd.txt?

The contents of this file is made on the WEB-server site. Thus an attacker can gain remote access to the server.

Also, the script contains the line:
Yogya Ceria Scaner Bot Created By eviL-Zone -= evil =-