Re: [Full-disclosure] (no subject)

[Ademar Gonzalez <ademar.gonzalez@xxxxxxxxx>]

Hi Aditya

On 9/28/05, Aditya Deshmukh
<aditya.deshmukh@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> Recently 2 days ago I saw this in a compromised system.
>
>
> Both this file and cpshost.dll were deleted from C:\InetPub\scripts
> This file was recovered but I was unable to recover cpshost.dll....
>
>
> Anyone know what is this ?
>

It is a upload script, cpshost.dll is the Posting Acceptor ActiveX control :

http://support.microsoft.com/kb/q230298/


>
> <% Response.Buffer = TRUE %>
>
>         Version=1.5
> <%
>         PathToPA = "http://"; + Request.ServerVariables("SERVER_NAME") +
> "/scripts/cpshost.dll"
>
>
>         PostingURL = PathToPA + "?PUBLISH"
>
>         TargetURL = "http://"; + Request.ServerVariables("SERVER_NAME")
> %>
>
>         [{8B14B770-748C-11D0-A309-00C04FD7CFC5}]
>         PostingURL="<%= PostingURL %>"
>         TargetURL="<%= TargetURL %>"
>         ComponentInstall="yes"
>

ciao ciao
ademar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/