Bestcasuals.com Vuln + Audit. _St0rm

Error links:

http://bestcasuals.com/image_resize.php?image=productData
----------------------------------------------------------

GIF87a2¡›‚ÿÿÿÿ,2†”©Ë£œ´Ú+Þ¼Gí…â7–h¦ª¶¤l@×ñFËT~ã4árÂZ b;m–p‰4*£P(O8qî¦R¥´JüVrÏ¢÷x=§9ä-Õz®¾±’vÔV§Íôúñi²6È4ØÓBˆØ¡¸¸ÑèxY1I9ayù¢ÉÈyâÙ	ú(ºQ;
Warning: Division by zero in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 277

Warning: imagecreatetruecolor() [function.imagecreatetruecolor]: Invalid image dimensions in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 337

Warning: imagecopyresampled(): supplied argument is not a valid Image resource in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 338
GIF87a2¡›‚ÿÿÿÿ,2…”©Ë£œ´Ú+Þ¼Gí…â7–h¦ª¶¤l@×1G³}w9ÅÛA¢M8‹Àß¤X;FxAª’ùèŒÓè5Êåz•§ú WX‹¹§±ëË{¬þ²¥`Œ6V7²•Ò'ØÓ2xx¢˜’È¸áøx)YAY9q‰ù²É¡Ùù¹ŠY;
Warning: imagedestroy(): supplied argument is not a valid Image resource in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 255
PHP Warning: Division by zero in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 277 PHP Warning: imagecreatetruecolor() [function.imagecreatetruecolor]: Invalid image dimensions in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 337 PHP Warning: imagecopyresampled(): supplied argument is not a valid Image resource in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 338 PHP Warning: imagedestroy(): supplied argument is not a valid Image resource in c:\domains\bestcasuals.com\wwwroot\image_resize.php on line 255


http://bestcasuals.com:80/staticpage.php?pageid=12
--------------------------------------------------

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 3


Those are the only scripting errors I could find.
--------------------------------------------------------------------------------------------------------------------

Database name: bestcasuals

Server info:

Web Server: 	Microsoft-IIS/6.0
Powered-by: 	PHP/5.1.2
Powered-by: 	ASP.NET
DB Server: 	MySQL >=4.1
Current DB: 	bestcasuals


Couldn't gather any tables from it.
--------------------------------------------------------------------------------------------------------------------
Virus information on the .zip link.

URL analysis tool	Result

Avira	                Clean site
BitDefender	        Malware site
Dr.Web	                Clean site
G-Data	                Clean site
Malc0de Database	Clean site
MalwareDomainList	Clean site
Opera	                Clean site
ParetoLogic	        Malware site
Phishtank	        Clean site
TrendMicro	        Malware site
Websense ThreatSeeker	Unrated site
Wepawet	                Unrated site

bestcasuals.com	ns1.24livehost.com => 69.93.85.106
ns2.24livehost.com => 69.93.85.107

ISP:   (AS21844) THEPLANET
IP:    70.86.21.146
Virus: Trojan

--------------------------------------------------------------------------------------------------------------------

C:\Users\St0rm>tracert bestcasuals.com

Tracing route to bestcasuals.com [70.86.21.146]
over a maximum of 30 hops:

  1   179 ms   179 ms   178 ms  :)
  2   184 ms   181 ms   183 ms  :)
  3   256 ms   193 ms   179 ms  :)
  4   217 ms   216 ms   180 ms  v995.core1.sjc1.he.net [64.71.150.21]
  5   187 ms   179 ms   178 ms  10gigabitethernet2-1.core1.sjc2.he.net [72.52.92.118]
  6   182 ms   182 ms   191 ms  mpr1.sjc7.us [206.223.116.86]
  7   186 ms   180 ms   181 ms  xe-4-1-0.er1.sjc2.us.above.net [64.125.27.90]
  8   182 ms   181 ms   193 ms  xe-4-0-0.cr1.sjc2.us.above.net [64.125.28.54]
  9   193 ms   191 ms   198 ms  64.125.26.25.available.above.net [64.125.26.25]
 10   258 ms   249 ms   232 ms  xe-3-2-0.cr1.iah1.us.above.net [64.125.26.121]
 11   228 ms   225 ms   229 ms  xe-2-1-0.cr1.dfw2.us.above.net [64.125.30.58]
 12   230 ms   226 ms   229 ms  xe-0-1-0.er1.dfw2.us.above.net [64.125.27.74]
 13   228 ms   236 ms   238 ms  64.125.199.94.t366.above.net [64.125.199.94]
 14   243 ms   236 ms   230 ms  te7-1.dsr01.dllstx3.networklayer.com [70.87.253.2]
 15     *        *        *     Request timed out.
 16   230 ms   233 ms   233 ms  po1.car03.dllstx5.networklayer.com [70.87.254.18]
 17   232 ms   228 ms   230 ms  92.15.5646.static.theplanet.com [70.86.21.146]

Trace complete.

Open ports for: 70.86.21.146

Not shown: 996 filtered ports


PORT    STATE SERVICE

80/tcp  open  http

110/tcp open  pop3

443/tcp open  https

587/tcp open  submission

Total Domains: 2.

Http://mail.bestcasuals.com
Http://bestcasuals.com
-----------------------------------------------------------------------------------------------------------------------


Opinion:

I think that the website could be legit, yet rooted by someone and is hosting a virus in the admins corner.

To gain full control of the site. So my other option is to email the webmaster if he knows he has a virus.

and then try and warn people. The only bad thing I could find was one virus being hosted by him.
There wasn't really anything to go by after that.

I Ddos'd it and it was going up and down for a little while. I may try again later.

The MySQL injection worked, but only found the database, not the tables.

if you have backtrack, I suggest giving it a go. To see where the files are stored, and get the admin login.

For some reason mine is messing up at the moment. =/

I'm sorry I couldn't really do very much on this one.

_St0rm


-----------------------------------------------------------------------------------------------------------------------