Advertisement
Guest User

Help: Malware Campaign from .rr.nu infects MySQL information

a guest
Mar 2nd, 2012
733
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.71 KB | None | 0 0
  1. SELECT *
  2. FROM `information_schema`.`PROCESSLIST`
  3. WHERE (
  4. `ID` LIKE '%<script%'
  5. OR `USER` LIKE '%<script%'
  6. OR `HOST` LIKE '%<script%'
  7. OR `DB` LIKE '%<script%'
  8. OR `COMMAND` LIKE '%<script%'
  9. OR `TIME` LIKE '%<script%'
  10. OR `STATE` LIKE '%<script%'
  11. OR `INFO` LIKE '%<script%')
  12. OR (
  13. `ID` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  14. OR `USER` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  15. OR `HOST` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  16. OR `DB` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  17. OR `COMMAND` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  18. OR `TIME` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  19. OR `STATE` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%'
  20. OR `INFO` LIKE '%src="http://rmore79riveru.rr.nu/nl.php?p=d"></script>%')
  21. LIMIT 0 , 30
  22.  
  23. EXPLAIN SELECT *
  24. FROM `information_schema`.`PROCESSLIST`
  25. WHERE (
  26. `ID` LIKE '%<script%'
  27. OR `USER` LIKE '%<script%'
  28. OR `HOST` LIKE '%<script%'
  29. OR `DB` LIKE '%<script%'
  30. OR `COMMAND` LIKE '%<script%'
  31. OR `TIME` LIKE '%<script%'
  32. OR `STATE` LIKE '%<script%'
  33. OR `INFO` LIKE '%<script%')
  34. AND (
  35. `ID` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  36. OR `USER` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  37. OR `HOST` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  38. OR `DB` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  39. OR `COMMAND` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  40. OR `TIME` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  41. OR `STATE` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%'
  42. OR `INFO` LIKE '%src="http://nia91nskg.rr.nu/nl.php?p=d"></script>%')
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement