#!/usr/bin/perl -w
# Copyright (c) 2002 Andrew Wales
# http://www.meow.org.uk/stan/pet_projects/honeypot.html
use strict;
my $logdir = "/home/rootsecure/public_html/logsdir";
my @time = localtime(time);
my $filename = sprintf("%04d%02d%02d%02d%02d%02d-%d",
1900+$time[5],1+$time[4],$time[3],$time[2],$time[1],$time[0],$$);
if (open(LOGFILE,'>'.$logdir.'/'.$filename.'.txt')) {
for my $envvar (sort keys %ENV) {
print LOGFILE "$envvar=$ENV{$envvar}\n";
}
print LOGFILE "\n";
if ((defined $ENV{REQUEST_METHOD}) && ($ENV{REQUEST_METHOD} eq "POST")) {
if (defined($ENV{CONTENT_LENGTH})) {
$ENV{CONTENT_LENGTH}=100_000 if ($ENV{CONTENT_LENGTH}>100_000);
my $query = "";
read( STDIN, $query, $ENV{CONTENT_LENGTH} );
print LOGFILE $query;
}
}
close(LOGFILE);
}
my $ip_addr="";
if (defined $ENV{REMOTE_ADDR}) {
$ip_addr = "(".$ENV{REMOTE_ADDR}.")";
}
print <<__HTML__;
Content-Type: text/html\n\n
Unsuccessful exploit
exploit unsuccessful
This is not the script you're looking for. Move along.
This is a program to catch people trying to exploit insecurities
in common CGIs.
Your details have been recorded, including the data you submitted
and your IP address ${ip_addr}.
Repeated attempts to exploit this server will result in you
being reported to your ISP.
__HTML__