Question with shell script

From: QuijadaReina, Julio C <QuijadJC_at_alfredstate.edu>
Date: Fri, 09 May 2003 06:41:55 -0800
Message-ID: <F001.00595187.20030509064155@fatcity.com>

Anne,  

It looks like your script is calling (or trying to run) ftp. Have you modified the script or looked inside at the code? It would seem to me that someone using piftp/texas1 (username/password) is trying to use ftp to copy/rename the files (20093280.M01 and 20093323.M01) to your ftp directory!  

Take a look at the file and see if malicious code has been inserted.  

Julio  

>Dear all, My shell script produced below output. Can anyone tell
me how
>to get rid of these 'SQL>' ?
>
>Many thanks,
>
>
>***********************************************************************

---

>******
>
>SQL*Plus: Release 8.1.7.0.0 - Production on Thu May 8 10:46:05 2003
>
>(c) Copyright 2000 Oracle Corporation. All rights reserved.
>
>
>Connected to:
>Oracle8i Enterprise Edition Release 8.1.7.4.0 - Production
>With the Partitioning option
>JServer Release 8.1.7.4.0 - Production
>
>SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> ftp -n
>SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> SQL> sosftp
<<FOO
>
>SQL> user piftp texas1
>SQL> cd /pub/ftp/tlc
>SQL> 2 3 4 5 6 7 put /opt/vr/dsgen/20093280.M01
jstick.txt
>
>put /opt/vr/dsgen/20093323.M01 jzaffirini.txt
>SQL> bye
>SQL> FOO
>SQL> SQL> Disconnected from Oracle8i Enterprise Edition Release
>SQL> SQL> 8.1.7.4.0 - Prod
>uction
>
>--
>Please see the official ORACLE-L FAQ: http://www.orafaq.net
<http://www.orafaq.net/>
>--
>Author: Anne Yu
> INET: AYu_at_sos.state.tx.us
>
 

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: QuijadaReina, Julio C
  INET: QuijadJC_at_alfredstate.edu

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).

Received on Fri May 09 2003 - 09:41:55 CDT