Re: OT: security

On Sun, 14 Oct 2007 19:57:59 +0200, <william.hooper@xxxxxxxxx> wrote:

I also trying to get my hear around:

http://www.attackers-r-us.com/nastycode

This translates to http://www.attackers-r-us.com/nastycode.php and
with allow_url_fopen enabled, this remote file will be included into
the script and executed. Note that the remote server would have to
serve php files as the raw script, instead of processing them with a
PHP module first, in order for this attack to be effective, or a
script would have to output PHP code ( readfile(realnastycode.php) for
instance).

Mechanisms such as the above allow attackers to execute any code they
desire on vulnerable web systems.

One simple way to prevent this style of attack is to disable
allow_url_fopen. This can be set in php.ini.

The last part is totally over the top. And it is of no concern to you: it would only be a risk if you can have code that includes that code somewhere on your server, which is what must and can be prevented in the first place.

You have to consider what kind of files you want to allow (for instance, only images would easily be checked wether or not getimagesize()) can make sense of it as an image. Preferably you can validate the types of file you want to allow.

Somewhat less reliable but OK for starters: find out what kind of file-extentions can be executed on your system (.php, .php3, .php4, .php5, ..inc, .pl, etc...), and disallow files with that extention to stored. Having some evil code in randomfile.blup won't matter as it will never be recognized by the webserver as such, so it won't be executed.
--
Rik Wasmus
.

Relevant Pages

  • Re: Fwd: [PHP] Highjack?
    ... show.php is a script you've written. ... This causes show.php to include (i.e. execute!!) the remote file injectionscript.txt from badguys.net at this URL... ... Probably not, because by the time it fails they've already replaced your index.php and potentially installed a rootkit, backdoors and whatever else (depending, of course, on how locked down the web server is and your file permissions). ...
    (php.general)
  • Re:perl script on remote server linux
    ... perl script on remote server linux ... I am trying to execute a perl script from source A to invoke another ... while ($tot> 0) ...
    (perl.beginners)
  • [OT] Re: Scp files to another server help
    ... seeing your shell script I was able to come up with this ... > The above script allows me to execute via command line in Unix. ... > remote server. ...
    (comp.lang.perl.misc)
  • Re: Fwd: [PHP] Highjack?
    ... I realize that one can grab stuff from another server, but I still don't see how one can do this. ... so badscript.php is a bad name for this script. ... This causes show.php to include (i.e. execute!!) the remote file injectionscript.txt from badguys.net at this URL... ...
    (php.general)
  • Re: Will Linux become as vulnerable as MS ??
    ... > beeing vulnerable to viruses. ... > that they know are executable, and execute intentionally. ... >> Linux, each distro is a little different, and even within the distro, ... > Since clicking on a script is easier than typing it's name, ...
    (comp.os.linux.security)