Security and Cryptography
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Security and Cryptography
Reload this Page

Solution to 777 directory hack problem?

Discuss Solution to 777 directory hack problem? in the Security and Cryptography forum on Dev Shed.
Solution to 777 directory hack problem? Security and Cryptography forum discussing issues related to coding, server applications, network protection, data protection, firewalls, ciphers and the like.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old January 19th, 2006, 10:26 PM
sexydawg sexydawg is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jul 2001
Posts: 16 sexydawg User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 3 h 7 m 46 sec
Reputation Power: 0
Solution to 777 directory hack problem?
I have been hacked twice now by somebody (or some script) that uploads an .htaccess file and a randomly named PHP script to any directories CHMODed 777 on my site. The .htaccess redirects any 404's to the PHP script that is uploaded and the PHP script redirects the user to a third party website. This has gotten me banned from Google because somebody the search engines grab a bunch of URLs pointing to the directory with random porn and warez phrases after the directory URL.

I can't CHMOD the affected directories (image directories) because of the nature of our website (images are uploaded on a constant basis), but I started thinking:

What if I upload an .htaccess file that is CHMOD'd 644 and prevents PHP scripts from running in that directory?

Would this work?

What would I need to put in the .htaccess to prevent anything with a .php extension from running?

Please overlook any ignorance that may be present (and probably is present) in this question -- I have very little knowledge of web security. Any help much appreciated... thanks...

- B
Reply With Quote
  #2  
Old January 20th, 2006, 01:34 AM
kuza55's Avatar
kuza55 kuza55 is offline
It's only wrong if you're caught....
Dev Shed Beginner (1000 - 1499 posts)
  
Join Date: Dec 2003
Location: Sydney, Australia
Posts: 1,286 kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 3 Weeks 3 Days 6 h 10 m 16 sec
Reputation Power: 98
Well, I think you need to fix your security problems, rather than looking for a band aid, because hackers are generally creative, and will probably find ways around what you're trying to do once they're in, but thats generally....

Find out how you were cracked, fix the hole,try to do an audit on your applications, and hope you don't get penetrated again.

Having said that uploading a .htaccess which can only be written to as root may work, just as long as Apache isn't running as root *cringes at the thought*. But it all depends on how you were penetrated, if its simply a dodgy upload script, why not fix that and make life easier for yourself?
__________________
- Alex
Web Security Research (my blog)
Handbook of Applied Cryptography (Free!)
Reply With Quote
  #3  
Old January 20th, 2006, 01:58 AM
SimonGreenhill's Avatar
SimonGreenhill SimonGreenhill is offline
(retired)
Dev Shed God 11th Plane (10000 - 10499 posts)
  
Join Date: Dec 2003
Location: The Laboratory
Posts: 10,101 SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)SimonGreenhill User rank is General 5th Grade (Above 100000 Reputation Level)  Folding Points: 4925 Folding Title: Novice Folder
Time spent in forums: 3 Months 3 Weeks 5 h 56 m 41 sec
Reputation Power: 1345
Facebook
Kuza55's right - fix the problem first, rather than bandaiding it. Personally, I'd move the uploads folder outside the document root, so it's NOT accessible via the web. Next, I'd run a cron script to move any IMAGE files alone ( check the type, not just the extension ) into the web accessible directory. Next it should be possible to turn off php execution for a certain dir ( but you'll probably need to do it in your httpd.conf file ), I've never done it, but it shouldn't be too hard to google up a solution.

--Simon
Reply With Quote
  #4  
Old January 20th, 2006, 02:39 AM
kuza55's Avatar
kuza55 kuza55 is offline
It's only wrong if you're caught....
Dev Shed Beginner (1000 - 1499 posts)
  
Join Date: Dec 2003
Location: Sydney, Australia
Posts: 1,286 kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level)kuza55 User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 3 Weeks 3 Days 6 h 10 m 16 sec
Reputation Power: 98
Quote:
Originally Posted by SimonGreenhill
Kuza55's right - fix the problem first, rather than bandaiding it. Personally, I'd move the uploads folder outside the document root, so it's NOT accessible via the web. Next, I'd run a cron script to move any IMAGE files alone ( check the type, not just the extension ) into the web accessible directory. Next it should be possible to turn off php execution for a certain dir ( but you'll probably need to do it in your httpd.conf file ), I've never done it, but it shouldn't be too hard to google up a solution.

--Simon
I think the easiest way to stop script execution would be to simply overwrite the type for PHP files in .htacces (assuming of course that AllowOverride is on in httpd.conf, if you don't then either turn it on, which you can always just do for a single directory, or simply add what you would put into the .htaccess file into <directory> tags, so you can stop execution in certian dirs), so having a .htacces file like this:
Code:
AddType text/plain .php
Will effectively stop code execution, you could even make it all prettyful and do:
Code:
AddType application/x-httpd-php-source .php
.....anyways....

I would also do an examination of your server to make sure no malware has been installed on there, just in case....

And Simon, why would you upload outside the web root and then do checks with a cronjob? Wouldn't it be just as easy to do checks when the images are being uploaded? And you would then not have any malicious files even touching the file system outside a temporary directory.....which should be cleaned anyway....

I've also got a quick question, is there any way to make PHP reject file uploads except from certain scripts (I know mod_security simply disables all of them, but is there a way to dissalow them, but to allow files to be sent to certain pages? Pages which would delete the items in question from the temp folder if they didn't pass the security checks....)?
Reply With Quote
  #5  
Old January 20th, 2006, 06:07 AM
rehash rehash is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Nov 2005
Posts: 164 rehash User rank is Sergeant (500 - 2000 Reputation Level)rehash User rank is Sergeant (500 - 2000 Reputation Level)rehash User rank is Sergeant (500 - 2000 Reputation Level)rehash User rank is Sergeant (500 - 2000 Reputation Level)rehash User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 11 h 27 m 41 sec
Reputation Power: 9
how they managed to upload the file? you are running some public hosting?
Reply With Quote
  #6  
Old January 20th, 2006, 08:54 AM
sexydawg sexydawg is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jul 2001
Posts: 16 sexydawg User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 3 h 7 m 46 sec
Reputation Power: 0
Quote:
Originally Posted by rehash
how they managed to upload the file? you are running some public hosting?


Yeah, it's public hosting. AllowOverride is on, so I can change the PHP filetype to text, thanks for the code to do it, couldn't seem to Google it last night.

I don't think they did this through a file upload script, the upload script for these images is in an Apache auth protected area, I think it was done as a direct result of the directory being CHMOD'd 777 -- there were two other directories on my server that were CHMOD'd 777 (deeply nested directories inside two statistics scripts I had installed) and both of these other directories were hit as well.

How do they upload to these directories? Through a browser?!?!??! I just don't understand the mechanism without them actually FTP'ing in...

I am going to move the images outside of the web accessible area and move them with a CRON job, but with my limited abilities it may take a while to figure it out and get it working so I'll utilize the bandaid for now.

Thanks for all the help...
Reply With Quote
  #7  
Old January 20th, 2006, 03:26 PM
Ergo12 Ergo12 is offline
Permanently Banned
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2005
Location: trolls only :)
Posts: 172 Ergo12 Negative: is most likely a SPAMMER and a traitor to the cause. 
Time spent in forums: 1 Day 20 h 5 m 11 sec
Warnings Level: 10
Number of bans: 1
Reputation Power: 0
Quote:
Originally Posted by sexydawg
I have been hacked twice now by somebody (or some script) that uploads an .htaccess file and a randomly named PHP script to any directories CHMODed 777 on my site. The .htaccess redirects any 404's to the PHP script that is uploaded and the PHP script redirects the user to a third party website. This has gotten me banned from Google because somebody the search engines grab a bunch of URLs pointing to the directory with random porn and warez phrases after the directory URL.

I can't CHMOD the affected directories (image directories) because of the nature of our website (images are uploaded on a constant basis), but I started thinking:

Please overlook any ignorance that may be present (and probably is present) in this question -- I have very little knowledge of web security. Any help much appreciated... thanks...

- B


I highly suspect you have a phpnuke/gallery or one of those apps with as many security holes as swiss cheese.

- Get an uptodate version
- find a similar app but with fewer security holes

Can you show us the logs of the actual-hacks-in progress?
Reply With Quote
  #8  
Old January 20th, 2006, 09:20 PM
sexydawg sexydawg is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jul 2001
Posts: 16 sexydawg User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 3 h 7 m 46 sec
Reputation Power: 0
I think I found it (if not something like it)... the attack had already occurred in those image directories at this point but this is the first mention of the GStats directory and the support directory in relation to weird stuff. All of these log entries were in one straight block of lines: (EDIT: All of these directories mentioned in the following block of requests were the directories that were affected)
Code:
208.185.80.98 - - [24/Sep/2005:22:14:01 -0400] "GET /images/properties/listings/100x75px/mosehtmbrq HTTP/1.0" 200 6344 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:01 -0400] "GET /images/properties/listings/320x240px/tsyrhvjoir HTTP/1.0" 200 6598 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:02 -0400] "GET /images/properties/listings/40x30px/rbyeoywdla HTTP/1.0" 200 6042 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:03 -0400] "GET /images/properties/listings/640x480px/mqyfhivmpy HTTP/1.0" 200 6529 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:04 -0400] "GET /images/properties/listings/280x210px/yoqeibucpk HTTP/1.0" 200 6016 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:04 -0400] "GET /images/properties/mls/vaiiefflkf HTTP/1.0" 200 5920 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:05 -0400] "GET /images/properties/mls/320x240px/ggpgqupsvt HTTP/1.0" 200 5989 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:06 -0400] "GET /images/temp/vdsanrkhep HTTP/1.0" 200 6185 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:06 -0400] "GET /support/web/eqgyjasiqe HTTP/1.0" 200 5972 "-" "Mozilla/4.0 (Yahoo!)"
208.185.80.98 - - [24/Sep/2005:22:14:07 -0400] "GET /statistics/gstats/images/graphs/woynemtfma HTTP/1.0" 200 6449 "-" "Mozilla/4.0 (Yahoo!)"

But all these are just requests, right? I don't see anything that shows an upload of a file -- what would I be looking for?


Here some of the hits on the non-existent URLs that were forwarding to the russian search engine via the .htaccess and script (to further clarify what was happening):

Code:
4.153.215.62 - - [24/Sep/2005:22:14:57 -0400] "GET /images/properties/listings/640x480px/warez.lingvo.dictionary.crack.html HTTP/1.1" 302 5 "http://www.google.com/search?q=File+Scavenger+key&hl=en&lr=&rls=GGLG,GGLG:2005-38,GGLG:en&start=30&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; PeoplePal 6.2)"
203.144.143.7 - - [24/Sep/2005:22:16:09 -0400] "GET /images/properties/listings/640x480px/crack.diary.ru.html HTTP/1.1" 302 5 "http://www.google.co.th/search?q=dvd-cloner%2Bcrack&hl=th&lr=&start=10&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; FDM)"
65.214.44.167 - - [24/Sep/2005:22:16:13 -0400] "GET /images/properties/listings/640x480px/C.Sony.Ericson.T600.html HTTP/1.0" 404 0 "-" "Mozilla/2.0 (compatible; Ask Jeeves/Teoma; +http://sp.ask.com/docs/about/tech_crawling.html)"
69.66.166.173 - - [24/Sep/2005:22:16:14 -0400] "GET /images/properties/listings/640x480px/ghost.7.5.warez.download.html HTTP/1.1" 302 5 "http://www.google.com/search?q=rmt-u110&hl=en&hs=aPL&lr=&client=firefox-a&rls=org.mozilla:en-US:official_s&start=10&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6"
71.97.0.181 - - [24/Sep/2005:22:16:49 -0400] "GET /images/properties/listings/640x480px/Evanescene.-.Hello.mp3.-.download.html HTTP/1.1" 302 5 "http://www.google.com/search?num=50&hs=KPL&hl=en&lr=&newwindow=1&safe=off&client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial_s&q=dap+7.1+serial&btnG=Search" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4"
220.225.137.242 - - [24/Sep/2005:22:17:05 -0400] "GET /images/properties/listings/640x480px/sexkey.user.id.list.login.download.html HTTP/1.0" 302 0 "http://www.google.co.in/search?q=key+of+dr.divx&hl=en&lr=&start=10&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
Reply With Quote
  #9  
Old January 20th, 2006, 09:52 PM
sexydawg sexydawg is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jul 2001
Posts: 16 sexydawg User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 3 h 7 m 46 sec
Reputation Power: 0
BTW, the IP on those suspicious requests resolves to Lomag.net which is a service that provides web hosting and *shell accounts* -- am I safe to assume that this is the source of my problem? Also that IP performed the same requests on other days also, so I am assuming it is an automated script of some type.

Also, I found these same type of requests by the same IP a few days before any of this activity started -- the first requests by this IP were on August 29th, Google visited the non-existent URLs on September 6th and then all hell broke loose on the 8th.
Reply With Quote
  #10  
Old February 26th, 2006, 06:54 PM
Eric M Eric M is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Mar 2004
Posts: 86 Eric M User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 14 h 48 m 34 sec
Reputation Power: 6
These hacks are done by an automated script that scans the server for any directories with write permissions.

While this will not stop you from being hacked it will stop any automated scans from finding your directory.

Chmod your public_html folder to 711
Reply With Quote
  #11  
Old April 7th, 2006, 05:19 PM
vahid1 vahid1 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Apr 2006
Posts: 2 vahid1 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 m 42 sec
Reputation Power: 0
Serch Engine Spiders
Quote:
Originally Posted by Eric M
These hacks are done by an automated script that scans the server for any directories with write permissions.

While this will not stop you from being hacked it will stop any automated scans from finding your directory.

Chmod your public_html folder to 711



Hi,

This is a good solution to prevent them to find the directories. Thanks a lot!
My website is hacked several times and they have uploaded fake PayPal pages and ... to cheat people. It can be really dangerous for webmasters.

My question is can Chmoding the public_html folder to 711 prevent the search engines spiders from crawling the website?

Best regards,
Vahid
Reply With Quote
  #12  
Old April 7th, 2006, 05:20 PM
vahid1 vahid1 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Apr 2006
Posts: 2 vahid1 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 4 m 42 sec
Reputation Power: 0
Quote:
Originally Posted by sexydawg
I have been hacked twice now by somebody (or some script) that uploads an .htaccess file and a randomly named PHP script to any directories CHMODed 777 on my site. The .htaccess redirects any 404's to the PHP script that is uploaded and the PHP script redirects the user to a third party website. This has gotten me banned from Google because somebody the search engines grab a bunch of URLs pointing to the directory with random porn and warez phrases after the directory URL.

I can't CHMOD the affected directories (image directories) because of the nature of our website (images are uploaded on a constant basis), but I started thinking:

What if I upload an .htaccess file that is CHMOD'd 644 and prevents PHP scripts from running in that directory?

Would this work?

What would I need to put in the .htaccess to prevent anything with a .php extension from running?

Please overlook any ignorance that may be present (and probably is present) in this question -- I have very little knowledge of web security. Any help much appreciated... thanks...

- B


This can not cause your website to get banned by Google. If it was like that, the tinyurl.com was banned long time ago.
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Security and Cryptography > Solution to 777 directory hack problem?

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump



 Free IT White Papers!
 
How to Present Effectively Online
This white paper offers practical and actionable advice on the key steps that any presenter should consider as they plan and execute a Webinar or online meeting.
 
Open Source Security Myths
Open Source Software (OSS) is computer software whose source code is available to the general public with relaxed or non-existent intellectual property restrictions (or arrangement such as the public domain), and is usually developed with the input of many contributors.
 
Power and Cooling Capacity Management for Data Centers
This paper describes the principles for achieving power and cooling capacity management.
 
Scalable, Fault-Tolerant NAS for Oracle - The Next Generation
For several years NAS has been evolving as a storage alternative for Oracle databases, and for good reason: NAS is quite often the simplest, most cost-effective storage approach for Oracle. Learn about the benefits that HP's approach to scalable NAS brings to Oracle environments in this comprehensive white paper.
 
Understanding Web Application Security Challenges
This white paper discusses many common threats and preventive measures for Web application security, and explains what you can do to help protect your organization.
 

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2009 by Developer Shed. All rights reserved. DS Cluster 6 hosted by Hostway. 
Stay green...Green IT