Security - getting scripts inserted into log file 1

[oppcos]

Hi all,
I have a modest little PHP server running that gets a lot of junk traffic. Recently I noticed that someone had somehow inserted the entire contents of PHPSHELL.PHP into my log file. There was no warning message or date stamp or anything around the entry so it has concerned me as to A) how they did it? and B) what was the purpose of doing it?

My log files are not, of course, browseable through the web server so they shouldn't have been able to execute it from there. Was this an attempt to upload it somehow to another place but that failed (or *gulp* succeeded)?

Never saw anything like this before and wanted to know, have you experts had experience with it and advice on how to guard against it?

Thanks!

 

[sleipnir214]

A) how they did it?

Insufficient data for a meaningful answer. We'd have to know your site and how it works before theorizing.

B) what was the purpose of doing it?

To gain shell access to your server. After that, the asshol miscreant could then use your server for all kinds of nefarious things. See

http://mgeisler.net/php-shell/

(or just do a Google search on the term phpshell.php hacking) for comments as to the grief some people have caused using either the script you found or one similar.

have you experts had experience with it and advice on how to guard against it?

I have not had specific experience, but I have heard of this. In every case, it was some software flaw that allows the upload and execution of a file. Check all your software vendor sites and make sure you're not running vulnerable software or software that is configured in a less-than-secure way. The site

http://mgeisler.net/php-shell/

has some user-supplied comments that might be useful in a more general way.



Want the best answers? Ask the best questions! TANSTAAFL!

 

[oppcos]

After looking more closely at the log I realized that the warning from the line above that script entry was actually continuing beyond the new line. Someone was attempting to execute a SQL vulnerability against a php file that runs a SQL select statement, but the php file filtered against the attack so we got a big fat failure message instead that contained the contents of the attack (AKA the PHPSHELL.PHP file).

Good news is I guess I'm OK (though I think I'll decrease the size limit available to POSTing to that page just to be safer). I thought it was much worse because the new line threw me off making me believe it was just magically appearing in the log. Just my inexperience, but I guess I'd better improve faster if I'm to survive something as public and dynamic as the Internet.

Thanks for the advice!