Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a wordpress site hosted on CentOS 6. After see the following access log, I checked the server, it seems ok. Can anyone explain what does this guy trying to do? Did they get what they want?

I have disabled allow_url_include, and restricted open_basedir to web dir and tmp(/etc is not in the path). - - [05/Sep/2012:21:24:42 -0700] "POST http://my_ip/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n HTTP/1.1" 200 32656 "-" "Mozilla/5.0"

share|improve this question
Thanks for the link. I have read the article. From my understanding, the hacker was trying to add something to my file from a remote link. I doubt it's successful since the allow_url_include function is disabled. – garconcn Sep 6 '12 at 5:25
Is a content length of 32656 normal for the content served by /? – Shane Madden Sep 6 '12 at 5:56
up vote 4 down vote accepted

Take a look at CVE-2012-1823 first.

The above URL is decoded as:

http://my_ip/?-d allow_url_include=On+-d auto_prepend_file=../../../../../../../../../../../../etc/passwd� -n/?-d allow_url_include=On+-d auto_prepend_file=../../../../../../../../../../../../etc/passwd� -n

?-d allow_url_include=On: he is trying to add an extra parameter in the php-cgi call:

$ php-cgi -h
Usage: php [-q] [-h] [-s] [-v] [-i] [-f <file>]
       php <file> [args...]
  -d foo[=bar]     Define INI entry foo with value 'bar'

+-d auto_prepend_file=../../../../../../../../../../../../etc/passwd� -n: then prepend his file as code to execute. Don't know why he uses Path Traversal attack here instead of using his code or php://input.

-n at the end to negate the php.ini:

$ php-cgi -h
Usage: php [-q] [-h] [-s] [-v] [-i] [-f <file>]
       php <file> [args...]
  -n               No php.ini file will be used

PS: No need to worry if you aren't running PHP as a CGI script.

share|improve this answer
What is a simple way to test if you are running PHP as CGI script? – BullfrogBlues Nov 21 '12 at 16:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.