Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a wordpress site hosted on CentOS 6. After see the following access log, I checked the server, it seems ok. Can anyone explain what does this guy trying to do? Did they get what they want?

I have disabled allow_url_include, and restricted open_basedir to web dir and tmp(/etc is not in the path).

190.26.208.130 - - [05/Sep/2012:21:24:42 -0700] "POST http://my_ip/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n HTTP/1.1" 200 32656 "-" "Mozilla/5.0"

share|improve this question
3  
    
Thanks for the link. I have read the article. From my understanding, the hacker was trying to add something to my file from a remote link. I doubt it's successful since the allow_url_include function is disabled. –  garconcn Sep 6 '12 at 5:25
1  
Is a content length of 32656 normal for the content served by /? –  Shane Madden Sep 6 '12 at 5:56
add comment

1 Answer

up vote 4 down vote accepted

Take a look at CVE-2012-1823 first.

The above URL is decoded as:

http://my_ip/?-d allow_url_include=On+-d auto_prepend_file=../../../../../../../../../../../../etc/passwd� -n/?-d allow_url_include=On+-d auto_prepend_file=../../../../../../../../../../../../etc/passwd� -n

?-d allow_url_include=On: he is trying to add an extra parameter in the php-cgi call:

$ php-cgi -h
Usage: php [-q] [-h] [-s] [-v] [-i] [-f <file>]
       php <file> [args...]
  -d foo[=bar]     Define INI entry foo with value 'bar'

+-d auto_prepend_file=../../../../../../../../../../../../etc/passwd� -n: then prepend his file as code to execute. Don't know why he uses Path Traversal attack here instead of using his code or php://input.

-n at the end to negate the php.ini:

$ php-cgi -h
Usage: php [-q] [-h] [-s] [-v] [-i] [-f <file>]
       php <file> [args...]
  -n               No php.ini file will be used

PS: No need to worry if you aren't running PHP as a CGI script.

share|improve this answer
    
What is a simple way to test if you are running PHP as CGI script? –  BullfrogBlues Nov 21 '12 at 16:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.