1 reputation
1
bio website
location
age
visits member for 3 years
seen Jan 9 '12 at 19:54

Nov
4
awarded  Popular Question
Nov
19
comment Apache/PHP root exploit
[apologies for the double post here - enter key doesn't give me a paragraph break] The access logs on the web server show that other php files were present and served up with a 200 response. So my assumption is that the attacker uploaded some root exploit, executed it, and deleted it.
Nov
19
comment Apache/PHP root exploit
As I mentioned in my original post the permissions were 644. This is only readable by "group" and "other", and is required for apache to be able to read the file for serving up to the web. I've already done a search similar to what you suggest, and I found the "web shell" you mention. However, I tried to use it to edit a file owned by root and no changes were saved.
Nov
19
comment Apache/PHP root exploit
apache owned the file upload directory, where the attacker (temporarily) stored the code. root owned the directory where the changed file was.
Nov
19
asked Apache/PHP root exploit