Prev: c99shell
Next: COM and the PHP equivalent of ASP Currency data type
From: "scot" on 30 Apr 2006 01:31
Hi there,
Not sure if this is proper place to post but here it goes. We got nailed by
someone using c99shell today. They were able to upload and overwrite a bunch
of index files. I am working on discovering how they were able to get it on
our server. Here's some basic info. I am by no means a php expert. Should
things be different? Is there a good paper out there somewhere in regards to
windows / iis5 / php security?

php 4.4.1
Safe Mode: OFF
Open basedir: none
Display Errors: ON
Short Open Tags: ON
File Uploads: ON
Magic Quotes: ON
Register Globals: ON
Output Buffering: OFF
Session save path: e:\PHP\sessiondata
Session auto start: 0
XML enabled: Yes
Zlib enabled: Yes
Disabled Functions: none

Here is also a snip of log (altered IP's and URL) of what I think is the
hack of the site. (I could be wrong)

2006-04-29 23:47:46 x.x.x.x - x.x.x.x 80 GET /index.html - 200 0 958 105 172
HTTP/1.0 www.blah.com Wget/1.9.1 - -
2006-04-29 23:49:32 x.x.x.x - x.x.x.x 80 GET /index.html - 200 0 953 122 297
HTTP/1.1 www.blah.com libwww-perl/5.805 - -

Thanks,
Scot
 | 
Pages: 1
Prev: c99shell
Next: COM and the PHP equivalent of ASP Currency data type