My HTTP Server gets probed, possible exploit?

Tarikc · 08-31-2012, 10:48 AM

Hello Gentlemen,

I don't know if this thing were posted here earlier, but I am panicked.

My Logwatch shows these writings in it:

Code:

A total of 1 sites probed the server 
   168.144.196.83

A total of 1 possible successful probes were detected (the following URLs
contain strings that match one or more of a listing of strings that
indicate a possible exploit):

   /?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n HTTP Response 200

It is showing that /etc/passwd, The http logs shows:

Code:

168.144.196.83 - - [30/Aug/2012:16:50:55 +0300] "POST /?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n HTTP/1.1" 200 22589 "-" "Mozilla/5.0"

It is showing POST??

Can someone please help me?? I checked the passwd file and it seems okay, nothing changed on it.

Looking forward to your replies.

unSpawn · 08-31-2012, 11:39 AM

Apart from that it's trying to append twice and it shows a 200 return code it shouldn't work anyway if the user the web server runs as has no write privileges on the file, and for the "/?-d" part see post http://www.linuxquestions.org/questi...4/#post4692267?

Tarikc · 09-01-2012, 05:19 AM

Hello unSpawn,
Thank you for your reply.

So there will be nothing to be afraid of?
The web user has no write access of course...

unSpawn · 09-01-2012, 06:44 AM

IMHO it's not a question of being afraid or not but thinking ahead and defending yourself:
- have your firewall drop accept bogon traffic and rate limits new requests,
- make your web server not expose any unused functionality (proxying, auth methods, etc) and configure only what is strictly necessary,
- make your web server more resilient by running mod_security with the default OWASP rule set,
- ensure that what off the shelf software you run is always current, including any 3rd party plugins, and remove what can't be updated,
- ensure you follow the security documentation off the shelf software provides,
- ensure that what homebrewn scripts you run follow best coding practices and have them examined if necessary,
- optionally monitor areas on your system the web server user can write to using Inotify and Maldetect.
*Examine your system for hardening other access vectors like running anonymous FTP, passworded FTP uploads from non-Linux machines, SSH without pubkey auth (as root?), etc, etc.