.htaccess help

technocrat · Involved Joined: Jul 07, 2005 Posts: 492

I have tried a couple of different things and can't get it working so I am looking for some assistance.

I want to block any request that contains ?act=

Any help?

technocrat · Involved Joined: Jul 07, 2005 Posts: 492

This appears to be working

Code:

RewriteCond %{QUERY_STRING} ^act\=(.*)
RewriteRule ^.*$ http://127.0.0.1/ [R,L]

FYI-This will block the c99shell default access completely.

montego · Posted: Tue Apr 10, 2007 7:17 am

Looks good to me as well. Here are some other examples of things that I have done over the years as they have popped up:

Code:

#
# Tired of external attempts to access Forums admin
#
RewriteCond %{HTTP_REFERER} !^http://(.*)montegoscripts\.com/.*$ [NC]
RewriteCond %{REQUEST_URI} modules/Forums/admin
RewriteRule ^.*$ http://127.0.0.1 [R=301,L]
#
# Try to stop Add Links from external sources
#
RewriteCond %{HTTP_REFERER} ^$
RewriteCond %{QUERY_STRING} ^(.*)name=Web_Links(.*)
RewriteRule ^.*$ http://127.0.0.1 [R=301,L]
#
# Added by montego as hack script reports these
#
RewriteCond %{QUERY_STRING} ^(.*)www\.shinwhat\.com(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)leyctud_b0x(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)217\.20\.112\.211(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)sucomi\.com(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)phentermine(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^(.*)register\.php(.*)$ [NC,OR]
RewriteCond %{REQUEST_URI} ^(.*)profile\.php(.*)$ [NC,OR]
RewriteRule ^.*$ http://127.0.0.1 [R=301,L]

I post these only as additional examples for folks in case they need the "pattern" to try.

evaders99 · Moderator Joined: Apr 30, 2004 Posts: 2795

A bunch of other ones that I use.

(Sometimes QUERY_STRING doesn't work for me, so these rules use THE_REQUEST to search the entire request data)

Code:

RewriteCond %{THE_REQUEST} (YIIQegYGKwYBBQU)       [OR]
RewriteCond %{THE_REQUEST} (absolute_path)       [OR]
RewriteCond %{THE_REQUEST} (phpbb_root_path)       [OR]
RewriteCond %{THE_REQUEST} (classified_path)       [OR]
RewriteCond %{THE_REQUEST} (THEME_DIR)       [OR]
RewriteCond %{THE_REQUEST} (basepath)             [OR]
RewriteCond %{THE_REQUEST} (BBCodeFile)          [OR]
RewriteCond %{THE_REQUEST} (spaw_root)             [OR]
RewriteCond %{THE_REQUEST} (path_red2)             [OR]
RewriteCond %{THE_REQUEST} (phpc_root_path)       [OR]
RewriteCond %{THE_REQUEST} (libpath)             [OR]
RewriteCond %{THE_REQUEST} (includedir)          [OR]
RewriteCond %{THE_REQUEST} (serverpath)          [OR]
RewriteCond %{THE_REQUEST} (vwar_root)             [OR]
RewriteCond %{THE_REQUEST} (dir\[inc\])          [OR]
RewriteCond %{THE_REQUEST} (rootpath)             [OR]
RewriteCond %{THE_REQUEST} (file=http:\/\/)       [OR]
RewriteCond %{THE_REQUEST} (name=http:\/\/)       [OR]
RewriteCond %{THE_REQUEST} (CPG_M_DIR)

montego · Posted: Wed Apr 11, 2007 6:29 am

You know, that is right, I have seen some quirky behavior with QUERY_STRING. I got the above to work, but I like your ideas here. Thanks!

Guardian2003 · Site Admin Joined: Aug 28, 2003 Posts: 4653

TechonocratI see you were struck by the same module hack I was.
I'm not sure that adding
[code]if (!eregi('image/', get_mime_content_type($imageurl_name))) die(_SP_CONFBANN); [/b] is a complete solution but I'm certainly warming to your htaccess idea.
I do not think there is anything in nuke that uses ?act= but if there is, it always possible to use the less likely ones like;
?act=f
?act=ls
?act=img

technocrat · Involved Joined: Jul 07, 2005 Posts: 492

My users are reporting that it will affect the arcade mod. So we might need to tweak it some more.

I have some more changes and I will post them once I get to the office.

Guardian2003 · Site Admin Joined: Aug 28, 2003 Posts: 4653

I sent you a PM, I understand the original author is working on the isuue now.

technocrat · Involved Joined: Jul 07, 2005 Posts: 492

Code fixes:

First mime_content_type seems to not work very well, so I used this code from DJMaze and it works much better.

Code:

In SPSubmitSave.php

Find:

Code:

$imageurl_name = $_FILES['site_image']['name'];

After add:

Code:

if (!eregi('image/', get_mime_content_type($imageurl_name))) die(_SP_CONFBANN);

That will stop bad image types

Then find:

Code:

if(move_uploaded_file($imageurl_temp, "modules/$module_name/images/supporters/$oid$ext")) {

After add:

Code:

list($width, $height, $type, $attr) = @getimagesize("modules/$module_name/images/supporters/$oid$ext");
if (empty($width) || empty($height)) {
unlink("modules/$module_name/images/supporters/$oid$ext");
include_once(NUKE_BASE_DIR.'header.php');
title(_SP_CONFBANN);
OpenTable();
echo "<center><strong>"._SP_NOUPLOAD."</strong></center><br />\n";
echo "<center>"._GOBACK."</center>";
CloseTable();
include_once(NUKE_BASE_DIR.'footer.php');
exit;
}

This will stop invalid images

technocrat · Involved Joined: Jul 07, 2005 Posts: 492

Update:

Added a .htaccess file to the modules/Supporters/images folder with:

Code:

Order allow,deny
allow from all

<FilesMatch "\.php$">
deny from all
</FilesMatch>

Using evaders99 suggestions I changed the main .htaccess to be:

Code:

RewriteCond %{THE_REQUEST} (\?act\=) [NC,OR]
RewriteCond %{THE_REQUEST} (sql_login) [NC]
RewriteRule ^.*$ http://127.0.0.1/ [R=301,L]

Steptoe · Involved Joined: Oct 09, 2004 Posts: 288

Hi guys, havnt been around for a while..
thu thats your fault, the support and stuff nothing goes wrong lol.
Anyway this .htasess thing..
I did get hacked the other day from Turkey, nothing serious, 8 mins and was up again...
This is what I have..
1/ my server is next to me, Apachie on MS
2/ I access it from this machine on the LAN
3/I figured out banning TR ips...well most of them, just got a list of TR isps and TR telecom ranges and banned them in htaccess.

This is what I would like to do...(tried differnt stuff but either doesnt work or the sever becomes inaccessable lol)
1/ I see how to ban access to file types...we need access to .php,
how does one do that yet ban just one file...eg admin.php
Yet allow access to it from 1 ip or ip range? ...eg LAN

2/I use ip_tracking one can see what modules are been visited, but it doesnt list admin.php.....is it possible to have this in the drop down menu?

Cheers Steps
Oh PS, I became a Grandfather the other day...9lb boy