Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel(tm)
Author Message
spcdata
Regular
Regular



Joined: Jan 24, 2004
Posts: 81
Location: Sweden

PostPosted: Tue Jun 01, 2004 11:02 am Reply with quote

Hello Very Happy i don't know if I can post this question here but since there are so many experts here I will do it.

I got this in my Apache log file and it comes about 4-5 times/day now and at one attemt the person almost got throw he/she got in to my databas but could not change anything at that time....but who knows when he/she will....?

from logfile:

Code:
213.89.8.73 - - [01/Jun/2004:18:30:20 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02..[LOTS CUT]..\xb1\x02\xb1\x02\xb1\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90..[LOTS CUT]..\x90HTTP/1.0" 414 341


I know that it has to do with PHP and make a buffer overflow thing but I do not know how to stop it is there any one that knows? I would be very grateful for a solution.

[Admin: edited for brevity sake]

_________________
/spcdata 
View user's profile Send private message Send e-mail Visit poster's website
Raven
Site Admin/Owner



Joined: Aug 27, 2002
Posts: 17088

PostPosted: Tue Jun 01, 2004 11:19 am Reply with quote

I would add a match check for something like "\x90\x02\xb1" in .htaccess and just return a 403 Forbidden page when found.
 
View user's profile Send private message
spcdata







PostPosted: Tue Jun 01, 2004 11:31 am Reply with quote

Thank You Raven for Your quick answer !!

I don't know much about adding things to the .htaccess if You know the lines that i should put in there i would be very Very Happy
 
spcdata







PostPosted: Tue Jun 01, 2004 2:21 pm Reply with quote

I really need help Please!!

I have searched the apache documentation online on how to set up my .htaccess file but can't find the answer it's like a djungel....

and that hacker is getting closer now heres the latest from my log file:

Code:
..[LOTS CUT]x90\x90\x90\"\") || (thearray[i] == null))\n\t\t\treturn i;\n\t\t}\n\treturn thearray.length;\n}\n\n// Replacement for arrayname.push(value) not implemented in IE until version 5.5\n// Appends element to the array\nfunction arraypush(thearray,value) {\n\tthearray[ getarraysize(thearray) ] = value;\n}\n\n// Replacement for arrayname.pop() not implemented in IE until version 5.5\n// Removes and returns the last element of an array\nfunction arraypop(thearray) {\n\tthearraysize = getarraysize(thearray);\n\tretval = thearray[thearraysize - 1];\n\tdelete thearray[thearraysize - 1];\n\treturn retval;\n}\n\n\nfunction checkForm() {\n\n\tformErrors = false;\n\n\tif (document.post.message.value.length < 2) {\n\t\tformErrors = \"Du m\xe5ste skriva ett meddelande n\xe4r du postar.\";\n\t}\n\n\tif (formErrors) {\n\t\talert(formErrors);\n\t\treturn false;\n\t} else {\n\t\tbbstyle(-1);\n\t\t//formObj.preview.disabled = true;\n\t\t//formObj.submit.disabled = true;\n\t\treturn true;\n\t}\n}\n\nfunction emoticon(text) {\n\tvar txtarea = document.post.message;\n\ttext = ' ' + text + ' ';\n\tif (txtarea.createTextRange && txtarea.caretPos) {\n\t\tvar caretPos = txtarea.caretPos;\n\t\tcaretPos.text = caretPos.text.charAt(caretPos.text.length - 1) == ' ' ? caretPos.text + text + ' ' : caretPos.text + text;\n\t\ttxtarea.focus();\n\t} else {\n\t\ttxtarea.value  += text;\n\t\ttxtarea.focus();\n\t}\n}\n\nfunction bbfontstyle(bbopen, bbclose) {\n\tvar txtarea = document.post.message;\n\n\tif ((clientVer >= 4) && is_ie && is_win) {\n\t\ttheSelection = document.selection.createRange().text;HTTP/1.0" 414 341


I don't know what all this means.... but I really want this to stop.
 
sixonetonoffun
Spouse Contemplates Divorce



Joined: Jan 02, 2003
Posts: 2496

PostPosted: Tue Jun 01, 2004 2:57 pm Reply with quote

Could try this I doubt that xb1 is very common in a query string?

RewriteEngine On
RewriteCond %{QUERY_STRING} ^.*xb1 [NC]
RewriteRule ^.* - [F,L]


Last edited by sixonetonoffun on Tue Jun 01, 2004 3:52 pm; edited 1 time in total 
View user's profile Send private message
spcdata







PostPosted: Tue Jun 01, 2004 3:13 pm Reply with quote

I will try it and see what happens (at the moment i write this it was a new attemt..)

I know this topic does not belong in here sorry for this !! but I got a little desperate and did not know what to do.

Thank You very much for taking time to help me with this one Very Happy
 
Raven







PostPosted: Tue Jun 01, 2004 3:52 pm Reply with quote

Been in an offsite meeting all afternoon - just got home. Post back after you try Six's suggestion.
 
spcdata







PostPosted: Wed Jun 02, 2004 7:49 am Reply with quote

I just got home from work and found this in my logfile:

I removed alot from it because it is the same as the above posts.

Code:
\x90\x90\x90\x90\x90rs_list'];\r\n}\r\n\r\n//\r\n// set the page title and include the page header\r\n//\r\n$page_title = $lang['Ranks'];\r\ninclude ($phpbb_root_path . 'includes/page_header.'.$phpEx);\r\n//\r\n// template setting\r\n//\r\n$template->set_filenames(array(\r\n\t'body' => 'ranks_body.tpl')\r\n);\r\n\r\n// constants\r\n$template->assign_vars(array(\r\n\t'L_SPECIAL_RANKS' => $lang['Special_ranks'],\r\n\t'L_USERS_LIST' => $lang['Memberlist'],\r\n\t'L_RANKS' => $lang['Ranks'],\r\n\t'L_MINI' => $lang['Rank_minimum'],\r\n\t'L_TOTAL_USERS' => $lang['Total_users'],\r\n\t'SPAN_USERLIST_STD' => ($std_rank_max_users != 0) ? 2 : 1,\r\n\t'S_HIDDEN_FIELDS' => '',\r\n\t)\r\n);\r\n\r\n// standard ranks\r\nif ($std_rank_max_users != 0)\r\n{\r\n\t$template->assign_block_vars('std_userlist', array());\r\n}\r\nelse $template->assign_block_vars('no_std_userlist', array());\r\n\r\nfor ($i=0; $i < count($ranks); $i++)\r\n{\r\n\t$template->assign_block_vars('ranks', array(\r\n\t\t'RANK_TITLE' => get_rank_title($ranks[$i]['rank_title']),\r\n\t\t'RANK_IMAGE' => ($ranks[$i]['rank_image'] == '') ? '' : '<img src=\"' . $ranks[$i]['rank_image'] . '\" border=0 align=\"center\">',\r\n\t\t'RANK_MINI'  => $ranks[$i]['rank_min'],\r\n\t\t'RANK_TOTAL' => $ranks[$i]['user_number'],\r\n\t\t)\r\n\t);\r\n\tif ($std_rank_max_users != 0)\r\n\t{\r\n\t\t$template->assign_block_vars('ranks.userlist', array(\r\n\t\t\t'USER" 414 341




I use PHP Version 4.3.4 does it help if i upgrade to version 5.0 ?
 
Raven







PostPosted: Wed Jun 02, 2004 7:54 am Reply with quote

No. This is not a PHP issue. It is a server (port 80) issue. The answer lies in the .htaccess file. I am leaving for a 2 hour meeting. If noone fixes this by the time I get back I will work it out for you and send it.
 
spcdata







PostPosted: Wed Jun 02, 2004 8:33 am Reply with quote

I know You ALL here have alot of things to work with Exclamation so I'm very greatful for every help i can get to solve this one Very Happy
 
spcdata







PostPosted: Thu Jun 03, 2004 4:15 am Reply with quote

I found this in my apache error logfile :

Code:
[Thu Jun 03 01:52:50 2004] [error] [client 213.67.210.30] request failed: URI too long (longer than 8190)


it looks like it wont get longer than 8190 then it should be stopped, but as I noticed earlier it seems to do it anyway sometimes...



And about Sentinelâ„¢ I have only good thing to say Very Happy I don't get so many hack attempts (yet) but I tested it on my own and it stopped everything Cool

I'm VERY IMPRESSED by Your security system Sentinelâ„¢ Exclamation what a FABULOUS work You have done Exclamation
 
Raven







PostPosted: Thu Jun 03, 2004 11:29 am Reply with quote

Can you just post, say the first 200 bytes or so from your log, including the url? I should have left that in the one I cut, but ...

Thanks.
 
spcdata







PostPosted: Thu Jun 03, 2004 11:36 am Reply with quote

213.140.237.14 - - [03/Jun/2004:12:33:07 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90

Embarassed I don't have that one anymore but this is how they all look like at the beginning.
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel(tm)

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©