Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - PHP Nuke
Author Message
fkelly
Former Moderator in Good Standing


Joined: Aug 30, 2005
Posts: 3312
Location: near Albany NY

PostPosted: Fri Jul 13, 2007 7:15 am Reply with quote

LOL, this is getting a big response. I'm going to try out the following code on my test system but I'll probably need to move it to a real system to get real results, fortunately hackers can't get into my local host. Anyway, right after the NS code I quoted, in the for loop that processes the get variables I'm going to try:

Code:
      if (eregi("Forums", $secvalue)) {

           if(eregi("username", $sec_key)) {
            $sqluser = 'SELECT username FROM '.$prefix_users.' WHERE username = \''.$sec+value.'\'';
           $result = $db->sql_query($sqluser);
         $numusers = $db->sql_numrows($result2);
         if ($numusers == 0) {
               block_ip($blocker_row);
         }
        }


If anyone sees anything obviously wrong or "dangerous" with this, let me know. I'll post back when I get some results. The more I look at IP tracking results, the more of these spam things I see and I want them banned automatically.
 
View user's profile Send private message Visit poster's website
fkelly
PostPosted: Fri Jul 13, 2007 11:52 am Reply with quote

Nahh, Frank, that will never work. The secvalue of Forums comes on a different iteration of the foreach loop from the username=xxxx key-value pair.

I am testing the following on my bike club site right now:

Code:
if($blocker_row['activate'] > 0) {

       $forumflag = false;
           foreach($_GET as $sec_key => $secvalue) {
      if((eregi("<[^>]script*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]style*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]body*\"?[^>]*>", $secvalue)) ||
      (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
      (eregi("\"", $secvalue)) ||
      (eregi("forum_admin", $sec_key)) ||
      (eregi("inside_mod", $sec_key))) {
        block_ip($blocker_row);
      }
      if (eregi("Forums", $secvalue)) {
           $forumflag = TRUE; }
           if(eregi("username", $sec_key)) {
            $sqluser = 'SELECT username FROM '.$prefix_users.' WHERE username = \''.$sec+value.'\'';
           $result = $db->sql_query($sqluser);
         $numusers = $db->sql_numrows($result2);
         if ($numusers == 0 && $forumflag) {
               block_ip($blocker_row);
         }
        }
      } // end for of get variables


It's hard to test this on a localhost, you need to get rid of the admin cookie to even get into this loop. So I'll try it on hackers from Turkey, Russia etc. and see if it gets them.
 
fkelly
PostPosted: Fri Jul 13, 2007 3:57 pm Reply with quote

$numusers = $db->sql_numrows($result2); has to be $result. I wasn't trapping anyone with it set to $result2. We'll see.
 
fkelly
PostPosted: Mon Jul 16, 2007 7:58 am Reply with quote

There is an additional error in my code posted above. I put the tic mark around $prefix in the wrong place. I will post the corrected code below. I can make the ban work after I delete my admin cookie and clear any protected ranges AND copy the get string in from NS's tracked IP's database. However, it does not appear to be banning these GETS "in the wild". I'm puzzled. I'm going to post some of my log stuff "internally" to try to get feedback from the experts and I'll post any resolutions back here. If anyone sees anything obvious feel free to post here.

Here's the corrected code:

Code:
if (!isset($_COOKIE['admin']) OR !is_admin($_COOKIE['admin'])) {

  // Check for SCRIPTING attack
  // Copyright 2004(c) ChatServ
  $blocker_row = $blocker_array[4];
  if($blocker_row['activate'] > 0) {
       $forumflag = false;
//       $diagnos = '';
           foreach($_GET as $sec_key => $secvalue) {
//                $diagnos .= ' || ' . $sec_key . ' || ' . $secvalue;
      if((eregi("<[^>]script*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]style*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
      (eregi("<[^>]body*\"?[^>]*>", $secvalue)) ||
      (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
      (eregi("\"", $secvalue)) ||
      (eregi("forum_admin", $sec_key)) ||
      (eregi("inside_mod", $sec_key))) {
        block_ip($blocker_row);
      }
      if (eregi("Forums", $secvalue)) {
           $forumflag = TRUE; }
           if(eregi("username", $sec_key)) {
            $sqluser = 'SELECT username FROM '.$prefix.'_users WHERE username = \''.$secvalue.'\'';
 //         $diagnos .= ' ||' . $sqluser;
           $result = $db->sql_query($sqluser);
         $numusers = $db->sql_numrows($result);
         if ($numusers == 0 && $forumflag) {
         //      block_ip($blocker_row);
         }
        }
      } // end for of get variables


You'll note that I put a diagnostic variable in which I echoed back out in footer.php in my localhost system to make sure I was getting the correct set of get variables. This is commented out in the code above. Obviously I wouldn't want this in a production system.
 
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Security - PHP Nuke

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©