Anonymous Posting through script

fkelly · Posted: Fri Jul 13, 2007 7:15 am

LOL, this is getting a big response. I'm going to try out the following code on my test system but I'll probably need to move it to a real system to get real results, fortunately hackers can't get into my local host. Anyway, right after the NS code I quoted, in the for loop that processes the get variables I'm going to try:

Code:

if (eregi("Forums", $secvalue)) {
   if(eregi("username", $sec_key)) {
   $sqluser = 'SELECT username FROM '.$prefix_users.' WHERE username = \''.$sec+value.'\'';
$result = $db->sql_query($sqluser);
      $numusers = $db->sql_numrows($result2);
      if ($numusers == 0) {
            block_ip($blocker_row);
      }
      }

If anyone sees anything obviously wrong or "dangerous" with this, let me know. I'll post back when I get some results. The more I look at IP tracking results, the more of these spam things I see and I want them banned automatically.

fkelly · Posted: Fri Jul 13, 2007 11:52 am

Nahh, Frank, that will never work. The secvalue of Forums comes on a different iteration of the foreach loop from the username=xxxx key-value pair.

I am testing the following on my bike club site right now:

Code:

if($blocker_row['activate'] > 0) {
   $forumflag = false;
   foreach($_GET as $sec_key => $secvalue) {
if((eregi("<[^>]script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]body*\"?[^>]*>", $secvalue)) ||
(eregi("$[^>]*\"?[^)]*$", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
block_ip($blocker_row);
}
if (eregi("Forums", $secvalue)) {
   $forumflag = TRUE; }
   if(eregi("username", $sec_key)) {
   $sqluser = 'SELECT username FROM '.$prefix_users.' WHERE username = \''.$sec+value.'\'';
$result = $db->sql_query($sqluser);
      $numusers = $db->sql_numrows($result2);
      if ($numusers == 0 && $forumflag) {
            block_ip($blocker_row);
      }
      }
} // end for of get variables

It's hard to test this on a localhost, you need to get rid of the admin cookie to even get into this loop. So I'll try it on hackers from Turkey, Russia etc. and see if it gets them.

fkelly · Posted: Fri Jul 13, 2007 3:57 pm

$numusers = $db->sql_numrows($result2); has to be $result. I wasn't trapping anyone with it set to $result2. We'll see.

fkelly · Posted: Mon Jul 16, 2007 7:58 am

There is an additional error in my code posted above. I put the tic mark around $prefix in the wrong place. I will post the corrected code below. I can make the ban work after I delete my admin cookie and clear any protected ranges AND copy the get string in from NS's tracked IP's database. However, it does not appear to be banning these GETS "in the wild". I'm puzzled. I'm going to post some of my log stuff "internally" to try to get feedback from the experts and I'll post any resolutions back here. If anyone sees anything obvious feel free to post here.

Here's the corrected code:

Code:

if (!isset($_COOKIE['admin']) OR !is_admin($_COOKIE['admin'])) {
// Check for SCRIPTING attack
// Copyright 2004(c) ChatServ
$blocker_row = $blocker_array[4];
if($blocker_row['activate'] > 0) {
   $forumflag = false;
//    $diagnos = '';
   foreach($_GET as $sec_key => $secvalue) {
//       $diagnos .= ' || ' . $sec_key . ' || ' . $secvalue;
if((eregi("<[^>]script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]body*\"?[^>]*>", $secvalue)) ||
(eregi("$[^>]*\"?[^)]*$", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
block_ip($blocker_row);
}
if (eregi("Forums", $secvalue)) {
   $forumflag = TRUE; }
   if(eregi("username", $sec_key)) {
   $sqluser = 'SELECT username FROM '.$prefix.'_users WHERE username = \''.$secvalue.'\'';
//       $diagnos .= ' ||' . $sqluser;
$result = $db->sql_query($sqluser);
      $numusers = $db->sql_numrows($result);
      if ($numusers == 0 && $forumflag) {
      //    block_ip($blocker_row);
      }
      }
} // end for of get variables

You'll note that I put a diagnostic variable in which I echoed back out in footer.php in my localhost system to make sure I was getting the correct set of get variables. This is commented out in the code above. Obviously I wouldn't want this in a production system.