Easy A
Would you like to react to this message? Create an account in a few clicks or log in to continue.


 
HomeHome  Latest imagesLatest images  SearchSearch  RegisterRegister  Log inLog in  

Easy A :: If blocking china and the russians with .htaccess won't do it... Edit-trash Useless :: TrashShare
 

 If blocking china and the russians with .htaccess won't do it...

View previous topic View next topic Go down 
AuthorMessage
corvex
Member
Member
corvex

Posts : 7
Join date : 2011-05-16

If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... EmptyThu Jun 23, 2011 7:48 am
... Then what will?

Someone injected files on my web server and got my site a malicious rating on Trend Micro.

I restored from a backup and started watching my logs.

I also picked a different dyndns alias than the one I got hacked on.

I see this stuff:

[error] [client 58.218.199.250] script '/(path omitted)/judge112233.php' not found or unable to stat
[error] [client 58.218.199.227] script ''/(path omitted)/cgi-bin/son!****you.php' not found or unable to stat.

(nice name they have for that second exploit script eh?)

How do I prevent these jokers from even reaching my server? I have already tried large blocks of deny from statements in .htaccess and I still see these, about once a day - it could be worse I know, but I don't want these idiots anywhere near my web site!

The last thing I need is an employer accessing my web site and being stopped by their virus scanner with a malicious site warning!

Help? :(
Back to top Go down
Knowledge
Member
Member
Knowledge

Posts : 21
Join date : 2011-03-09

If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: Re: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... EmptyThu Jun 23, 2011 7:50 am
When you got hacked before, how did they get in? Depending on how they compromised the server, htaccess may or may not help. Are you still seeing requests from IP blocks that you have denied in your htaccess file?
Back to top Go down
corvex
Member
Member
corvex

Posts : 7
Join date : 2011-05-16

If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: Re: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... EmptyThu Jun 23, 2011 7:51 am
Knowledge wrote:
When you got hacked before, how did they get in? Depending on how they compromised the server, htaccess may or may not help. Are you still seeing requests from IP blocks that you have denied in your htaccess file?

Yup.

They got in I am pretty sure by having public upload turned on (I turned it off) or through free e107 CMS plugins known to have backdoors in them.

When I restored to a backup a full week before the trouble started (I have all the way to 01/01/2011 so if need be I can back up even further!)

I deleted my entire forum, deleted all the plugins, changed all the passwords, moved phpmyadmin to still another alias, etc.

I just got new requests logged to my apache error.log

Code:

[error] client 109.237.214.63 File does not exist: /(path omitted)/w00tw00t.at.blackhats.romainian.antisec:)
[error] client 109.237.214.63 File does not exist: /(path omitted)/MyAdmin
[error] client 109.237.214.63 File does not exist: /(path omitted)/phpmyadmin

====== Partial copy of my .htaccess ========

# e107 .htaccess script for hosts with mod_rewrite
# If e107 is not installed in the document root, then make RewriteBase
# RewriteBase /your-e107-folder/
<FilesMatch \.php$>
ErrorDocument 400 /error.php?400
ErrorDocument 401 /error.php?401
ErrorDocument 403 /error.php?403
ErrorDocument 404 /error.php?404
ErrorDocument 500 /error.php?500
</FilesMatch>
ErrorDocument 404 /404.html
ErrorDocument 403 default
RewriteEngine on
RewriteBase /

<Limit GET HEAD POST>
order allow,deny
# Manual Blocks
deny from 58.218.199.

# Country: AFGHANISTAN
# ISO Code: AF
# Total Networks: 22
# Total Subnets: 98,560
deny from 27.116.56.0/22
deny from 58.147.128.0/19
deny from 61.5.192.0/20
deny from 111.125.152.0/21
deny from 111.223.244.0/22
deny from 117.55.192.0/20
deny from 117.104.224.0/21
deny from 119.59.80.0/21
deny from 121.100.48.0/21
deny from 121.127.32.0/19
deny from 124.199.112.0/20
deny from 125.213.192.0/19
deny from 175.106.32.0/19
deny from 180.94.64.0/19
deny from 180.222.136.0/21
deny from 182.50.176.0/20
deny from 202.56.176.0/20
deny from 202.86.16.0/20
deny from 203.174.27.0/24
deny from 203.215.32.0/20
deny from 210.80.0.0/19
deny from 210.80.32.0/19
## Country: CHINA
# ISO Code: CN
# Total Networks: 3,410
# Total Subnets: 331,821,056
deny from 1.0.1.0/24
deny from 1.0.2.0/23
deny from 1.0.8.0/21
deny from 1.0.32.0/19

.... lots more countries added via countryipblocks.net (not that it is doing any good ...)

Yes at the bottom is an "allow from all"
hmm. do I need to change the top to say order "deny, allow" ??? I am pretty sure countryipblocks.net generated that part too.
Back to top Go down
corvex
Member
Member
corvex

Posts : 7
Join date : 2011-05-16

If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: Re: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... EmptyThu Jun 23, 2011 7:53 am
There is actually a smiley in the part of the address there on the blackhats request. Forum converted it to a graphic smiley
Back to top Go down
corvex
Member
Member
corvex

Posts : 7
Join date : 2011-05-16

If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: Re: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... EmptyThu Jun 23, 2011 7:54 am
oop those errors BTW are generated by GET requests coming from those URL's with HTTP/1.1 303 390 "-" "ZmEu"

the following two are 404 478 "-" "ZmEu" in the GET request, respectively.

I want these guys to go away! Is there no way to stop their attempts? at least the files they think they planted seem to be missing!
Back to top Go down
Corverta
Member
Member
avatar

Posts : 20
Join date : 2011-03-09

If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: Re: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... EmptyThu Jun 23, 2011 7:55 am
I think hackforums.net can help you with this. They deal with this stuff, they should know whats up.
Back to top Go down
Sponsored content




If blocking china and the russians with .htaccess won't do it... Empty
PostSubject: Re: If blocking china and the russians with .htaccess won't do it...   If blocking china and the russians with .htaccess won't do it... Empty
Back to top Go down
 

If blocking china and the russians with .htaccess won't do it...

View previous topic View next topic Back to top 
Page 1 of 1

Permissions in this forum:You cannot reply to topics in this forum
Easy A :: If blocking china and the russians with .htaccess won't do it... Edit-trash Useless :: Trash-