Welcome to Geeklog, Anonymous Thursday, September 28 2023 @ 12:58 am EDT

Comments for So-called Geeklog "exploit" posted

So-called Geeklog "exploit" posted | 9 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

So-called Geeklog "exploit" posted

Authored by: AA6QN on Sunday, October 21 2007 @ 09:04 am EDT

I would like a sanity check here. First off nothing is in my public access root that should not be. Second I have employed directory authentication to area's in my public access root where I want to restrict access using AllowOverride AuthConfig in the httpd.conf file.

In my httpd.conf file I have added:

<Directory "/">
Options -All +FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
</Directory>

<Directory "/my/web/root/htdocs">
Options -All +FollowSymLinks +ExecCGI
AllowOverride Options FileInfo AuthConfig Limit
Order allow,deny
Allow from all
</Directory>

AccessFileName .htaccess
<FilesMatch "^\.ht">
Order allow,deny
Deny from all
</FilesMatch>

The .htaccess in my public access root directory is:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^Morfeus
RewriteRule ^.*$ - [F]

Redirect 403 /plugins

RewriteEngine On
RewriteCond %{QUERY_STRING} _CONF
RewriteRule .* - [L,F]

Since AllowOverride defaults to ALL, I did not add it to the httpd.conf. I hope that is correct? I hope my .htaccess file is correct. I did get a Morfeus scan once upon a time and this is what was recommended.

So, am I hopefully close with the configurations?
Thank you in advance, JohnF

So-called Geeklog "exploit" posted

Authored by: Dirk on Sunday, October 21 2007 @ 04:22 pm EDT

Well, if you don't have anything in your webroot that shouldn't be there, then you won't have this problem anyway. The above issue mostly affects sites that used installers like Fantastico (and, in retrospect, I had no idea how widespread its usage was when I wrote the that article).

bye, Dirk

So-called Geeklog "exploit" posted

Authored by: AA6QN on Monday, October 22 2007 @ 07:44 am EDT

Thank you, Just for grins, my logwatch reports daily attempts:

Requests with error response codes
403 Forbidden
//plugins/spamx/BlackList.Examine.class.ph ... host.com/safe3?: 2 Time(s)
/forum//plugins/spamx/BlackList.Examine.cl ... host.com/safe3?: 2 Time(s)
/plugins/links/functions.inc?_CONF[path]=h ... el.es/safe.gif?: 1 Time(s)
/plugins/spamx/DeleteComment.Action.class. ... 00/cmdhtml.txt?: 2 Time(s)
/plugins/spamx/MassDelete.Admin.class.php? ... el.es/safe.gif?: 1 Time(s)

The offending IP will end up in a ipblock statement on a firewall. No Snort signatures for this yet. I am glad you did write the article as it gave deffinintion as to what was going on.
Thank you once again, JohnF

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks