Silic Security Handbook

7/26/2019 Silic Security Handbook

1/21

Silic Security andbook

* Silic Corporation Juliet,

2012, 21 44, 166


2/21

- Silic Security

Silic.Org

1)

1.1 HTTP

1.2 IIS HTTP Trace

1.3 Apache

1.4 IIS

1.5 nginx

1.6 Nginx http

2) Apache + PHP

2.1 Apache + PHP

2.2 PHP

2.3 Apache

2.4

2.5 php socket

2.6 php

2.7 CGI

2.8

2.9 PHP Session

2.10 Apache

3)

3.1 ()Wscript.Shell

3.2

3.3

4)

4.1 Mysql.user

4.2 MySQL


3/21

- Silic Security

Silic.Org

1)

1.1 HTTP

HTTP

HTTP/1.1 200 OK

Date: Fri, 20 May 2011 18:37:50 GMT

Server: Apache/2.2.17 (Win32) PHP/5.2.8

X-Powered-By: PHP/5.2.8

Set-Cookie: PHPSESSID=hakhoeidtb1kv78dh4aik8arc6; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: lang=italian; expires=Sat, 19-May-2012 18:37:50 GMT

Vary: Accept-Encoding

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

PHP php.ini(Windows php5.ini)

apache/bin/php.ini

Expose_php = off


4/21

- Silic Security

Silic.Org

1.2 IISHTTP trace

Nessus X-Scan trace

IIS

c:\\windows\\system32\\inetsrv\\MetaBase.xml

TRACE IIS

\inetsrv\asp.dll,5,GET,HEAD,POST,TRACE

TRACEWebDAV PUTCopyDelete

IISWindows(Apache)

1.3 Apache

1404403500

extra http-defaut.conf ServerSignature Off


5/21

- Silic Security

Silic.Org

off

2(HTTP header)

Server: Apache/2.2.3 (CentOS) Server at xxxxxxx Port 80

extra/httpd-default.conf

# ServerTokens

# This directive configures what you return as the Server HTTP response

# Header. The default is 'Full' which sends information about the OS-Type

# and compiled in modules.

# Set to one of: Full | OS | Minor | Minimal | Major | Prod

# where Full conveys the most information, and Prod the least.

ServerTokens Full

ServerTokens Prod

ServerTokens Prod[uctOnly]


6/21

- Silic Security

Silic.Org

server:Apache

ServerTokens Major (Minor 2.0)

server:apache 2

1.4 IIS

ip,,uri(User-Agent)

cookie

GB


7/21

- Silic Security

Silic.Org

1.5 nginx

nginx nginxnginx.conf

server {

#

listen 80 default;

#

server_name localhost;

#

#access_log logshost.access.log main;

#

server_name_in_redirect off;

#

location {

root E:/Web/forum/htdocs;

index index.html index.htm;

}

#

location ~ .php$ {

# root

# root html;

#phpfastcgi

fastcgi_pass 127.0.0.19000;

#

fastcgi_index index.php;

#

fastcgi_param SCRIPT_FILENAME E:/Web/forum/htdocs$fastcgi_script_name;

#

include fastcgi_params;

}

#error_page 404 404.html;

# 50x

error_page 500 502 503 504 50x.html;

location = 50x.html {

root html;

}

}

server{}


8/21

- Silic Security

Silic.Org

1.6 Nginx http

HTTP Header Server : nginx/1.1.15

nginx.conf

http { server_tokens off;


9/21

- Silic Security

Silic.Org

2) Apache + PHP

2.1 Apache + PHP

apache conf/httpd.confAddType application/x-gzip

AddType application/x-compress .Z

AddType application/x-gzip .gz .tgz

gzipgzip

#

AddType application/x-httpd-php .abc

.abc.html.htm.xxoo .jsp.asp

.gif .gif x-httpd-php

a.abc php abc:

.gif gif php gif

php gif phpgif

html googleGoogle gif html


10/21

- Silic Security

Silic.Org

.htaccess

AddType application/x-httpd-php .php

AddType application/x-httpd-php .html

AddType application/x-httpd-php .htm

.php Apache php

.htaccess urlrewrite AllowOverride None

AllowOverride All httpd.conf rewrite

mod

TypesConfig conf/mime.types

AddType application/x-tar .tgz

AddType application/x-rar-compressed .rar

AddType application/x-httpd-php .php

AddType application/x-httpd-php-source .phps

.php

2.2 PHP

PHP PHPphp.ini

php.ini disable_functions

exec()

disable_functions = exec

Windows PHPdl

Windows dl php

phpinfo


11/21

- Silic Security

Silic.Org

Windows Apache PHPdl

PHPdl PHP

dl

WindowsApache + PHPPHP

; phpinfo

Warning: phpinfo() has been disabled for security reasons in XX.XX line x

PHP

System()

shell_exec()

passthru()

exec()

popen()

proc_open()

allow_url_fopen()

fsockopen()

pfsockopen()


12/21

- Silic Security

Silic.Org

()

allow_url_fopen,apache_child_terminate,apache_get_modules,apache_get_version,apache_getenv,apach

e_note,apache_setenv,chgrp,chown,closelog,dbmopen,debugger_on,debugger_off,define_syslog_variabl

es,dl,dll,error_log,escapeshellcmd,escapeshellarg,exec,fsockopen,ftp,ftp_exec,fpassthru,ini_alter,leak,l

ink,listen,ln,lynx,myshellexec,readlink,shell_exec,show_source,symlink,system,ocinumcols,openlog,pass

thru,pcntl_exec,pclose,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifsto

pped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dis

patch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pc

ntl_exec,pcntl_getpriority,pcntl_setpriority,pfsockopen,popen,proc_open,proc_close,proc_get_status

,proc_nice,proc_terminate,prus,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setsid,posix_setui

d,posix_setpgid,readfile,show_source,shell,socket_bind,suexec,symlink,syslog,system,virtual,wget

*

2.3 Apache

Apache Apache

options Indexes Indexes Apache

.htaccess ()

Options Indexes

Apache


13/21

- Silic Security

Silic.Org

2.4

MySQL root Apache

Apache Windows

httpd-vhost.conf xx.conf vhost

Include "D: /Apache/vhosts/[^. ]*"

apache/vhosts

MySQL load_file() text

MySQL.user file_privN

.

2.5 php socket

php Socket PHP Web cmd

php.ini

extension=php_sockets.dll

OK Windows


14/21

- Silic Security

Silic.Org

2.6 php

PHP php.ini

safe_mode = On

Gid off

safe_mode_gid = Off

basedir

x:/a/b/c x:/a/b

x:/a/b/c/ x:/a/b/c

safe_mode_exec_dir =E:/Web/forum

safe_mode_include_dirdir windows linux

2.7 CGI

.htaccess

Options -ExecCGI

AddHandler cgi-script .php .php5 .pl .py .jsp .asp .aspx .shtml .sh .cgi .sql .rb

500

2.8

.htaccess

AuthType Basic

AuthName "Silic Group Hacker Army"

AuthUserFile /home/blackbap/blackbap.org/bbs/.htpasswd

Require valid-user

.htpasswd

#silic:bbs

silicbbs:532WkhU9SF/iQ

#bbs:silic

bbs:85QlNg/2GZWGY

2.9 PHP Session

PHP session

sessionphp php

2012= =

http://g.blackbap.org/index.php/first/admin
http://g.blackbap.org/index.php/first/adminhttp://g.blackbap.org/index.php/first/adminhttp://g.blackbap.org/index.php/first/admin


15/21

- Silic Security

Silic.Org

cookie PHPSESSID=123;;; PHP php

The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,'

in

Config.php session_start();

@session_start();

phpat @

2.10 Apache


16/21

- Silic Security

Silic.Org

options Indexes FollowSymLinks

Apache

IndexOptions Charset=GB2312

gb2312


17/21

- Silic Security

Silic.Org

3)

Linux

3.1()Wscript.Shell

Wscript.Shell cmd

regsvr32 /u %windir%/system32/wshom.ocx

()FSO regsvr32 /u %windir%/system32/scrrun.dll

()Shell.application regsvr32 /u %windir%/system32/shell32.dll

()Wscript.network regsvr32 /u %windir%/system32/Wshext.dll


18/21

- Silic Security

Silic.Org

3.2

webshell

cmd

SYSTEM Administrators/Users

cmd system

attrib +a +r +s +h

cmd + -


19/21

- Silic Security

Silic.Org

3.3

SYSTEM

C:\windows\system32\config

SECURITY.Evt

2008C:\Windows\System32\winevt\Logs


20/21

- Silic Security

Silic.Org

SYSTEM

Administrator


21/21

- Silic Security

Silic.Org

4)

4.1 Mysql.user

MySQL mysql db MySQL

User_info

User mysql file_prive Nroot

N rootN host

%

Func udf dll( func

func)

MySQL mysql

4.2 MySQL

MySQL 3306 MySQL my.ini

[mysqld]

# The TCP/IP Port the MySQL Server will listen on

port=3306

[mysqld]

# The TCP/IP Port the MySQL Server will listen on

port=53306

MySQL PHP host

localhostlocalhost:53306

Date post:	03-Mar-2018
Category:	Documents
Upload:	jojo-la
View:	249 times
Download:	0 times

Silic Security Handbook

Documents