My server got hacked, probably because an unsafe php script.

Discussion in 'PHP' started by fatabbot, Dec 14, 2006.

  1. #1
    Hi,


    I have a folder on my server where people can upload images like their avatar and other stuff. I have the folder CHMOD to 777, so everyone can upload their images via a form.
    Now i just noticed that the whole folder is EMPTY !! Someone deleted everything.
    How can someone delete a complete folder ? I really have to secure this better now, but i don't see exactly how because write permissions is really needed in that folder.
    Any advice?
     
    fatabbot, Dec 14, 2006 IP
  2. alecs

    alecs Well-Known Member

    Messages:
    156
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    128
    #2
    Are you sure you didn't delete the contents accidentally?
    777 means that php scripts may alter the content of that folder. You can't just hit delete yourself from the browser.
    Do you validate the uploaded files? Does the "other stuff" include .php files ? If so, anyone can upload their script and run it on your server.
     
    alecs, Dec 14, 2006 IP
  3. fatabbot

    fatabbot Well-Known Member

    Messages:
    559
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    138
    #3
    No i have tests so that only jpg and gif gets accepted.
    Don't think i accidently deleted it because it happened when i was not at home...
    Is it possible a problem with the server ? Can maps go empty for some reason ?

    damn this sux :(
     
    fatabbot, Dec 14, 2006 IP
  4. fatabbot

    fatabbot Well-Known Member

    Messages:
    559
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    138
    #4
    Can jpg's contain suspicious stuff that does harm to any server files ?
     
    fatabbot, Dec 14, 2006 IP
  5. drewbe121212

    drewbe121212 Well-Known Member

    Messages:
    733
    Likes Received:
    20
    Best Answers:
    0
    Trophy Points:
    125
    #5
    Images can be ran as executables. :)
    Nasty stuff.

    Um, do you use copy() to upload it? Please don't use copy() if you do. Bad bad idea. If you use copy, I can almost gurentee that is where the problem came from.
     
    drewbe121212, Dec 14, 2006 IP
  6. fatabbot

    fatabbot Well-Known Member

    Messages:
    559
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    138
    #6
    Seriously ? That's crazy...
    The most important php functions i use the handle the form are:

    imagejpeg()
    imagecopyresampled()
    imagedestroy()


    Is it that copy you mean ? And what alternatives are there ?
     
    fatabbot, Dec 14, 2006 IP
  7. drewbe121212

    drewbe121212 Well-Known Member

    Messages:
    733
    Likes Received:
    20
    Best Answers:
    0
    Trophy Points:
    125
    #7
    No, that should be fine. The uploading part is the part that I am concerned with.
     
    drewbe121212, Dec 14, 2006 IP
  8. CodyRo

    CodyRo Peon

    Messages:
    365
    Likes Received:
    15
    Best Answers:
    0
    Trophy Points:
    0
    #8
    Mind PMing me the part of the script you're concerned with and I'll look over it.
     
    CodyRo, Dec 14, 2006 IP
  9. john_loch

    john_loch Rodent Slayer

    Messages:
    1,294
    Likes Received:
    66
    Best Answers:
    0
    Trophy Points:
    138
    #9
    I have a very simple rule of thumb.

    NEVER expose (in the markup of a page etc) the folder to which you're uploading files. When you do upload files, serialize or the like in a tmp dir (dont use their actual names). Then, move the files to a read only directory from which you CAN then refer to them by name in the page.

    If you're using a blog or other typically Open Source script, change the default directory names.

    Yes, it's not a nice pill after the fact, but it should mean you dont have to go through it again :)

    Best

    JL
     
    john_loch, Dec 14, 2006 IP