D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
proc
/
3
/
task
/
3
/
root
/
etc
/
apache2
/
conf.d
/
imh-modsec
/
Filename :
20_known_hacks.conf
back
Copy
# both.conf # Mitigation for a timthumb exploit described at http://seclists.org/fulldisclosure/2014/Jun/117 # Trac 7313 SecRule ARGS:src "(:?\$\(|`).*(:?\)|`)" \ "chain,deny,log,auditlog,status:406,\ msg:'ARGS:src contains shell special characters',id:'13055',\ tag:'WEB_ATTACK/SHELL ACCESS',severity:'4',\ t:none,t:htmlEntityDecode,t:urlDecode" SecRule &ARGS:webshot "@gt 0" # Stop requests to known hack scripts SecRule REQUEST_URI "/plugins/system/infophp.php" \ "log,deny,status:406,auditlog,id:13923,rev:1,severity:3,\ msg:'Access to known hack script',\ tag:'WEB_ATTACK/SHELL ACCESS'" # Stop requests to a known DoS script SecRule ARGS:action "(udp|tcp|syn|http)" "t:lowercase,log,deny,auditlog,\ id:13924,deny,status:406,severity:3,msg:'Access to known hack script',\ tag:'WEB_ATTACK/SHELL ACCESS',chain" SecRule ARGS_NAMES "host" "t:lowercase,chain" SecRule REQUEST_URI "online\.php" "t:lowercase" # Stop requests to known shells SecRule REQUEST_URI "/w[0-9][0-9]+w*\.php" \ "log,deny,status:406,auditlog,id:13929,rev:1,severity:3,\ msg:'known php shell',\ tag:'WEB_ATTACK/SHELL ACCESS'" SecRule REQUEST_URI "/sm[0-9]+rk[0-9]+\.php" \ "log,deny,status:406,auditlog,id:13930,rev:1,severity:3,\ msg:'known php shell',\ tag:'WEB_ATTACK/SHELL ACCESS'" # Blocks request to hacks in the bluestork admin template folder, a common Joomla hack payload SecRule REQUEST_URI "administrator/templates/bluestork/((indx|stph|stcp|start|startphp)\.php|(run|f1)\.pl)" \ "deny,log,auditlog,status:406,id:'13999',\ t:none,t:lowercase,t:htmlEntityDecode,t:removeWhitespace,\ msg:'Joomla Admin bluestork theme exploits',\ tag:'WEB_ATTACK/SHELL EXPLOIT',severity:'4'" # Stop requests to l_backuptoster.php SecRule REQUEST_URI "/l_backuptoster.*\.php" \ "log,deny,status:406,auditlog,id:13582,rev:1,severity:3,\ msg:'l_backuptoster.php spam script',\ tag:'WEB_ATTACK/SPAMBOT'" # No posts to dvmessages\.php SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,\ msg:'POST to dvmessages.php',id:'13068',\ tag:'WEB_ATTACK/SHELL ACCESS',severity:'4'" SecRule REQUEST_URI "dvmessages\.php" # No posts to known hack/mailer URIs SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,id:'13069',severity:'4',\ msg:'POST request to hack/mailer script',\ tag:'WEB_ATTACK/SHELL ACCESS'" SecRule REQUEST_URI "/(?:(?:components/com_content/(?:statistics[0-9A-Za-z_-]{4}|com_it|faccount)).*\.php)|(?:wp-content/mod_gogle/)" # Block known behavior for interacting with a PHP shell SecRule REQUEST_URI "/stph\.php\?.*(page|action\=(start|status))"\ "deny,log,auditlog,status:406,id:'13998',severity:'4',\ t:none,t:lowercase,t:htmlEntityDecode,t:removeWhitespace,\ msg:'stph.php shell',\ tag:'WEB_ATTACK/SHELL EXPLOIT'" # Block POSTs to mod_frosty hacks SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,id:'13996',severity:'4',\ msg:'POST request to known hack',\ tag:'WEB_ATTACK/SHELL ACCESS'" SecRule REQUEST_URI "/mod_frosty/.*\.php" "t:lowercase,t:removeWhitespace" # Block POSTs to xcloner shells. PHP scripts matching [a-z0-9]{6}\.php do not exist in the plugin SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,\ msg:'POST request to known hack',id:'13997',tag:'WEB_ATTACK/SHELL ACCESS',\ severity:'4'" SecRule REQUEST_URI "/(?:com_)?xcloner-backup-?and-?restore.*/[a-z0-9]{6}\.php$" # Block xmlrpc calls with specific User-Agent SecRule REQUEST_METHOD "POST" \ "chain,deny,log,auditlog,status:406,\ msg:'POST request to xmlrpc from bad User-Agent',id:'13995',tag:'WEB_ATTACK/XMLRPC',\ severity:'4'" SecRule REQUEST_URI "xmlrpc\.php" "chain" SecRule HTTP_User-Agent "Mozilla\/4\.0 \(compatible; Win32; WinHttp\.WinHttpRequest\.5\)" # Block requests to php hidden files SecRule REQUEST_URI "\/\.[a-zA-Z0-9].+\.php" \ "log,deny,status:406,auditlog,id:14203,rev:1,severity:3,\ msg:'Blocking access to hidden php files'" # Block requests to potential cryptolocker hacks SecRule REQUEST_METHOD "POST" \ "chain,log,deny,status:406,auditlog,id:14208,rev:1,severity:3,\ msg:'Blocking acccess to potential cryptolocker activation'" SecRule REQUEST_URI "\/skin\/error\.php" # Block access to known botnet scripts SecRule REQUEST_METHOD "POST" \ "chain,log,deny,status:406,auditlog,id:14209,rev:1,severity:3,\ msg:'Blocking acccess to known botnet scripts'" SecRule REQUEST_URI "\/plugins\/index\.php\?cookie=1" "chain" SecRule HTTP_USER-Agent "Mozilla\/5\.0 \(compatible\; Googlebot\/2\.1\; \+http://www.google\.com\/bot\.html\)" # ded.conf # Block access to known Fox* botnet scripts SecRule REQUEST_URI "\/[a-z]{8}\.php\?Fox\=" \ "log,deny,status:406,auditlog,id:14210,rev:1,severity:3,\ msg:'Block access to known Fox botnet scripts'"