Hacker News Reader

Comment by jacquesm | Hacker News Reader

yes.

I run a filedump as part of all the stuff we do, one day some smart alec figured out that I had forgotten that if somebody uploaded a .php file that it would execute instead of being downloaded... Very very stupid of me.

The next step was to upload a nice little backdoor filemanager package written in php and run it from the download directory (this must have been harsh because the url switches after every download). Eventually they got access to the password hashes, but since I found out about the hack within 24 hours I just changed the passwords on the system after plugging the hole.

Obviously the way to handle that was to refuse files whose exension is .php.

I still can't believe that it was that easy to get in, and I feel totally stupid for not having foreseen that.

View on HN

It's possible that you've still missed something, unless you're certain that .php is the only extension which your server executes (.php5 often works, and some servers will also run files with .cgi or .py extensions, among others). Blacklists are never fun.

The solution which occurs to me is (assuming you're on Apache) setting the .htaccess file in that directory to cause all files to be downloaded, regardless of their type. I haven't tested it, but I think this is the setting you'd need to make:

  ForceType application/octet-stream

you had me paraonoid enough there to check :)

It's ok though, the fix I applied was a little more elaborate than indicated above.

thanks anyway!

It's really hard to harden yourself against code getting interpreted by the browser (and thus allowing someone to steal cookies and impersonate other users). Here's a long article on exactly how complex it is (as known today): http://tstarling.com/blog/2008/12/secure-web-uploads/

Personally, I just don't trust web uploads on the same domain. Put them on a subdomain or better yet a completely separate domain, preferably served out of something set up to never execute any code whatsoever.

Excellent read Timothy, thank you. I have changed some of the code because of this article. I also checked the history of all uploads to see if any of the holes mentioned had been used, and apparently there was at least one instance of somebody trying the .js route but they got hung up on the fact that the file names are changed after every download.

By default, mod_php registers .php, .php4, .php5, .phtml, and .pht. (Also .phps, but that isn't executed.) A lot of people forget about the last two.

Reply on news.ycombinator.com