Symlink files in my server.

YasIT

• May 31, 2014 07:21

Hello. On my server I've applied the following settings: Disable php.ini for users. safe_mode on disable_functions: ir_a_bajo,phpinfo,disk_free_space,disk_total_space,php_uname,symlink,shell_exec,exec,proc_close,proc_open,popen,pclose,system,dl,passthru,escapeshellarg,escapeshellcmd,readfile,posix_access,posix_ctermid,posix_errno,posix_get_last_error,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid,posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_initgroups,posix_isatty,posix_kill,posix_mkfifo,posix_mknod,posix_setegid,posix_seteuid,posix_setgid,posix_setpgid,posix_setsid,posix_setuid,posix_strerror,posix_times,posix_ttyname,posix_uname open_basedir : /home/:/usr/lib/php:/usr/local/lib/php:/tmp:/home2/:/usr/lib/php:/usr/local/lib/php:/tmp:/home3/:/usr/lib/php:/usr/local/lib/php:/tmp:/home4/:/usr/lib/php:/usr/local/lib/php:/tmp safe_mode_gid on enable_dl off suhosin enabled by easy apache. fix all warning in CSF. permisson /usr/bin/perl set 700 permisson /bin/ln set 700 Handler php set SuPHP php 5.3.27
But the hacker can bypass and symlink in my server. Please help. Thank.

• 

  quizknows

  • May 31, 2014 17:53

  0
• 

  YasIT

  • May 31, 2014 19:16

  my webserver LiteSpeed. This post for apache!

  0
• 

  cPanelMichael

  • June 02, 2014 12:57

  Hello :) Please note the LiteSpeed web server is a third-party application that is not natively supported by cPanel. You may find more information or advice regarding their product's security directly from their support team or forums: [url=http://www.litespeedtech.com/support/forum/]LiteSpeed Support Forums Thank you.

  0
• 

  Felipe M.

  • June 07, 2014 02:16

  Hello If you have PHP 5 Handler "suphp" enabled in your server Please make file named .htaccess in your home directory with this content suPHP_ConfigPath /usr/local/lib/php.ini Or put file directly [QUOTE]echo "suPHP_ConfigPath /usr/local/lib/php.ini" > /home/.htaccess
  Hackers can't bypass your php.ini directives with this file Note: If you see abnormally symlinks in your users public_html, you can change permission of /bin/ln to chmod 700 (chmod 700 /bin/ln) Hackers can't make syminks and pass to other users or folders. Thanks

  0
• 

  quizknows

  • June 07, 2014 18:26

  Even with /bin/ln restricted they can just upload a .zip with a symlink to / in it. That offers little actual protection. Bypassing php.ini is also not hard with SuPHP. I recommend looking into seeing if cloudlinux and cagefs plays nicely with litespeed or not.

  0
• 

  Felipe M.

  • June 08, 2014 03:59

  [quote="quizknows, post: 1659431">Even with /bin/ln restricted they can just upload a .zip with a symlink to / in it. That offers little actual protection. Bypassing php.ini is also not hard with SuPHP. I recommend looking into seeing if cloudlinux and cagefs plays nicely with litespeed or not.
  Not possible bypass symlinks with rar or zip file, because permission are 700 in server. Litespeed is not secured but very fastest with php, the best way is activate cagefs with jailed shell for all users and make hardening to your server. I recommend too use [url=http://applications.cpanel.net/appcat/anti-malware-plugin-for-whm]Anti Malware Plugin for WHM or [url=http://configserver.com/cp/cxs.html]ConfigServer eXploit Scanner (cxs) and search all PHPshells or malware in your server Thanks

  0
• 

  quizknows

  • June 08, 2014 04:17

  Yes, it is possible to bypass even with ln set to 700. On your own workstation/server without restriction, make a symlink and tar it: local_computer:~$ ln -s / testlink.txt #create symlink local_computer:~$ tar -cvzpf test.tar.gz testlink.txt #add to .tar testlink.txt local_computer:~$ tar -tvzpf test.tar.gz #list tar content lrwxrwxrwx unpriv/unpriv 0 2014-06-08 00:11 testlink.txt -> / (upload as normal user to server, ftp or whatever) unpriv@server.com [~/public_html]# tar -xvzf test.tar.gz #extract tar unpriv@server.com [~/public_html]# ls -alrt #list dir -rw-r--r-- 1 unpriv unpriv 119 Jun 8 00:13 test.tar.gz lrwxrwxrwx 1 unpriv unpriv 1 Jun 8 00:14 testlink.txt -> //
  There you have it, I never used the ln binary on the server, and my normal user has a symlink to root.

  0

Please sign in to leave a comment.