<html>
<body>
Excellent suggestion. Will try and let you know about success
level.<br><br>
-Rashid<br><br>
At 01:21 PM 3/26/2006, you wrote:<br>
<blockquote type=cite class=cite cite="">Can you just do a site-wide grep
for anyplace that lets you do a file<br>
upload and check that code? You'd be looking for a form type of<br>
"multipart/form-data" (and a text field of
'type="file"', but that's a<br>
bit harder to search for unless you know what quote style they are<br>
using, single or double). Make a shell script (I'll call it<br>
file_upload_find.sh):<br><br>
vi ~/file_upload_find.sh<br><br>
#!/bin/sh<br>
for search in pl cgi php<br>
do<br>
# first build a list of file names for each type<br>
MATCHES=`find . -name "*.${search}" -exec grep -il<br>
'multipart/form-data' {} \;`<br><br>
if [ "x$MATCHESx" != "xx" ]; then<br>
# show all the lines in each file that match<br>
for file in $MATCHES<br>
do<br>
echo "File: $file"<br>
grep -in "multipart/form-data"
"$file"<br>
done<br>
fi<br><br>
done<br><br>
<br>
Make it executable:<br><br>
chmod +x ~/file_upload_find.sh<br><br>
<br>
Then go to the site's web root and run it:<br><br>
cd
/home/sites/<a href="http://www.example.com/web" eudora="autourl">
www.example.com/web</a><br>
~/file_upload_find.sh<br><br>
You should see output like this:<br><br>
File: ./filemanager.php<br>
11: echo "<form action=\"" .
$PHP_SELF . "\" method=\"POST\"<br>
ENCTYPE=\"multipart/form-data\">";<br>
File: ./fileupload.php<br>
56: <form name="uploadform"
action="fileupload.php" method="POST"<br>
enctype="multipart/form-data"><br><br>
That will give you a list of all .php/.cgi/.pl files with the string<br>
in them, and tell you the line number(s) of each file that it exists<br>
at. Then check those files to see what kind of input validation they<br>
are doing, etc., and fix any errors...<br><br>
<br>
If the IRC bot is always named the same, you could set up a cron job<br>
to look for it and email you if it appears - that might let you
catch<br>
someone in the act. Make a shell script like this (I'll call
it<br>
botwatch.sh):<br><br>
vi ~/botwatch.sh<br><br>
#!/bin/sh<br><br>
FILE_TO_FIND="/tmp/filename"<br><br>
if [ -f $FILE_TO_FIND ]; then<br>
NOW=`date +%c`<br>
echo $NOW | mail -s "$FILE_TO_FIND found - exploit in
progress!" \<br>
you (at mark) example.com<br>
fi<br><br>
<br>
Set the script to be executable:<br><br>
chmod +x ~/botwatch.sh<br><br>
See where it is:<br><br>
pwd<br><br>
Then set up a cron job to run every minute to execute the
script:<br><br>
crontab -e<br>
* * * * * /path/to/botwatch.sh > /dev/null<br><br>
where "/path/to" is whatever the pwd command gave you.<br><br>
Be aware that you will get an email every minute that the file
exists,<br>
so until you clean it up, you will continue to receive emails. If
you<br>
want to tone it down a bit, just alter the cron interval:<br><br>
crontab -e<br>
2,32 * * * * /path/to/botwatch.sh > /dev/null<br><br>
will run it every half hour at :02 and :32 past the hour.<br><br>
<br>
Alternatively if you set up the cronjob under the root user, it can<br>
just delete the file for you:<br><br>
#!/bin/sh<br><br>
FILE_TO_FIND="/tmp/filename"<br>
ME="me (at mark) example.com"<br><br>
if [ -f "$FILE_TO_FIND" ]; then<br>
# capture all running processes<br>
PS_LIST=`ps afx`<br>
/bin/rm "$FILE_TO_FIND"<br>
# you will need to add some process killing here too<br><br>
# see if we actually got rid of it<br>
if [ -f "$FILE_TO_FIND" ]; then<br>
echo $PS_LIST | mail -s "$FILE_TO_FIND found, NOT
DELETED!" $ME<br>
else<br>
echo $PS_LIST | mail -s "$FILE_TO_FIND found and
deleted" $ME<br>
fi<br>
fi</blockquote>
<x-sigsep><p></x-sigsep>
***************************************************************** <br>
MuntadaNet Web Hosting and Web Design Services<br>
<font color="#0000FF"><u>
<a href="http://www.muntada.com/" eudora="autourl">
http://www.muntada.com<br><br>
</a></u></font>Sales - sales (at mark) muntada.com <br>
Support - support (at mark) muntada.com <br>
Billing - billing (at mark) muntada.com<br><br>
Main Office - 808-689-6092<br>
Fax - (808) 356-0279<br>
*****************************************************************<br><br>
</body>
</html>