Just a few minutes ago I was skimming around my script archive looking for some code I needed, when I was finished, I closed explorer and opened scite, as scite re-sized, I noticed there was something out of the usual on my desktop.
It was an image thumbnail out of place, I have a special directory for all images and seeing the image thumbnail with the ocean sunset thing that stands out from all the other icons caught my eye immediately.
I tried to refresh my memory and remember how it got there as I was typing into scite and, and it's lingering presence in my mind made me open it, as I opened it I realized it could have not been me who saved such an image, if it wasn't for that I wouldn't have found a few shells that were uploaded about 3 months ago, both r57 and c99 were there, several copies, if it wasn't for prior foresight they would have been able to use them, but luckily I had disabled execution of php files and replaced the php extension with something else in order to keep someone doing this busy for a good while.
As I looked deeper into the problem I noticed there were a ton of nyancat, my little pony and anonymous pictures all over the server, thankfully it doesn't seem like they were able to delete anything or execute any of the shells.
This is the code I use for file uploads on my site., apparently someone has been exploiting it to upload ridiculous images of anonymous hackers, nyancats and obscene my little pony characters...
Code on index page~
Plain Text
Function UploadForm() { global $allowed,$one,$notyet,$final,$language,$keys,$num_files,$flat_allowed,$txt; Echo PageHeader(); Echo '<div id="upload"><h2><p align="center" class="header">Uploade your shit 1.0</p></h2>'; require_once('C:/UniServer/www/inc/config.php'); require_once('C:/UniServer/www/inc/Internal.php'); require_once("C:/UniServer/www/inc/$language.lng"); $keys = array_keys($allowed); foreach($keys as $one) if (!in_array(strtolower($one), array('text', 'exec', 'image', 'package'))) { echo '<p align="center"><span style="color:red; font-size: 12pt;"><b>'.$txt['unknown_attr'].': '.$one.'<br />'.$txt['unknown_notify'].'</b></span></p>'; exit; } if (_CHANGE_NUM === true && isset($_GET['num_files']) && is_numeric($_GET['num_files'])) $num_files = (int)$_GET['num_files']; foreach($allowed as $notyet) foreach($notyet as $final) $flat_allowed[] = strtolower($final); PrintForm(); clearstatcache(); Echo '<br><center>Only you can prevent forest fires!</center></div>'; Echo PageFooter(); }
Upload.php
Plain Text
<?PHP require_once('config.php'); require_once('Internal.php'); require_once("$language.lng"); define('_REALPATH', 'C:\UniServer\www\autorepo\User Uploads/'); $keys = array_keys($allowed); foreach($keys as $one) if (!in_array(strtolower($one), array('text', 'exec', 'image', 'package'))) { echo '<p align="center"><span style="color:red; font-size: 12pt;"><b>'.$txt['unknown_attr'].': '.$one.'<br />'.$txt['unknown_notify'].'</b></span></p>'; exit; } if (_CHANGE_NUM === true && isset($_GET['num_files']) && is_numeric($_GET['num_files'])) $num_files = (int)$_GET['num_files']; foreach($allowed as $notyet) foreach($notyet as $final) $flat_allowed[] = strtolower($final); if (isset($_POST['_submit'])) { for ($i = 0; $i < $num_files; $i++) { if ($_FILES['_file']['name'][$i] == '') continue; $File = strtr(stripslashes($_FILES['_file']['name'][$i]), '\'" |\\/?!*#', '__________'); $dotpos = strrpos($File, '.'); $length = strlen($File); $ext = strtolower(substr($File, -($length - $dotpos - 1))); $noext = substr($File, 0, -($length - $dotpos - 1)); if (!in_array($ext, $flat_allowed)) { LogErrors("{$txt['extension']} <b>$ext</b> {$txt['not_allowed']}"); continue; } switch($_FILES['_file']['error'][$i]) { case 0: break; case 1: LogErrors($txt['PHP_file_size']); continue 2; break; case 2: LogErrors("$txt[file_size] $txt[exceded_limit]"); continue 2; break; case 3: LogErrors($txt['partial_upload']); continue 2; break; case 4: LogErrors($txt['no_file']); continue 2; break; } if ($_FILES['_file']['size'][$i] > (_MAXSIZE * 1024)) { LogErrors($txt['file_size'].' ('.round($_FILES['_file']['size'][$i]/1024, 2)." $txt[KB]) {$txt['not_allowed']}"); continue; } $fullname = _REALPATH.$File; if (!isset($content)) $content = ''; if (_OVERWRITE == false or !isset($_POST['_overwrite'])) { if (file_exists($fullname)) { LogErrors($txt['file_exists']); continue; } if (isset($allowed['exec']) and in_array($ext, $allowed['exec'])) { if ($ext == 'php' and $highlight_php == true and file_exists(_REALPATH.$noext.'html')) { LogErrors($txt['exec_file_exists']); continue; } elseif (file_exists(_REALPATH.$noext.'txt')) { LogErrors($txt['exec_file_exists']); continue; } } } if(@move_uploaded_file($_FILES['_file']['tmp_name'][$i], $fullname)) { if (isset($allowed['image']) and in_array($ext, $allowed['image'])) is_image(); elseif (isset($allowed['text']) and in_array($ext, $allowed['text'])) is_text(); elseif (isset($allowed['exec']) and in_array($ext, $allowed['exec'])) is_exec(); elseif (isset($allowed['package']) and in_array($ext, $allowed['package'])) $uploaded[] = $File; if ($change_mode == true) @chmod($fullname, $mode)or LogErrors($txt['chmod_fail']); } else { LogErrors($txt['move_failiur'].'<br />'.$txt['try_again']); if (!file_exists(_REALPATH)) echo '<span style="color:red; font-size: 12pt;"><b>'.$txt['doesnot_exist'].'</b></span><br />'; elseif (!is_writable(_REALPATH)) echo '<span style="color:red; font-size: 12pt;"><b>'.$txt['unwritable'].'</b></span><br />'; } } if ($show_error_log == true and isset($errors) and count($errors) > 0) ShowErrorLog($errors); if ($show_uploaded_list == true and isset($uploaded) and count($uploaded) > 0) ShowUploaded($uploaded); if (isset($content)) echo $content; // if ($show_upload_form == true) // PrintForm(); if ($notify_admin == true) MailUploaded(); if ($log_upload == true) FilesLogging(); } else { exit; } ?>
