Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

How to block a POST Text string using mod security ?

Discussion in 'Security' started by fuzioneer, Oct 5, 2013.

  1. fuzioneer

    fuzioneer Well-Known Member

    Joined:
    Dec 12, 2003
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    I have mod sec installed on my cpanel server and I have installed common rules etc, but i want to block a defacement bot which is modifying files through an as yet unidentified flaw in a file somewhere

    an identifying part of the script it appends to files contains the text string "a9a007"

    so i thought it should be possible to block this in query urls etc using mod security as an interim measure ?
     
    #1 fuzioneer, Oct 5, 2013
  2. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,010
    Likes Received:
    87
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    Append this to your modsec config:
    Code:
    SecRule REQUEST_METHOD "post" "deny,chain,status:500,id:9379635"
SecRule REQUEST_HEADERS "a9a007"
    This is assuming that the POST data is not encoded using base64 or something. You could add this to cover that:
    Code:
    SecRule REQUEST_METHOD "post" "deny,chain,status:500,id:9379636"
SecRule REQUEST_HEADERS "a9a007" t:base64Decode
    How you should really track this down, is run 'stat' on one of the modified files. Take the exact change and modify times provided, and find those times in the domains apache access log (domlog). This will really answer how it's happening, the file POSTed to at the time the other files were modified is the one doing the injection. That said, the modsec rules above might stop it. I would not recommend leaving these in place permanantly as it will deny any POST request with the string "a9a007" anywhere in the request headers.
     
    #2 quizknows, Oct 5, 2013
  3. fuzioneer

    fuzioneer Well-Known Member

    Joined:
    Dec 12, 2003
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    thx added the rules

    Having real problems trying to find the source, initially the hacker was uploading somehow a file to our server in a directory, the file was randomly named and contained a series of php code to find flaws in security (none disabled functions in php.ini etc)

    We found this file, disabled any functions it might use

    We are still getting attacked "successfully" once or twice a week with redirector code being added to .php and .html files on our site !!!
    (Note nothing since adding the mod sec extra rules but this is very early days)

    trying to find how they are gaining access and not really getting anywhere
    checked messages log but nothing happening around the time of attacks
    checked domain logs but nothing happening at time of attacks

    any other pointers of where / how to check ?
     
    #3 fuzioneer, Oct 7, 2013
  4. fuzioneer

    fuzioneer Well-Known Member

    Joined:
    Dec 12, 2003
    Messages:
    100
    Likes Received:
    0
    Trophy Points:
    166
    the only facet of info I have found is from an older attack where an ip address was continuously over a very short timeframe so obviously a script accessing our forums (an old derivative of phpnuke / phpbb 2)

    http://ourdomain.com/ftoptitle-137109.html&sa=U&ei=JBgnUdXtNaTg0QHZw4CICg&ved=0CLsBEBYwMTisAg&usg=AFQjCNG0v848-sF24eoGCwqcmgJywrALNA" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"

    this may or may not be a red herring though
     
    #4 fuzioneer, Oct 7, 2013
  5. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,010
    Likes Received:
    87
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    Nothing stands out to me from that request.

    What I would do in your case, aside from modsec rules, is go into the cPanel account and enable the "Raw Access Logs" archiving.

    As soon as a file gets affected again, before restoring or fixing it, just 'stat file.php' from a root shell. Note the output for Change and Modify. Technically Modify can be spoofed, however, "Change" cannot (at least, not on a system that is not root-level compromised).

    Assuming this is a webapp hack (and they don't have your FTP password or something), when you get the file stats, you will be able to match a request to that exact time in the archived Apache access logs (located in /home/$username/logs). If the times don't match up then you need to start checking your FTP logs and cPanel access log for file manager access.
     
    #5 quizknows, Oct 7, 2013
(You must log in or sign up to post here.)
Loading...
Similar Threads - block POST Text
  1. pixelaté

    SOLVED SMTP Restrictions Disabled but Still Blocked

    pixelaté, Aug 14, 2018 at 11:21 PM, in forum: Security
    Replies:
    4
    Views:
    56
    cPanelMichael
    Aug 16, 2018 at 9:50 AM
  2. Znuff

    Same-domain impersonation increases deferred count, triggering domain-wide blocking

    Znuff, Aug 13, 2018, in forum: E-mail Discussion
    Replies:
    3
    Views:
    74
    cPanelLauren
    Aug 16, 2018 at 9:08 AM
  3. Vipin Haridas

    SpamAssassin not blocking emails with invalid SPF?

    Vipin Haridas, Aug 10, 2018, in forum: E-mail Discussion
    Replies:
    1
    Views:
    57
    cPanelLauren
    Aug 13, 2018
  4. Usif Nasirov

    SOLVED Can't find cause of CBL blocking

    Usif Nasirov, Aug 2, 2018, in forum: E-mail Discussion
    Replies:
    2
    Views:
    71
    cPanelMichael
    Aug 2, 2018
  5. Jason Richmond

    Block all incoming SMTP except from ip's of my spam filter service

    Jason Richmond, Jul 31, 2018, in forum: E-mail Discussion
    Replies:
    1
    Views:
    52
    cPanelLauren
    Aug 1, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice