[heropage]

my site just got hacked.
I have a site where user can upload photo.
in my httpd.conf file.
I use

<Directory /var/www/html/photo>
Order Deny,Allow
Deny from All
</Directory>

to block access to photo folder directly.
It works fine for most users.
But for for some reason, some hacker still be able to access this folder.

He uploaded a gif file which contains php codes and execute it
http://mysite/photo/123.gif
and my site get hacked.

I guess he use some software to bypass apache.

Also weird thing is : I can not find the log from the apache access log.
But I can see it in the error log, because there are some php warning error .

[error] [client 113.1.1.1] PHP Warning: Unexpected character in input: '\x01' (ASCII=1) state=0 in /var/www/html/photo/123.gif : eval()'d code on line 1, referer: site.com

So 2 things:
1) how to block the photo folder completely. it looks like if user use browser, he got blocked. but if he use some software, he can access. any software can do this?
2)how come there is not server log in access_log? any software can do this?

[Lυcιғεя]

He shelled your site sir, if you need help pm me.

[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

I remember someone posting somewhere that changing your HTTP method from GET/POST to something like KJAFD (Using Tamperdata) could bypass either the .htpasswd or .htaccess. Dont quote me on it as I can't remember 100% and I can't seem to find the thread

[heropage]

I remember someone posting somewhere that changing your HTTP method from GET/POST to something like KJAFD (Using Tamperdata) could bypass either the .htpasswd or .htaccess. Dont quote me on it as I can't remember 100% and I can't seem to find the thread

i don't think Tamperdata can bypass htpasswd or htaccess

[phlower]

I remember someone posting somewhere that changing your HTTP method from GET/POST to something like KJAFD (Using Tamperdata) could bypass either the .htpasswd or .htaccess. Dont quote me on it as I can't remember 100% and I can't seem to find the thread

changing it to anything can possibly bypass it
https://hackforums.net/showthread.php?tid=3392310

[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

changing it to anything can possibly bypass it
https://hackforums.net/showthread.php?tid=3392310

That's what I was thinking of and by the looks of that thread it seems your vuln. Test it just to see if you are though

[heropage]

That's what I was thinking of and by the looks of that thread it seems your vuln. Test it just to see if you are though

live http header can only bypass .htaccess which use

<LimitExcept GET POST>
Order Allow,Deny
Deny from all
</LimitExcept>

it doesn't work if .htaccess use something like

AuthName Login
AuthType Basic
require valid-user

[tehunseen]

What if you create a .htaccess file in the /var/www/html/photo/ directory which contains "deny from all"?

Also PM me your upload script, I can patch the vulnerability.

[cheatson]

Check your site for local file inclusion vulns mate! https://hackforums.net/showthread.php?tid=3837733

[heropage]

Check your site for local file inclusion vulns mate! https://hackforums.net/showthread.php?tid=3837733

i think it's a good direction!
my site is a clipshare video site.
it has inclusion vulns.
But BTW, I inject a php into a jpg file, and it looks like it doesn't run the php codes.
I have tried edjpgcom and Exif editor.
I also tried this

copy google.gif /b + phpinfo.php /a phpinfo.gif

the image still not running php codes.