Waraxe IT Security Portal

pexli · Valuable expert

In dir _vti_pvt have file service.pwd.inside in this file is stored your password hash.

to waraxe

Там Suhosin Extension и много чего сделать почти невозможно.Имхо надо искать по логам где хранятся backup's.В диров других юзеров наверно у него прав не будет.

Вот такое

drwxr-x--- 2 fakeuser nobody 4096 Dec 27 21:32 _vti_pvt

..немного дает надеждъй но наверно на файл service.pwd из nobody не будет прав на просмотр....етц,а если будет прав то сервак можно взять целиком.

waraxe · Site admin

Yes, it is obvious, that server admin knows about security (hardened php, *bsd opsystem), so probably cross-neighbour attacks are hard to make happen. But this is just guess. Without comprehensive tests it's just speculation, there can be insecurities everywhere Wink

By the way, this server seems to be full of various users:

http://search.msn.com/results.aspx?q=ip%3A208.87.241.96&FORM=MSNH

Smile

Snoop1990 · Advanced user

Ok about the service.pwd file there was something inside like:

Snoop1990 · Advanced user

But one more thing, can you please tell me what you are looking for ? Cause I would be very please to be able to do this php security check on my own. So if I switch to another host in future time I do not have to do it all again.

What I understand so far is:
phpinfo(); shows general information about the system, the version and the variables in php, but can you please tell me, which are potential security holes? Which variables have to be disabled ?

The second step was to check for /etc/master.passwd sure if this file is available you can easily get the password by testing the maximum length and if special characters are supported (there are not that much potential MD5s)

then you did some ls, mmh I do not understand this, what are you looking for ? or is it just a try to see if it is possible ?

then you check which directory we are in and then check posix and the globals. So here again, which are insecure ? which should be disabled ?

In the next snippet you check for even more files and again check something with posix ... please just tell me what you are looking for, please !

waraxe · Site admin

It's too many questions for me, i can talk about this issues hours and hours ...
But one thing is clear - your current hosting is secure against cross-neighbour attacks. I mean: if someone hacks into the website, that is hosted on same server, and if attacker gets php code level and opsystem shell level access, then he/she is unable to leverage his presence to other websites. Or vice versa - you have there shell and php access, but you can't read other website's files, right?
Main reason fro such thoughts is bsd Jailing, used in that server. It's kind of sandboxing, and it's not easy to escape it. So this hosting is good from cross-user point of view.
Now that "master.passwd". If you could read it, then it's not fatal. It's not containing password hashes, only usernames, uids, gids and some other stuff. It's just usual test about opsystem files readability. Password hashes are in "master.shadow" file, which can be read only by root user. And those hashes are not usual md5, but >1000 times rehashed hashes. So cracking them is real pain in a$$ and good passes are uncrackable.
There is much more i wanted to talk here, but i'm to tired for today.
See ya Smile

Snoop1990 · Advanced user

Thank you for your response that far. If you find some time I would be very pleased if you can teach me something more about security and such things. It is a really interesting topic and I wanted to learn all time, but I did known where to start. Now I found your forum and I am really happy about it. But as I said in another topic I do not want to be one of those script kids who just copy paste code. I want to understand what I am doing and how to prevent myself and others from being hacked. And I think you are the kind of guy who knows a lot about all these so I would be very pleas to learn some of your tricks.

Regrades Snoop1990