Re: [mod-security-users] Fwd: Blocking File uploads by contents

[Ryan B. <Ryan.Barnett@Breach.com>]

From: Justin Brown [mailto:gq...@gm...]
Sent: Wednesday, November 12, 2008 9:45 PM
To: Brian Rectanus
Cc: mod...@li...
Subject: Re: [mod-security-users] Fwd: Blocking File uploads by contents

Success!! The rule and script is working as desired. The only thing I had to add was an I switch to the grep command so it wouldn't try to search binary files (like jpgs). the new command is `grep -Ic "<?" $1`

Thanks so much for your help, Brian. When I have time I'll write up a step by step in case anyone else wants to reproduce my results. I think this will go a long way to stop people from uploading malicious PHP files through vulnerable applications on our server (we have a large number of hosting clients and there's just no way to keep all the PHP apps up to date without going super draconian on our clients). Thanks again.
[Ryan Barnett] I am glad that you got the @inspectFile operator to work appropriately for you, however it seems to me that in this particular case you may not need it.  If you are using this operator to simply run a GREP for some PHP strings within the uploaded data then you should be able to use the following Core Rule to accomplish the same goal without having to fire off a script -
#
# PHP injection
#
SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/* "@pm <? fgets move_uploaded_file $_session readfile ftp_put ftp_fget gzencode ftp_nb_put bzopen readdir $_post fopen gzread ftp_nb_fput ftp_nb_fget ftp_get $_get scandir fscanf readgzfile fread proc_open fgetc fgetss ftp_fput ftp_nb_get session_start fwrite gzwrite gzopen gzcompress" \
        "phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,pass,nolog,skip:1"
SecAction pass,nolog,skipAfter:959013
SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "(?:(?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open)|\$_(?:(?:pos|ge)t|session))\b|<\?(?!xml))" \
        "phase:2,capture,t:none,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'PHP Injection Attack',id:'950013',tag:'WEB_ATTACK/PHP_INJECTION',tag:'WEB_ATTACK/HTTP_RESPONSSE_SPLITTING',logdata:'%{TX.0}',severity:'2'"
SecRule REQUEST_HEADERS|XML:/* "(?:(?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open)|\$_(?:(?:pos|ge)t|session))\b|<\?(?!xml))" \
        "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'PHP Injection Attack',id:'959013',tag:'WEB_ATTACK/PHP_INJECTION',tag:'WEB_ATTACK/HTTP_RESPONSSE_SPLITTING',logdata:'%{TX.0}',severity:'2'"