{"id":1244,"date":"2012-02-25T20:57:51","date_gmt":"2012-02-25T18:57:51","guid":{"rendered":"http:\/\/netspider.com.ua\/?p=1244"},"modified":"2012-02-25T20:57:53","modified_gmt":"2012-02-25T18:57:53","slug":"function-hijaking","status":"publish","type":"post","link":"https:\/\/netspider.com.ua\/index.php\/2012\/02\/25\/function-hijaking\/","title":{"rendered":"Function hijaking"},"content":{"rendered":"<p>\u041f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u2013 \u0430\u0440\u0445\u0438\u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u0448\u0442\u0443\u043a\u0430. \u0415\u0441\u043b\u0438 \u043d\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u043f\u044f\u0442\u0442\u0438\u043a\u043e\u043b\u0435\u0441\u043d\u044b\u0439 \u0432\u0435\u043b\u043e\u0441\u043e\u043f\u0435\u0434, \u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u044e (\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443) \u0437\u0430 \u0445\u0432\u043e\u0441\u0442 \u043c\u043e\u0436\u043d\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043c\u043e\u0434\u0443\u043b\u044f Baxtep (\u0441\u043f\u0430\u0441\u0438\u0431\u043e <a href=\"https:\/\/rogovsky.net\/\">\u0410\u043d\u0434\u0440\u0435\u044e<\/a>).<\/p>  <p><strong><a href=\"https:\/\/code.google.com\/p\/baxtep\/\">Baxtep<\/a><\/strong> \u2013 PHP security extension to intercept execution of system commands.<\/p>  <p>\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u044f\u0442\u0441\u044f \u043f\u0430\u0440\u0430 \u043f\u0440\u044f\u043c\u044b\u0445 \u0440\u0443\u043a \u0438 \u0442\u0430\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b:<\/p>  <pre class=\"brush: bash; auto-links: true; collapse: false; first-line: 1; gutter: true; html-script: false; light: false; ruler: false; smart-tabs: true; tab-size: 4; toolbar: true;\"># \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u043c \u0441 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\nsvn checkout https:\/\/baxtep.googlecode.com\/svn\/trunk\/ baxtep\n\n# \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\ncd baxtep\n\n# \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c:\nphpize\n# \u0435\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 PHP \u0432 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435, \u0443\u043a\u0430\u0436\u0438\u0442\u0435 \u043f\u043e\u043b\u043d\u044b\u0439 \u043f\u0443\u0442\u044c:\n# \/usr\/local\/php5-fcgi\/bin\/phpize\n.\/configure\nmake\n\n# \u0437\u0430\u043a\u0438\u043d\u044c\u0442\u0435 \u043c\u043e\u0434\u0443\u043b\u044c \u0432 \u043f\u0430\u043f\u043a\u0443 \u0441 \u043c\u043e\u0434\u0443\u043b\u044f\u043c\u0438:\ncp .libs\/baxtep.so \/usr\/local\/php5-fcgi\/lib\/php\/extensions\/no-debug-non-zts-20060613\/baxtep.so\n\n# \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0441 \u043c\u043e\u0434\u0443\u043b\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439\nphp -i | grep extension_\n# \u0438\u043b\u0438 \u043f\u043e \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043f\u0443\u0442\u0438:\n# \/usr\/local\/php53-fcgi\/bin\/php -i | grep extension_\n\n# php.ini \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0442\u043e\u0436\u0435 \u0447\u0435\u0440\u0435\u0437 php -i, \u0434\u043e\u0431\u0430\u0432\u044c\u0442\u0435 \u0442\u0443\u0434\u0430:\nbaxtep.logfile = &quot;\/tmp\/baxtep_messages&quot;\n# \u0438\u043b\u0438 \u0443\u043a\u0430\u0436\u0438\u0442\u0435 \u0434\u0440\u0443\u0433\u043e\u0439 \u043f\u0443\u0442\u044c, \u043a\u0443\u0434\u0430 \u0443\u0434\u043e\u0431\u043d\u0435\u0435. \u044f \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0441\u0442\u0440\u043e\u0447\u043a\u0443 \u043f\u0435\u0440\u0435\u0434\n# [Zend]<\/pre>\n\n<p>\u0412\u0441\u0435, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0439\u0442\u0435 Apache\/PHP, \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0434\u0433\u0440\u0443\u0437\u0438\u043b\u0441\u044f. \u0412\u0430\u0445\u0442\u0435\u0440 \u043f\u043e\u0441\u043b\u0443\u0448\u043d\u043e \u0437\u0430\u043f\u0438\u0448\u0435\u0442 \u0432 \u043b\u043e\u0433-\u0444\u0430\u0439\u043b \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440:<\/p>\n\n<pre class=\"brush: shell; auto-links: true; collapse: false; first-line: 1; gutter: true; html-script: false; light: false; ruler: false; smart-tabs: true; tab-size: 4; toolbar: true;\">2012-02-25 19:35:39 BAXTEP: proc_open CMDLINE: `php` FILE: \/path\/to\/file\/1.php on line 11 URI: \/1.php\n2012-02-25 19:35:39 BAXTEP: shell_exec CMDLINE: `date` FILE: - on line 1 URI: (null)<\/pre>\n\n<p>\u0421\u0440\u0435\u0434\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u044f proc_open, \u0447\u0442\u043e\u0431\u044b \u0435\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c, \u043d\u0443\u0436\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0432 \u0444\u0430\u0439\u043b baxtep.c \u0441\u0442\u0440\u043e\u0447\u043a\u0443:<\/p>\n\n<pre class=\"brush: cpp; auto-links: true; collapse: false; first-line: 1; gutter: true; html-script: false; light: false; ruler: false; smart-tabs: true; tab-size: 4; toolbar: true;\">php_baxtep_substitute_function(&quot;proc_open&quot; TSRMLS_CC);<\/pre>\n\n<p>\u0438 \u043f\u0435\u0440\u0435\u0441\u043e\u0431\u0440\u0430\u0442\u044c\/\u043f\u0435\u0440\u0435\u043f\u043e\u0434\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c.<\/p>\n\n<p>\u0421\u043f\u0438\u0441\u043e\u043a \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e, \u0435\u0441\u043b\u0438 \u0432 \u043d\u0438\u0445 \u043d\u0435\u0442 \u043e\u0441\u0442\u0440\u043e\u0439 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 (php.ini):<\/p>\n\n<pre class=\"brush: shell; auto-links: true; collapse: false; first-line: 1; gutter: true; html-script: false; light: false; ruler: false; smart-tabs: true; tab-size: 4; toolbar: true;\">disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec<\/pre>","protected":false},"excerpt":{"rendered":"\u041f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u2013 \u0430\u0440\u0445\u0438\u043f\u043e\u043b\u0435\u0437\u043d\u0430\u044f \u0448\u0442\u0443\u043a\u0430. \u0415\u0441\u043b\u0438 \u043d\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u043f\u044f\u0442\u0442\u0438\u043a\u043e\u043b\u0435\u0441\u043d\u044b\u0439 \u0432\u0435\u043b\u043e\u0441\u043e\u043f\u0435\u0434, \u043f\u043e\u0439\u043c\u0430\u0442\u044c \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u044e (\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443) \u0437\u0430 \u0445\u0432\u043e\u0441\u0442 \u043c\u043e\u0436\u043d\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043c\u043e\u0434\u0443\u043b\u044f Baxtep (\u0441\u043f\u0430\u0441\u0438\u0431\u043e \u0410\u043d\u0434\u0440\u0435\u044e). Baxtep \u2013 PHP security extension to intercept execution of system commands. \u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u044f \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u044f\u0442\u0441\u044f \u043f\u0430\u0440\u0430 \u043f\u0440\u044f\u043c\u044b\u0445 \u0440\u0443\u043a \u0438 \u0442\u0430\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b: # \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u043c \u0441 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f svn checkout https:\/\/baxtep.googlecode.com\/svn\/trunk\/ baxtep #\u2026 <span class=\"read-more\"><a href=\"https:\/\/netspider.com.ua\/index.php\/2012\/02\/25\/function-hijaking\/\">\u0427\u0438\u0442\u0430\u0442\u044c \u0434\u0430\u043b\u0435\u0435 &raquo;<\/a><\/span>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1570,665,1571,550,1572,1573,1574],"class_list":["post-1244","post","type-post","status-publish","format-standard","hentry","category-main","tag-baxtep","tag-php","tag-vaxter","tag-vzlom","tag-modul","tag-perexvat","tag-funkciya"],"_links":{"self":[{"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/posts\/1244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/comments?post=1244"}],"version-history":[{"count":0,"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/posts\/1244\/revisions"}],"wp:attachment":[{"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/media?parent=1244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/categories?post=1244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netspider.com.ua\/index.php\/wp-json\/wp\/v2\/tags?post=1244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}