Defense from PHPDDOS source code

 

Author: tenzy [ESST]

Information Source: Alibaba Cloud Security Team http://bbs.x-xox-x.com/

The complete reference source code for PHPDDOS can be searched on the Internet.

Let's take a look at the principle.

It's actually very simple,

It is to set a text that does not time out, and then continuously establish TCP connections. Of course, there are also UDP/SYN methods, but the connection method is not important,

The key code above is

 

Set_time_limit (0); and $ fp = fsockopen ("tcp: // $ ipb", $ portb, $ errno, $ errstr, 0 );

 

The reason is that this is the key code, because it makes the script do not time out. One is to open the socket, which is undoubtedly the most critical.

The solution seems to have been found.

1. Timeout for the script,

2. Cannot open socket

 

Let's take a look at how to solve it,

It is easy to set the script not to allow timeout. 1. Disable the set_time_limit function. 2. enable the safe mode of PHP (safe_mode = on)

Disabling the socket function can directly disable all socket modules or disable the fsockopen function,

 

We recommend that you enable the Security Mode directly because the socket is often used to retrieve the password for sending emails.

In this case, the script times out every 30 seconds. It is estimated that no hacker is lonely and starts DDOS attacks every 30 seconds...

Attached is the impact of enabling the Security Mode on the program...

 

Function Name restrictions

Dbmopen () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Dbase_open () check whether the operated file or directory has the same UID (owner) as the script being executed ).

Filepro () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Filepro_rowcount () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Filepro_retrieve () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Ifx _ * SQL _safe_mode limit (! = Safe mode)

Ingres _ * SQL _safe_mode limit (! = Safe mode)

Mysql _ * SQL _safe_mode limit (! = Safe mode)

Pg_loimport () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Posix_mkfifo () check whether the operated directory has the same UID (owner) as the script being executed ).

Putenv () follows the safe_mode_protected_env_vars and safe_mode_allowed_env_vars options set by ini. See the putenv () function documentation.

Move_uploaded_file () check whether the operated file or directory has the same UID (owner) as the script being executed ).

Chdir () check whether the operated directory has the same UID (owner) as the script being executed ).

Dl () this function is disabled in safe mode.

Backtick operator this function is disabled in safe mode.

Shell_exec () (same function as the backticks function) this function is disabled in safe mode.

Exec () can only be executed in the directory set by safe_mode_exec_dir. For some reason, it cannot be used in the path of the executable object... Escapeshellcmd () will be applied to the parameters of this function.

System () can only be executed in the directory set by safe_mode_exec_dir. For some reason, it cannot be used in the path of the executable object... Escapeshellcmd () will be applied to the parameters of this function.

Passthru () can only be executed in the directory set by safe_mode_exec_dir. For some reason, it cannot be used in the path of the executable object... Escapeshellcmd () will be applied to the parameters of this function.

Popen () can only be executed in the directory set by safe_mode_exec_dir. For some reason, it cannot be used in the path of the executable object... Escapeshellcmd () will be applied to the parameters of this function.

Fopen () checks whether the operated directory has the same UID (owner) as the script being executed ).

Mkdir () check whether the operated directory has the same UID (owner) as the script being executed ).

Rmdir () check whether the operated directory has the same UID (owner) as the script being executed ).

Rename () checks whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ).

Unlink () checks whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ).

Copy () check whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ). (On source and target)

Chgrp () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Chown () checks whether the operated file or directory has the same UID (owner) as the script being executed ).

Chmod () checks whether the operated file or directory has the same UID (owner) as the script being executed ). In addition, SUID, SGID, and sticky bits cannot be set.

Touch () checks whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ).

Symlink () checks whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ). (Note: Only test target)

Link () checks whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ). (Note: Only test target)

Apache_request_headers () in safe mode, headers starting with "authorization" (case sensitive) are not returned.

Header () in safe mode, if WWW-Authenticate is set, the uid of the current script will be added to the realm part of the header.

In safe mode, PHP_AUTH_USER, PHP_AUTH_PW, and PHP_AUTH_TYPE are not available in $ _ SERVER. However, you can still use REMOTE_USER to obtain the USER name ). (Note: it is valid only after PHP 4.3.0)

Highlight_file (), show_source () check whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ). (Note: it is only valid after version 4.2.1)

Parse_ini_file () check whether the operated file or directory has the same UID (owner) as the script being executed ). Check whether the operated directory has the same UID (owner) as the script being executed ). (Note: it is only valid after version 4.2.1)

Set_time_limit () does not work in safe mode.

Max_execution_time does not work in safe mode.

In secure mode, the fifth parameter is blocked. (Note: only affected since PHP 4.2.3)