Recently, hackers use fsockopen for PHPDDOS attacks after exploiting program vulnerability injection, leading to instability on some servers. Now, the dangerous function fsockopen is temporarily disabled. Some program functions may be faulty.
Recently, hackers use fsockopen for PHPDDOS attacks after exploiting program vulnerability injection, leading to instability on some servers. Now, the dangerous function fsockopen is temporarily disabled. Some program functions may be faulty.
I. Recently, hackers used fsockopen for PHPDDOS attacks after exploiting program vulnerability injection, leading to instability in some servers. Now, the dangerous function fsockopen is temporarily disabled, and some program functions may be faulty, the following lists known issues and common solutions:
General Solution:
Find the fsockopen function in the program and replace it with pfsockopen to solve all the problems. The difference between the two functions is that pfsockopen keeps keep-alive, which prevents hackers from launching connection attacks.
The path of the program file using the fsockopen function is known (add p before fsockopen, that is, change fsockopen to pfsockopen)
2. If fsockopen pfsockopen is disabled on the server, use other functions, such as stream_socket_client (). Note: The parameters of stream_socket_client () and fsockopen () are different.
Specific operations:
Search for the character string fsockopen in the Program (replace it with stream_socket_client (, and then delete the port parameter "80" in the original fsockopen function and add it to $ host.
Example:
Before modification:
$ Fp = fsockopen ($ host, 80, $ errno, $ errstr, 30 );
After modification:
$ Fp = stream_socket_client ($ host. "80", $ errno, $ errstr, 30 );
List of files in the mainstream PHP website in China involving the fsockopen function:
List of files in the mainstream PHP website in China involving the fsockopen function:
DEDECMS:
The Code is as follows:
Source \ function \ function_core.php has two fsockopen files and pfsockopen files.
Uc_client \ client. php has two fsockopen files and pfsockopen files.
Uc_client \ lib \ sendmail. inc. php
Uc_client \ model \ misc. php has two fsockopen files, and pfsockopen files.
Uc_server \ install \ func. inc. php contains two fsockopen files, and pfsockopen files.
Uc_server \ lib \ sendmail. inc. php
The uc_server \ model \ misc. php file contains two fsockopen files, and pfsockopen files.
Discuz! 2.5:
The Code is as follows:
Source \ function \ function_core.php has two fsockopen files and pfsockopen files.
Uc_client \ client. php has two fsockopen files and pfsockopen files.
Uc_client \ lib \ sendmail. inc. php
Uc_client \ model \ misc. php has two fsockopen files, and pfsockopen files.
Uc_server \ install \ func. inc. php contains two fsockopen files, and pfsockopen files.
Uc_server \ lib \ sendmail. inc. php
Uc_server \ model \ misc. php has two fsockopen files, and pfsockopen files.
Ecms (Empire ):
E \ class. smtp. php
ECSHOP:
The Code is as follows:
Admin \ index. php
Demo \ mongodes \ lib_updater.php
Includes \ cls_smtp.php
Schemdes \ cls_transport.php
Includes \ lib_base.php
Des \ modules \ payment \ paypal. php
Shopex:
The Code is as follows:
Core \ api \ include \ api_utility.php
Core \ api \ tools \ 1.0 \ api_ B2B _1_0_tools.php
Core \ func_ext.php
Core \ lib \ nusoap. php
Core \ lib \ uc_client \ client. php
Instal \ svinfo. php
Plugins \ passport. ucenter. php
Plugins \ payment \ pay. nochek. php
Plugins \ pay. paypal. php
Plugins \ pay. paypal. server. php
Plugins \ pay. paypal_cn.php