Use shell scripts to enhance file upload security

Tap water brewed coffee

During Security Detection two days ago, a Java servlet with a file upload function in an application system can be scanned to upload any file. It is easy to place scripts and Trojans. Although it cannot be executed directly, however, as long as you find other security vulnerabilities that can be exploited, it is still possible to remotely execute the uploaded code.

Although you just need to add the code of the dot detection file type, you don't know that the code was written by the Fairy. It may be laborious to change the code.

In addition to code modification, there are two solutions, one is to install anti-virus software monitoring, and the other is to write a script to monitor the uploaded directory in real time, if an executable file or shell script is found, it is automatically deleted, and the client can upload the file in white.

I was not doing anything in the past two days. I wrote a Shell script in the last three days, so I got a temporary one:

Notify. sh (inotify-tools must be installed before running on Kernel 2.6)

-------
#! /Bin/sh
Inotifywait-mrq-e create/webroot/upload/| while read A B C
Do
Fileinfo = $ A $ C
Filetype = 'file-z $ fileinfo | grep-f/home/testuser/filterfile | wc-l'
If test $ filetype-gt 0
Then
Mv $ {fileinfo}/home/testuser/upload-bak/
Echo "Invalid File Format !" >$ {Fileinfo}
Echo $ fileinfo $ (date) >>/ home/testuser/filecheck. log
Fi
Done
-----

Filterfile content
-----
Script
Extended-ASCII
PE32
Executable
ELF

After a try, it seems that the uploaded files are all in the Format of "Invalid File Format !", Normally uploaded attachments are not affected.

Let's get it done. Let's get it done first and notify the people who used to develop this stuff to modify the program. It's King to clean your ass.