I think my PERL script allowed my website to get HACKED!

[nvautier]

I wrote my first PERL script recently, so that my parked domains would show different content.

Today someone had managed to add links and a virus to the various files the PERL script opened.

My index.cgi has permissions 755 and looks sort of like this...

#!/usr/bin/perl
##########################################################################

$name = $ENV{'HTTP_HOST'};
$browser = $ENV{'HTTP_USER_AGENT'};
$match = "no";

if ($name =~ m/ www.parked-domain-1.com /i)
{
open (FILE, 'parked-domain-1.htm');
@database = <FILE>;
close (FILE);

print "Content-type: text/html\n\n";

foreach $line (@database)
{
print $line;
print "\n";
}
}

if ($name =~ m/ www.parked-domain-2.com /i)
{
open (FILE, 'parked-domain-2.htm');
@database = <FILE>;
close (FILE);

print "Content-type: text/html\n\n";

foreach $line (@database)
{
print $line;
print "\n";
}
}

if ($name =~ m/ www.parked-domain-3.com /i)
{
open (FILE, 'parked-domain-3.htm');
@database = <FILE>;
close (FILE);

print "Content-type: text/html\n\n";

foreach $line (@database)
{
print $line;
print "\n";
}
}

if ($name =~ m/www.parked-domain-4.com/i)
{
open (FILE, 'parked-domain-4.htm');
@database = <FILE>;
close (FILE);

print "Content-type: text/html\n\n";

foreach $line (@database)
{
print $line;
print "\n";
}
}

any help truly appreciated.

[perl_diver]

that script is not writing to any files so I am not sure if it's the problem. Could be you are on a shared server and someone used something like cgitelnet to overwrite the pages. But there is still a chance the script could be used for something malicious that I am not aware of. At least change your file open functions to read only:

open (FILE, '<parked-domain-1.htm');

[rainborick]

From what I see on other bulletin boards, the most common gateway for hackers these days is forum and BLOG scripts. If your site uses either of those services, then you need to be sure that you're running the latest versions and that the folder and file permissions on your site are set to the highest level compatible with your ongoing needs.

[perl_diver]

You may want to switch to a more secure version of your script too:

#!/usr/bin/perl -T
##########################################################################

use CGI qw/:standard -no_xhtml/;
$CGI::POST_MAX = 0; #no form field data will be accepted;
$CGI::DISABLE_UPLOADS = 1; # no file uploads accepted

my $name = $ENV{'HTTP_HOST'};
#my $browser = $ENV{'HTTP_USER_AGENT'};
#my $match = "no";

my %hosts = (
'www.parked-domain-1.com' => 'parked-domain-1.htm',
'www.parked-domain-2.com' => 'parked-domain-2.htm',
'www.parked-domain-3.com' => 'parked-domain-3.htm',
'www.parked-domain-4.com' => 'parked-domain-4.htm',
);
print header;
if ($name and $name =~ m/^([\w.-]+)$/) {
open (FILE, "<$hosts{$1}") or error();
print while (<FILE>);
close (FILE);
}
else {error()};

sub error {
print start_html;
print "Some error meesage or whatever you want";
print end_html;
}
exit(0);

remove the -no_xhtml switch if you want xhtml otherwise the CGI module will use doctype HTML 4.01 Transitional instead of XHTML 1.0 Transitional.

[nvautier]

Works well! Even though I can't comprehend everything going on, I do love the fact that it is elegantly compact. Thanks!

[Agzl]

ahhhhhh,the old perl hack.The same thing happened to bell south in 1999 when their site got hacked by people manipulating perl.Be warned use perl wisely