Protecting 777 chmodded folders

DarkMindZ · Post by **DarkMindZ** » 23 Dec 2007, 06:12

As most of you already know, chmod 777 would give writing / executing rights for everyone `on *nix servers`, it is mostly used in upload scripts / galleries / logs..

Well, you can protect that folder, from being used as a lab for Mr Hacker..

Simple way of doing it is, using a .htaccess, and turning the PHP engine off on that folder and disallowing html / pl / php files.. here is how:

Create a new file, called .htaccess, in it:

php_flag engine off
<Files ~ "\.(php*|s?p?html|cgi|pl)$">
deny from all
</Files>

that's it, now the `hacker` cannot use this folder as a place for PHP shells / scripts or backdooring tools `mostly are perl scripts`...

n3rd · Post by **n3rd** » 23 Dec 2007, 09:36

U might want to add your own IP incase you are using a CMS. otherwise no 1 can write in em.

Post by **Big-E** » 23 Dec 2007, 10:33

Good informational post and if I have not done so thus far, welcome to the boards!

rhysh · Post by **rhysh** » 04 Jan 2008, 03:52

yes but wat will you add to allow files like index.php

Post by **bad_brain** » 04 Jan 2008, 07:55

good one...additionally setting the sticky bit for the directory permissions would also be good, the sticky bit allows only the owner of the files in the directory (or the root user) to rename/delete them.

http://en.wikipedia.org/wiki/Sticky_bit

rhysh · Post by **rhysh** » 04 Jan 2008, 08:26

but what canyou put in an .htaccess to make it so only files like
index.php and lol.php and a.html etc can be viewed

n3rd · Post by **n3rd** » 04 Jan 2008, 09:08

ht access is only to deny modification to those pages from a remote location.
it can still be viewed.

taken from wikipedia:

.htaccess files are often used to specify the security restrictions for the particular directory,

DarkMindZ · Post by **DarkMindZ** » 04 Jan 2008, 09:09

this htaccess

stops PHP in that dir, means the attacker cant use it as his shell-lab.

and it stops access from remote to html, perl,. and php files

what do you need more? ;s

rhysh · Post by **rhysh** » 04 Jan 2008, 09:14

wats say i want it in /http_docs/
that would be my main dir
but i have
index.php
and a shell is placed there called c99.php .pl .jav
i only want index.php to execute not c99.php or c99.pl etc
well?

DarkMindZ · Post by **DarkMindZ** » 04 Jan 2008, 09:16

well then you wil need to mod that for your needs.

this is made to fully protect the dir and all the contents.

so lookup some .htaccess usage.