# Help! Nginx Vulnerable Remote file inclusion

**URL:** <https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489>\
**Category:** NGINX\
**Created:** [December 3, 2011, 5:48am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489 "2011-12-03T05:48:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [December 3, 2011, 5:48am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/1 "2011-12-03T05:48:45Z")

</div>

I really need help here ☹

my forum got hacked 3 times, and i detected the hacker use RFI(Remote  
file inclusion) after i found an avatar image contain Phpshell code  
inside it. and the weird thing is when i tried to use RFI on Apache it  
will not run the phpshell,

You can see here:

[http://www.ceriwis.org/rfi.php?hal=ass.jpg](http://www.ceriwis.org/rfi.php?hal=ass.jpg) \<------------ using  
NGINX and phpshell executed

and

[http://ceri.ws/rfi.php?hal=ass.jpg](http://ceri.ws/rfi.php?hal=ass.jpg) \<---------------- using  
Apace and phpshell unable to executed

im using Nginx 0.8.53 and php-fpm

I really need solution to solve my problem guys. i want to stop the  
image to get executed like Apache does…  
Please give me solution. thanks

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,219523,219523#msg-219523](http://forum.nginx.org/read.php?2,219523,219523#msg-219523)

---

<div class="post-metadata">

**Author:** ![escavern](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/5f9b8f/32.png) [@escavern](https://www.ruby-forum.com/u/escavern)\
**Post date:** [December 3, 2011, 5:49am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/2 "2011-12-03T05:49:59Z")

</div>

the image file is JPEG  
you can see the image file here:

[http://www.ceriwis.org/ass.jpg](http://www.ceriwis.org/ass.jpg)

[![](http://ceri.ws/ass.jpg) ](http://ceri.ws/ass.jpg)

Posted at Nginx Forum:

> **[Re: Help! Nginx Vulnerable Remote file inclusion](https://forum.nginx.org/read.php?2,219523,219524#msg-219524)**
>
> I really need help here :( my forum got hacked 3 times, and i detected the hacker use RFI(Remote file inclusion) after i found an avatar image contain Phpshell code inside it. and the weird thing is when i tried to use RFI on Apache it will not run...

---

<div class="post-metadata">

**Author:** ![escavern](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/5f9b8f/32.png) [@escavern](https://www.ruby-forum.com/u/escavern)\
**Post date:** [December 3, 2011, 6:12am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/3 "2011-12-03T06:12:09Z")

</div>

Check out this thread and see if it answers your question:

[http://mailman.nginx.org/pipermail/nginx/2011-November/030503.html](http://mailman.nginx.org/pipermail/nginx/2011-November/030503.html)

It’s not precisely the same, since you have rfi.php?hal=ass.jpg and not  
rfi.php/ass.jpg, but it feels like the same bug, and you’re only a  
rewrite rule away from having exactly the problem command line.

The short answer is to add this:

```
 try_files $uri =404;

```

or this:

```
if (!-f $request_filename) { return 404; }

```

to your PHP configuration in the PHP fastcgi configuration block.

Tim

---

<div class="post-metadata">

**Author:** ![escavern](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/5f9b8f/32.png) [@escavern](https://www.ruby-forum.com/u/escavern)\
**Post date:** [December 3, 2011, 6:47am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/4 "2011-12-03T06:47:59Z")

</div>

its not working man… i added the line you gave and i think you can  
still access it

Posted at Nginx Forum:

> **[Re: Help! Nginx Vulnerable Remote file inclusion](https://forum.nginx.org/read.php?2,219523,219526#msg-219526)**
>
> I really need help here :( my forum got hacked 3 times, and i detected the hacker use RFI(Remote file inclusion) after i found an avatar image contain Phpshell code inside it. and the weird thing is when i tried to use RFI on Apache it will not run...

---

<div class="post-metadata">

**Author:** ![escavern](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/5f9b8f/32.png) [@escavern](https://www.ruby-forum.com/u/escavern)\
**Post date:** [December 3, 2011, 7:36am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/5 "2011-12-03T07:36:45Z")

</div>

## This is my PHP configuration :

```
server {
    listen 80;
    server_name www.ceriwis.org;

```

#rewrite ^/(.\*) [http://ceriwis.us/$1](http://ceriwis.us/$1) permanent;  
client\_max\_body\_size 50M;

```
    #access_log logs/host.access.log main;

    location / {
        root /home/ceriorg/public_html;
       index index.php index.html;

```

location /crwscp {  
auth\_basic “Administrator Login”;  
auth\_basic\_user\_file /home/htpasswd.txt;  
}

location ~ .._/._.php {  
return 403;  
}

if ($http\_user\_agent ~\* “^._(sharp)._”) {  
return 403;  
}

```
    }

    error_page 404 /404.html;
    location = /404.html {
        root /usr/share/nginx/html;
    }

    # redirect server error pages to the static page /50x.html
    #
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    # pass the PHP scripts to FastCGI server listening on

```

127.0.0.1:9000  
#  
location ~ .php$ {  
root public\_html;  
include fastcgi\_params;  
fastcgi\_pass 127.0.0.1:9000;  
fastcgi\_index index.php;  
fastcgi\_param HTTPS on;  
fastcgi\_param SCRIPT\_FILENAME  
/home/ceriorg/public\_html$fastcgi\_script\_name;  
#fastcgi\_intercept\_errors on;

```
    }

}

```

---

<div class="post-metadata">

**Author:** ![escavern](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/5f9b8f/32.png) [@escavern](https://www.ruby-forum.com/u/escavern)\
**Post date:** [December 3, 2011, 10:44am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/6 "2011-12-03T10:44:27Z")

</div>

On Sat, 03 Dec 2011 01:36:10 -0500, “escavern” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

Try inserting the following to see if it helps:

> ```
> location ~ \.php$ {
> 
> ```

```
             try_files $uri =404;

```

> ```
> root public_html;
> include fastcgi_params;
> fastcgi_pass 127.0.0.1:9000;
> fastcgi_index index.php;
> fastcgi_param HTTPS on;
> fastcgi_param SCRIPT_FILENAME
> 
> ```
> 
> /home/ceriorg/public\_html$fastcgi\_script\_name;  
> #fastcgi\_intercept\_errors on;

M.

---

<div class="post-metadata">

**Author:** ![escavern](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/5f9b8f/32.png) [@escavern](https://www.ruby-forum.com/u/escavern)\
**Post date:** [December 3, 2011, 6:51am UTC](https://www.ruby-forum.com/t/help-nginx-vulnerable-remote-file-inclusion/214489/7 "2011-12-03T06:51:05Z")

</div>

On 12/2/2011 10:47 PM, escavern wrote:

> its not working man.. i added the line you gave and i think you can  
> still access it

Don’t know, then, sorry. Maybe post your log and the php configuration  
that you’re using? Someone else will likely need to help from this  
point. My post was a shot in the dark because your issue looked so much  
like the php fastcgi issue that I linked to.

Tim