Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

RULE（RULE ID：336860）

Rule General Information


Release Date:		2022-07-28

Rule Name:		Sensitive File /etc/passwd Access Detection

Severity:

CVE ID:

Rule Protection Details


Description:		By acquiring key sensitive information, an attacker can further harm the target of infiltration. Under Linux, etcpasswd is a file that records the basic attributes of each user, which can be modified by the system administrator to manage the user. This rule is used to detect suspicious behavior that attempts to obtain /etc/passwd information.

Impact:		By obtaining sensitive files or directories, an attacker can obtain critical system information and cause other harm to the target.

Affected OS:		Windows, Linux, Others

Reference:

Solutions

1. Ensure that file system permissions on the Web server and applications are properly set to limit access to sensitive files and directories. 2. Check the access records of the system for unauthorized access. 3. Ensure that systems and applications are updated to the latest version and fix known vulnerabilities to minimize system impact.