[Ayuda] modsecurity problemas en la instalacion

[arthusu]

Hola usuarios del foro el hacker he estado intentando instalar modsecurity en windows solo que no lo he logrado no se en que estoy mal

he descargado el archivo desde http://www.apachelounge.com/download/

y luego sigo los pasos que son los siguientes:

17 April 2014                               Apache Lounge Distribution

                   mod_security-2.8.0 build with libxml2-2.9.1 lua-5.1.5 pcre-8.34 yajl-2.1.0 for Apache 2.4.x Win32 VC10

# Original source by: Ivan Ristic <ivanr@webkreator.com>
# Original Home: http://www.modsecurity.org/
# Win32 binary by: Steffen
# Mail: info@apachelounge.com
# Home: http://www.apachelounge.com/


Build with Visual Studio® 2010 SP1 (VC10) x86
---------------------------------------------

Be sure you have installed the Visual C++ 2010 SP1 Redistributable Package x86,
download and install, if you not have it already, from:

 http://www.microsoft.com/download/en/details.aspx?id=8328


# Notes:

- PCRE and libxml2 are since 2.4 included in the Apache build (bin)

- Lua is build inline.


# Install:

- Copy mod_security2.so to your apache modules folder

- Copy yajl.dll to your apache bin folder

# Add to your httpd.conf:

- LoadModule security2_module modules/mod_security2.so

- Enable the module unique_id by uncommenting:

 LoadModule unique_id_module modules/mod_unique_id.so


# Configuration: see the included documentation

# Rules at: http://www.modsecurity.org/

# A very quick start:

SecRuleEngine On
SecDefaultAction "deny,phase:2,status:403"

## -- rule --


SecRule ARGS "\.\./" "t:normalizePathWin,id:50904,severity:4,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,msg:'Drive Access'"


Call your site with:

http://www.xxxx.com/?abc=../../

You should get a access denied and is logged in the Apache error.log, it is triggered by the above rule

Enjoy,

Steffen

Estoy usando XAMPP, ahora me dirigo a apache/modules y copio el archivo mod_security2.so que viene en el archivo winrar, luego me voi a la carpeta apache/bin y ahi copio el archivo yajl.dll que viene en el winrar.

Abro el archivo httpd.conf que se encuentra en apache/conf/ y le pego esta linea donde se encuentran las demas:
LoadModule security2_module modules/mod_security2.so

descomento esta linea:

LoadModule unique_id_module modules/mod_unique_id.so

y tambien activo otros modulos  (descomentandolos) como son:

LoadModule xml2enc_module modules/mod_xml2enc.so
LoadModule lua_module modules/mod_lua.so

Ahora lo siguiente que hago es irme a donde estan los archivos de configuracion de apache que es apache/conf ahi creo un archivo llamado modsecurity.conf con el siguiente contenido:

# Configuration: see the included documentation

# Rules at: http://www.modsecurity.org/

# A very quick start:

SecRuleEngine On
SecDefaultAction "deny,phase:2,status:403"

## -- rule --


SecRule ARGS "\.\./" "t:normalizePathWin,id:50904,severity:4,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,msg:'Drive Access'"

y en el httpd.conf lo llamo asi:

<IfModule mod_security.c>
Include conf/modsecurity.conf
</IfModule>

y no funciona

al ponerle ../../ en alguna variable de algun php no me da forbidden ni en error.log

ahora pues le quito el condicional IF y me manda el siguiente error:

12:57:05 a.m.  [Apache]    Error: Apache shutdown unexpectedly.
12:57:05 a.m.  [Apache]    This may be due to a blocked port, missing dependencies,
12:57:05 a.m.  [Apache]    improper privileges, a crash, or a shutdown by another method.
12:57:05 a.m.  [Apache]    Press the Logs button to view error logs and check
12:57:05 a.m.  [Apache]    the Windows Event Viewer for more clues
12:57:05 a.m.  [Apache]    If you need more help, copy and post this
12:57:05 a.m.  [Apache]    entire log window on the forums

Se me olvidaba en error.log tengo lo siguiente:

[Sat May 31 00:45:30.441800 2014] [:notice] [pid 6600:tid 440] ModSecurity for Apache/2.8.0 (http://www.modsecurity.org/) configured.
[Sat May 31 00:45:30.441800 2014] [:notice] [pid 6600:tid 440] ModSecurity: APR compiled version="1.5.0"; loaded version="1.5.0"
[Sat May 31 00:45:30.441800 2014] [:notice] [pid 6600:tid 440] ModSecurity: PCRE compiled version="8.34 "; loaded version="8.33 2013-05-28"
[Sat May 31 00:45:30.441800 2014] [:warn] [pid 6600:tid 440] ModSecurity: Loaded PCRE do not match with compiled!
[Sat May 31 00:45:30.441800 2014] [:notice] [pid 6600:tid 440] ModSecurity: LUA compiled version="Lua 5.1"
[Sat May 31 00:45:30.441800 2014] [:notice] [pid 6600:tid 440] ModSecurity: LIBXML compiled version="2.9.1"
[Sat May 31 00:45:30.581800 2014] [core:warn] [pid 6600:tid 440] AH00098: pid file C:/xampp/apache/logs/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Sat May 31 00:45:31.660800 2014] [ssl:warn] [pid 6600:tid 440] AH01909: RSA certificate configured for www.example.com:443 does NOT include an ID which matches the server name
[Sat May 31 00:45:31.728800 2014] [mpm_winnt:notice] [pid 6600:tid 440] AH00455: Apache/2.4.7 (Win32) OpenSSL/1.0.1e PHP/5.5.9 configured -- resuming normal operations
[Sat May 31 00:45:31.728800 2014] [mpm_winnt:notice] [pid 6600:tid 440] AH00456: Apache Lounge VC11 Server built: Nov 21 2013 20:13:01
[Sat May 31 00:45:31.728800 2014] [core:notice] [pid 6600:tid 440] AH00094: Command line: 'c:\\xampp\\apache\\bin\\httpd.exe -d C:/xampp/apache'
[Sat May 31 00:45:31.735800 2014] [mpm_winnt:notice] [pid 6600:tid 440] AH00418: Parent: Created child process 6584
[Sat May 31 00:45:33.447800 2014] [ssl:warn] [pid 6584:tid 452] AH01909: RSA certificate configured for www.example.com:443 does NOT include an ID which matches the server name
[Sat May 31 00:45:33.449800 2014] [:notice] [pid 6584:tid 452] ModSecurity for Apache/2.8.0 (http://www.modsecurity.org/) configured.
[Sat May 31 00:45:33.449800 2014] [:notice] [pid 6584:tid 452] ModSecurity: APR compiled version="1.5.0"; loaded version="1.5.0"
[Sat May 31 00:45:33.449800 2014] [:notice] [pid 6584:tid 452] ModSecurity: PCRE compiled version="8.34 "; loaded version="8.33 2013-05-28"
[Sat May 31 00:45:33.449800 2014] [:warn] [pid 6584:tid 452] ModSecurity: Loaded PCRE do not match with compiled!
[Sat May 31 00:45:33.449800 2014] [:notice] [pid 6584:tid 452] ModSecurity: LUA compiled version="Lua 5.1"
[Sat May 31 00:45:33.449800 2014] [:notice] [pid 6584:tid 452] ModSecurity: LIBXML compiled version="2.9.1"
[Sat May 31 00:45:34.699800 2014] [ssl:warn] [pid 6584:tid 452] AH01909: RSA certificate configured for www.example.com:443 does NOT include an ID which matches the server name
[Sat May 31 00:45:34.787800 2014] [mpm_winnt:notice] [pid 6584:tid 452] AH00354: Child: Starting 150 worker threads.

No se en que me estare equivocando si alguien me pudiese echar una mano se lo agradeceria, cabe comentar que el archivo que baje es el siguiente: http://www.apachelounge.com/download/win32/modules-2.4/mod_security-2.8.0-win32.zip

Espero su ayuda y gracias de antemano  

[el-brujo]

la configuración y los pasos dados parecen correcto.s

No conozco apachelounge, pero en el error.log hay un error que podría darte problemas:

[Sat May 31 00:45:30.441800 2014] [:notice] [pid 6600:tid 440] ModSecurity: PCRE compiled version="8.34 "; loaded version="8.33 2013-05-28"
[Sat May 31 00:45:30.441800 2014] [:warn] [pid 6600:tid 440] ModSecurity: Loaded PCRE do not match with compiled!

El módculo PCRE es necesario para el mod_security y si hay version mismatched puede que ni se active.

Para ver los módulos cargados en Apache es muy fácil en linux, en Windows ni idea pero debe ser muy parecido.

Mira si los módulos están cargados.

Otra muy buena manera es mirar el phpinfo los módulos cargados:

https://php.net/manual/es/function.phpinfo.php

Código [Seleccionar] Expandir

<?php
print_r(apache_get_modules());
?>