PHP and remote execution

From: Strider (strider_at_chatcircuit.com)
Date: 05/11/03

  • Next message: Allan Schon: "RE: Non Disclosure Agreements" 
    Date: Sun, 11 May 2003 11:51:38 -0500 (Central Daylight Time)
To: <security-basics@securityfocus.com>

    After our latest fun with one of our boxes becoming a DoS source, we've
    spent much time tracking how it was compromised. It was all because of a
    forum called CyBoards. There exists a bug that is known to exists and has
    not been fix that allows execution of code on the hosting server. In this
    case, the attacker wanted to conceal is activity as much as possible so he
    made use of the exploit as little as possible by making it install a back
    door. Through the back door, he installed a DoS client and initiated 2 DoS
    attacks.
     
    We found the DoS client without a problem. It was in /tmp with the name of
    milk', which seems to be a lesser known packet fragmentation DoS attack
    program originating from Brasil. The two attacks were launched against
    Basilian sites, so this clued us in that it was a rather local attack.
     
    With 400+ site logs to navigate, it wasn't easy looking for something we
    didn't know to look for. We quickly figured out that it was in fact done via
    the web server due to the fact the attack binary was owned by the user and
    group as the httpd, and we also fairly quickly figured out the DoS attack
    was not launched via an interactive web script (php, cgi, etc). It was
    either a script specifically used for this purpose, or an installed backdoor

     
    It took hours of scouring, several cups of coffee, and several packs of
    cigarettes to find the initial attack. An exploit was done on an
    installation of CyBoards which instructed a hole to execute a script from
    another server in Brasil, which instructed our server to download, compile,
    and execute a shell backdoor. From there, the attacker logged into the shell
    backdoor and downloaded the milk binary to the server, already compiled.
     
    The measures we have taken to prevent this so far is to prevent php from
    executing remote scripts, and modifying the kernel with grsec for better
    access control. Does anyone know of any other measures we should take to
    prevent these things? Is there a way to move the tmp dir access to the user
    dirs?
     
    Beau (Strider) Steward
    strider@chatcircuit.com
    http://www.arteryplanet.net
    http://www.chatcircuit.com

    ---------------------------------------------------------------------------
    FastTrain has your solution for a great CISSP Boot Camp. The industry's most
    recognized corporate security certification track, provides a comprehensive
    prospectus based upon the core principle concepts of security. This ALL INCLUSIVE curriculum utilizes lectures, case studies and true hands-on utilization
    of pertinent security tools. For a limited time you can enter for a chance
    to win one of the latest technological innovations, the SEGWAY HT.
    Log onto http://www.securityfocus.com/FastTrain-security-basics
    ----------------------------------------------------------------------------

  • Next message: Allan Schon: "RE: Non Disclosure Agreements"

    Relevant Pages

    • Re: DOS Printing from Windows Server 2003 TS?
      ... STAT-NT03 is the TS server name. ... We will see if it works for the 5 remote users over the Internet. ... We have a customer who is still using and old DOS version of software ... could not find anything except a Kixstart script. ...
      (microsoft.public.windows.terminal_services)
    • Re: Help me identify this IIS DoS attack
      ... Sounds to me like one of your web sites is the target of a DoS. ... the attacker is using fake IP's while trying to make the attack. ... explained by the "random" IP's you seeing trying to attach to your server. ... > This list is provided by the SecurityFocus ARIS analyzer service. ...
      (Incidents)
    • Re: whats the best virus protection
      ... >> haven't they now been given the go ahead to lauch DOS attacks against ... > give the content industry the legal power to attack infringers (DoS'ing ... [quote from "Steal This File Sharing Book - What They Wont Tell You About ... Martin Spencer-Ford ...
      (alt.comp.anti-virus)
    • RE: DOS ATTACK
      ... Subject: DOS ATTACK ... server which I guess is your problem. ... block traffic based on referrer. ...
      (Incidents)
    • RE: PHP and remote execution
      ... not been fix that allows execution of code on the hosting server. ... he installed a DoS client and initiated 2 DoS ... so this clued us in that it was a rather local attack. ... prospectus based upon the core principle concepts of security. ...
      (Security-Basics)