Comments on: PHP Worms: Santy / Perl.PhpInclude – ModSecurity

By: nathanj

nathanj — Tue, 30 Nov 1999 00:00:00 +0000

Thanks for the heads up. I notice this script on a exploit site today. :S

By: evolve

evolve — Tue, 30 Nov 1999 00:00:00 +0000

ModSecurity is really key for webhosts who use apache to have.

Google also helped the spread of the Santy worm by preventing its search engine for being used to find websites to attack. They blacklisted a number of keywords which the worm was using to find targets.

By: trigger

trigger — Tue, 30 Nov 1999 00:00:00 +0000

so,its only a phpBB thing? just wondering what the exploit is, or if there’s a function in specific they are using. got +10K visitors over X-Mas Weekend, which is a little unusual, but my site isn’t defaced (yet).

By: HarryF

HarryF — Tue, 30 Nov 1999 00:00:00 +0000

so,its only a phpBB thing?

The phpBB vuln seems to have been related to highlighted words passed from searches(?). I presume this diff was the fix.

The include worm is different though and not specifically targetting any application. The version here looks to pull a list of pages with '.php' in the URL from Google and Yahoo modify the GET query string and replace what would become PHP variables with a link to a remote site (which I guess was hacked in advance). One such site I saw in a log seems to have been taken down on the 25th, thereby "neutralizing" worms using it.

Bottom line is if you have code like;


// Validate first!!!
include $_GET['page'];

You could be in for trouble (depending on PHP configuration).

This blog suggests that, this time round, there's no need for panic. At the same time, this is the first serious attempt of this kind. There's room to be "smarter" as well as target other oft-installed PHP-apps. Expect we're going to see more of it.

MOTD: Validate all incoming data. Anything you get from the browser cannot be trusted.

By: subnet_rx

subnet_rx — Tue, 30 Nov 1999 00:00:00 +0000

why would webhosts not install modsecurity? Overhead?

By: HarryF

HarryF — Tue, 30 Nov 1999 00:00:00 +0000

why would webhosts not install modsecurity? Overhead?

Think the main thing is ModSecurity is still fairly new - think the awareness isn't quite there yet. Overhead could be an issue although reading the ModSecurity docs suggests it shouldn't. It probably (Ivan can no doubt answer that) needs a larger user base before it's possible to consider performance in detail.

By: Richard Thomas

Richard Thomas — Tue, 30 Nov 1999 00:00:00 +0000

Someone is limiting/spamming that channel to prevent it from getting a lot of connections while they try to get the channel killed. Thats the only reason the worm isn't spreading like wildfire

At least this is what I saw in one of the reports somewhere

By: Website Rob

Website Rob — Tue, 30 Nov 1999 00:00:00 +0000

Actually, phpBB had a similar type exploit a few years ago -- v2.04 or thereabouts. That's when, as a Server Admin, I started paying more attention to the security within PHP itself.

By having the following in a Server php.ini file:

disable_functions = shell_exec,system,proc_open

all PHP scripts have very good security.

Everytime I see this error showing in the Server Error logs:

PHP Warning: system() has been disabled for security reasons

it gives me a warm feeling knowing Clients scripts are safe and no defacement has been done, regardless of any security weaknesses within an individual script.

Tis only one part of an over-all security strategy for any Server though, and as mod_security becomes more popular, is an excellent security addition.

By: Stephen

Stephen — Tue, 30 Nov 1999 00:00:00 +0000

Well our server has been compromised in the last week or so. On Friday they managed to use it to send a whole load of spam emails and that gave the game away as server usage rocketted. We have been noticing very high traffic since 9th Jan anyway.
Doing some digging now reveals that it got compromised via the include hack into phpBBs viewtopic.php script. I am just decoding the system calls to see what happened.
I think the mistake is to assume that the vulnerability is with the urldecode() function. That is simply the phpBB guys fix. i.e. to remove it - as far as I can see. No. The real problem lies with the preg_replace(#....#e,,) call that uses what gets passed by that variable in the viewtopic.php url. The 'e' option on preg_replace causes the second parameter to act like a function on the first. So they simply include a system call in there with the execution vars encoded as chr()s.
So the rule seems to be for php coders nothing to do with urlencode, etc. but don't use preg_replace with the 'e' option unless you check what it is you are executing!

Now back to our server. What really troubles me is that not only did they gain access to /var/ where they can upload files and execute as user apache, but they also managed to get root access. This is the bit I can't work out. Do I take it that they managed to run one of the latest known compromises for "root as local user" scripts? I see there is one for SMP kernels on Linux. We were using Mandrake 9.2 with SMP and looking at other sites it seems that there is just such a script for our kernel.
Has anyone else had this? Apart from that no pages defaced etc. But we will need to reinstall the server, change all passwords now, etc. which is a real pain.

By: Gavin C

Gavin C — Tue, 30 Nov 1999 00:00:00 +0000

It stumped me for a while too. It's just a short script running as the apache user, no real exploit.
it tricks phpbb into running something like this:
exec (wget some perl script; perl /var/the script)

It does a trick where it disguises itself to look like an httpd process in the list. this makes it look like it has root and started a server. It uses wget to download some scripts into var which it is allowed to do running as apache. then it runs the script with perl. The quick way top stop it is to rename wget. then upgrade phpbb.