7 ms·
ShellShock exploited in the wild: kernel exploit with CnC component
- lazyant 12y agoI had this stupid idea long ago of using "security by obscurity" and rename some commands that are typically used manually and are favorite ones of exploits like this, for ex: curl, wget, gcc -> rename to le_curl, le_wget, le_gcc etc, just for my use. Maybe it wasn't such a stupid idea.
- jewel 12y agoOn a hardened system you remove all unnecessary binaries completely. See, for example, PCI DSS section 2.2.5. https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pd...
- lazyant 12y agoyes, but those commands (wget, curl, gcc and a few others) are unnecessary usually but sometimes needed once in a while, ideally you could uninstall them and then install on demand.
- aortega 12y agoYour idea won't work and also would prevent most scripts in your system to work correctly. I wrote unix exploits for a living for years (All legit, in a pentest company) and for payloads I would normally use echo or printf to upload a binary and execute it. And those are built-in commands in the shell.
- lazyant 12y agoI know, still most of the script kiddy attacks I see (on a honeypot ssh for ex) are of the 'wget download bad script' type. I typically uninstall gcc and my scripts don't use wget/curl/scp, now rsync otoh... can't blacklist all possible tools, you may as well netfilter traffic to block non-root initiated traffic going out.
- pritambaral 12y agoWhich kernel exploit are they using? One of the old ones or is it a zero day? This information is, frankly, more interesting than the fact that ShellShock is being exploited in the wild. Really, it was only a matter of time.
- verroq 12y ago>is it a zero day? The most obvious answer is no.
- SchizoDuckie 12y agoI imagine that there would be little need for a 0day. Also, if your setup allows you to be exploited via HTTP, chances are high that you're running old stuff anyway. Somone is going to make a fortune mining bitcoin in the coming weeks.
- patio11 12y agoYou could bot up every server at AmaGooBookSoft and still not make an appreciable amount of money mining Bitcoin, though I suppose that is not true if you go to one of the scrypt altcoins. CPU mining is very uncompetitive. A CPU miner is upper bounded at about 100 mega-hash per second (100 * 10^6 hashes) and more typically closer to 5 * 10^6. 100 megahash per second is worth approximately two cents per month. My off-the-cuff estimate for AmaGooBookSoft is 300k servers, which gets you about $6k a month or $200 a day if you rooted all of them and they were the most effective CPUs ever reported for mining Bitcoin. The far more likely way for this bug resulting in someone exfiltrating lots of bitcoins is them hitting every Bitcoin exchange looking for e.g. cPanel on a development box, Wordpress hosted on Nginx with fastcgi, etc etc. If they find one, they've got the hot wallet inside of five minutes later if it is on the same box, a bit more if it is somewhere else on the local network. (I've got to admit, the first thing I did after patching my boxes, to relax about the stress, was grepping Bitcoin Core for system calls. No obvious ones that I could see, for what it is worth.) If I can emphasize again, though: just because you don't engage in risky behaviors like e.g. transacting in bitcoins, doesn't mean your boxes are safe. Every. Server. On. The. Internet. Will be probed for a variety of exploits enabled by this vulnerability. There will be dozens of independently administered for loops probing for it within 24 hours.
- Maro 12y agoWhat does CnC mean here? (Google doesn't tell me.)
- martinml 12y ago"Command and control", I guess? http://en.wikipedia.org/wiki/Botnet#Organization http://en.wikipedia.org/wiki/Botnet#Organization
- mukyu 12y agoCommand and Control
- patio11 12y agoCommand and control. One frequent thing that black hats do is have all the boxes they root subscribe to e.g. an IRC channel, so that they can receive further commands. The ratware ("software written with nefarious purposes in mind") often comes pre-configured with options for blasting spam, hosting content on HTTP (for SEO or exploitative purposes), doing DOSes, and executing arbitrary commands against the local system. One can, of course, envision numerous ways to get data in and out without it being an IRC channel, but that is easy to implement, works across a wide variety of target environments, and plays well with the existing ratware ecosystem.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- sagischwarz 12y agoCould someone explain to me if what I think this gist shows is correct? A get request is sent to the server with additional commands added to the content, which creates the file ./tmp/besh whose content comes from the ngix file from http://162.253.66.76/nginx http://162.253.66.76/nginx. The executable flag is set and then the file gets executed. The next three commands show information about the downloaded nginx file (check sums, file command info). For what reason? Is the file really an nginx server or is it just named like this to show that nginx is exploitable? I know that this is basically about the bash exploit, right? Thanks
- pritambaral 12y agoThe file is only named nginx. The file has been downloaded from an untrested server, 162.253.66.76, so it could be anything really. The title/description of the gist claims it is a kernel exploit with CnC (Command and Control) capabilities. So yeah, the file is only named nginx; it doesn't have anything to do with the popular web server software of the same name. Probably named that way to avoid suspicion
- sagischwarz 12y agoI see. Thank you!
- CyberShadow 12y ago> Probably named that way to avoid suspicion Correct, it is usually done to conceal the process in process listings (top / ps aux).
- sagischwarz 12y agoThank you for the clarification!
- freakonom 12y agoYou know what would be super clever? Discovering a case where wget shells out to bash while setting some env vars based on received headers. And then anonymously posting a supposed shellshock payload just begging to be downloaded with wget.
- antocv 12y ago> wget shells out to bash Why oh why would this ever happen? This hole bug is way overblown. Not every small program on the planet "shells out to bash", and if they do, thats one seriously messed up program.
- FooBarWidget 12y agoWhy would it be messed up if it's true? The Unix philosophy is to compose complex functionality using lots of small tools. Shelling out to existing tools instead of reinventing your own makes total sense.
- spacemanmatt 12y agoGenerally, that is true for small feats of system automation, but secure applications need to be isolated from the system layer.
- FooBarWidget 12y agoBut wget is not specialized security software.
- hadoukenio 12y agoI don't think it's overblown. If you run a web server that generates its own CAPTCHA using something like ImageMagick, or call system() to gzip something, you could possibly be vulnerable. Never underestimate vulnerabilities and the way people can use them, or even combine them, to exploit systems.
- 12y ago
- crypt1d 12y agoInteresting. I ran the "nginx" binary thru strace in a vagrant vm and got some connection attempts to a clouldflare IP connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("108.162.197.26")}, 16) = 0 but didn't see anything interesting being sent there... My tcpdump output showed it connects to a http server at 89.238.150.154:5 and exchanges some data there sent >>> BUILD X86 recv >>> !* HTTP recv >>> 190.93.240.15,190.93.241.15,141.101.112.16,190.93.243.15,190.93.242.15 pastebin.com /4HQ2w4AZ 80 2 recv >>> PING sent >>> PONG then it just goes to do ping/pong with the same server. At one point the process forks a separate process of itself and dies... The pastebin link leads to an uploadcash.org file named hermoine_granger_jpg.jpg which I can assume is a payload of somekind...
- samcrawford 12y agoInteresting that they're presumably hiding behind Cloudflare, does it send a HTTP Host header? FWIW, it doesn't appear to be a new bit of malware - the same strings match this pastebin from March - http://pastebin.com/xa87Gh7q http://pastebin.com/xa87Gh7q
- crypt1d 12y agoYes the syntax looks familiar, I got few more responses that match the commands from that pastebin. Seems like a general C&C setup where they just add new exploits as they get published. Anyhow, doesn't seem like it sends anything to Cloudflare. I think it just checks if the IP is alive (perhaps this is how it tests connectivity to the internet). It also checks my routing table and extracts the MAC address. P.S as of now, the CC server at 89.238.150.154:5 is not accessible.
- Svip 12y agoI am a bit confused. Why would a webserver start bash?
- nikital 12y agoOne example: If a server script calls system(), it actually pops up a shell to execute the command.
- antocv 12y agoWhich has not been standard security practice for last 20 years - Do Not Use System or Execve or any other stuff from your php/web-scripts. Not. Ever. This bug only affects people who dont care about security.
- hadoukenio 12y agoSerious question - how do you run utility programs to do things without system()?
- mborch 12y agoRun the program without starting a shell?
- hadoukenio 12y agoThis is exactly what system() does.
- antocv 12y agoWhere is the kernel exploit in this? Whats so kernel about some script which probably just replaces nginx with a malwared one?
- passfree 12y agoIn case you want to test for ShellSheck https://suite.websecurify.com/market/shellshock https://suite.websecurify.com/market/shellshock
- drtse4 12y agoOr just run from terminal: env x='() { :;}; echo vulnerable' bash -c "echo this is a test" This should be displayed: bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test
- passfree 12y agoThis test is for public sites. The vulnerability effects web apps too in a big way.
- driverdan 12y ago"Warning: This application requires Websecurify Browser Extension for Google Chrome." NOPE
- passfree 12y agoAs a best practice, you should use it in a separate profile but this is the only way to benefit from this technology.
- aortega 12y agoThe scale of pwning going on is unbelievable.
- peterwwillis 12y agoWant more exploit POC? Search 'CVE-2014-6271' on pastebin, gist.github and twitter. There's a bunch of remote shells since yesterday.
- daviddede 12y agocPanel servers vulnerable as well: http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shock-thousands-of-cpanel-sites-are-high-risk.html http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...