Joined: 18 Apr 2002 Posts: 16777215 Location: Kuala Lumpur, Malaysia
Posted: Wed Dec 22, 2004 4:57 am Post subject:
Aye we are indeed safe It wouldn't find us anyway as we've removed version info.
From the original post on BugTraq:
This morning one of our client's sites was found to have been defaced
with the words "NeverEverNoSanity WebWorm Generation 9." The defacement
appeared to take place on all .html files in the web root trees of
multiple virtual hosts on the web server in a very short period of time.
After some investigation, we determined that the attacker had gained
access via phpbb in a series of crafted URL requests, like so:
After checking the phpbb site, it turns out that this is a vulnerability
posted the 18th of November, called Hilight; we didn't update to prevent
it because the client whose domain it was has their own admin, and we
thought he was taking care of phpBB. Oops. The exploit is described here:
When I copied all these entries out of the log and translated the chr()
calls, they turned out to be the attached perl script, which is capable
of finding .html files to deface, and then going to google and finding
more instances of phpbb to infect. Which makes it a worm. It also
tracks itself by generation; we were generation 9.
Please find attached the above-mentioned script as well as the series of
log entries from access_log.
I've heard of a few people being infected, the lesson is patch!
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum