Re: Rumours about Apache 1.3.22 exploits

["VeNoMouS" <venom () phreaker net>]

Ive looked into this a little bit more and it adds 8.7KB of data to any elf
file it finds on your system

it seems to contain the text string OSF

it does apare to be some type of virii back door, plz find attached a clean
and a infected version of grep 2.4.2 (GNU) from a rh 6.2 box it appends its
data to the end of the elf but have been unsuccsessful reverse engineing it
so far.

first run it stays in memory and then goes after /bin/
and infects all elfs in there then moves onto /usr/bin
then /usr/lib/gcc* then /sbin

well thats the way i saw it happening over a period of 4 days
and every elf contains the listen() code to open port 3049

still uncertain as to wat the 3049 actally does
----- Original Message -----
From: "VeNoMouS" <venom () phreaker net>
To: "Olaf Kirch" <okir () caldera de>; "H D Moore" <hdm () digitaloffense net>
Cc: <fractalg () highspeedweb net>; <vuln-dev () securityfocus com>
Sent: Friday, March 01, 2002 6:03 AM
Subject: Re: Rumours about Apache 1.3.22 exploits


> Actally I was pasted on a so called exploit this afternoon which claims to
> exploit via post but was only pasted on a binary,
> how ever please watch out for this I beleave its a working exploit but it
> also seems to open up a udp port on 3049 and some how seems to cloning the
> last proc , when stracing the 3049 all it seems to do is sit there and
> recv(...) and does nothing when you type anything.
>
> binary is called 73501867 - x86/linux mod_php v4.0.2rc1-v4.0.5 by lorian.
>
> Has any one seen this about before?? Is this a trojan , if not then why
does
> it open udp 3049 even after a reboot.
> i trace the proc opening that port kill it and it seems to clone some how
my
> last proc and then 2mins l8r opens the port again.
>
> Any ideas?
>
>
> ----- Original Message -----
> From: "Olaf Kirch" <okir () caldera de>
> To: "H D Moore" <hdm () digitaloffense net>
> Cc: <fractalg () highspeedweb net>; <vuln-dev () securityfocus com>
> Sent: Wednesday, February 27, 2002 3:07 AM
> Subject: Re: Rumours about Apache 1.3.22 exploits
>
>
> > > There is a bug in the php_split_mime function in PHP 3.x and 4.x.
There
> is a
> > > working exploit floating around which provides a remote bindshell for
> PHP
> > > versions 4.0.1 to 4.0.6 with a handful of default offsets for
different
> > > platforms.
> >
> > Blechch. This code is really icky. There's really an sprintf down there
> > in the code that looks bad (apart from a few other things that look
bad).
> > But if I don't misread the patch, the sprintf is still there in 4.1.1.
> >
> > > Since the PHP developers commited another change to the affected
> > > source file (rfc1687.c) about two days ago, speculation is that there
is
> yet
> > > another remote exploit.
> >
> > Not in the public CVS (has been removed?)
> >
> > Olaf
> > --
> > Olaf Kirch         |  --- o --- Nous sommes du soleil we love when we
play
> > okir () monad swb de  |    / | \   sol.dhoop.naytheet.ah kin.ir.samse.qurax
> > okir () caldera de    +-------------------- Why
Not?! -----------------------
> >          UNIX, n.: Spanish manufacturer of fire extinguishers.

Attachment: infected_grep.tar.gz
Description:

Attachment: clean_grep.tar.gz
Description: