Posted: Sat Jan 01, 2005 5:24 pmI just wrote a script that will automatically block IP addresses (via iptables) that are running the phpBB worm or people trying to exploit my site via the same vulnerability. Even though I am patched I don't want them poking around. There are two parts to this. The Perl CGI script and the rewrite rules. Here are the rules for the /etc/httpd/conf/httpd.conf:
The /z/blk_php_worm.cgi script (modify to fit your environment):
NOTES:
- You have to have my "block" script in your /sbin directory (should be in my files section).
- You have to have sudo configured to allow the apache user to execute the block script.
- The only check above the QUERY_STRING checks in the rewrite rules are to see if the QUERY_STRING is greater than 50 chars (so I can test without blocking myself). You could come up with better tests.
- I have my logs in /public, change this to whereever you want them to go and then make sure they exist and are writable by user "apache".
- Code: Select all
# block IP addresses of PHP/phpBB vulnerability attempts
RewriteCond %{REQUEST_URI} ^(.*)\&rush=(.*) [NC]
RewriteRule ^.*$ /z/blk_php_worm.cgi
RewriteCond %{QUERY_STRING} ^(.*)\&rush=(.*) [NC]
RewriteRule ^.*$ /z/blk_php_worm.cgi
RewriteCond %{QUERY_STRING} ^(.*)echr\((.*) [NC]
RewriteRule ^.*$ /z/blk_php_worm.cgi
RewriteCond %{QUERY_STRING} ^(.*)wget%20(.*) [NC]
RewriteRule ^.*$ /z/blk_php_worm.cgi
RewriteCond %{QUERY_STRING} ^(.*)perl%20(.*) [NC]
RewriteRule ^.*$ /z/blk_php_worm.cgi
RewriteCond %{QUERY_STRING} ^(.*)system\((.*) [NC]
RewriteRule ^.*$ /z/blk_php_worm.cgi
The /z/blk_php_worm.cgi script (modify to fit your environment):
- Code: Select all
#!/usr/bin/perl
# by Void Main
# block sites with PHP worm
use Socket;
# These files have to exist and writable by apache user
$log = "/public/php_worm.log";
$blklog = "/public/php_worm_blocked.log";
$iaddr = inet_aton("$ENV{REMOTE_ADDR}");
$name = gethostbyaddr($iaddr, AF_INET);
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
$year+=1900; $mon+=1;
open(OF,">>$log");
printf(OF "%04d/%02d/%02d %02d:%02d:%02d - $ENV{REMOTE_ADDR} - $name\n", $year, $mon, $mday, $hour, $min, $sec);
close(OF);
# Only really block if Query String is greater than 50 chars
# Put any conditions you like here
if ( length($ENV{QUERY_STRING}) > 50 ) {
$block = 1;
$blkmsg = "If you feel you have been blocked in error please send your IP address to \"voidmain AT linuxmail.org\" and I will unblock you.";
} else {
$blkmsg = "Actually, you weren\'t blocked this time but you are pushing your luck!";
}
print "Content-type: text/html\n\n";
print <<EndEND;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Your IP Address has been blocked!</title>
</head>
<body bgcolor=black text=white>
<h3><font color=red>Your IP Address has been blocked!</font></h3>
<font color=red>The following is a portion of the information that has been logged and sent to the FBI for further analysis:</font><br><br>
<font color=yellow>
Your Address: $ENV{REMOTE_ADDR}<br>
Your Hostname: $name<br>
</font>
<br>
$blkmsg
</body>
</html>
EndEND
if ( $block ) {
system("/usr/bin/sudo /sbin/block $ENV{REMOTE_ADDR} >> $blklog 2>&1");
} else {
open(OF,">>$blklog");
printf(OF "%04d/%02d/%02d %02d:%02d:%02d - $ENV{REMOTE_ADDR} - not infected\n",$year,$mon,$mday,$hour,$min,$sec);
close(OF);
}
NOTES:
- You have to have my "block" script in your /sbin directory (should be in my files section).
- You have to have sudo configured to allow the apache user to execute the block script.
- The only check above the QUERY_STRING checks in the rewrite rules are to see if the QUERY_STRING is greater than 50 chars (so I can test without blocking myself). You could come up with better tests.
- I have my logs in /public, change this to whereever you want them to go and then make sure they exist and are writable by user "apache".
.