Exploitation of an old Rails vulnerability

Re:Exploitation of an old Rails vulnerability by orf on Monday May 27, 2013 @06:49PM (#5777025)

Looking at the source code for the IRC bot installed on all compromised system shows the IRC server it connects to. The source is here: http://88.198.20.247/k.c

The IRC server is cvv4you.ru:6667 #rails There are currently 2164 idling bots on there. Holy fuck. Its run by a guy with the handle "ryan".

Connect to it and see for yourself: http://chat.mibbit.com/

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by comex on Tuesday May 28, 2013 @02:29AM (#5778475)

Some notes other than what has already been said:

- Both IRC servers are currently down (connection refused).

- The C code is full of bugs, but they're probably only exploitable if you can get either a nick more than 1024 characters or a full line more than 4096 characters (in the latter case, aside from there being an off-by-one error, the data after 4096 characters will be treated as a command, so you could spoof a privmsg and cause the bot to execute a shell command).

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by 300bps on Monday May 27, 2013 @09:24PM (#5777484)

Here are the commands for the bot:

NICK <nick> = Changes the nick of the client

SERVER <server> = Changes servers

KILL = Kills the client

GET <http address> <save as> = Downloads a file off the web and saves it onto the hd

HELP = Displays this

IRC <command> = send_msgs this command to the server

SH <command> = Executes a command

I'm a little light on IRC proxies right now - anyone care to test if you can kill all 2,164 bots in one easy peasy MIRC script?

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by dopamean on Monday May 27, 2013 @09:33PM (#5777508)

you cant. it seems that they only respond to messages in the channel #rails and the channel is set +m

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by meowface on Tuesday May 28, 2013 @12:19AM (#5778026)

This is a botnet being ran, at least in part, by hacking group HTP.

ryan is one of its lead members. Other evidence is the fact that "starfall.cu.cc" is one domain being used to grab this script: http://starfall.cu.cc/chips.txt

Starfall is another one of their members.

They're the people who breached Linode, MIT, nmap, and a few other places recently. See: http://www.exploit-db.com/papers/25306/

I'm surprised no one's thought of mass exploiting all those RoR servers months ago, unless those have all been there for months.

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by voltagex_ on Monday May 27, 2013 @08:33PM (#5777342)

Looking at SpamHaus, that IP range is owned by a company that provides professional botnet hosting. Approach with caution.

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by outworlder on Monday May 27, 2013 @08:58PM (#5777418)

Professional botnet hosting? Didn't even know there was such a thing.

How come these guys are even operational?

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by karlkatzke on Monday May 27, 2013 @10:04PM (#5777601)

It's a huge thing. KrebsOnSecurity covers a lot of the news in that industry, and discusses how they're used. http://krebsonsecurity.com/

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by meowface on Tuesday May 28, 2013 @12:22AM (#5778034)

They're never located in the US, so they're a lot harder to crack down on.

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by epochwolf on Monday May 27, 2013 @11:31PM (#5777867)

This botnet has been attacking servers at my work for the last few days. I'm glad we upgraded within a month of the security patches.

[ Parent | on HN ]