OT: Website Exploits - IPTABLES Deny Scripts

[Lisa Kachold]

1) Okay, you need to make your "report" - this a complete forensics of all the IP's with a complete log example to send to the their authorative technical and abuse contacts.2) You can use a script to drop all such exploits to the iptables deny file?  It's going to look like something like this (you are going to have to play with your logfile sed/awk statement to be sure that the field $7 is the seventh from the left and that the sed statement gets the full ip string correct before implementing).  Season to taste (any of the unique statements from your logs will work):#!/bin/bashrm -f ttttouch tmp# disabled IPs can be obtained from /etc/sysconfig/iptablesgrep DROP /etc/sysconfig/iptables|awk '{print $5}' >tmp# ------------------------ DoS attacks rule -------------------------#identity mismatch in securegrep Did /var/log/secure|awk '{print $12}' >>tmp#Invalid usergrep "Invalid user" /var/log/secure|awk '{print $10}' >>tmp#  Maximum Logingrep "Maximum login" /var/log/secure|awk '{print $7}'|sed 's/.*\[\(.*\)\])/\1/g' >>tmp#  humanogrep "humano" /var/log/apache/access_log|awk '{print $7}'|sed 's/.*\[\(.*\)\])/\1/g' >>tmp# ------------------ reduce redundant IPs from tmp file -------------size=`/usr/bin/wc tmp|awk '{print $1}'`i=0while test $i -lt $sizedo      us=`sed -n 1p tmp`      sed /$us/d tmp >tmps      echo $us >>ttt      cp -f tmps tmp      size=`/usr/bin/wc tmp|awk '{print $1}'`donerm -f tmp tmps temp0 temp## ------------------ activate detected IPs --------------------------size=`wc ttt|awk '{print $1}'`size=`expr $size + 1`/sbin/iptables -Fi=1while test $i -lt $sizedo        ip=`sed -n "$i"p ttt`        i=`expr $i + 1`/sbin/iptables -A INPUT -s $ip -j DROPdone   # -----------------end of shell script test -------------------------     www.Obnosis.com |  http://en.wiktionary.org/wiki/Citations:obnosis |
http://www.urbandictionary.com/define.php?term=obnosis (503)754-4452--- On Wed, 12/3/08, Lisa Kachold <lisakachold at obnosis.com> wrote:From: Lisa Kachold <lisakachold at obnosis.com>Subject: RE: OT: Website ExploitsTo: klsmith2020 at yahoo.com, plug-discuss at lists.plug.phoenix.az.usDate: Wednesday, December 3, 2008, 3:58 PM


It appears as though someone is attempting to  access http://humano.ya.com via a redirect.It's is probably not a "real" exploit but a miscrafted URL referral.Without more information related to the contents of your index.php, I can't tell you what exactly they are exploiting.  However, since the page they are going to doesn't appear to be a google ad site or phishing site, I would just call this a mistaken URI fat fingered redirect from some place?But here's the basic steps for "forensics" of any such problem (even the exploitive ones):1) Where is it coming from?  Your log should have a complete source IP?Cut and splice the complete log report example into your "forensics" report.Include your TIMEZONE for their edification.  Include the date of the first attack using grep on your logs.  Add frequency or whatever else is unique about it.If the issue or attack comes from multiple sources,
 indicating bots, include that information also.2) Run a whois on the source IP and see who is the Swip'd IP block owner, domain name, and access that page for additional information.Cut and splice the technical contact for that block into your "report".3) Go to the referral site (http://humano.ya.com) and find their email address to add to the "report".4) Send a copy of the referring ip address to your firewall administrator to deny for port 80/443, or add to your server based IPTABLES deny via a one liner:iptables -A INPUT -s $ipaddress -j DROP/etc/init.d/iptables save5) Include your name and address, contact information and statement of confidentiality.www.Obnosis.com |  http://en.wiktionary.org/wiki/Citations:obnosis |
http://www.urbandictionary.com/define.php?term=obnosis (503)754-4452Catch the January PLUG HackFest!   Kristy Westphal, CSO for the Arizona Department of Economic
Security will provide a one hour
presentation on forensics.Date: Wed, 3 Dec 2008 14:39:40 -0800From: klsmith2020 at yahoo.comSubject: OT: Website ExploitsTo: plug-discuss at lists.plug.phoenix.az.usHi,I am working on a website that gets a lot of exploit attempts.They mostly look like this:  /index.php?display=http://humano.ya.com/mysons/index.htm?Our code is set to disregard any value that is not expected.  I'm wondering if there is a clearing house for reporting this type of stuff.  I have the IP address as reported.... if that is
 accurate.Thanks in advance!KeithSend e-mail faster without improving your typing skills. Get your Hotmail® account. 

_________________________________________________________________
You live life online. So we put Windows on the web. 
http://clk.atdmt.com/MRT/go/127032869/direct/01/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20081203/e100bc03/attachment.htm