On 5/24/07, <b class="gmail_sendername">Big Wave Dave</b> <<a href="mailto:bigwavedave@gmail.com">bigwavedave@gmail.com</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<snip><br>> The problem is that leaving cacti open was the most stupid thing I've done.<br>> After checking /var/log/httpd/error_log, I saw that someone exploited a<br>> cacti php file and the result was:
<br><snip><br>> which immediately downloaded ShellBOT to /tmp and executed it. It was a good<br>> thing I caught this as early as I did. So, what's everyone elses solution<br>> these days? Or is it simply a matter of creating a /tmp partition and
<br>> mounting it noexec?<br><snip><br><br>Using htaccess in addition to the built-in Cacti auth might be<br>helpful. What version of Cacti were you running? </blockquote><div><br>Unfortunately I had to not limit access to Cacti, as I had to connect to it from different IP addresses. I was running Cacti
0.8.6h from <a href="http://dag.wieers.com">dag.wieers.com</a>. I couldn't get 0.8.6j to work for some reason, so I had to fall back to 0.8.6h. For reference, here's what error_log had with regards to the exploited Cacti:
<br><br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: 1 in /var/www/cacti/lib/functions.php on line 455<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: total_polls in /var/www/cacti/lib/functions.php on line 455
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: failed_polls in /var/www/cacti/lib/functions.php on line 456<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: snmp_community in /var/www/cacti/lib/functions.php on line 467
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: max_time in /var/www/cacti/lib/functions.php on line 480<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: min_time in /var/www/cacti/lib/functions.php on line 484
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: failed_polls in /var/www/cacti/lib/functions.php on line 488<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: avg_time in /var/www/cacti/lib/functions.php on line 489
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: failed_polls in /var/www/cacti/lib/functions.php on line 489<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: status in /var/www/cacti/lib/functions.php on line 492
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: status in /var/www/cacti/lib/functions.php on line 492<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: status_fail_date in /var/www/cacti/lib/functions.php on line 568
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: status_rec_date in /var/www/cacti/lib/functions.php on line 569<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: status_last_error in /var/www/cacti/lib/functions.php on line 570
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: min_time in /var/www/cacti/lib/functions.php on line 571<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: max_time in /var/www/cacti/lib/functions.php on line 572
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: failed_polls in /var/www/cacti/lib/functions.php on line 576<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice: Undefined index: hostname in /var/www/cacti/lib/functions.php on line 578
<br><br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Something like<br>mod_security might be helpful as well.</blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Dave</blockquote><div><br>Thanks Dave, I'll look into that later. I still have a lot of investigating and testing to do with this.<br><br>dex <br></div></div>