On 5/24/07, <b class="gmail_sendername">Big Wave Dave</b> &lt;<a href="mailto:bigwavedave@gmail.com">bigwavedave@gmail.com</a>&gt; wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
&lt;snip&gt;<br>&gt; The problem is that leaving cacti open was the most stupid thing I&#39;ve done.<br>&gt; After checking /var/log/httpd/error_log, I saw that someone exploited a<br>&gt; cacti php file and the result was:
<br>&lt;snip&gt;<br>&gt; which immediately downloaded ShellBOT to /tmp and executed it. It was a good<br>&gt; thing I caught this as early as I did. So, what&#39;s everyone elses solution<br>&gt; these days? Or is it simply a matter of creating a /tmp partition and
<br>&gt; mounting it noexec?<br>&lt;snip&gt;<br><br>Using htaccess in addition to the built-in Cacti auth might be<br>helpful.&nbsp;&nbsp;What version of Cacti were you running?&nbsp;&nbsp;</blockquote><div><br>Unfortunately I had to not limit access to Cacti, as I had to connect to it from different IP addresses. I was running Cacti 
0.8.6h from <a href="http://dag.wieers.com">dag.wieers.com</a>. I couldn&#39;t get 0.8.6j to work for some reason, so I had to fall back to 0.8.6h. For reference, here&#39;s what error_log had with regards to the exploited Cacti:
<br><br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; 1 in /var/www/cacti/lib/functions.php on line 455<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; total_polls in /var/www/cacti/lib/functions.php on line 455
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; failed_polls in /var/www/cacti/lib/functions.php on line 456<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; snmp_community in /var/www/cacti/lib/functions.php on line 467
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; max_time in /var/www/cacti/lib/functions.php on line 480<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; min_time in /var/www/cacti/lib/functions.php on line 484
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; failed_polls in /var/www/cacti/lib/functions.php on line 488<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; avg_time in /var/www/cacti/lib/functions.php on line 489
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; failed_polls in /var/www/cacti/lib/functions.php on line 489<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; status in /var/www/cacti/lib/functions.php on line 492
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; status in /var/www/cacti/lib/functions.php on line 492<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; status_fail_date in /var/www/cacti/lib/functions.php on line 568
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; status_rec_date in /var/www/cacti/lib/functions.php on line 569<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; status_last_error in /var/www/cacti/lib/functions.php on line 570
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; min_time in /var/www/cacti/lib/functions.php on line 571<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; max_time in /var/www/cacti/lib/functions.php on line 572
<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; failed_polls in /var/www/cacti/lib/functions.php on line 576<br>[client <a href="http://217.11.132.214">217.11.132.214</a>] PHP Notice:&nbsp; Undefined index:&nbsp; hostname in /var/www/cacti/lib/functions.php on line 578
<br><br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Something like<br>mod_security might be helpful as well.</blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Dave</blockquote><div><br>Thanks Dave, I&#39;ll look into that later. I still have a lot of investigating and testing to do with this.<br><br>dex <br></div></div>