Kobrashell Hell

Back in the late 1990’s it was trés cool for hackers to attempt to overwrite the home page of well known sites with their own and declare the site “Pwn3d”. I thought this was far since over as the newly initiated script kiddies tend to want much more for their entertainment dollar these days.

I guess that isn’t the case in Turkey.

_{Hacker’s uploaded page. Perhaps they should retail it at Starbucks?}

A recent signup uploaded an avatar to a forum I administer, the file, called kobrashell.gif.php was uploaded as kobrashell.gif. This file is widely available and was written by a Russian. It allows the user to pretty much do what they like to the directories on your server, as long as the permissions are set to allow it, which is generally the case with file upload directories, allowing them to be written to by the web client.

_{Portion of the file with GIF Header}

The forum was a part of a CMS authored by e107.org which allowed signups to upload avatars and photos and was secure as far as those go, but it also has an html area which includes a filemanager, allowing images to be renamed. One can upload an image, resize it, rename it, even with a new extention. Once uploaded and run, the file was used to rewrite the index pages.

These folks took their time, however, as the signup was a full 10 days before they used the file, and as I have uncovered, the CMS at that point had a number of people exploit it using this file, as was discovered by a quick google search.

Since forums are popular and image upload sites are all the rage, the use of any type of file manager has become alot less common, as was the case with this older CMS. But forums are generally under the most danger as they generally allow users to signup with only a valid hotmail account, and even then, as was the case here, “hacking” and international laws are not well defined still. Site administrators generally only allow forums to appear on servers that are heavily hardened. A good lesson learned.

Mail Server DOS Hell Italian Celibrates World Cup Victory With SSH Attack