From owner-freebsd-security Sun Sep 23 11:10:46 2001 Delivered-To: freebsd-security@freebsd.org Received: from tomts5-srv.bellnexxia.net (tomts5.bellnexxia.net [209.226.175.25]) by hub.freebsd.org (Postfix) with ESMTP id 08DFD37B41F for ; Sun, 23 Sep 2001 11:10:42 -0700 (PDT) Received: from khan.anarcat.dyndns.org ([65.92.169.79]) by tomts5-srv.bellnexxia.net (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP id <20010923181041.ESAD27768.tomts5-srv.bellnexxia.net@khan.anarcat.dyndns.org>; Sun, 23 Sep 2001 14:10:41 -0400 Received: from shall.anarcat.dyndns.org (shall.anarcat.dyndns.org [192.168.0.1]) by khan.anarcat.dyndns.org (Postfix) with ESMTP id CC20D1A86; Sun, 23 Sep 2001 14:10:34 -0400 (EDT) Received: by shall.anarcat.dyndns.org (Postfix, from userid 1000) id 9D3CD20B4A; Sun, 23 Sep 2001 14:10:31 -0400 (EDT) Date: Sun, 23 Sep 2001 14:10:31 -0400 From: The Anarcat To: David G Andersen Cc: Ian Smith , Chris Byrnes , security@FreeBSD.ORG Subject: Re: New worm protection Message-ID: <20010923141030.B546@shall.anarcat.dyndns.org> References: <200109231703.f8NH3NK24837@faith.cs.utah.edu> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="VrqPEDrXMn8OVzN4" Content-Disposition: inline In-Reply-To: <200109231703.f8NH3NK24837@faith.cs.utah.edu> User-Agent: Mutt/1.3.22.1i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --VrqPEDrXMn8OVzN4 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, 23 Sep 2001, David G Andersen wrote: > Use mod_rewrite to redirect all accesses to that script. >=20 > RewriteEngine on > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi >=20 > (I haven't tested this syntax. Test it first. :) Unfortunatly, I tested this using a text file, which is fine. Here, if I try using a compiled C script (instead of a perl script, faster on a small machine), the script gets dumped in binary form! Not executed! GET /root.exe ELF =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e= lf.so.FreeBSD=C0=B6 =2E.. So I used the redirect approach: RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.= cgi sleep.c: int main() { sleep(5); printf("Content-type: text/plain\n\n"); } This works. However, it generates a bit too much output: GET /cmd.exe 302 Found

Found

The document has moved here.

Apache/1.3.20 Server at anarcat.dyndns.org Port 80

;) I really don't understand why the Rewrite rule doesn't work as expected. A. --VrqPEDrXMn8OVzN4 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd c+QAn324N8SSDAEyDviPsqrhDTujaXuP =v3ql -----END PGP SIGNATURE----- --VrqPEDrXMn8OVzN4-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message