I’ve been toying around quite a bit with robots who attempt to exploit the site in various ways. I’ve been seeing an interesting shift in robots that are moving away from direct exploitation until they detect that it is exploitable. That is interesting because it’s reducing the risk of someone just connecting to the script, downloading it and connecting to the controlling IRC servers. Here’s the list I got in today’s log file (please use extreme caution when viewing these - they are intentionally hostile in unknown ways):

http://2zero.by.ru/bot/echo.txt
http://38.99.89.50/.r/echo.txt
http://38.99.89.50/echo.txt
http://59.25.189.83/~upload/tt
http://66.235.205.131/echo
http://72.29.94.218/scr/evl.txt
http://80.86.105.122/echo.txt
http://afcomdfw.org/echo
http://albapower.de/id.txt
http://aldy.deep-ice.com/99.txt
http://aldy.deep-ice.com/mitra/echo.txt
http://aldy.ifastnet.com/xpl/echo.txt
http://alienr0x.by.ru/.spreag.txt
http://alienr0x.by.ru/r57.txt
http://andravarldar.se/cmd
http://arva.medusanetwork.com/echo.txt
http://az.co.cz/foto/c9.txt
http://b4ngs4t.com/echo
http://bacaplume.free.fr/manager/frontinc/services.txt
http://bavatuesdays.com//wp-content/plugins/wordtube/n00gr00d.txt
http://bb.domaindlx.com/armee/x.txt
http://br.geocities.com/darkteam4ever/echo.txt
http://br.geocities.com/porfook/engine.txt
http://bristoloakpaintballclub.com/calendar/calendar/includes/js/.,/.,/.,/test.txt
http://buceta.789mb.com/cmd1.txt
http://busca.uol.com.br/uol/index.html
http://bwlist.altervista.org/stringa.txt
http://chireo.info/n00gr00d.txt
http://clubmusic.caucasus.net/f22.txt
http://cmdfile.ifastnet.com/cmd/57.txt
http://cmdfile.ifastnet.com/cmd/a.txt
http://coccor0x.altervista.org/response.txt
http://d3prive.my-place.us/id.txt
http://d4rk4ir.altervista.org/r57.txt
http://dandorohoi.0catch.com/.r/echo.txt
http://deporpasto.com/portal/components/com_smo_ajax_shoutbox/languages/cmd.do
http://detroit.my-php.net/id.txt
http://dezzign.ru/echo
http://diving.actionpro.cz/galerie/tmp/vob.txt
http://dj.eliteradio.info/ech21o.txt
http://dj.eliteradio.info/echo.txt
http://drxrwx.ifastnet.com/57.txt
http://drxrwx.ifastnet.com/a.txt
http://dvl.by.ru/cmd/r57shell.txt
http://ebrain.netfast.org/r57
http://efardella.cinet.it/claroline/phpbb/id.txt
http://emi.faccat.br/coisasdowindovaio/freeman.txt
http://empore.altervista.org/rox.txt
http://equipexapadao.com/echo
http://faillurecorp.iespana.es/evals.txt
http://faillurecorp.iespana.es/id.txt
http://for-a.co.in/vulgar.htm
http://founder-poltekcrews-allnetwork.org/echo
http://freewebs.com/celinho/id.txt
http://freewebs.com/sak4w/r57.txt
http://geocities.com/surabayateam/vulgar.gif
http://gnuworld.evolink.ro/xxx/3739.echo.txt
http://h1.ripway.com/eownz/id.txt
http://h1.ripway.com/h4ck/echo.txt
http://h1.ripway.com/overcashxd/echo
http://h1.ripway.com/thc/id.txt
http://hacker.to.md/Qe3
http://hacker.to.md/mesin
http://hacker.to.md/x
http://happy.altervista.org/name.txt
http://heidik.org/y/id.txt
http://heritagelost.net/phpraid/cmd.txt
http://hokkian.dalnetz.biz/cibe.txt
http://ht-o.de/hto/images/echo
http://ikhlas.com.my/57.txt
http://ikhlas.com.my/cmd.txt
http://int0xic.by.ru/id.txt
http://jargo.phpnet.us/ilkom.txt
http://k52.jp/echo
http://kaoru-t.com/cache/echo.txt
http://kretenovich.phpnet.us/cmd.gif
http://l3to.by.ru/id.txt
http://lamerma.com.ve/n00gr00d.txt
http://lifechangerscc.com//catalog/includes/asd.txt
http://lifechangerscc.com//catalog/includes/cmd.txt
http://lppm.uns.ac.id/r57.txt
http://luis.infopiera.com/evl.txt
http://mabiographie.fr/httaccess
http://maxdemon.1sthost.org/docs/robot.txt
http://members.lycos.co.uk/modelteam/echo.txt
http://mensagem.us/hack/echo
http://multiplex.netfast.org/stringa.txt
http://nainty.xlphp.net/c99.txt
http://napushenko.phpnet.us/evl.txt
http://nemecsek87.altervista.org/ciao.jpg
http://netbarg.com/admin/backups/id.txt
http://new.bacone.edu/mambo/help.txt
http://niigatakubota.co.jp/.defacer/.secret/echo
http://nikkeydetetives.com/over/echo
http://nocommercial.altervista.org/my/nc.txt
http://norman.webspacemania.com/id.txt
http://norman.webspacemania.com/r57.txt
http://nosaj.1sweethost.com/freeman.txt
http://nxlf.cn/1
http://offzinho.netfast.org/57
http://openl4b.altervista.org/CMD.txt
http://partyaccess.net/2007/components/com_extcalendar/echo
http://pasto.com/administrator/components/safe.txt
http://perdu.ch/cgi-bin/echo
http://portal.isara.fr/claro151grain/claroline/auth/ldap/…bl/…/stringa.txt
http://priv8.netfast.org/cmd/r57.gif
http://putogame.webspacemania.com/r57.txt
http://putogame.webspacemania.com/safe.txt
http://raz0r-sh4rks.org/id.txt
http://redza.t35.com/xpl/injek
http://reshack.ifastnet.com/xpl/xpl.txt
http://rizla2.interfree.it/p.txt
http://rootkay.by.ru/id.txt
http://rotaryclub-fulham.org//components/com_extcalendar/cmd.txt
http://rpgnet.com/images/m4f14d3c4lc1nh4.txt
http://sanwall.info/echo.txt
http://scan.prohosts.org/echo.txt
http://serc.ilc.edu.tw/echo
http://site.netspace.pt/media/echo.php
http://sniffo.by.ru/SuPrEmO.txt
http://stip-city.org/evl.txt
http://suntikan.org/echo
http://sup3rskunk.interfree.it/c99.txt
http://sup3rskunk.interfree.it/o.txt
http://symboliclynx.com/images/a
http://tauzendmark.ro/.r/echo.txt
http://thebadfox.jeeran.com/c99.txt
http://thedivaslist.com/.r/echo.txt
http://thelostsummer.com/x.do
http://theoriginalista.altervista.org/unix/no.txt
http://topnlpsites.com/images/gif/echo.txt
http://tosa.altervista.org/stringa.txt
http://treo.palmtop.pl/klub/Cmd.txt
http://ulil.xlphp.net/msn/msn
http://va7in.phpnet.us/vhv
http://valdhano.phpnet.us/gfs
http://valdhano.phpnet.us/vhv
http://varmvaffel.no-ip.com/andy/c99.txt
http://vcsok.com/echo
http://vegeta.co.jp/echo
http://vh1.srt.com.cn/sewam/c99.txt
http://waou.altervista.org/r57.txt
http://woodshack.com/components/com_phpshop/shop_image/help/freeman.txt
http://www.247live7.com/diablocrew/cmd.txt
http://www.Leonard0.kit.net/echo.txt
http://www.activekitten.com//bitrix/updates/ciola.txt
http://www.apnic.net/index.html
http://www.article-website.co.uk/admin/backup/RipperzCrewz
http://www.asqbuffalo.org/backups/freeman.txt
http://www.bastardirc.net/scan5.txt
http://www.bewahrer-azeroth.de/phpraid//raid_lua/asd.txt
http://www.chv.ro/cache/0day
http://www.defi.isep.ipp.pt/~jaa/cache/a
http://www.dgsport.be/components/res.txt
http://www.eclypse.info/oche
http://www.ekin0x.com/r57.txt
http://www.equipexapadao.com//id.txt
http://www.equipexapadao.com/echo
http://www.equipexapadao.com/id.txt
http://www.esto.sky7.us/RipperzCrewz
http://www.esto.sky7.us/SECRET.c
http://www.facepi.com.br/cache/…/botnet/out2.txt
http://www.fena.nu//components/com_rsgallery/r57rex.txt
http://www.freewebs.com/alezinn/n00gr00d.txt
http://www.geocities.com/junlee_180/metro/yeyen.txt
http://www.geocities.com/kampusunika/lamercrew.txt
http://www.geocities.com/kharisma_usada_mustika/checkit.txt
http://www.gonfiabiligamespark.it/flash/r57.txt
http://www.gritservice.it/r57.txt
http://www.hanovercova.us/business/x.txt
http://www.himagara-unila.com/x.do
http://www.k1ll3rx.addr.com/id.txt
http://www.kebcomputer.com/cache/error.txt
http://www.kebcomputer.com/cache/tess.txt
http://www.kebcomputer.com/cache/tests.txt
http://www.kelserific.xpg.com.br/tool25.txt
http://www.kendera.com.br/mvk.txt
http://www.leonard0.kit.net/echo.txt
http://www.modulardepot.com/smallimages/help/freeman.txt
http://www.mvmedia.com/old/Cmd.txt
http://www.mydezent.de/dload/pdl-gfx/ciola.txt
http://www.panglimacollection.com/titid.gif
http://www.panglimacollection.com/titid.txt
http://www.phazethree.com/shoponline/images/CMD.txt
http://www.pic4.us/pic/wvj89367.gif
http://www.private-scan.kit.net/evl.txt
http://www.pronext.eu/help/a.txt
http://www.propgpq.uece.br/mdb/echo
http://www.raaness.no/a
http://www.rhino-invest.info/FIP/id.txt
http://www.rpgnet.com/images/m4f14d3c4lc1nh4.txt
http://www.stockgoeroe.com/main.txt
http://www.subway56.com/delivery/modules/maindisplay/id.txt
http://www.sunshinefalls.com/Templates/.m/string.jpg
http://www.t5kclan.com/echo
http://www.tarcisiobr.kit.net/echo.txt
http://www.telecom.conexlink.com/includes/cache_tpls/freeman.txt
http://www.the-esao.com/imag/stringa.txt
http://www.thedivaslist.com/.r/echo.txt
http://www.thegrumbleweeds.com/pubgal/freeman.txt
http://www.thelostsummer.com/x.do
http://www.thiaguinho.net/id.txt
http://www.trendsturm.de/catalog/includes/help/freeman.txt
http://www.triton.xpg.com.br/biscate.txt
http://www.ugurfotograf.com/resources/incoming/a.txt
http://www.velozbr.netfast.org/Cmd/r57.txt
http://www.vortex2.altervista.org/cmd.txt
http://www.wantme.ca/cache/.,/.,/.,/test.txt
http://www.webbmakaren.se/test/admin/img/help/cmd.txt
http://www.webbmakaren.se/test/admin/img/help/freeman.txt
http://www.wow-insomnia.com/images/cmd.txt
http://www.yotasurf.co.uk/coppermine/albums/CMD.TXT
http://www.yufa.spb.ru/modules/coppermine/include/main.txt
http://www1.greenpeace.org.hk/camp/id.txt
http://xmlstuff.ifastnet.com/cmd/cmdx.do
http://xoomer.alice.it/hackz/ahah/no.php
http://xoomer.alice.it/marian0zx/ahah/no.php
http://xoomer.alice.it/marian0zx/ahah/solo.php
http://xoomer.alice.it/uploadftp/r57rex.txt
http://xpl46.altervista.org/config.txt
http://xpls.my-place.us/own.txt
http://younes.by.ru/c99.txt

You’ll notice an awful lot of “echo” versions which (when still valid) return content like:

<? echo "1122548"; ?>

Apparently others have seen this as well so it’s not just me. This is a shift in tactics that will no doubt have a big impact on the survivability of bot-nets as they will be more difficult to detect. The only problem is that the numbers don’t appear to be dynamic. It won’t take long to correct that, which will mean that seeing what the bots are doing will require honeypots. It’ll be interesting to see the bots evolve over time.

This entry was posted on Monday, June 11th, 2007 at 9:40 pm and is filed under Webappsec. You can leave a response as well.