There might be a new exploit

[surp]

Latest updates as of several days ago.

Look for a /tmp/zoo.txt file. It is small php file with a bogus 404 redirect message. Doesn't seem to have been installed anywhere yet.

I think this is the first sign of the file upload in the logs.

/a2billing/admin/Public/A2B_entity_restore.php?atmenu=upload&form_action=upload HTTP/1.1"

 

[danardf]

With a fresh update?
Put this information to Elastix bugs report please.

 

[surp]

With a fresh update?
Put this information to Elastix bugs report please.

There are no updates available for a2billing so if they are getting in via a2billing a fresh update won't do anything.

Please make A2billing optional! Right now it has elastix dependencies so if I force uninstall the RPM it re-installs again the next time there are elastix updates.

 

[danardf]

I can't do anything.
Again, put this issue into bugs.elastix.org.
Next, the team could be able to make some update i guess.

If you put anything, nothing will be done.

 

[surp]

I can't do anything.
Again, put this issue into bugs.elastix.org.
Next, the team could be able to make some update i guess.

If you put anything, nothing will be done.

We gave up posting things in bugs.elastix.org because they always got ignored.

 

[danardf]

Into the forum, it will be ignored more again.
Remember, the good place for this kind of stuff is, bugs.elastix.org.

Post it here, and give me your ticket.
I'll try to see that i can do.

 

[surp]

http://bugs.elastix.org/view.php?id=2444

 

[danardf]

Ok great.

I'll send this bug to Elastix team.

Regards

 

[surp]

This might be leftover from the previous exploit on A2billing. Looking at that zizo.txt file they are accessing I was able to find other php files they sprinkled throughout Elastix web folders that I missed when these servers were hacked before.

 

[danardf]

You must be sure before.
Try to reinstall A2B like this : yum reinstall elastix-a2billing
I guess that all the files should be deleted.
I wondered if a script could be done for cleaning this hacking.
Just an idea like that.

 

[surp]

You must be sure before.
Try to reinstall A2B like this : yum reinstall elastix-a2billing
I guess that all the files should be deleted.
I wondered if a script could be done for cleaning this hacking.
Just an idea like that.

Nothing is for sure when it involves hacks. The hacks are designed to be hard to find and clean.

Elastix-a2billing is definitely up to date. There is no doubt about that. If they try add php files with odd names hidden in subfolders that is a different story. None hidden in a2billing, they are in the following root web folders. I don't want to give away too much information how I am able to find them.

_asterisk
configs
help
images
lang
libs
mail

 

[danardf]

If you read the content of zizo.txt and others bad files, you may see some ip address.
Next, ban the whole of these ip address for ever using a good iptables rules.
Or why not, ban the whole of the network.