Apache mod_proxy abuse?

[Polaris_777]

Hi all,

I'm running Fedora 10 with Apache 2.2.11 and I noticed something a little strange going on which I'm hoping you may be able to shed some light on for me. This morning, logwatch alerted me to the following concerning apache:

Connection attempts using mod_proxy:
   89.41.85.251 -> 205.188.251.43:443: 2 Time(s)
   89.41.85.251 -> 64.12.161.153:443: 4 Time(s)
   89.41.85.251 -> 64.12.161.185:443: 3 Time(s)
   89.41.85.251 -> 64.12.200.89:443: 4 Time(s)

Sure enough, the apache access log file shows the following:

# cat access_log-20090329 | grep 89.41.85.251
89.41.85.251 - - [27/Mar/2009:22:24:33 +0000] "GET http://www.google.com/ HTTP/1.1" 200 6970 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"
89.41.85.251 - - [28/Mar/2009:23:42:05 +0000] "CONNECT 64.12.161.153:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:06 +0000] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:22 +0000] "CONNECT 64.12.161.185:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:28 +0000] "CONNECT 205.188.251.43:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:36 +0000] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:47 +0000] "CONNECT 64.12.161.185:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:53 +0000] "CONNECT 64.12.161.185:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:56 +0000] "CONNECT 205.188.251.43:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:42:58 +0000] "CONNECT 64.12.161.153:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:43:04 +0000] "CONNECT 64.12.161.153:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:43:07 +0000] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:43:13 +0000] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 6970 "-" "-"
89.41.85.251 - - [28/Mar/2009:23:43:22 +0000] "CONNECT 64.12.161.153:443 HTTP/1.0" 200 6970 "-" "-"

mod_proxy is disabled in the apache config file anyway (default mod_proxy commented out):

# Proxy Server directives. Uncomment the following lines to
# enable the proxy server:
#
#<IfModule mod_proxy.c>
#ProxyRequests On
#
#<Proxy *>
#    Order deny,allow
#    Deny from all
#    Allow from .example.com
#</Proxy>

When I tried to access my web server to check, it was down, and I got the following when checking its status:

# service httpd status
httpd dead but pid file exists

... so I checked the apache error logs and found the following:

[Sun Mar 29 04:39:53 2009] [notice] SIGHUP received.  Attempting to restart
httpd: Syntax error on line 188 of /etc/httpd/conf/httpd.conf: Cannot load /etc/httpd/modules/mod_proxy.so into server:

There's nothing wrong with line 188 of the config file:

188 LoadModule proxy_module modules/mod_proxy.so

It seems fairly apparent that there has been an attempt to use my web server as a proxy to gain access to other servers, so I have a couple of questions:

1) I presume that the attack failed, since mod_proxy was disabled?

2) Why did my web server crash? (It has never done this before). It seems very suspicious that it tried to restart, but failed to load proxy_module modules/mod_proxy.so on the same night that someone had attempted to use mod_proxy. I have since successfully started apache without making any configuration changes.

3) Do I need to worry that any part of my system has been compromised?

[prolfe]

Hi,

I had the same attack at around 5:00AM thismorning.

I will remove the mod_proxy modules from httpd.conf as a precuation, maybe you should try the same.

We have two web servers, one for http and one for https. Both recieved this attack within 30 mins of each other.

Interestingly only the https server shut down. Or http server is FC6, the HTTPS is FC10.

Slightly disturbing is the HTTP log on tht http server.

[notice] SIGHUP received. Attempting to restart
[notice] Digest: generating secret for digest authentication ...
[notice] Digest: done
[notice] Apache/2.2.3 (Fedora) configured -- resuming normal operations

These lines are repeated a few times in different times.

[pete_1967]

Here's info why they're doing it: http://www.checkpoint.com/defense/ad...ai-20-Jan.html

It's couple months old exploit so my guess is it has been patched in Fedora as well, but check your Apache version.

[Polaris_777]

Thanks for the responses guys. At least I know why it happened now.

My Apache version was 2.2.11 - the very latest version - so it's rather worrying to see that this bug was supposedly fixed in version 2.2.6 (CVE-2007-3847) or 2.2.9 (CVE-2008-2364):

http://httpd.apache.org/security/vul...lities_22.html

[gsgleason]

Same thing happened to me this morning. I found my server down.

/var/log/httpd/error_log:

[Sun Apr 05 04:52:21 2009] [notice] SIGHUP received.  Attempting to restart
httpd: Syntax error on line 188 of /etc/httpd/conf/httpd.conf: Cannot load /etc/httpd/modules/mod_proxy.so into server: /etc/httpd/modules/mod_proxy.so: undefined symbol: ap_timeout_parameter_parse

# rpm -q httpd
httpd-2.2.11-2.fc10.x86_64