Server OS X and Drupal Exploit?

[Zoatibix]

Hello,

 

We've been notified that our mac server may have been compromised by some form of botnet, possibly a .."vulnerable Drupal CMS Version https://thehackernews.com/2018/04/drupal-rce-exploit-code.html"

 

The only web stuff we have running on our MAC server is the basic website to run Profile Manager and Enroll Devices. We do have an alias set on our Firewall as we have been trying to set up DEP and remote locking of our MacBooks.

 

Questions:

 

1. As I haven't installed Drupal, Apache, etc where and what should I be looking to patch?

2. What would be the best way of cleaning up the server after the patch is applied?

 

Thank you.

 

Zoatibix

[Arthur]

Have you tried doing a scan with MalwareBytes?

 

Which version of macOS and the Server.app do you have? Are both up-to-date?

[Zoatibix]

Hello,

 

Server version is 5.6.1

OS X is High Sierra 10.13.5 (updated on 13th June)

 

I'd got SCEP installed but I'm installing and running Malwarebytes now.

 

Thank you.

 

Zoatibix

[AntonioRocco]

Sounds strange seeing as you haven't installed it. Sounds like a scam/scare-ware? How were you notified? A pop-up when browsing the internet on the server itself by any chance? I would not browse the internet on any server regardless of platform. Can't imagine how anyone could get details of your mac server if it was by email notification?

 

Before installing Drupal you need to install MySQL. Unless you really know what you're doing then the default install location for this would be /var. To list the contents of /var launch Terminal (in the Utilities folder) and type:

 

ls /var

 

If it's installed you should see a folder name mysql. If there was a chance that someone else other than yourself had access to your server then you can use the history command to see all the commands that have been issued on the mac server. Look for an obvious reference to it there.

 

MAMP, Drupal etc have never been part of any stock/factory OS X install AFAIK. SQL on OS X server is now PostGreSQL. It's what Profile Manager/Wiki uses for its database. Apache binaries have been part of every OS X since at least 10.3 server or client. Basically you can turn any mac into a web server using the command line only. Apple provided a simple GUI for it in their server releases only.

 

Hope this helps?

 

Antonio Rocco (ACSA)

[Zoatibix]

We had an email forwarded to us via JANET.

 

JANET have confirmed that they are getting IP connections between our server's external IP and a botnet server.

 

While I can see pgsql in that folder, I don't see MySQL.

 

Update: Malwarebytes didn't turn up anything. SCEP is still running.

 

Thank you.

 

Zoatibix

Edited June 27, 2018 by Zoatibix
Update

[AntonioRocco]

Can you trace the connection from your external IP to anything on the private side of your firewall? Can you telnet (or portscan) externally and see if there are any open ports? Do you have anything on your private network accessible externally?

 

I'm asking because apart from what PM and APNS requires there shouldn't be anything else other than what your windows servers are providing. Perhaps that's where the attack is? Botnets invariably target the usual ports - email/web/smb etc - and its doubtful you're mac server is handling any of those services in a school environment.