Oh Man This is GREAT!!!

gsibble · 08-19-2003, 03:46 AM

Hehe. I was playing with DIG and nmap's ability to determine OSs earlier.......look at what I found about www.microsoft.com

(If you don't wanna read the entire thing, it shows that at least 3 of www.microsoft.com's IPs are running Linux webservers!!!!!)

This WAS in the news earlier in the week. Microsoft put up some backup linux servers in case of an attack similar to blaster that might take down their Windows Server 2003!

;; Got SERVFAIL reply from 127.0.0.1, trying next server

; <<>> DiG 9.2.2 <<>> www.microsoft.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 433
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 9, ADDITIONAL: 9

;; QUESTION SECTION:
;www.microsoft.com. IN A

;; ANSWER SECTION:
http://www.microsoft.com. 2909 IN CN...suite.net.</a>
www.microsoft.com.edgesuite.net. 215 IN CNAME a562.cd.akamai.net.
a562.cd.akamai.net. 5 IN A 80.15.249.112
a562.cd.akamai.net. 5 IN A 80.15.249.121
a562.cd.akamai.net. 5 IN A 80.15.249.136

;; AUTHORITY SECTION:
cd.akamai.net. 1225 IN NS n5cd.akamai.net.
cd.akamai.net. 1225 IN NS n6cd.akamai.net.
cd.akamai.net. 1225 IN NS n7cd.akamai.net.
cd.akamai.net. 1225 IN NS n8cd.akamai.net.
cd.akamai.net. 1225 IN NS n0cd.akamai.net.
cd.akamai.net. 1225 IN NS n1cd.akamai.net.
cd.akamai.net. 1225 IN NS n2cd.akamai.net.
cd.akamai.net. 1225 IN NS n3cd.akamai.net.
cd.akamai.net. 1225 IN NS n4cd.akamai.net.

;; ADDITIONAL SECTION:
n0cd.akamai.net. 1315 IN A 66.77.183.28
n1cd.akamai.net. 2215 IN A 66.77.183.29
n2cd.akamai.net. 3115 IN A 66.77.183.31
n3cd.akamai.net. 1315 IN A 66.77.183.45
n4cd.akamai.net. 1315 IN A 66.77.183.28
n5cd.akamai.net. 1315 IN A 66.77.183.28
n6cd.akamai.net. 1315 IN A 199.232.61.133
n7cd.akamai.net. 2215 IN A 63.209.213.19
n8cd.akamai.net. 1315 IN A 66.77.183.28

;; Query time: 165 msec
;; SERVER: 151.203.0.84#53(151.203.0.84)
;; WHEN: Tue Aug 19 03:39:11 2003
;; MSG SIZE rcvd: 472

Running NMAP as ROOT...

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-08-19 03:39 EDT
Host 80.15.249.121 appears to be up ... good.
Initiating SYN Stealth Scan against 80.15.249.121 at 03:39
Adding open port 22/tcp
The SYN Stealth Scan took 0 seconds to scan 1 ports.
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
For OSScan assuming that port 22 is open and port 42480 is closed and neither are firewalled
Interesting ports on 80.15.249.121:
Port State Service
22/tcp open ssh
Device type: general purpose
Running: Linux 2.1.X|2.2.X
OS details: Linux 2.1.19 - 2.2.20
OS Fingerprint:
(None)
Uptime 48.219 days (since Tue Jul 1 22:24:36 2003)
TCP Sequence Prediction: Class=random positive increments
Difficulty=3225289 (Good luck!)
TCP ISN Seq. Numbers: E196E8CE E16B4B48 E1846C12 E21E7476 E23892F1 E216F85C
IPID Sequence Generation: Busy server or unknown class

Host 80.15.249.136 appears to be up ... good.
Initiating SYN Stealth Scan against 80.15.249.136 at 03:39
Adding open port 22/tcp
The SYN Stealth Scan took 0 seconds to scan 1 ports.
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
For OSScan assuming that port 22 is open and port 42335 is closed and neither are firewalled
Interesting ports on 80.15.249.136:
Port State Service
22/tcp open ssh
Device type: general purpose
Running: Linux 2.1.X|2.2.X
OS details: Linux 2.1.19 - 2.2.20
OS Fingerprint:
(None)
Uptime 21.521 days (since Mon Jul 28 15:08:35 2003)
TCP Sequence Prediction: Class=random positive increments
Difficulty=4443820 (Good luck!)
TCP ISN Seq. Numbers: E0D0CC36 E0C9D6B0 E116608B E179CD82 E0BE67FE E0C1CBE5
IPID Sequence Generation: Busy server or unknown class

Host 80.15.249.112 appears to be up ... good.
Initiating SYN Stealth Scan against 80.15.249.112 at 03:39
Adding open port 22/tcp
The SYN Stealth Scan took 0 seconds to scan 1 ports.
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
For OSScan assuming that port 22 is open and port 32121 is closed and neither are firewalled
Interesting ports on 80.15.249.112:
Port State Service
22/tcp open ssh
Device type: general purpose
Running: Linux 2.1.X|2.2.X
OS details: Linux 2.1.19 - 2.2.20
OS Fingerprint:
(None)
Uptime 48.218 days (since Tue Jul 1 22:25:05 2003)
TCP Sequence Prediction: Class=random positive increments
Difficulty=4397727 (Good luck!)
TCP ISN Seq. Numbers: E2925122 E2B169D4 E1EA076F E228D2B6 E1F1F774 E299281F
IPID Sequence Generation: Busy server or unknown class

Nmap run completed -- 3 IP addresses (3 hosts up) scanned in 16.624 seconds

Enjoy!

sandy · 08-19-2003, 04:07 AM

Its utter foolish!!!!

I dont think that Micro$oft can do so with such an ease..

Quote:

Reports of 'Microsoft/IIS on Linux' may indicate that either the web sever is behind a Linux server that is acting as a reverse proxy, or has
configured the Akamai caching system such that the first request to the site goes to one of Akamai's servers [which run Linux], or as in the case of www.walmart.com has been configured to send a misleading signature.

http://uptime.netcraft.com/up/graph?....microsoft.com
http://uptime.netcraft.com/up/graph?...dowsupdate.com

These reports just say that microsoft has configured Akamai in their servers from 15th august or so...

gsibble · 08-19-2003, 04:18 AM

Ya, that's true

Still fun that microsoft even APPEARS to be on linux

sandy · 08-19-2003, 04:22 AM

Yaa i also got wondered when i read the news for the first-time somewhere..

cnjohnson · 08-19-2003, 08:17 AM

Hmmm. As much fun as nmap is, you want to be careful running it against a box you do not control. Most sysadmins (like me) consider that a hostile act. I suspect that it happens to Microsoft a lot, but you don't want to have your ISP suggesting that you do business with someone else. So, have fun, but be careful. You (and me too) are little fleas. The ISP's (and Mocrosoft) are the 500 lbs gorillas!

Cheers--
Charles

trickykid · 08-19-2003, 09:06 AM

Moved: More suitable in General as I don't see a Linux technical type question in your original post. Also threads that relate or discuss M$ belong in General. Regards.