Blocking hackers

DISCUSSION Phillp Morgan 4 participants 4 messages Jun 21, 2002 – Jul 12, 2002

lore

Share & tools

lore

Phillp Morgan

author

2002-06-21 03:57 UTC #0 lore raw

Hi,

It looks like someone is trying to break into my system. This is out of my apache error log...

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir

HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET

/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET

/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET

/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET

/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:34 +1000] "GET

/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:36 +1000] "GET

/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir

HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET

/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET

/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET

/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Quoted 1 line

61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET

/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -

Is there any way I can block this nasty person?

Who should I report this to?

Regards,

Phillip Morgan
Chief Information Offier
Quickpages Business Directories
----------------------------------------------------------------------------
------------
This email is intended for the above named recipient only, and may contain priveledged information. If you are not the intended recipient please delete this email immediately and notify Quickpages of the problem.

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Richard Adams

2002-06-21 06:26 UTC #1 lore raw

Quoted 50 lines · Phillp Morgan

Hi,
It looks like someone is trying to break into my system. This is out of my apache error log...
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:34 +1000] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:36 +1000] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET

Quoted 8 lines

/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Is there any way I can block this nasty person?

Depends on which kernel you use, with a 2.2.x kernel one can use; /sbin/ipchains -A input -j REJECT -s 61.243.140.78

Quoted 2 lines

Who should I report this to?

No idea, all the IP#'s shown with traceroute are unresolveable so who knows who he actually is, the last resolvable ip# with traceroute was linx01.hkt.net but thats 5 hops before 61.243.140.78.

Quoted 6 lines

Regards,
Phillip Morgan
Chief Information Offier
Quickpages Business Directories

Signature · 9 lines

Regards Richard
[email protected]
http://people.zeelandnet.nl/pa3gcu/

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Chuck Gelm

2002-06-21 20:50 UTC #2 lore raw

In reply to Phillp Morgan

I get the same thing, Phillp.

It is not a hacker, it is a trojan infected user. The host owner probably has no idea that his system is trying to infect your web server with Nimda.

If you are not running an unpatched version of a
Windows server, you are not vulnerable to this attack. It consumes very very little bandwidth. ;-)

I use apache. ;-)

Also watch for 'Code Red'. Those log file lines
will have a bunch of upper case "N's in them.
ala:
211.218.111.96 - - [08/May/2002:03:15:03 -0400] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 316

Again, if your are not running an unpatched Windows server...

HTH, Chuck

Quoted 50 lines · Phillp Morgan

Hi,
It looks like someone is trying to break into my system. This is out of my apache error log...
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:34 +1000] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di r HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:36 +1000] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:30 +1000] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:31 +1000] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:32 +1000] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Quoted 1 line
61.243.140.78 - - [21/Jun/2002:13:58:33 +1000] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
Is there any way I can block this nasty person?
Who should I report this to?
Regards,
Phillip Morgan
Chief Information Offier
Quickpages Business Directories
----------------------------------------------------------------------------
------------
This email is intended for the above named recipient only, and may contain priveledged information. If you are not the intended recipient please delete this email immediately and notify Quickpages of the problem.

Quoted 5 lines

-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs

Benny Pedersen

2002-07-12 14:33 UTC #3 lore raw

In reply to Phillp Morgan

Originally to: Phillp Morgan

Hi Phillp Morgan

you wrote about "Blocking hackers":

PM> It looks like someone is trying to break into my system. This is PM> out of my apache error log...

Quoted 2 lines

Quoted 2 lines
61.243.140.78 - - [21/Jun/2002:13:58:29 +1000] "GET /MSADC/root.exe?/c+dir

this is code red (virus on this computer)

i will make a perl script that scans for root.exe or cmd.exe or simply just .exe and put this ip in my firewall and last put it on a page so others can see ip i have the ip blocked, well i can do this but i just dont since its bad behavior :-)

PM> Is there any way I can block this nasty person?

block the ip from your firewall

PM> Who should I report this to?

your isp in the abuse team

Benny Pedersen http://fido.juncorg.dk/ icq:36248146

...Today is the day you worried about yesterday.

<-> Gateway Information.
This message originated from a Fidonet System (http://www.fidonet.org)
and was gated at TCOB1 (http://www.tcob1.net)
Please do not respond direct to this message but via the list