WORM FORENSICS?

From: Technical Support (bob@dexis.net)
Date: 09/18/01 

Message-Id: <5.1.0.14.2.20010918132314.02c0dea0@pop3.norton.antivirus>
Date: Tue, 18 Sep 2001 13:24:32 -0700
To: Jensenne Roculan <jroculan@securityfocus.com>, <incidents@securityfocus.com>
From: Technical Support <bob@dexis.net>
Subject: WORM FORENSICS?

I have just investigated a server that attacked me.

Here is what I found:

It appears that the servers are keeping a log of the results.
My server logs show that an attempt was made:

[18/Sep/2001:12:37:43 -0700] "from 207.104.210.242" "GET <clip> HTTP/1.0"
404 56 "- -> /scripts/<clip>/system32/cmd.exe" "User-Agent=-" "port: 80

Since I saw that I was attacked at 12:37, I went to the attacker site and
listed the directory and discovered what appears to be a log of all the
attempts.

As can be seen, the log 09/18/01 12:37p 0 TFTP9513
has a zero byte length which seems to indicate that it failed, since I am
running Apache.

If all those other logs are 57,344 each, then there appears to be many more
MSII servers out there than I expected and these logs appear to have
information which appears to be success data.

I feel that any server attacking another is fair game to publish data about it.

Bob

http://207.104.25.194/scripts/root.exe?/c+dir%20"c:\InetPub\scripts"

The directory listing is included in the attached ZIP file

Relevant Pages

  • WORM FORENSICS?
    ... I have just investigated a server that attacked me. ... Since I saw that I was attacked at 12:37, I went to the attacker site and ... If all those other logs are 57,344 each, then there appears to be many more ... information which appears to be success data. ...
    (Incidents)
  • Re: Can anyone identify this backdoor?
    ... > I appreciate all the responses I'm getting, I'm finding out more that I ... this server is Windows 2000 and not vulnerable to the ... As to how cc.exe got there, the logs referenced above show the server ... file CMD.EXE to the attacker. ...
    (Incidents)
  • Re: Hack Attempt - Remote Web Workplace?
    ... Over the past two months I have seen the following event logs ... Caller User Name: <server name>$ ... Access or Remote Web Workplace applications by some kind of automated ... The attacker, if one exists, will certainly not be using his own computer to open the connection, and he's unlikely to have just one or even a few at his disposal. ...
    (microsoft.public.windows.server.sbs)
  • RE: Is this as bad as it seems?
    ... The network being protected by the router or firewall is still vulnerable to ... > circumvented - the administrator has explicitly allowed HTTP traffic on ... this exploit has the effect of allowing the attacker to send *INBOUND* HTTP ... The HTTP server (located on the internal network or anywhere else that is ...
    (Security-Basics)
  • [NEWS] Firewall Circumvention Possible with All Browsers
    ... The exploit allows an attacker to use any JavaScript-enabled web browser ... any HTTP server behind the firewall. ... outlined in the section "Quick-Swap DNS". ... If the client in use is Microsoft Internet Explorer, ...
    (Securiteam)